drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "pno.h"
  36 #include "cfg80211.h"
  37 #include "feature.h"
  38 #include "fwil.h"
  39 #include "proto.h"
  40 #include "vendor.h"
  41 #include "bus.h"
  42 #include "common.h"
  43
  44 #define BRCMF_SCAN_IE_LEN_MAX           2048
  45
  46 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  47 #define WPA_OUI_TYPE                    1
  48 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  49 #define WME_OUI_TYPE                    2
  50 #define WPS_OUI_TYPE                    4
  51
  52 #define VS_IE_FIXED_HDR_LEN             6
  53 #define WPA_IE_VERSION_LEN              2
  54 #define WPA_IE_MIN_OUI_LEN              4
  55 #define WPA_IE_SUITE_COUNT_LEN          2
  56
  57 #define WPA_CIPHER_NONE                 0       /* None */
  58 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  59 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  60 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  61 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  62
  63 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  64 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  65 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  66 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  67 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  68 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  69 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  70 #define RSN_CAP_MFPR_MASK               BIT(6)
  71 #define RSN_CAP_MFPC_MASK               BIT(7)
  72 #define RSN_PMKID_COUNT_LEN             2
  73
  74 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  75                                                  * string :"add", "del" (+ NUL)
  76                                                  */
  77 #define VNDR_IE_COUNT_OFFSET            4
  78 #define VNDR_IE_PKTFLAG_OFFSET          8
  79 #define VNDR_IE_VSIE_OFFSET             12
  80 #define VNDR_IE_HDR_SIZE                12
  81 #define VNDR_IE_PARSE_LIMIT             5
  82
  83 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  84 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  85
  86 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  87 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  88 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  89
  90 #define BRCMF_SCAN_CHANNEL_TIME         40
  91 #define BRCMF_SCAN_UNASSOC_TIME         40
  92 #define BRCMF_SCAN_PASSIVE_TIME         120
  93
  94 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  95
  96 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  97         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  98
  99 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 100 {
 101         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 102                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 103                           vif->sme_state);
 104                 return false;
 105         }
 106         return true;
 107 }
 108
 109 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 110 #define RATETAB_ENT(_rateid, _flags) \
 111         {                                                               \
 112                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 113                 .hw_value       = (_rateid),                            \
 114                 .flags          = (_flags),                             \
 115         }
 116
 117 static struct ieee80211_rate __wl_rates[] = {
 118         RATETAB_ENT(BRCM_RATE_1M, 0),
 119         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 122         RATETAB_ENT(BRCM_RATE_6M, 0),
 123         RATETAB_ENT(BRCM_RATE_9M, 0),
 124         RATETAB_ENT(BRCM_RATE_12M, 0),
 125         RATETAB_ENT(BRCM_RATE_18M, 0),
 126         RATETAB_ENT(BRCM_RATE_24M, 0),
 127         RATETAB_ENT(BRCM_RATE_36M, 0),
 128         RATETAB_ENT(BRCM_RATE_48M, 0),
 129         RATETAB_ENT(BRCM_RATE_54M, 0),
 130 };
 131
 132 #define wl_g_rates              (__wl_rates + 0)
 133 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 134 #define wl_a_rates              (__wl_rates + 4)
 135 #define wl_a_rates_size         (wl_g_rates_size - 4)
 136
 137 #define CHAN2G(_channel, _freq) {                               \
 138         .band                   = NL80211_BAND_2GHZ,            \
 139         .center_freq            = (_freq),                      \
 140         .hw_value               = (_channel),                   \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144
 145 #define CHAN5G(_channel) {                                      \
 146         .band                   = NL80211_BAND_5GHZ,            \
 147         .center_freq            = 5000 + (5 * (_channel)),      \
 148         .hw_value               = (_channel),                   \
 149         .max_antenna_gain       = 0,                            \
 150         .max_power              = 30,                           \
 151 }
 152
 153 static struct ieee80211_channel __wl_2ghz_channels[] = {
 154         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 155         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 156         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 157         CHAN2G(13, 2472), CHAN2G(14, 2484)
 158 };
 159
 160 static struct ieee80211_channel __wl_5ghz_channels[] = {
 161         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 162         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 163         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 164         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 165         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 166         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 167 };
 168
 169 /* Band templates duplicated per wiphy. The channel info
 170  * above is added to the band during setup.
 171  */
 172 static const struct ieee80211_supported_band __wl_band_2ghz = {
 173         .band = NL80211_BAND_2GHZ,
 174         .bitrates = wl_g_rates,
 175         .n_bitrates = wl_g_rates_size,
 176 };
 177
 178 static const struct ieee80211_supported_band __wl_band_5ghz = {
 179         .band = NL80211_BAND_5GHZ,
 180         .bitrates = wl_a_rates,
 181         .n_bitrates = wl_a_rates_size,
 182 };
 183
 184 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 185  * By default world regulatory domain defined in reg.c puts the flags
 186  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 187  * With respect to these flags, wpa_supplicant doesn't * start p2p
 188  * operations on 5GHz channels. All the changes in world regulatory
 189  * domain are to be done here.
 190  */
 191 static const struct ieee80211_regdomain brcmf_regdom = {
 192         .n_reg_rules = 4,
 193         .alpha2 =  "99",
 194         .reg_rules = {
 195                 /* IEEE 802.11b/g, channels 1..11 */
 196                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 197                 /* If any */
 198                 /* IEEE 802.11 channel 14 - Only JP enables
 199                  * this and for 802.11b only
 200                  */
 201                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 202                 /* IEEE 802.11a, channel 36..64 */
 203                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 204                 /* IEEE 802.11a, channel 100..165 */
 205                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 206 };
 207
 208 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 209  * are supported. A pointer to this array and the number of entries is passed
 210  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 211  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 212  * device does not support MFP then the number of suites will be decreased by 1
 213  */
 214 static const u32 brcmf_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         /* Keep as last entry: */
 220         WLAN_CIPHER_SUITE_AES_CMAC
 221 };
 222
 223 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 224 struct brcmf_vs_tlv {
 225         u8 id;
 226         u8 len;
 227         u8 oui[3];
 228         u8 oui_type;
 229 };
 230
 231 struct parsed_vndr_ie_info {
 232         u8 *ie_ptr;
 233         u32 ie_len;     /* total length including id & length field */
 234         struct brcmf_vs_tlv vndrie;
 235 };
 236
 237 struct parsed_vndr_ies {
 238         u32 count;
 239         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 240 };
 241
 242 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 243 {
 244         switch (band) {
 245         case NL80211_BAND_2GHZ:
 246                 return WLC_BAND_2G;
 247         case NL80211_BAND_5GHZ:
 248                 return WLC_BAND_5G;
 249         default:
 250                 WARN_ON(1);
 251                 break;
 252         }
 253         return 0;
 254 }
 255
 256 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 257                                struct cfg80211_chan_def *ch)
 258 {
 259         struct brcmu_chan ch_inf;
 260         s32 primary_offset;
 261
 262         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 263                   ch->chan->center_freq, ch->center_freq1, ch->width);
 264         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 265         primary_offset = ch->chan->center_freq - ch->center_freq1;
 266         switch (ch->width) {
 267         case NL80211_CHAN_WIDTH_20:
 268         case NL80211_CHAN_WIDTH_20_NOHT:
 269                 ch_inf.bw = BRCMU_CHAN_BW_20;
 270                 WARN_ON(primary_offset != 0);
 271                 break;
 272         case NL80211_CHAN_WIDTH_40:
 273                 ch_inf.bw = BRCMU_CHAN_BW_40;
 274                 if (primary_offset > 0)
 275                         ch_inf.sb = BRCMU_CHAN_SB_U;
 276                 else
 277                         ch_inf.sb = BRCMU_CHAN_SB_L;
 278                 break;
 279         case NL80211_CHAN_WIDTH_80:
 280                 ch_inf.bw = BRCMU_CHAN_BW_80;
 281                 if (primary_offset == -30)
 282                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 283                 else if (primary_offset == -10)
 284                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 285                 else if (primary_offset == 10)
 286                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80P80:
 291         case NL80211_CHAN_WIDTH_160:
 292         case NL80211_CHAN_WIDTH_5:
 293         case NL80211_CHAN_WIDTH_10:
 294         default:
 295                 WARN_ON_ONCE(1);
 296         }
 297         switch (ch->chan->band) {
 298         case NL80211_BAND_2GHZ:
 299                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 300                 break;
 301         case NL80211_BAND_5GHZ:
 302                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 303                 break;
 304         case NL80211_BAND_60GHZ:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         d11inf->encchspec(&ch_inf);
 309
 310         return ch_inf.chspec;
 311 }
 312
 313 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 314                         struct ieee80211_channel *ch)
 315 {
 316         struct brcmu_chan ch_inf;
 317
 318         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 319         ch_inf.bw = BRCMU_CHAN_BW_20;
 320         d11inf->encchspec(&ch_inf);
 321
 322         return ch_inf.chspec;
 323 }
 324
 325 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 326  * triples, returning a pointer to the substring whose first element
 327  * matches tag
 328  */
 329 static const struct brcmf_tlv *
 330 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 331 {
 332         const struct brcmf_tlv *elt = buf;
 333         int totlen = buflen;
 334
 335         /* find tagged parameter */
 336         while (totlen >= TLV_HDR_LEN) {
 337                 int len = elt->len;
 338
 339                 /* validate remaining totlen */
 340                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 341                         return elt;
 342
 343                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 344                 totlen -= (len + TLV_HDR_LEN);
 345         }
 346
 347         return NULL;
 348 }
 349
 350 /* Is any of the tlvs the expected entry? If
 351  * not update the tlvs buffer pointer/length.
 352  */
 353 static bool
 354 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 355                  const u8 *oui, u32 oui_len, u8 type)
 356 {
 357         /* If the contents match the OUI and the type */
 358         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 359             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 360             type == ie[TLV_BODY_OFF + oui_len]) {
 361                 return true;
 362         }
 363
 364         if (tlvs == NULL)
 365                 return false;
 366         /* point to the next ie */
 367         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 368         /* calculate the length of the rest of the buffer */
 369         *tlvs_len -= (int)(ie - *tlvs);
 370         /* update the pointer to the start of the buffer */
 371         *tlvs = ie;
 372
 373         return false;
 374 }
 375
 376 static struct brcmf_vs_tlv *
 377 brcmf_find_wpaie(const u8 *parse, u32 len)
 378 {
 379         const struct brcmf_tlv *ie;
 380
 381         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 382                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 383                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 384                         return (struct brcmf_vs_tlv *)ie;
 385         }
 386         return NULL;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpsie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 403                                      struct brcmf_cfg80211_vif *vif,
 404                                      enum nl80211_iftype new_type)
 405 {
 406         struct brcmf_cfg80211_vif *pos;
 407         bool check_combos = false;
 408         int ret = 0;
 409         struct iface_combination_params params = {
 410                 .num_different_channels = 1,
 411         };
 412
 413         list_for_each_entry(pos, &cfg->vif_list, list)
 414                 if (pos == vif) {
 415                         params.iftype_num[new_type]++;
 416                 } else {
 417                         /* concurrent interfaces so need check combinations */
 418                         check_combos = true;
 419                         params.iftype_num[pos->wdev.iftype]++;
 420                 }
 421
 422         if (check_combos)
 423                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 424
 425         return ret;
 426 }
 427
 428 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 429                                   enum nl80211_iftype new_type)
 430 {
 431         struct brcmf_cfg80211_vif *pos;
 432         struct iface_combination_params params = {
 433                 .num_different_channels = 1,
 434         };
 435
 436         list_for_each_entry(pos, &cfg->vif_list, list)
 437                 params.iftype_num[pos->wdev.iftype]++;
 438
 439         params.iftype_num[new_type]++;
 440         return cfg80211_check_combinations(cfg->wiphy, &params);
 441 }
 442
 443 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 444                                  struct brcmf_wsec_key_le *key_le)
 445 {
 446         key_le->index = cpu_to_le32(key->index);
 447         key_le->len = cpu_to_le32(key->len);
 448         key_le->algo = cpu_to_le32(key->algo);
 449         key_le->flags = cpu_to_le32(key->flags);
 450         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 451         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 452         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 453         memcpy(key_le->data, key->data, sizeof(key->data));
 454         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 455 }
 456
 457 static int
 458 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 459 {
 460         int err;
 461         struct brcmf_wsec_key_le key_le;
 462
 463         convert_key_from_CPU(key, &key_le);
 464
 465         brcmf_netdev_wait_pend8021x(ifp);
 466
 467         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 468                                         sizeof(key_le));
 469
 470         if (err)
 471                 brcmf_err("wsec_key error (%d)\n", err);
 472         return err;
 473 }
 474
 475 static s32
 476 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 477 {
 478         s32 err;
 479         u32 mode;
 480
 481         if (enable)
 482                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 483         else
 484                 mode = 0;
 485
 486         /* Try to set and enable ARP offload feature, this may fail, then it  */
 487         /* is simply not supported and err 0 will be returned                 */
 488         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 489         if (err) {
 490                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 491                           mode, err);
 492                 err = 0;
 493         } else {
 494                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 495                 if (err) {
 496                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 497                                   enable, err);
 498                         err = 0;
 499                 } else
 500                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 501                                   enable, mode);
 502         }
 503
 504         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 505         if (err) {
 506                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 507                           enable, err);
 508                 err = 0;
 509         } else
 510                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 511                           enable, mode);
 512
 513         return err;
 514 }
 515
 516 static void
 517 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 518 {
 519         struct brcmf_cfg80211_vif *vif;
 520         struct brcmf_if *ifp;
 521
 522         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 523         ifp = vif->ifp;
 524
 525         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 526             (wdev->iftype == NL80211_IFTYPE_AP) ||
 527             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 528                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 529                                                 ADDR_DIRECT);
 530         else
 531                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 532                                                 ADDR_INDIRECT);
 533 }
 534
 535 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 536 {
 537         int bsscfgidx;
 538
 539         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 540                 /* bsscfgidx 1 is reserved for legacy P2P */
 541                 if (bsscfgidx == 1)
 542                         continue;
 543                 if (!drvr->iflist[bsscfgidx])
 544                         return bsscfgidx;
 545         }
 546
 547         return -ENOMEM;
 548 }
 549
 550 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 551 {
 552         struct brcmf_mbss_ssid_le mbss_ssid_le;
 553         int bsscfgidx;
 554         int err;
 555
 556         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 557         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 558         if (bsscfgidx < 0)
 559                 return bsscfgidx;
 560
 561         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 562         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 563         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 564
 565         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 566                                         sizeof(mbss_ssid_le));
 567         if (err < 0)
 568                 brcmf_err("setting ssid failed %d\n", err);
 569
 570         return err;
 571 }
 572
 573 /**
 574  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 575  *
 576  * @wiphy: wiphy device of new interface.
 577  * @name: name of the new interface.
 578  * @params: contains mac address for AP device.
 579  */
 580 static
 581 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 582                                       struct vif_params *params)
 583 {
 584         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 585         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 586         struct brcmf_cfg80211_vif *vif;
 587         int err;
 588
 589         if (brcmf_cfg80211_vif_event_armed(cfg))
 590                 return ERR_PTR(-EBUSY);
 591
 592         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 593
 594         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 595         if (IS_ERR(vif))
 596                 return (struct wireless_dev *)vif;
 597
 598         brcmf_cfg80211_arm_vif_event(cfg, vif);
 599
 600         err = brcmf_cfg80211_request_ap_if(ifp);
 601         if (err) {
 602                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 603                 goto fail;
 604         }
 605
 606         /* wait for firmware event */
 607         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 608                                             BRCMF_VIF_EVENT_TIMEOUT);
 609         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 610         if (!err) {
 611                 brcmf_err("timeout occurred\n");
 612                 err = -EIO;
 613                 goto fail;
 614         }
 615
 616         /* interface created in firmware */
 617         ifp = vif->ifp;
 618         if (!ifp) {
 619                 brcmf_err("no if pointer provided\n");
 620                 err = -ENOENT;
 621                 goto fail;
 622         }
 623
 624         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 625         err = brcmf_net_attach(ifp, true);
 626         if (err) {
 627                 brcmf_err("Registering netdevice failed\n");
 628                 free_netdev(ifp->ndev);
 629                 goto fail;
 630         }
 631
 632         return &ifp->vif->wdev;
 633
 634 fail:
 635         brcmf_free_vif(vif);
 636         return ERR_PTR(err);
 637 }
 638
 639 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 640 {
 641         enum nl80211_iftype iftype;
 642
 643         iftype = vif->wdev.iftype;
 644         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 645 }
 646
 647 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 648 {
 649         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 650 }
 651
 652 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 653                                                      const char *name,
 654                                                      unsigned char name_assign_type,
 655                                                      enum nl80211_iftype type,
 656                                                      struct vif_params *params)
 657 {
 658         struct wireless_dev *wdev;
 659         int err;
 660
 661         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 662         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 663         if (err) {
 664                 brcmf_err("iface validation failed: err=%d\n", err);
 665                 return ERR_PTR(err);
 666         }
 667         switch (type) {
 668         case NL80211_IFTYPE_ADHOC:
 669         case NL80211_IFTYPE_STATION:
 670         case NL80211_IFTYPE_AP_VLAN:
 671         case NL80211_IFTYPE_WDS:
 672         case NL80211_IFTYPE_MONITOR:
 673         case NL80211_IFTYPE_MESH_POINT:
 674                 return ERR_PTR(-EOPNOTSUPP);
 675         case NL80211_IFTYPE_AP:
 676                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 677                 break;
 678         case NL80211_IFTYPE_P2P_CLIENT:
 679         case NL80211_IFTYPE_P2P_GO:
 680         case NL80211_IFTYPE_P2P_DEVICE:
 681                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 682                 break;
 683         case NL80211_IFTYPE_UNSPECIFIED:
 684         default:
 685                 return ERR_PTR(-EINVAL);
 686         }
 687
 688         if (IS_ERR(wdev))
 689                 brcmf_err("add iface %s type %d failed: err=%d\n",
 690                           name, type, (int)PTR_ERR(wdev));
 691         else
 692                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 693
 694         return wdev;
 695 }
 696
 697 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 698 {
 699         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 700                 brcmf_set_mpc(ifp, mpc);
 701 }
 702
 703 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 704 {
 705         s32 err = 0;
 706
 707         if (check_vif_up(ifp->vif)) {
 708                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 709                 if (err) {
 710                         brcmf_err("fail to set mpc\n");
 711                         return;
 712                 }
 713                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 714         }
 715 }
 716
 717 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 718                                 struct brcmf_if *ifp, bool aborted,
 719                                 bool fw_abort)
 720 {
 721         struct brcmf_scan_params_le params_le;
 722         struct cfg80211_scan_request *scan_request;
 723         u64 reqid;
 724         u32 bucket;
 725         s32 err = 0;
 726
 727         brcmf_dbg(SCAN, "Enter\n");
 728
 729         /* clear scan request, because the FW abort can cause a second call */
 730         /* to this functon and might cause a double cfg80211_scan_done      */
 731         scan_request = cfg->scan_request;
 732         cfg->scan_request = NULL;
 733
 734         if (timer_pending(&cfg->escan_timeout))
 735                 del_timer_sync(&cfg->escan_timeout);
 736
 737         if (fw_abort) {
 738                 /* Do a scan abort to stop the driver's scan engine */
 739                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 740                 memset(&params_le, 0, sizeof(params_le));
 741                 eth_broadcast_addr(params_le.bssid);
 742                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 743                 params_le.scan_type = 0;
 744                 params_le.channel_num = cpu_to_le32(1);
 745                 params_le.nprobes = cpu_to_le32(1);
 746                 params_le.active_time = cpu_to_le32(-1);
 747                 params_le.passive_time = cpu_to_le32(-1);
 748                 params_le.home_time = cpu_to_le32(-1);
 749                 /* Scan is aborted by setting channel_list[0] to -1 */
 750                 params_le.channel_list[0] = cpu_to_le16(-1);
 751                 /* E-Scan (or anyother type) can be aborted by SCAN */
 752                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 753                                              &params_le, sizeof(params_le));
 754                 if (err)
 755                         brcmf_err("Scan abort failed\n");
 756         }
 757
 758         brcmf_scan_config_mpc(ifp, 1);
 759
 760         /*
 761          * e-scan can be initiated internally
 762          * which takes precedence.
 763          */
 764         if (cfg->int_escan_map) {
 765                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 766                           cfg->int_escan_map);
 767                 while (cfg->int_escan_map) {
 768                         bucket = __ffs(cfg->int_escan_map);
 769                         cfg->int_escan_map &= ~BIT(bucket);
 770                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 771                                                                bucket);
 772                         if (!aborted) {
 773                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 774                                           reqid);
 775                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 776                                                             reqid);
 777                         }
 778                 }
 779         } else if (scan_request) {
 780                 struct cfg80211_scan_info info = {
 781                         .aborted = aborted,
 782                 };
 783
 784                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 785                           aborted ? "Aborted" : "Done");
 786                 cfg80211_scan_done(scan_request, &info);
 787         }
 788         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 789                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 790
 791         return err;
 792 }
 793
 794 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 795                                        struct wireless_dev *wdev)
 796 {
 797         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 798         struct net_device *ndev = wdev->netdev;
 799         struct brcmf_if *ifp = netdev_priv(ndev);
 800         int ret;
 801         int err;
 802
 803         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 804
 805         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 806         if (err) {
 807                 brcmf_err("interface_remove failed %d\n", err);
 808                 goto err_unarm;
 809         }
 810
 811         /* wait for firmware event */
 812         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 813                                             BRCMF_VIF_EVENT_TIMEOUT);
 814         if (!ret) {
 815                 brcmf_err("timeout occurred\n");
 816                 err = -EIO;
 817                 goto err_unarm;
 818         }
 819
 820         brcmf_remove_interface(ifp, true);
 821
 822 err_unarm:
 823         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 824         return err;
 825 }
 826
 827 static
 828 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 829 {
 830         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 831         struct net_device *ndev = wdev->netdev;
 832
 833         if (ndev && ndev == cfg_to_ndev(cfg))
 834                 return -ENOTSUPP;
 835
 836         /* vif event pending in firmware */
 837         if (brcmf_cfg80211_vif_event_armed(cfg))
 838                 return -EBUSY;
 839
 840         if (ndev) {
 841                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 842                     cfg->escan_info.ifp == netdev_priv(ndev))
 843                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 844                                                     true, true);
 845
 846                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 847         }
 848
 849         switch (wdev->iftype) {
 850         case NL80211_IFTYPE_ADHOC:
 851         case NL80211_IFTYPE_STATION:
 852         case NL80211_IFTYPE_AP_VLAN:
 853         case NL80211_IFTYPE_WDS:
 854         case NL80211_IFTYPE_MONITOR:
 855         case NL80211_IFTYPE_MESH_POINT:
 856                 return -EOPNOTSUPP;
 857         case NL80211_IFTYPE_AP:
 858                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 859         case NL80211_IFTYPE_P2P_CLIENT:
 860         case NL80211_IFTYPE_P2P_GO:
 861         case NL80211_IFTYPE_P2P_DEVICE:
 862                 return brcmf_p2p_del_vif(wiphy, wdev);
 863         case NL80211_IFTYPE_UNSPECIFIED:
 864         default:
 865                 return -EINVAL;
 866         }
 867         return -EOPNOTSUPP;
 868 }
 869
 870 static s32
 871 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 872                          enum nl80211_iftype type,
 873                          struct vif_params *params)
 874 {
 875         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 876         struct brcmf_if *ifp = netdev_priv(ndev);
 877         struct brcmf_cfg80211_vif *vif = ifp->vif;
 878         s32 infra = 0;
 879         s32 ap = 0;
 880         s32 err = 0;
 881
 882         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 883                   type);
 884
 885         /* WAR: There are a number of p2p interface related problems which
 886          * need to be handled initially (before doing the validate).
 887          * wpa_supplicant tends to do iface changes on p2p device/client/go
 888          * which are not always possible/allowed. However we need to return
 889          * OK otherwise the wpa_supplicant wont start. The situation differs
 890          * on configuration and setup (p2pon=1 module param). The first check
 891          * is to see if the request is a change to station for p2p iface.
 892          */
 893         if ((type == NL80211_IFTYPE_STATION) &&
 894             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 895              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 896              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 897                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 898                 /* Now depending on whether module param p2pon=1 was used the
 899                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 900                  * that if p2pon=1 is used, but a newer supplicant is used then
 901                  * we should return an error, as this combination wont work.
 902                  * In other situations 0 is returned and supplicant will start
 903                  * normally. It will give a trace in cfg80211, but it is the
 904                  * only way to get it working. Unfortunately this will result
 905                  * in situation where we wont support new supplicant in
 906                  * combination with module param p2pon=1, but that is the way
 907                  * it is. If the user tries this then unloading of driver might
 908                  * fail/lock.
 909                  */
 910                 if (cfg->p2p.p2pdev_dynamically)
 911                         return -EOPNOTSUPP;
 912                 else
 913                         return 0;
 914         }
 915         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 916         if (err) {
 917                 brcmf_err("iface validation failed: err=%d\n", err);
 918                 return err;
 919         }
 920         switch (type) {
 921         case NL80211_IFTYPE_MONITOR:
 922         case NL80211_IFTYPE_WDS:
 923                 brcmf_err("type (%d) : currently we do not support this type\n",
 924                           type);
 925                 return -EOPNOTSUPP;
 926         case NL80211_IFTYPE_ADHOC:
 927                 infra = 0;
 928                 break;
 929         case NL80211_IFTYPE_STATION:
 930                 infra = 1;
 931                 break;
 932         case NL80211_IFTYPE_AP:
 933         case NL80211_IFTYPE_P2P_GO:
 934                 ap = 1;
 935                 break;
 936         default:
 937                 err = -EINVAL;
 938                 goto done;
 939         }
 940
 941         if (ap) {
 942                 if (type == NL80211_IFTYPE_P2P_GO) {
 943                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 944                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 945                 }
 946                 if (!err) {
 947                         brcmf_dbg(INFO, "IF Type = AP\n");
 948                 }
 949         } else {
 950                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 951                 if (err) {
 952                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 953                         err = -EAGAIN;
 954                         goto done;
 955                 }
 956                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 957                           "Adhoc" : "Infra");
 958         }
 959         ndev->ieee80211_ptr->iftype = type;
 960
 961         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 962
 963 done:
 964         brcmf_dbg(TRACE, "Exit\n");
 965
 966         return err;
 967 }
 968
 969 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 970                              struct brcmf_scan_params_le *params_le,
 971                              struct cfg80211_scan_request *request)
 972 {
 973         u32 n_ssids;
 974         u32 n_channels;
 975         s32 i;
 976         s32 offset;
 977         u16 chanspec;
 978         char *ptr;
 979         struct brcmf_ssid_le ssid_le;
 980
 981         eth_broadcast_addr(params_le->bssid);
 982         params_le->bss_type = DOT11_BSSTYPE_ANY;
 983         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
 984         params_le->channel_num = 0;
 985         params_le->nprobes = cpu_to_le32(-1);
 986         params_le->active_time = cpu_to_le32(-1);
 987         params_le->passive_time = cpu_to_le32(-1);
 988         params_le->home_time = cpu_to_le32(-1);
 989         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 990
 991         n_ssids = request->n_ssids;
 992         n_channels = request->n_channels;
 993
 994         /* Copy channel array if applicable */
 995         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 996                   n_channels);
 997         if (n_channels > 0) {
 998                 for (i = 0; i < n_channels; i++) {
 999                         chanspec = channel_to_chanspec(&cfg->d11inf,
1000                                                        request->channels[i]);
1001                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1002                                   request->channels[i]->hw_value, chanspec);
1003                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1004                 }
1005         } else {
1006                 brcmf_dbg(SCAN, "Scanning all channels\n");
1007         }
1008         /* Copy ssid array if applicable */
1009         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1010         if (n_ssids > 0) {
1011                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1012                                 n_channels * sizeof(u16);
1013                 offset = roundup(offset, sizeof(u32));
1014                 ptr = (char *)params_le + offset;
1015                 for (i = 0; i < n_ssids; i++) {
1016                         memset(&ssid_le, 0, sizeof(ssid_le));
1017                         ssid_le.SSID_len =
1018                                         cpu_to_le32(request->ssids[i].ssid_len);
1019                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1020                                request->ssids[i].ssid_len);
1021                         if (!ssid_le.SSID_len)
1022                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1023                         else
1024                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1025                                           i, ssid_le.SSID, ssid_le.SSID_len);
1026                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1027                         ptr += sizeof(ssid_le);
1028                 }
1029         } else {
1030                 brcmf_dbg(SCAN, "Performing passive scan\n");
1031                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1032         }
1033         /* Adding mask to channel numbers */
1034         params_le->channel_num =
1035                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1036                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1037 }
1038
1039 static s32
1040 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1041                 struct cfg80211_scan_request *request)
1042 {
1043         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1044                           offsetof(struct brcmf_escan_params_le, params_le);
1045         struct brcmf_escan_params_le *params;
1046         s32 err = 0;
1047
1048         brcmf_dbg(SCAN, "E-SCAN START\n");
1049
1050         if (request != NULL) {
1051                 /* Allocate space for populating ssids in struct */
1052                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1053
1054                 /* Allocate space for populating ssids in struct */
1055                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1056         }
1057
1058         params = kzalloc(params_size, GFP_KERNEL);
1059         if (!params) {
1060                 err = -ENOMEM;
1061                 goto exit;
1062         }
1063         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1064         brcmf_escan_prep(cfg, &params->params_le, request);
1065         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1066         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1067         params->sync_id = cpu_to_le16(0x1234);
1068
1069         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1070         if (err) {
1071                 if (err == -EBUSY)
1072                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1073                 else
1074                         brcmf_err("error (%d)\n", err);
1075         }
1076
1077         kfree(params);
1078 exit:
1079         return err;
1080 }
1081
1082 static s32
1083 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1084 {
1085         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1086         s32 err;
1087         u32 passive_scan;
1088         struct brcmf_scan_results *results;
1089         struct escan_info *escan = &cfg->escan_info;
1090
1091         brcmf_dbg(SCAN, "Enter\n");
1092         escan->ifp = ifp;
1093         escan->wiphy = cfg->wiphy;
1094         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1095         passive_scan = cfg->active_scan ? 0 : 1;
1096         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1097                                     passive_scan);
1098         if (err) {
1099                 brcmf_err("error (%d)\n", err);
1100                 return err;
1101         }
1102         brcmf_scan_config_mpc(ifp, 0);
1103         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1104         results->version = 0;
1105         results->count = 0;
1106         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1107
1108         err = escan->run(cfg, ifp, request);
1109         if (err)
1110                 brcmf_scan_config_mpc(ifp, 1);
1111         return err;
1112 }
1113
1114 static s32
1115 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1116                      struct cfg80211_scan_request *request,
1117                      struct cfg80211_ssid *this_ssid)
1118 {
1119         struct brcmf_if *ifp = vif->ifp;
1120         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1121         struct cfg80211_ssid *ssids;
1122         u32 passive_scan;
1123         bool escan_req;
1124         bool spec_scan;
1125         s32 err;
1126         struct brcmf_ssid_le ssid_le;
1127         u32 SSID_len;
1128
1129         brcmf_dbg(SCAN, "START ESCAN\n");
1130
1131         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1132                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1133                 return -EAGAIN;
1134         }
1135         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1136                 brcmf_err("Scanning being aborted: status (%lu)\n",
1137                           cfg->scan_status);
1138                 return -EAGAIN;
1139         }
1140         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1141                 brcmf_err("Scanning suppressed: status (%lu)\n",
1142                           cfg->scan_status);
1143                 return -EAGAIN;
1144         }
1145         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1146                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1147                 return -EAGAIN;
1148         }
1149
1150         /* If scan req comes for p2p0, send it over primary I/F */
1151         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1152                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1153
1154         escan_req = false;
1155         if (request) {
1156                 /* scan bss */
1157                 ssids = request->ssids;
1158                 escan_req = true;
1159         } else {
1160                 /* scan in ibss */
1161                 /* we don't do escan in ibss */
1162                 ssids = this_ssid;
1163         }
1164
1165         cfg->scan_request = request;
1166         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1167         if (escan_req) {
1168                 cfg->escan_info.run = brcmf_run_escan;
1169                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1170                 if (err)
1171                         goto scan_out;
1172
1173                 err = brcmf_do_escan(vif->ifp, request);
1174                 if (err)
1175                         goto scan_out;
1176         } else {
1177                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1178                           ssids->ssid, ssids->ssid_len);
1179                 memset(&ssid_le, 0, sizeof(ssid_le));
1180                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1181                 ssid_le.SSID_len = cpu_to_le32(0);
1182                 spec_scan = false;
1183                 if (SSID_len) {
1184                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1185                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1186                         spec_scan = true;
1187                 } else
1188                         brcmf_dbg(SCAN, "Broadcast scan\n");
1189
1190                 passive_scan = cfg->active_scan ? 0 : 1;
1191                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1192                                             passive_scan);
1193                 if (err) {
1194                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1195                         goto scan_out;
1196                 }
1197                 brcmf_scan_config_mpc(ifp, 0);
1198                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1199                                              sizeof(ssid_le));
1200                 if (err) {
1201                         if (err == -EBUSY)
1202                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1203                                           ssid_le.SSID);
1204                         else
1205                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1206
1207                         brcmf_scan_config_mpc(ifp, 1);
1208                         goto scan_out;
1209                 }
1210         }
1211
1212         /* Arm scan timeout timer */
1213         mod_timer(&cfg->escan_timeout, jiffies +
1214                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1215
1216         return 0;
1217
1218 scan_out:
1219         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1220         cfg->scan_request = NULL;
1221         return err;
1222 }
1223
1224 static s32
1225 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1226 {
1227         struct brcmf_cfg80211_vif *vif;
1228         s32 err = 0;
1229
1230         brcmf_dbg(TRACE, "Enter\n");
1231         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1232         if (!check_vif_up(vif))
1233                 return -EIO;
1234
1235         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1236
1237         if (err)
1238                 brcmf_err("scan error (%d)\n", err);
1239
1240         brcmf_dbg(TRACE, "Exit\n");
1241         return err;
1242 }
1243
1244 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1245 {
1246         s32 err = 0;
1247
1248         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1249                                       rts_threshold);
1250         if (err)
1251                 brcmf_err("Error (%d)\n", err);
1252
1253         return err;
1254 }
1255
1256 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1257 {
1258         s32 err = 0;
1259
1260         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1261                                       frag_threshold);
1262         if (err)
1263                 brcmf_err("Error (%d)\n", err);
1264
1265         return err;
1266 }
1267
1268 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1269 {
1270         s32 err = 0;
1271         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1272
1273         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1274         if (err) {
1275                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1276                 return err;
1277         }
1278         return err;
1279 }
1280
1281 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1282 {
1283         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1284         struct net_device *ndev = cfg_to_ndev(cfg);
1285         struct brcmf_if *ifp = netdev_priv(ndev);
1286         s32 err = 0;
1287
1288         brcmf_dbg(TRACE, "Enter\n");
1289         if (!check_vif_up(ifp->vif))
1290                 return -EIO;
1291
1292         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1293             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1294                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1295                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1296                 if (!err)
1297                         goto done;
1298         }
1299         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1300             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1301                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1302                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1303                 if (!err)
1304                         goto done;
1305         }
1306         if (changed & WIPHY_PARAM_RETRY_LONG
1307             && (cfg->conf->retry_long != wiphy->retry_long)) {
1308                 cfg->conf->retry_long = wiphy->retry_long;
1309                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1310                 if (!err)
1311                         goto done;
1312         }
1313         if (changed & WIPHY_PARAM_RETRY_SHORT
1314             && (cfg->conf->retry_short != wiphy->retry_short)) {
1315                 cfg->conf->retry_short = wiphy->retry_short;
1316                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1317                 if (!err)
1318                         goto done;
1319         }
1320
1321 done:
1322         brcmf_dbg(TRACE, "Exit\n");
1323         return err;
1324 }
1325
1326 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1327 {
1328         memset(prof, 0, sizeof(*prof));
1329 }
1330
1331 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1332 {
1333         u16 reason;
1334
1335         switch (e->event_code) {
1336         case BRCMF_E_DEAUTH:
1337         case BRCMF_E_DEAUTH_IND:
1338         case BRCMF_E_DISASSOC_IND:
1339                 reason = e->reason;
1340                 break;
1341         case BRCMF_E_LINK:
1342         default:
1343                 reason = 0;
1344                 break;
1345         }
1346         return reason;
1347 }
1348
1349 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1350 {
1351         struct brcmf_wsec_pmk_le pmk;
1352         int i, err;
1353
1354         /* convert to firmware key format */
1355         pmk.key_len = cpu_to_le16(pmk_len << 1);
1356         pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1357         for (i = 0; i < pmk_len; i++)
1358                 snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1359
1360         /* store psk in firmware */
1361         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1362                                      &pmk, sizeof(pmk));
1363         if (err < 0)
1364                 brcmf_err("failed to change PSK in firmware (len=%u)\n",
1365                           pmk_len);
1366
1367         return err;
1368 }
1369
1370 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1371 {
1372         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1373         s32 err = 0;
1374
1375         brcmf_dbg(TRACE, "Enter\n");
1376
1377         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1378                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1379                 err = brcmf_fil_cmd_data_set(vif->ifp,
1380                                              BRCMF_C_DISASSOC, NULL, 0);
1381                 if (err) {
1382                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1383                 }
1384                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1385                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1386                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1387                                               true, GFP_KERNEL);
1388         }
1389         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1390         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1391         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1392         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1393                 brcmf_set_pmk(vif->ifp, NULL, 0);
1394                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1395         }
1396         brcmf_dbg(TRACE, "Exit\n");
1397 }
1398
1399 static s32
1400 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1401                       struct cfg80211_ibss_params *params)
1402 {
1403         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1404         struct brcmf_if *ifp = netdev_priv(ndev);
1405         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1406         struct brcmf_join_params join_params;
1407         size_t join_params_size = 0;
1408         s32 err = 0;
1409         s32 wsec = 0;
1410         s32 bcnprd;
1411         u16 chanspec;
1412         u32 ssid_len;
1413
1414         brcmf_dbg(TRACE, "Enter\n");
1415         if (!check_vif_up(ifp->vif))
1416                 return -EIO;
1417
1418         if (params->ssid)
1419                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1420         else {
1421                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1422                 return -EOPNOTSUPP;
1423         }
1424
1425         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1426
1427         if (params->bssid)
1428                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1429         else
1430                 brcmf_dbg(CONN, "No BSSID specified\n");
1431
1432         if (params->chandef.chan)
1433                 brcmf_dbg(CONN, "channel: %d\n",
1434                           params->chandef.chan->center_freq);
1435         else
1436                 brcmf_dbg(CONN, "no channel specified\n");
1437
1438         if (params->channel_fixed)
1439                 brcmf_dbg(CONN, "fixed channel required\n");
1440         else
1441                 brcmf_dbg(CONN, "no fixed channel required\n");
1442
1443         if (params->ie && params->ie_len)
1444                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1445         else
1446                 brcmf_dbg(CONN, "no ie specified\n");
1447
1448         if (params->beacon_interval)
1449                 brcmf_dbg(CONN, "beacon interval: %d\n",
1450                           params->beacon_interval);
1451         else
1452                 brcmf_dbg(CONN, "no beacon interval specified\n");
1453
1454         if (params->basic_rates)
1455                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1456         else
1457                 brcmf_dbg(CONN, "no basic rates specified\n");
1458
1459         if (params->privacy)
1460                 brcmf_dbg(CONN, "privacy required\n");
1461         else
1462                 brcmf_dbg(CONN, "no privacy required\n");
1463
1464         /* Configure Privacy for starter */
1465         if (params->privacy)
1466                 wsec |= WEP_ENABLED;
1467
1468         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1469         if (err) {
1470                 brcmf_err("wsec failed (%d)\n", err);
1471                 goto done;
1472         }
1473
1474         /* Configure Beacon Interval for starter */
1475         if (params->beacon_interval)
1476                 bcnprd = params->beacon_interval;
1477         else
1478                 bcnprd = 100;
1479
1480         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1481         if (err) {
1482                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1483                 goto done;
1484         }
1485
1486         /* Configure required join parameter */
1487         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1488
1489         /* SSID */
1490         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1491         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1492         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1493         join_params_size = sizeof(join_params.ssid_le);
1494
1495         /* BSSID */
1496         if (params->bssid) {
1497                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1498                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1499                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1500         } else {
1501                 eth_broadcast_addr(join_params.params_le.bssid);
1502                 eth_zero_addr(profile->bssid);
1503         }
1504
1505         /* Channel */
1506         if (params->chandef.chan) {
1507                 u32 target_channel;
1508
1509                 cfg->channel =
1510                         ieee80211_frequency_to_channel(
1511                                 params->chandef.chan->center_freq);
1512                 if (params->channel_fixed) {
1513                         /* adding chanspec */
1514                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1515                                                        &params->chandef);
1516                         join_params.params_le.chanspec_list[0] =
1517                                 cpu_to_le16(chanspec);
1518                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1519                         join_params_size += sizeof(join_params.params_le);
1520                 }
1521
1522                 /* set channel for starter */
1523                 target_channel = cfg->channel;
1524                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1525                                             target_channel);
1526                 if (err) {
1527                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1528                         goto done;
1529                 }
1530         } else
1531                 cfg->channel = 0;
1532
1533         cfg->ibss_starter = false;
1534
1535
1536         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1537                                      &join_params, join_params_size);
1538         if (err) {
1539                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1540                 goto done;
1541         }
1542
1543 done:
1544         if (err)
1545                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1546         brcmf_dbg(TRACE, "Exit\n");
1547         return err;
1548 }
1549
1550 static s32
1551 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1552 {
1553         struct brcmf_if *ifp = netdev_priv(ndev);
1554
1555         brcmf_dbg(TRACE, "Enter\n");
1556         if (!check_vif_up(ifp->vif)) {
1557                 /* When driver is being unloaded, it can end up here. If an
1558                  * error is returned then later on a debug trace in the wireless
1559                  * core module will be printed. To avoid this 0 is returned.
1560                  */
1561                 return 0;
1562         }
1563
1564         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1565         brcmf_net_setcarrier(ifp, false);
1566
1567         brcmf_dbg(TRACE, "Exit\n");
1568
1569         return 0;
1570 }
1571
1572 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1573                                  struct cfg80211_connect_params *sme)
1574 {
1575         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1576         struct brcmf_cfg80211_security *sec;
1577         s32 val = 0;
1578         s32 err = 0;
1579
1580         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1581                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1582         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1583                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1584         else
1585                 val = WPA_AUTH_DISABLED;
1586         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1587         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1588         if (err) {
1589                 brcmf_err("set wpa_auth failed (%d)\n", err);
1590                 return err;
1591         }
1592         sec = &profile->sec;
1593         sec->wpa_versions = sme->crypto.wpa_versions;
1594         return err;
1595 }
1596
1597 static s32 brcmf_set_auth_type(struct net_device *ndev,
1598                                struct cfg80211_connect_params *sme)
1599 {
1600         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1601         struct brcmf_cfg80211_security *sec;
1602         s32 val = 0;
1603         s32 err = 0;
1604
1605         switch (sme->auth_type) {
1606         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1607                 val = 0;
1608                 brcmf_dbg(CONN, "open system\n");
1609                 break;
1610         case NL80211_AUTHTYPE_SHARED_KEY:
1611                 val = 1;
1612                 brcmf_dbg(CONN, "shared key\n");
1613                 break;
1614         default:
1615                 val = 2;
1616                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1617                 break;
1618         }
1619
1620         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1621         if (err) {
1622                 brcmf_err("set auth failed (%d)\n", err);
1623                 return err;
1624         }
1625         sec = &profile->sec;
1626         sec->auth_type = sme->auth_type;
1627         return err;
1628 }
1629
1630 static s32
1631 brcmf_set_wsec_mode(struct net_device *ndev,
1632                     struct cfg80211_connect_params *sme)
1633 {
1634         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1635         struct brcmf_cfg80211_security *sec;
1636         s32 pval = 0;
1637         s32 gval = 0;
1638         s32 wsec;
1639         s32 err = 0;
1640
1641         if (sme->crypto.n_ciphers_pairwise) {
1642                 switch (sme->crypto.ciphers_pairwise[0]) {
1643                 case WLAN_CIPHER_SUITE_WEP40:
1644                 case WLAN_CIPHER_SUITE_WEP104:
1645                         pval = WEP_ENABLED;
1646                         break;
1647                 case WLAN_CIPHER_SUITE_TKIP:
1648                         pval = TKIP_ENABLED;
1649                         break;
1650                 case WLAN_CIPHER_SUITE_CCMP:
1651                         pval = AES_ENABLED;
1652                         break;
1653                 case WLAN_CIPHER_SUITE_AES_CMAC:
1654                         pval = AES_ENABLED;
1655                         break;
1656                 default:
1657                         brcmf_err("invalid cipher pairwise (%d)\n",
1658                                   sme->crypto.ciphers_pairwise[0]);
1659                         return -EINVAL;
1660                 }
1661         }
1662         if (sme->crypto.cipher_group) {
1663                 switch (sme->crypto.cipher_group) {
1664                 case WLAN_CIPHER_SUITE_WEP40:
1665                 case WLAN_CIPHER_SUITE_WEP104:
1666                         gval = WEP_ENABLED;
1667                         break;
1668                 case WLAN_CIPHER_SUITE_TKIP:
1669                         gval = TKIP_ENABLED;
1670                         break;
1671                 case WLAN_CIPHER_SUITE_CCMP:
1672                         gval = AES_ENABLED;
1673                         break;
1674                 case WLAN_CIPHER_SUITE_AES_CMAC:
1675                         gval = AES_ENABLED;
1676                         break;
1677                 default:
1678                         brcmf_err("invalid cipher group (%d)\n",
1679                                   sme->crypto.cipher_group);
1680                         return -EINVAL;
1681                 }
1682         }
1683
1684         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1685         /* In case of privacy, but no security and WPS then simulate */
1686         /* setting AES. WPS-2.0 allows no security                   */
1687         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1688             sme->privacy)
1689                 pval = AES_ENABLED;
1690
1691         wsec = pval | gval;
1692         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1693         if (err) {
1694                 brcmf_err("error (%d)\n", err);
1695                 return err;
1696         }
1697
1698         sec = &profile->sec;
1699         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1700         sec->cipher_group = sme->crypto.cipher_group;
1701
1702         return err;
1703 }
1704
1705 static s32
1706 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1707 {
1708         struct brcmf_if *ifp = netdev_priv(ndev);
1709         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1710         s32 val;
1711         s32 err;
1712         const struct brcmf_tlv *rsn_ie;
1713         const u8 *ie;
1714         u32 ie_len;
1715         u32 offset;
1716         u16 rsn_cap;
1717         u32 mfp;
1718         u16 count;
1719
1720         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1721
1722         if (!sme->crypto.n_akm_suites)
1723                 return 0;
1724
1725         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1726         if (err) {
1727                 brcmf_err("could not get wpa_auth (%d)\n", err);
1728                 return err;
1729         }
1730         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1731                 switch (sme->crypto.akm_suites[0]) {
1732                 case WLAN_AKM_SUITE_8021X:
1733                         val = WPA_AUTH_UNSPECIFIED;
1734                         if (sme->want_1x)
1735                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1736                         break;
1737                 case WLAN_AKM_SUITE_PSK:
1738                         val = WPA_AUTH_PSK;
1739                         break;
1740                 default:
1741                         brcmf_err("invalid cipher group (%d)\n",
1742                                   sme->crypto.cipher_group);
1743                         return -EINVAL;
1744                 }
1745         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1746                 switch (sme->crypto.akm_suites[0]) {
1747                 case WLAN_AKM_SUITE_8021X:
1748                         val = WPA2_AUTH_UNSPECIFIED;
1749                         if (sme->want_1x)
1750                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1751                         break;
1752                 case WLAN_AKM_SUITE_8021X_SHA256:
1753                         val = WPA2_AUTH_1X_SHA256;
1754                         if (sme->want_1x)
1755                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1756                         break;
1757                 case WLAN_AKM_SUITE_PSK_SHA256:
1758                         val = WPA2_AUTH_PSK_SHA256;
1759                         break;
1760                 case WLAN_AKM_SUITE_PSK:
1761                         val = WPA2_AUTH_PSK;
1762                         break;
1763                 default:
1764                         brcmf_err("invalid cipher group (%d)\n",
1765                                   sme->crypto.cipher_group);
1766                         return -EINVAL;
1767                 }
1768         }
1769
1770         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
1771                 brcmf_dbg(INFO, "using 1X offload\n");
1772
1773         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1774                 goto skip_mfp_config;
1775         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1776          * IE will not be verified, just a quick search for MFP config
1777          */
1778         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1779                                   WLAN_EID_RSN);
1780         if (!rsn_ie)
1781                 goto skip_mfp_config;
1782         ie = (const u8 *)rsn_ie;
1783         ie_len = rsn_ie->len + TLV_HDR_LEN;
1784         /* Skip unicast suite */
1785         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1786         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1787                 goto skip_mfp_config;
1788         /* Skip multicast suite */
1789         count = ie[offset] + (ie[offset + 1] << 8);
1790         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1791         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1792                 goto skip_mfp_config;
1793         /* Skip auth key management suite(s) */
1794         count = ie[offset] + (ie[offset + 1] << 8);
1795         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1796         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1797                 goto skip_mfp_config;
1798         /* Ready to read capabilities */
1799         mfp = BRCMF_MFP_NONE;
1800         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1801         if (rsn_cap & RSN_CAP_MFPR_MASK)
1802                 mfp = BRCMF_MFP_REQUIRED;
1803         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1804                 mfp = BRCMF_MFP_CAPABLE;
1805         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1806
1807 skip_mfp_config:
1808         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1809         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1810         if (err) {
1811                 brcmf_err("could not set wpa_auth (%d)\n", err);
1812                 return err;
1813         }
1814
1815         return err;
1816 }
1817
1818 static s32
1819 brcmf_set_sharedkey(struct net_device *ndev,
1820                     struct cfg80211_connect_params *sme)
1821 {
1822         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1823         struct brcmf_cfg80211_security *sec;
1824         struct brcmf_wsec_key key;
1825         s32 val;
1826         s32 err = 0;
1827
1828         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1829
1830         if (sme->key_len == 0)
1831                 return 0;
1832
1833         sec = &profile->sec;
1834         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1835                   sec->wpa_versions, sec->cipher_pairwise);
1836
1837         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1838                 return 0;
1839
1840         if (!(sec->cipher_pairwise &
1841             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1842                 return 0;
1843
1844         memset(&key, 0, sizeof(key));
1845         key.len = (u32) sme->key_len;
1846         key.index = (u32) sme->key_idx;
1847         if (key.len > sizeof(key.data)) {
1848                 brcmf_err("Too long key length (%u)\n", key.len);
1849                 return -EINVAL;
1850         }
1851         memcpy(key.data, sme->key, key.len);
1852         key.flags = BRCMF_PRIMARY_KEY;
1853         switch (sec->cipher_pairwise) {
1854         case WLAN_CIPHER_SUITE_WEP40:
1855                 key.algo = CRYPTO_ALGO_WEP1;
1856                 break;
1857         case WLAN_CIPHER_SUITE_WEP104:
1858                 key.algo = CRYPTO_ALGO_WEP128;
1859                 break;
1860         default:
1861                 brcmf_err("Invalid algorithm (%d)\n",
1862                           sme->crypto.ciphers_pairwise[0]);
1863                 return -EINVAL;
1864         }
1865         /* Set the new key/index */
1866         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1867                   key.len, key.index, key.algo);
1868         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1869         err = send_key_to_dongle(netdev_priv(ndev), &key);
1870         if (err)
1871                 return err;
1872
1873         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1874                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1875                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1876                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1877                 if (err)
1878                         brcmf_err("set auth failed (%d)\n", err);
1879         }
1880         return err;
1881 }
1882
1883 static
1884 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1885                                            enum nl80211_auth_type type)
1886 {
1887         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1888             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1889                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1890                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1891         }
1892         return type;
1893 }
1894
1895 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1896                                 struct cfg80211_bss_selection *bss_select)
1897 {
1898         struct brcmf_join_pref_params join_pref_params[2];
1899         enum nl80211_band band;
1900         int err, i = 0;
1901
1902         join_pref_params[i].len = 2;
1903         join_pref_params[i].rssi_gain = 0;
1904
1905         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1906                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1907
1908         switch (bss_select->behaviour) {
1909         case __NL80211_BSS_SELECT_ATTR_INVALID:
1910                 brcmf_c_set_joinpref_default(ifp);
1911                 return;
1912         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1913                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1914                 band = bss_select->param.band_pref;
1915                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1916                 i++;
1917                 break;
1918         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1919                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1920                 band = bss_select->param.adjust.band;
1921                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1922                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1923                 i++;
1924                 break;
1925         case NL80211_BSS_SELECT_ATTR_RSSI:
1926         default:
1927                 break;
1928         }
1929         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1930         join_pref_params[i].len = 2;
1931         join_pref_params[i].rssi_gain = 0;
1932         join_pref_params[i].band = 0;
1933         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1934                                        sizeof(join_pref_params));
1935         if (err)
1936                 brcmf_err("Set join_pref error (%d)\n", err);
1937 }
1938
1939 static s32
1940 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1941                        struct cfg80211_connect_params *sme)
1942 {
1943         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1944         struct brcmf_if *ifp = netdev_priv(ndev);
1945         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1946         struct ieee80211_channel *chan = sme->channel;
1947         struct brcmf_join_params join_params;
1948         size_t join_params_size;
1949         const struct brcmf_tlv *rsn_ie;
1950         const struct brcmf_vs_tlv *wpa_ie;
1951         const void *ie;
1952         u32 ie_len;
1953         struct brcmf_ext_join_params_le *ext_join_params;
1954         u16 chanspec;
1955         s32 err = 0;
1956         u32 ssid_len;
1957
1958         brcmf_dbg(TRACE, "Enter\n");
1959         if (!check_vif_up(ifp->vif))
1960                 return -EIO;
1961
1962         if (!sme->ssid) {
1963                 brcmf_err("Invalid ssid\n");
1964                 return -EOPNOTSUPP;
1965         }
1966
1967         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1968                 /* A normal (non P2P) connection request setup. */
1969                 ie = NULL;
1970                 ie_len = 0;
1971                 /* find the WPA_IE */
1972                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1973                 if (wpa_ie) {
1974                         ie = wpa_ie;
1975                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1976                 } else {
1977                         /* find the RSN_IE */
1978                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1979                                                   sme->ie_len,
1980                                                   WLAN_EID_RSN);
1981                         if (rsn_ie) {
1982                                 ie = rsn_ie;
1983                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1984                         }
1985                 }
1986                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1987         }
1988
1989         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1990                                     sme->ie, sme->ie_len);
1991         if (err)
1992                 brcmf_err("Set Assoc REQ IE Failed\n");
1993         else
1994                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1995
1996         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1997
1998         if (chan) {
1999                 cfg->channel =
2000                         ieee80211_frequency_to_channel(chan->center_freq);
2001                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2002                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2003                           cfg->channel, chan->center_freq, chanspec);
2004         } else {
2005                 cfg->channel = 0;
2006                 chanspec = 0;
2007         }
2008
2009         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2010
2011         err = brcmf_set_wpa_version(ndev, sme);
2012         if (err) {
2013                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
2014                 goto done;
2015         }
2016
2017         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2018         err = brcmf_set_auth_type(ndev, sme);
2019         if (err) {
2020                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
2021                 goto done;
2022         }
2023
2024         err = brcmf_set_wsec_mode(ndev, sme);
2025         if (err) {
2026                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
2027                 goto done;
2028         }
2029
2030         err = brcmf_set_key_mgmt(ndev, sme);
2031         if (err) {
2032                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2033                 goto done;
2034         }
2035
2036         err = brcmf_set_sharedkey(ndev, sme);
2037         if (err) {
2038                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2039                 goto done;
2040         }
2041
2042         if (sme->crypto.psk) {
2043                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2044                         err = -EINVAL;
2045                         goto done;
2046                 }
2047                 brcmf_dbg(INFO, "using PSK offload\n");
2048                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2049         }
2050
2051         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2052                 /* enable firmware supplicant for this interface */
2053                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2054                 if (err < 0) {
2055                         brcmf_err("failed to enable fw supplicant\n");
2056                         goto done;
2057                 }
2058         }
2059
2060         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
2061                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2062                                     BRCMF_WSEC_MAX_PSK_LEN);
2063                 if (err)
2064                         goto done;
2065         }
2066
2067         /* Join with specific BSSID and cached SSID
2068          * If SSID is zero join based on BSSID only
2069          */
2070         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2071                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2072         if (cfg->channel)
2073                 join_params_size += sizeof(u16);
2074         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2075         if (ext_join_params == NULL) {
2076                 err = -ENOMEM;
2077                 goto done;
2078         }
2079         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2080         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2081         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2082         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2083                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2084                           ext_join_params->ssid_le.SSID, ssid_len);
2085
2086         /* Set up join scan parameters */
2087         ext_join_params->scan_le.scan_type = -1;
2088         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2089
2090         if (sme->bssid)
2091                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2092         else
2093                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2094
2095         if (cfg->channel) {
2096                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2097
2098                 ext_join_params->assoc_le.chanspec_list[0] =
2099                         cpu_to_le16(chanspec);
2100                 /* Increase dwell time to receive probe response or detect
2101                  * beacon from target AP at a noisy air only during connect
2102                  * command.
2103                  */
2104                 ext_join_params->scan_le.active_time =
2105                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2106                 ext_join_params->scan_le.passive_time =
2107                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2108                 /* To sync with presence period of VSDB GO send probe request
2109                  * more frequently. Probe request will be stopped when it gets
2110                  * probe response from target AP/GO.
2111                  */
2112                 ext_join_params->scan_le.nprobes =
2113                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2114                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2115         } else {
2116                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2117                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2118                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2119         }
2120
2121         brcmf_set_join_pref(ifp, &sme->bss_select);
2122
2123         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2124                                          join_params_size);
2125         kfree(ext_join_params);
2126         if (!err)
2127                 /* This is it. join command worked, we are done */
2128                 goto done;
2129
2130         /* join command failed, fallback to set ssid */
2131         memset(&join_params, 0, sizeof(join_params));
2132         join_params_size = sizeof(join_params.ssid_le);
2133
2134         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2135         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2136
2137         if (sme->bssid)
2138                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2139         else
2140                 eth_broadcast_addr(join_params.params_le.bssid);
2141
2142         if (cfg->channel) {
2143                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2144                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2145                 join_params_size += sizeof(join_params.params_le);
2146         }
2147         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2148                                      &join_params, join_params_size);
2149         if (err)
2150                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2151
2152 done:
2153         if (err)
2154                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2155         brcmf_dbg(TRACE, "Exit\n");
2156         return err;
2157 }
2158
2159 static s32
2160 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2161                        u16 reason_code)
2162 {
2163         struct brcmf_if *ifp = netdev_priv(ndev);
2164         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2165         struct brcmf_scb_val_le scbval;
2166         s32 err = 0;
2167
2168         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2169         if (!check_vif_up(ifp->vif))
2170                 return -EIO;
2171
2172         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2173         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2174         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2175
2176         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2177         scbval.val = cpu_to_le32(reason_code);
2178         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2179                                      &scbval, sizeof(scbval));
2180         if (err)
2181                 brcmf_err("error (%d)\n", err);
2182
2183         brcmf_dbg(TRACE, "Exit\n");
2184         return err;
2185 }
2186
2187 static s32
2188 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2189                             enum nl80211_tx_power_setting type, s32 mbm)
2190 {
2191         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2192         struct net_device *ndev = cfg_to_ndev(cfg);
2193         struct brcmf_if *ifp = netdev_priv(ndev);
2194         s32 err;
2195         s32 disable;
2196         u32 qdbm = 127;
2197
2198         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2199         if (!check_vif_up(ifp->vif))
2200                 return -EIO;
2201
2202         switch (type) {
2203         case NL80211_TX_POWER_AUTOMATIC:
2204                 break;
2205         case NL80211_TX_POWER_LIMITED:
2206         case NL80211_TX_POWER_FIXED:
2207                 if (mbm < 0) {
2208                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2209                         err = -EINVAL;
2210                         goto done;
2211                 }
2212                 qdbm =  MBM_TO_DBM(4 * mbm);
2213                 if (qdbm > 127)
2214                         qdbm = 127;
2215                 qdbm |= WL_TXPWR_OVERRIDE;
2216                 break;
2217         default:
2218                 brcmf_err("Unsupported type %d\n", type);
2219                 err = -EINVAL;
2220                 goto done;
2221         }
2222         /* Make sure radio is off or on as far as software is concerned */
2223         disable = WL_RADIO_SW_DISABLE << 16;
2224         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2225         if (err)
2226                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2227
2228         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2229         if (err)
2230                 brcmf_err("qtxpower error (%d)\n", err);
2231
2232 done:
2233         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2234         return err;
2235 }
2236
2237 static s32
2238 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2239                             s32 *dbm)
2240 {
2241         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2242         struct net_device *ndev = cfg_to_ndev(cfg);
2243         struct brcmf_if *ifp = netdev_priv(ndev);
2244         s32 qdbm = 0;
2245         s32 err;
2246
2247         brcmf_dbg(TRACE, "Enter\n");
2248         if (!check_vif_up(ifp->vif))
2249                 return -EIO;
2250
2251         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2252         if (err) {
2253                 brcmf_err("error (%d)\n", err);
2254                 goto done;
2255         }
2256         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2257
2258 done:
2259         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2260         return err;
2261 }
2262
2263 static s32
2264 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2265                                   u8 key_idx, bool unicast, bool multicast)
2266 {
2267         struct brcmf_if *ifp = netdev_priv(ndev);
2268         u32 index;
2269         u32 wsec;
2270         s32 err = 0;
2271
2272         brcmf_dbg(TRACE, "Enter\n");
2273         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2274         if (!check_vif_up(ifp->vif))
2275                 return -EIO;
2276
2277         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2278         if (err) {
2279                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2280                 goto done;
2281         }
2282
2283         if (wsec & WEP_ENABLED) {
2284                 /* Just select a new current key */
2285                 index = key_idx;
2286                 err = brcmf_fil_cmd_int_set(ifp,
2287                                             BRCMF_C_SET_KEY_PRIMARY, index);
2288                 if (err)
2289                         brcmf_err("error (%d)\n", err);
2290         }
2291 done:
2292         brcmf_dbg(TRACE, "Exit\n");
2293         return err;
2294 }
2295
2296 static s32
2297 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2298                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2299 {
2300         struct brcmf_if *ifp = netdev_priv(ndev);
2301         struct brcmf_wsec_key *key;
2302         s32 err;
2303
2304         brcmf_dbg(TRACE, "Enter\n");
2305         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2306
2307         if (!check_vif_up(ifp->vif))
2308                 return -EIO;
2309
2310         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2311                 /* we ignore this key index in this case */
2312                 return -EINVAL;
2313         }
2314
2315         key = &ifp->vif->profile.key[key_idx];
2316
2317         if (key->algo == CRYPTO_ALGO_OFF) {
2318                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2319                 return -EINVAL;
2320         }
2321
2322         memset(key, 0, sizeof(*key));
2323         key->index = (u32)key_idx;
2324         key->flags = BRCMF_PRIMARY_KEY;
2325
2326         /* Clear the key/index */
2327         err = send_key_to_dongle(ifp, key);
2328
2329         brcmf_dbg(TRACE, "Exit\n");
2330         return err;
2331 }
2332
2333 static s32
2334 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2335                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2336                        struct key_params *params)
2337 {
2338         struct brcmf_if *ifp = netdev_priv(ndev);
2339         struct brcmf_wsec_key *key;
2340         s32 val;
2341         s32 wsec;
2342         s32 err;
2343         u8 keybuf[8];
2344         bool ext_key;
2345
2346         brcmf_dbg(TRACE, "Enter\n");
2347         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2348         if (!check_vif_up(ifp->vif))
2349                 return -EIO;
2350
2351         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2352                 /* we ignore this key index in this case */
2353                 brcmf_err("invalid key index (%d)\n", key_idx);
2354                 return -EINVAL;
2355         }
2356
2357         if (params->key_len == 0)
2358                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2359                                               mac_addr);
2360
2361         if (params->key_len > sizeof(key->data)) {
2362                 brcmf_err("Too long key length (%u)\n", params->key_len);
2363                 return -EINVAL;
2364         }
2365
2366         ext_key = false;
2367         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2368             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2369                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2370                 ext_key = true;
2371         }
2372
2373         key = &ifp->vif->profile.key[key_idx];
2374         memset(key, 0, sizeof(*key));
2375         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2376                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2377         key->len = params->key_len;
2378         key->index = key_idx;
2379         memcpy(key->data, params->key, key->len);
2380         if (!ext_key)
2381                 key->flags = BRCMF_PRIMARY_KEY;
2382
2383         switch (params->cipher) {
2384         case WLAN_CIPHER_SUITE_WEP40:
2385                 key->algo = CRYPTO_ALGO_WEP1;
2386                 val = WEP_ENABLED;
2387                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2388                 break;
2389         case WLAN_CIPHER_SUITE_WEP104:
2390                 key->algo = CRYPTO_ALGO_WEP128;
2391                 val = WEP_ENABLED;
2392                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2393                 break;
2394         case WLAN_CIPHER_SUITE_TKIP:
2395                 if (!brcmf_is_apmode(ifp->vif)) {
2396                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2397                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2398                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2399                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2400                 }
2401                 key->algo = CRYPTO_ALGO_TKIP;
2402                 val = TKIP_ENABLED;
2403                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2404                 break;
2405         case WLAN_CIPHER_SUITE_AES_CMAC:
2406                 key->algo = CRYPTO_ALGO_AES_CCM;
2407                 val = AES_ENABLED;
2408                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2409                 break;
2410         case WLAN_CIPHER_SUITE_CCMP:
2411                 key->algo = CRYPTO_ALGO_AES_CCM;
2412                 val = AES_ENABLED;
2413                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2414                 break;
2415         default:
2416                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2417                 err = -EINVAL;
2418                 goto done;
2419         }
2420
2421         err = send_key_to_dongle(ifp, key);
2422         if (ext_key || err)
2423                 goto done;
2424
2425         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2426         if (err) {
2427                 brcmf_err("get wsec error (%d)\n", err);
2428                 goto done;
2429         }
2430         wsec |= val;
2431         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2432         if (err) {
2433                 brcmf_err("set wsec error (%d)\n", err);
2434                 goto done;
2435         }
2436
2437 done:
2438         brcmf_dbg(TRACE, "Exit\n");
2439         return err;
2440 }
2441
2442 static s32
2443 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2444                        bool pairwise, const u8 *mac_addr, void *cookie,
2445                        void (*callback)(void *cookie,
2446                                         struct key_params *params))
2447 {
2448         struct key_params params;
2449         struct brcmf_if *ifp = netdev_priv(ndev);
2450         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2451         struct brcmf_cfg80211_security *sec;
2452         s32 wsec;
2453         s32 err = 0;
2454
2455         brcmf_dbg(TRACE, "Enter\n");
2456         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2457         if (!check_vif_up(ifp->vif))
2458                 return -EIO;
2459
2460         memset(&params, 0, sizeof(params));
2461
2462         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2463         if (err) {
2464                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2465                 /* Ignore this error, may happen during DISASSOC */
2466                 err = -EAGAIN;
2467                 goto done;
2468         }
2469         if (wsec & WEP_ENABLED) {
2470                 sec = &profile->sec;
2471                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2472                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2473                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2474                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2475                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2476                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2477                 }
2478         } else if (wsec & TKIP_ENABLED) {
2479                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2480                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2481         } else if (wsec & AES_ENABLED) {
2482                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2483                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2484         } else  {
2485                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2486                 err = -EINVAL;
2487                 goto done;
2488         }
2489         callback(cookie, &params);
2490
2491 done:
2492         brcmf_dbg(TRACE, "Exit\n");
2493         return err;
2494 }
2495
2496 static s32
2497 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2498                                        struct net_device *ndev, u8 key_idx)
2499 {
2500         struct brcmf_if *ifp = netdev_priv(ndev);
2501
2502         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2503
2504         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2505                 return 0;
2506
2507         brcmf_dbg(INFO, "Not supported\n");
2508
2509         return -EOPNOTSUPP;
2510 }
2511
2512 static void
2513 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2514 {
2515         s32 err;
2516         u8 key_idx;
2517         struct brcmf_wsec_key *key;
2518         s32 wsec;
2519
2520         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2521                 key = &ifp->vif->profile.key[key_idx];
2522                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2523                     (key->algo == CRYPTO_ALGO_WEP128))
2524                         break;
2525         }
2526         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2527                 return;
2528
2529         err = send_key_to_dongle(ifp, key);
2530         if (err) {
2531                 brcmf_err("Setting WEP key failed (%d)\n", err);
2532                 return;
2533         }
2534         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2535         if (err) {
2536                 brcmf_err("get wsec error (%d)\n", err);
2537                 return;
2538         }
2539         wsec |= WEP_ENABLED;
2540         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2541         if (err)
2542                 brcmf_err("set wsec error (%d)\n", err);
2543 }
2544
2545 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2546 {
2547         struct nl80211_sta_flag_update *sfu;
2548
2549         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2550         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2551         sfu = &si->sta_flags;
2552         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2553                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2554                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2555                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2556         if (fw_sta_flags & BRCMF_STA_WME)
2557                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2558         if (fw_sta_flags & BRCMF_STA_AUTHE)
2559                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2560         if (fw_sta_flags & BRCMF_STA_ASSOC)
2561                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2562         if (fw_sta_flags & BRCMF_STA_AUTHO)
2563                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2564 }
2565
2566 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2567 {
2568         struct {
2569                 __le32 len;
2570                 struct brcmf_bss_info_le bss_le;
2571         } *buf;
2572         u16 capability;
2573         int err;
2574
2575         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2576         if (!buf)
2577                 return;
2578
2579         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2580         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2581                                      WL_BSS_INFO_MAX);
2582         if (err) {
2583                 brcmf_err("Failed to get bss info (%d)\n", err);
2584                 goto out_kfree;
2585         }
2586         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2587         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2588         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2589         capability = le16_to_cpu(buf->bss_le.capability);
2590         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2591                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2592         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2593                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2594         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2595                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2596
2597 out_kfree:
2598         kfree(buf);
2599 }
2600
2601 static s32
2602 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2603                                 struct station_info *sinfo)
2604 {
2605         struct brcmf_scb_val_le scbval;
2606         struct brcmf_pktcnt_le pktcnt;
2607         s32 err;
2608         u32 rate;
2609         u32 rssi;
2610
2611         /* Get the current tx rate */
2612         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2613         if (err < 0) {
2614                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2615                 return err;
2616         }
2617         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2618         sinfo->txrate.legacy = rate * 5;
2619
2620         memset(&scbval, 0, sizeof(scbval));
2621         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2622                                      sizeof(scbval));
2623         if (err) {
2624                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2625                 return err;
2626         }
2627         rssi = le32_to_cpu(scbval.val);
2628         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2629         sinfo->signal = rssi;
2630
2631         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2632                                      sizeof(pktcnt));
2633         if (err) {
2634                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2635                 return err;
2636         }
2637         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2638                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2639                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2640                          BIT(NL80211_STA_INFO_TX_FAILED);
2641         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2642         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2643         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2644         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2645
2646         return 0;
2647 }
2648
2649 static s32
2650 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2651                            const u8 *mac, struct station_info *sinfo)
2652 {
2653         struct brcmf_if *ifp = netdev_priv(ndev);
2654         struct brcmf_scb_val_le scb_val;
2655         s32 err = 0;
2656         struct brcmf_sta_info_le sta_info_le;
2657         u32 sta_flags;
2658         u32 is_tdls_peer;
2659         s32 total_rssi;
2660         s32 count_rssi;
2661         int rssi;
2662         u32 i;
2663
2664         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2665         if (!check_vif_up(ifp->vif))
2666                 return -EIO;
2667
2668         if (brcmf_is_ibssmode(ifp->vif))
2669                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2670
2671         memset(&sta_info_le, 0, sizeof(sta_info_le));
2672         memcpy(&sta_info_le, mac, ETH_ALEN);
2673         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2674                                        &sta_info_le,
2675                                        sizeof(sta_info_le));
2676         is_tdls_peer = !err;
2677         if (err) {
2678                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2679                                                &sta_info_le,
2680                                                sizeof(sta_info_le));
2681                 if (err < 0) {
2682                         brcmf_err("GET STA INFO failed, %d\n", err);
2683                         goto done;
2684                 }
2685         }
2686         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2687         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2688         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2689         sta_flags = le32_to_cpu(sta_info_le.flags);
2690         brcmf_convert_sta_flags(sta_flags, sinfo);
2691         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2692         if (is_tdls_peer)
2693                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2694         else
2695                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2696         if (sta_flags & BRCMF_STA_ASSOC) {
2697                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2698                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2699                 brcmf_fill_bss_param(ifp, sinfo);
2700         }
2701         if (sta_flags & BRCMF_STA_SCBSTATS) {
2702                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2703                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2704                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2705                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2706                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2707                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2708                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2709                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2710                 if (sinfo->tx_packets) {
2711                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2712                         sinfo->txrate.legacy =
2713                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2714                 }
2715                 if (sinfo->rx_packets) {
2716                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2717                         sinfo->rxrate.legacy =
2718                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2719                 }
2720                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2721                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2722                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2723                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2724                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2725                 }
2726                 total_rssi = 0;
2727                 count_rssi = 0;
2728                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2729                         if (sta_info_le.rssi[i]) {
2730                                 sinfo->chain_signal_avg[count_rssi] =
2731                                         sta_info_le.rssi[i];
2732                                 sinfo->chain_signal[count_rssi] =
2733                                         sta_info_le.rssi[i];
2734                                 total_rssi += sta_info_le.rssi[i];
2735                                 count_rssi++;
2736                         }
2737                 }
2738                 if (count_rssi) {
2739                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2740                         sinfo->chains = count_rssi;
2741
2742                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2743                         total_rssi /= count_rssi;
2744                         sinfo->signal = total_rssi;
2745                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2746                         &ifp->vif->sme_state)) {
2747                         memset(&scb_val, 0, sizeof(scb_val));
2748                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2749                                                      &scb_val, sizeof(scb_val));
2750                         if (err) {
2751                                 brcmf_err("Could not get rssi (%d)\n", err);
2752                                 goto done;
2753                         } else {
2754                                 rssi = le32_to_cpu(scb_val.val);
2755                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2756                                 sinfo->signal = rssi;
2757                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2758                         }
2759                 }
2760         }
2761 done:
2762         brcmf_dbg(TRACE, "Exit\n");
2763         return err;
2764 }
2765
2766 static int
2767 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2768                             int idx, u8 *mac, struct station_info *sinfo)
2769 {
2770         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2771         struct brcmf_if *ifp = netdev_priv(ndev);
2772         s32 err;
2773
2774         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2775
2776         if (idx == 0) {
2777                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2778                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2779                                              &cfg->assoclist,
2780                                              sizeof(cfg->assoclist));
2781                 if (err) {
2782                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2783                                   err);
2784                         cfg->assoclist.count = 0;
2785                         return -EOPNOTSUPP;
2786                 }
2787         }
2788         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2789                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2790                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2791         }
2792         return -ENOENT;
2793 }
2794
2795 static s32
2796 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2797                            bool enabled, s32 timeout)
2798 {
2799         s32 pm;
2800         s32 err = 0;
2801         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2802         struct brcmf_if *ifp = netdev_priv(ndev);
2803
2804         brcmf_dbg(TRACE, "Enter\n");
2805
2806         /*
2807          * Powersave enable/disable request is coming from the
2808          * cfg80211 even before the interface is up. In that
2809          * scenario, driver will be storing the power save
2810          * preference in cfg struct to apply this to
2811          * FW later while initializing the dongle
2812          */
2813         cfg->pwr_save = enabled;
2814         if (!check_vif_up(ifp->vif)) {
2815
2816                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2817                 goto done;
2818         }
2819
2820         pm = enabled ? PM_FAST : PM_OFF;
2821         /* Do not enable the power save after assoc if it is a p2p interface */
2822         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2823                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2824                 pm = PM_OFF;
2825         }
2826         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2827
2828         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2829         if (err) {
2830                 if (err == -ENODEV)
2831                         brcmf_err("net_device is not ready yet\n");
2832                 else
2833                         brcmf_err("error (%d)\n", err);
2834         }
2835 done:
2836         brcmf_dbg(TRACE, "Exit\n");
2837         return err;
2838 }
2839
2840 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2841                                    struct brcmf_bss_info_le *bi)
2842 {
2843         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2844         struct ieee80211_channel *notify_channel;
2845         struct cfg80211_bss *bss;
2846         struct ieee80211_supported_band *band;
2847         struct brcmu_chan ch;
2848         u16 channel;
2849         u32 freq;
2850         u16 notify_capability;
2851         u16 notify_interval;
2852         u8 *notify_ie;
2853         size_t notify_ielen;
2854         s32 notify_signal;
2855
2856         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2857                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2858                 return 0;
2859         }
2860
2861         if (!bi->ctl_ch) {
2862                 ch.chspec = le16_to_cpu(bi->chanspec);
2863                 cfg->d11inf.decchspec(&ch);
2864                 bi->ctl_ch = ch.control_ch_num;
2865         }
2866         channel = bi->ctl_ch;
2867
2868         if (channel <= CH_MAX_2G_CHANNEL)
2869                 band = wiphy->bands[NL80211_BAND_2GHZ];
2870         else
2871                 band = wiphy->bands[NL80211_BAND_5GHZ];
2872
2873         freq = ieee80211_channel_to_frequency(channel, band->band);
2874         notify_channel = ieee80211_get_channel(wiphy, freq);
2875
2876         notify_capability = le16_to_cpu(bi->capability);
2877         notify_interval = le16_to_cpu(bi->beacon_period);
2878         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2879         notify_ielen = le32_to_cpu(bi->ie_length);
2880         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2881
2882         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2883         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2884         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2885         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2886         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2887
2888         bss = cfg80211_inform_bss(wiphy, notify_channel,
2889                                   CFG80211_BSS_FTYPE_UNKNOWN,
2890                                   (const u8 *)bi->BSSID,
2891                                   0, notify_capability,
2892                                   notify_interval, notify_ie,
2893                                   notify_ielen, notify_signal,
2894                                   GFP_KERNEL);
2895
2896         if (!bss)
2897                 return -ENOMEM;
2898
2899         cfg80211_put_bss(wiphy, bss);
2900
2901         return 0;
2902 }
2903
2904 static struct brcmf_bss_info_le *
2905 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2906 {
2907         if (bss == NULL)
2908                 return list->bss_info_le;
2909         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2910                                             le32_to_cpu(bss->length));
2911 }
2912
2913 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2914 {
2915         struct brcmf_scan_results *bss_list;
2916         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2917         s32 err = 0;
2918         int i;
2919
2920         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2921         if (bss_list->count != 0 &&
2922             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2923                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2924                           bss_list->version);
2925                 return -EOPNOTSUPP;
2926         }
2927         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2928         for (i = 0; i < bss_list->count; i++) {
2929                 bi = next_bss_le(bss_list, bi);
2930                 err = brcmf_inform_single_bss(cfg, bi);
2931                 if (err)
2932                         break;
2933         }
2934         return err;
2935 }
2936
2937 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2938                              struct net_device *ndev, const u8 *bssid)
2939 {
2940         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2941         struct ieee80211_channel *notify_channel;
2942         struct brcmf_bss_info_le *bi = NULL;
2943         struct ieee80211_supported_band *band;
2944         struct cfg80211_bss *bss;
2945         struct brcmu_chan ch;
2946         u8 *buf = NULL;
2947         s32 err = 0;
2948         u32 freq;
2949         u16 notify_capability;
2950         u16 notify_interval;
2951         u8 *notify_ie;
2952         size_t notify_ielen;
2953         s32 notify_signal;
2954
2955         brcmf_dbg(TRACE, "Enter\n");
2956
2957         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2958         if (buf == NULL) {
2959                 err = -ENOMEM;
2960                 goto CleanUp;
2961         }
2962
2963         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2964
2965         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2966                                      buf, WL_BSS_INFO_MAX);
2967         if (err) {
2968                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2969                 goto CleanUp;
2970         }
2971
2972         bi = (struct brcmf_bss_info_le *)(buf + 4);
2973
2974         ch.chspec = le16_to_cpu(bi->chanspec);
2975         cfg->d11inf.decchspec(&ch);
2976
2977         if (ch.band == BRCMU_CHAN_BAND_2G)
2978                 band = wiphy->bands[NL80211_BAND_2GHZ];
2979         else
2980                 band = wiphy->bands[NL80211_BAND_5GHZ];
2981
2982         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2983         cfg->channel = freq;
2984         notify_channel = ieee80211_get_channel(wiphy, freq);
2985
2986         notify_capability = le16_to_cpu(bi->capability);
2987         notify_interval = le16_to_cpu(bi->beacon_period);
2988         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2989         notify_ielen = le32_to_cpu(bi->ie_length);
2990         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2991
2992         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2993         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2994         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2995         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2996
2997         bss = cfg80211_inform_bss(wiphy, notify_channel,
2998                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2999                                   notify_capability, notify_interval,
3000                                   notify_ie, notify_ielen, notify_signal,
3001                                   GFP_KERNEL);
3002
3003         if (!bss) {
3004                 err = -ENOMEM;
3005                 goto CleanUp;
3006         }
3007
3008         cfg80211_put_bss(wiphy, bss);
3009
3010 CleanUp:
3011
3012         kfree(buf);
3013
3014         brcmf_dbg(TRACE, "Exit\n");
3015
3016         return err;
3017 }
3018
3019 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3020                                  struct brcmf_if *ifp)
3021 {
3022         struct brcmf_bss_info_le *bi;
3023         const struct brcmf_tlv *tim;
3024         u16 beacon_interval;
3025         u8 dtim_period;
3026         size_t ie_len;
3027         u8 *ie;
3028         s32 err = 0;
3029
3030         brcmf_dbg(TRACE, "Enter\n");
3031         if (brcmf_is_ibssmode(ifp->vif))
3032                 return err;
3033
3034         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3035         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3036                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3037         if (err) {
3038                 brcmf_err("Could not get bss info %d\n", err);
3039                 goto update_bss_info_out;
3040         }
3041
3042         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3043         err = brcmf_inform_single_bss(cfg, bi);
3044         if (err)
3045                 goto update_bss_info_out;
3046
3047         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
3048         ie_len = le32_to_cpu(bi->ie_length);
3049         beacon_interval = le16_to_cpu(bi->beacon_period);
3050
3051         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
3052         if (tim)
3053                 dtim_period = tim->data[1];
3054         else {
3055                 /*
3056                 * active scan was done so we could not get dtim
3057                 * information out of probe response.
3058                 * so we speficially query dtim information to dongle.
3059                 */
3060                 u32 var;
3061                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3062                 if (err) {
3063                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3064                         goto update_bss_info_out;
3065                 }
3066                 dtim_period = (u8)var;
3067         }
3068
3069 update_bss_info_out:
3070         brcmf_dbg(TRACE, "Exit");
3071         return err;
3072 }
3073
3074 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3075 {
3076         struct escan_info *escan = &cfg->escan_info;
3077
3078         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3079         if (cfg->int_escan_map || cfg->scan_request) {
3080                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3081                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3082         }
3083         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3084         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3085 }
3086
3087 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3088 {
3089         struct brcmf_cfg80211_info *cfg =
3090                         container_of(work, struct brcmf_cfg80211_info,
3091                                      escan_timeout_work);
3092
3093         brcmf_inform_bss(cfg);
3094         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3095 }
3096
3097 static void brcmf_escan_timeout(unsigned long data)
3098 {
3099         struct brcmf_cfg80211_info *cfg =
3100                         (struct brcmf_cfg80211_info *)data;
3101
3102         if (cfg->int_escan_map || cfg->scan_request) {
3103                 brcmf_err("timer expired\n");
3104                 schedule_work(&cfg->escan_timeout_work);
3105         }
3106 }
3107
3108 static s32
3109 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3110                               struct brcmf_bss_info_le *bss,
3111                               struct brcmf_bss_info_le *bss_info_le)
3112 {
3113         struct brcmu_chan ch_bss, ch_bss_info_le;
3114
3115         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3116         cfg->d11inf.decchspec(&ch_bss);
3117         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3118         cfg->d11inf.decchspec(&ch_bss_info_le);
3119
3120         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3121                 ch_bss.band == ch_bss_info_le.band &&
3122                 bss_info_le->SSID_len == bss->SSID_len &&
3123                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3124                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3125                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3126                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3127                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3128
3129                         /* preserve max RSSI if the measurements are
3130                         * both on-channel or both off-channel
3131                         */
3132                         if (bss_info_rssi > bss_rssi)
3133                                 bss->RSSI = bss_info_le->RSSI;
3134                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3135                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3136                         /* preserve the on-channel rssi measurement
3137                         * if the new measurement is off channel
3138                         */
3139                         bss->RSSI = bss_info_le->RSSI;
3140                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3141                 }
3142                 return 1;
3143         }
3144         return 0;
3145 }
3146
3147 static s32
3148 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3149                              const struct brcmf_event_msg *e, void *data)
3150 {
3151         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3152         s32 status;
3153         struct brcmf_escan_result_le *escan_result_le;
3154         u32 escan_buflen;
3155         struct brcmf_bss_info_le *bss_info_le;
3156         struct brcmf_bss_info_le *bss = NULL;
3157         u32 bi_length;
3158         struct brcmf_scan_results *list;
3159         u32 i;
3160         bool aborted;
3161
3162         status = e->status;
3163
3164         if (status == BRCMF_E_STATUS_ABORT)
3165                 goto exit;
3166
3167         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3168                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3169                 return -EPERM;
3170         }
3171
3172         if (status == BRCMF_E_STATUS_PARTIAL) {
3173                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3174                 if (e->datalen < sizeof(*escan_result_le)) {
3175                         brcmf_err("invalid event data length\n");
3176                         goto exit;
3177                 }
3178                 escan_result_le = (struct brcmf_escan_result_le *) data;
3179                 if (!escan_result_le) {
3180                         brcmf_err("Invalid escan result (NULL pointer)\n");
3181                         goto exit;
3182                 }
3183                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3184                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3185                     escan_buflen > e->datalen ||
3186                     escan_buflen < sizeof(*escan_result_le)) {
3187                         brcmf_err("Invalid escan buffer length: %d\n",
3188                                   escan_buflen);
3189                         goto exit;
3190                 }
3191                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3192                         brcmf_err("Invalid bss_count %d: ignoring\n",
3193                                   escan_result_le->bss_count);
3194                         goto exit;
3195                 }
3196                 bss_info_le = &escan_result_le->bss_info_le;
3197
3198                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3199                         goto exit;
3200
3201                 if (!cfg->int_escan_map && !cfg->scan_request) {
3202                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3203                         goto exit;
3204                 }
3205
3206                 bi_length = le32_to_cpu(bss_info_le->length);
3207                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3208                         brcmf_err("Ignoring invalid bss_info length: %d\n",
3209                                   bi_length);
3210                         goto exit;
3211                 }
3212
3213                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3214                                         BIT(NL80211_IFTYPE_ADHOC))) {
3215                         if (le16_to_cpu(bss_info_le->capability) &
3216                                                 WLAN_CAPABILITY_IBSS) {
3217                                 brcmf_err("Ignoring IBSS result\n");
3218                                 goto exit;
3219                         }
3220                 }
3221
3222                 list = (struct brcmf_scan_results *)
3223                                 cfg->escan_info.escan_buf;
3224                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3225                         brcmf_err("Buffer is too small: ignoring\n");
3226                         goto exit;
3227                 }
3228
3229                 for (i = 0; i < list->count; i++) {
3230                         bss = bss ? (struct brcmf_bss_info_le *)
3231                                 ((unsigned char *)bss +
3232                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3233                         if (brcmf_compare_update_same_bss(cfg, bss,
3234                                                           bss_info_le))
3235                                 goto exit;
3236                 }
3237                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3238                        bi_length);
3239                 list->version = le32_to_cpu(bss_info_le->version);
3240                 list->buflen += bi_length;
3241                 list->count++;
3242         } else {
3243                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3244                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3245                         goto exit;
3246                 if (cfg->int_escan_map || cfg->scan_request) {
3247                         brcmf_inform_bss(cfg);
3248                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3249                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3250                 } else
3251                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3252                                   status);
3253         }
3254 exit:
3255         return 0;
3256 }
3257
3258 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3259 {
3260         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3261                             brcmf_cfg80211_escan_handler);
3262         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3263         /* Init scan_timeout timer */
3264         init_timer(&cfg->escan_timeout);
3265         cfg->escan_timeout.data = (unsigned long) cfg;
3266         cfg->escan_timeout.function = brcmf_escan_timeout;
3267         INIT_WORK(&cfg->escan_timeout_work,
3268                   brcmf_cfg80211_escan_timeout_worker);
3269 }
3270
3271 static struct cfg80211_scan_request *
3272 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3273         struct cfg80211_scan_request *req;
3274         size_t req_size;
3275
3276         req_size = sizeof(*req) +
3277                    n_netinfo * sizeof(req->channels[0]) +
3278                    n_netinfo * sizeof(*req->ssids);
3279
3280         req = kzalloc(req_size, GFP_KERNEL);
3281         if (req) {
3282                 req->wiphy = wiphy;
3283                 req->ssids = (void *)(&req->channels[0]) +
3284                              n_netinfo * sizeof(req->channels[0]);
3285         }
3286         return req;
3287 }
3288
3289 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3290                                          u8 *ssid, u8 ssid_len, u8 channel)
3291 {
3292         struct ieee80211_channel *chan;
3293         enum nl80211_band band;
3294         int freq, i;
3295
3296         if (channel <= CH_MAX_2G_CHANNEL)
3297                 band = NL80211_BAND_2GHZ;
3298         else
3299                 band = NL80211_BAND_5GHZ;
3300
3301         freq = ieee80211_channel_to_frequency(channel, band);
3302         if (!freq)
3303                 return -EINVAL;
3304
3305         chan = ieee80211_get_channel(req->wiphy, freq);
3306         if (!chan)
3307                 return -EINVAL;
3308
3309         for (i = 0; i < req->n_channels; i++) {
3310                 if (req->channels[i] == chan)
3311                         break;
3312         }
3313         if (i == req->n_channels)
3314                 req->channels[req->n_channels++] = chan;
3315
3316         for (i = 0; i < req->n_ssids; i++) {
3317                 if (req->ssids[i].ssid_len == ssid_len &&
3318                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3319                         break;
3320         }
3321         if (i == req->n_ssids) {
3322                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3323                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3324         }
3325         return 0;
3326 }
3327
3328 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3329                                       struct cfg80211_scan_request *request)
3330 {
3331         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3332         int err;
3333
3334         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3335                 if (cfg->int_escan_map)
3336                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3337                                   cfg->int_escan_map);
3338                 /* Abort any on-going scan */
3339                 brcmf_abort_scanning(cfg);
3340         }
3341
3342         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3343         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3344         cfg->escan_info.run = brcmf_run_escan;
3345         err = brcmf_do_escan(ifp, request);
3346         if (err) {
3347                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3348                 return err;
3349         }
3350         cfg->int_escan_map = fwmap;
3351         return 0;
3352 }
3353
3354 static struct brcmf_pno_net_info_le *
3355 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3356 {
3357         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3358         struct brcmf_pno_net_info_le *netinfo;
3359
3360         switch (pfn_v1->version) {
3361         default:
3362                 WARN_ON(1);
3363                 /* fall-thru */
3364         case cpu_to_le32(1):
3365                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3366                 break;
3367         case cpu_to_le32(2):
3368                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3369                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3370                 break;
3371         }
3372
3373         return netinfo;
3374 }
3375
3376 /* PFN result doesn't have all the info which are required by the supplicant
3377  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3378  * via wl_inform_single_bss in the required format. Escan does require the
3379  * scan request in the form of cfg80211_scan_request. For timebeing, create
3380  * cfg80211_scan_request one out of the received PNO event.
3381  */
3382 static s32
3383 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3384                                 const struct brcmf_event_msg *e, void *data)
3385 {
3386         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3387         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3388         struct cfg80211_scan_request *request = NULL;
3389         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3390         int i, err = 0;
3391         struct brcmf_pno_scanresults_le *pfn_result;
3392         u32 bucket_map;
3393         u32 result_count;
3394         u32 status;
3395         u32 datalen;
3396
3397         brcmf_dbg(SCAN, "Enter\n");
3398
3399         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3400                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3401                 return 0;
3402         }
3403
3404         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3405                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3406                 return 0;
3407         }
3408
3409         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3410         result_count = le32_to_cpu(pfn_result->count);
3411         status = le32_to_cpu(pfn_result->status);
3412
3413         /* PFN event is limited to fit 512 bytes so we may get
3414          * multiple NET_FOUND events. For now place a warning here.
3415          */
3416         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3417         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3418         if (!result_count) {
3419                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3420                 goto out_err;
3421         }
3422
3423         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3424         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3425         if (datalen < result_count * sizeof(*netinfo)) {
3426                 brcmf_err("insufficient event data\n");
3427                 goto out_err;
3428         }
3429
3430         request = brcmf_alloc_internal_escan_request(wiphy,
3431                                                      result_count);
3432         if (!request) {
3433                 err = -ENOMEM;
3434                 goto out_err;
3435         }
3436
3437         bucket_map = 0;
3438         for (i = 0; i < result_count; i++) {
3439                 netinfo = &netinfo_start[i];
3440
3441                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3442                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3443                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3444                           netinfo->SSID, netinfo->channel);
3445                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3446                 err = brcmf_internal_escan_add_info(request,
3447                                                     netinfo->SSID,
3448                                                     netinfo->SSID_len,
3449                                                     netinfo->channel);
3450                 if (err)
3451                         goto out_err;
3452         }
3453
3454         if (!bucket_map)
3455                 goto free_req;
3456
3457         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3458         if (!err)
3459                 goto free_req;
3460
3461 out_err:
3462         cfg80211_sched_scan_stopped(wiphy, 0);
3463 free_req:
3464         kfree(request);
3465         return err;
3466 }
3467
3468 static int
3469 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3470                                 struct net_device *ndev,
3471                                 struct cfg80211_sched_scan_request *req)
3472 {
3473         struct brcmf_if *ifp = netdev_priv(ndev);
3474         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3475
3476         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3477                   req->n_match_sets, req->n_ssids);
3478
3479         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3480                 brcmf_err("Scanning suppressed: status=%lu\n",
3481                           cfg->scan_status);
3482                 return -EAGAIN;
3483         }
3484
3485         if (req->n_match_sets <= 0) {
3486                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3487                           req->n_match_sets);
3488                 return -EINVAL;
3489         }
3490
3491         return brcmf_pno_start_sched_scan(ifp, req);
3492 }
3493
3494 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3495                                           struct net_device *ndev, u64 reqid)
3496 {
3497         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3498         struct brcmf_if *ifp = netdev_priv(ndev);
3499
3500         brcmf_dbg(SCAN, "enter\n");
3501         brcmf_pno_stop_sched_scan(ifp, reqid);
3502         if (cfg->int_escan_map)
3503                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3504         return 0;
3505 }
3506
3507 static __always_inline void brcmf_delay(u32 ms)
3508 {
3509         if (ms < 1000 / HZ) {
3510                 cond_resched();
3511                 mdelay(ms);
3512         } else {
3513                 msleep(ms);
3514         }
3515 }
3516
3517 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3518                                      u8 *pattern, u32 patternsize, u8 *mask,
3519                                      u32 packet_offset)
3520 {
3521         struct brcmf_fil_wowl_pattern_le *filter;
3522         u32 masksize;
3523         u32 patternoffset;
3524         u8 *buf;
3525         u32 bufsize;
3526         s32 ret;
3527
3528         masksize = (patternsize + 7) / 8;
3529         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3530
3531         bufsize = sizeof(*filter) + patternsize + masksize;
3532         buf = kzalloc(bufsize, GFP_KERNEL);
3533         if (!buf)
3534                 return -ENOMEM;
3535         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3536
3537         memcpy(filter->cmd, cmd, 4);
3538         filter->masksize = cpu_to_le32(masksize);
3539         filter->offset = cpu_to_le32(packet_offset);
3540         filter->patternoffset = cpu_to_le32(patternoffset);
3541         filter->patternsize = cpu_to_le32(patternsize);
3542         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3543
3544         if ((mask) && (masksize))
3545                 memcpy(buf + sizeof(*filter), mask, masksize);
3546         if ((pattern) && (patternsize))
3547                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3548
3549         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3550
3551         kfree(buf);
3552         return ret;
3553 }
3554
3555 static s32
3556 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3557                       void *data)
3558 {
3559         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3560         struct brcmf_pno_scanresults_le *pfn_result;
3561         struct brcmf_pno_net_info_le *netinfo;
3562
3563         brcmf_dbg(SCAN, "Enter\n");
3564
3565         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3566                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3567                 return 0;
3568         }
3569
3570         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3571
3572         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3573                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3574                 return 0;
3575         }
3576
3577         if (le32_to_cpu(pfn_result->count) < 1) {
3578                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3579                           le32_to_cpu(pfn_result->count));
3580                 return -EINVAL;
3581         }
3582
3583         netinfo = brcmf_get_netinfo_array(pfn_result);
3584         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3585                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3586         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3587         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3588         cfg->wowl.nd->n_channels = 1;
3589         cfg->wowl.nd->channels[0] =
3590                 ieee80211_channel_to_frequency(netinfo->channel,
3591                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3592                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3593         cfg->wowl.nd_info->n_matches = 1;
3594         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3595
3596         /* Inform (the resume task) that the net detect information was recvd */
3597         cfg->wowl.nd_data_completed = true;
3598         wake_up(&cfg->wowl.nd_data_wait);
3599
3600         return 0;
3601 }
3602
3603 #ifdef CONFIG_PM
3604
3605 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3606 {
3607         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3608         struct brcmf_wowl_wakeind_le wake_ind_le;
3609         struct cfg80211_wowlan_wakeup wakeup_data;
3610         struct cfg80211_wowlan_wakeup *wakeup;
3611         u32 wakeind;
3612         s32 err;
3613         int timeout;
3614
3615         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3616                                        sizeof(wake_ind_le));
3617         if (err) {
3618                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3619                 return;
3620         }
3621
3622         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3623         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3624                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3625                        BRCMF_WOWL_PFN_FOUND)) {
3626                 wakeup = &wakeup_data;
3627                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3628                 wakeup_data.pattern_idx = -1;
3629
3630                 if (wakeind & BRCMF_WOWL_MAGIC) {
3631                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3632                         wakeup_data.magic_pkt = true;
3633                 }
3634                 if (wakeind & BRCMF_WOWL_DIS) {
3635                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3636                         wakeup_data.disconnect = true;
3637                 }
3638                 if (wakeind & BRCMF_WOWL_BCN) {
3639                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3640                         wakeup_data.disconnect = true;
3641                 }
3642                 if (wakeind & BRCMF_WOWL_RETR) {
3643                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3644                         wakeup_data.disconnect = true;
3645                 }
3646                 if (wakeind & BRCMF_WOWL_NET) {
3647                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3648                         /* For now always map to pattern 0, no API to get
3649                          * correct information available at the moment.
3650                          */
3651                         wakeup_data.pattern_idx = 0;
3652                 }
3653                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3654                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3655                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3656                                 cfg->wowl.nd_data_completed,
3657                                 BRCMF_ND_INFO_TIMEOUT);
3658                         if (!timeout)
3659                                 brcmf_err("No result for wowl net detect\n");
3660                         else
3661                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3662                 }
3663                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3664                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3665                         wakeup_data.gtk_rekey_failure = true;
3666                 }
3667         } else {
3668                 wakeup = NULL;
3669         }
3670         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3671 }
3672
3673 #else
3674
3675 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3676 {
3677 }
3678
3679 #endif /* CONFIG_PM */
3680
3681 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3682 {
3683         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3684         struct net_device *ndev = cfg_to_ndev(cfg);
3685         struct brcmf_if *ifp = netdev_priv(ndev);
3686
3687         brcmf_dbg(TRACE, "Enter\n");
3688
3689         if (cfg->wowl.active) {
3690                 brcmf_report_wowl_wakeind(wiphy, ifp);
3691                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3692                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3693                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3694                         brcmf_configure_arp_nd_offload(ifp, true);
3695                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3696                                       cfg->wowl.pre_pmmode);
3697                 cfg->wowl.active = false;
3698                 if (cfg->wowl.nd_enabled) {
3699                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3700                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3701                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3702                                             brcmf_notify_sched_scan_results);
3703                         cfg->wowl.nd_enabled = false;
3704                 }
3705         }
3706         return 0;
3707 }
3708
3709 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3710                                  struct brcmf_if *ifp,
3711                                  struct cfg80211_wowlan *wowl)
3712 {
3713         u32 wowl_config;
3714         struct brcmf_wowl_wakeind_le wowl_wakeind;
3715         u32 i;
3716
3717         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3718
3719         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3720                 brcmf_configure_arp_nd_offload(ifp, false);
3721         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3722         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3723
3724         wowl_config = 0;
3725         if (wowl->disconnect)
3726                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3727         if (wowl->magic_pkt)
3728                 wowl_config |= BRCMF_WOWL_MAGIC;
3729         if ((wowl->patterns) && (wowl->n_patterns)) {
3730                 wowl_config |= BRCMF_WOWL_NET;
3731                 for (i = 0; i < wowl->n_patterns; i++) {
3732                         brcmf_config_wowl_pattern(ifp, "add",
3733                                 (u8 *)wowl->patterns[i].pattern,
3734                                 wowl->patterns[i].pattern_len,
3735                                 (u8 *)wowl->patterns[i].mask,
3736                                 wowl->patterns[i].pkt_offset);
3737                 }
3738         }
3739         if (wowl->nd_config) {
3740                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3741                                                 wowl->nd_config);
3742                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3743
3744                 cfg->wowl.nd_data_completed = false;
3745                 cfg->wowl.nd_enabled = true;
3746                 /* Now reroute the event for PFN to the wowl function. */
3747                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3748                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3749                                     brcmf_wowl_nd_results);
3750         }
3751         if (wowl->gtk_rekey_failure)
3752                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3753         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3754                 wowl_config |= BRCMF_WOWL_UNASSOC;
3755
3756         memcpy(&wowl_wakeind, "clear", 6);
3757         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3758                                  sizeof(wowl_wakeind));
3759         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3760         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3761         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3762         cfg->wowl.active = true;
3763 }
3764
3765 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3766                                   struct cfg80211_wowlan *wowl)
3767 {
3768         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3769         struct net_device *ndev = cfg_to_ndev(cfg);
3770         struct brcmf_if *ifp = netdev_priv(ndev);
3771         struct brcmf_cfg80211_vif *vif;
3772
3773         brcmf_dbg(TRACE, "Enter\n");
3774
3775         /* if the primary net_device is not READY there is nothing
3776          * we can do but pray resume goes smoothly.
3777          */
3778         if (!check_vif_up(ifp->vif))
3779                 goto exit;
3780
3781         /* Stop scheduled scan */
3782         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3783                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3784
3785         /* end any scanning */
3786         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3787                 brcmf_abort_scanning(cfg);
3788
3789         if (wowl == NULL) {
3790                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3791                 list_for_each_entry(vif, &cfg->vif_list, list) {
3792                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3793                                 continue;
3794                         /* While going to suspend if associated with AP
3795                          * disassociate from AP to save power while system is
3796                          * in suspended state
3797                          */
3798                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3799                         /* Make sure WPA_Supplicant receives all the event
3800                          * generated due to DISASSOC call to the fw to keep
3801                          * the state fw and WPA_Supplicant state consistent
3802                          */
3803                         brcmf_delay(500);
3804                 }
3805                 /* Configure MPC */
3806                 brcmf_set_mpc(ifp, 1);
3807
3808         } else {
3809                 /* Configure WOWL paramaters */
3810                 brcmf_configure_wowl(cfg, ifp, wowl);
3811         }
3812
3813 exit:
3814         brcmf_dbg(TRACE, "Exit\n");
3815         /* clear any scanning activity */
3816         cfg->scan_status = 0;
3817         return 0;
3818 }
3819
3820 static __used s32
3821 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3822 {
3823         struct brcmf_pmk_list_le *pmk_list;
3824         int i;
3825         u32 npmk;
3826         s32 err;
3827
3828         pmk_list = &cfg->pmk_list;
3829         npmk = le32_to_cpu(pmk_list->npmk);
3830
3831         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3832         for (i = 0; i < npmk; i++)
3833                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3834
3835         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3836                                        sizeof(*pmk_list));
3837
3838         return err;
3839 }
3840
3841 static s32
3842 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3843                          struct cfg80211_pmksa *pmksa)
3844 {
3845         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3846         struct brcmf_if *ifp = netdev_priv(ndev);
3847         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3848         s32 err;
3849         u32 npmk, i;
3850
3851         brcmf_dbg(TRACE, "Enter\n");
3852         if (!check_vif_up(ifp->vif))
3853                 return -EIO;
3854
3855         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3856         for (i = 0; i < npmk; i++)
3857                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3858                         break;
3859         if (i < BRCMF_MAXPMKID) {
3860                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3861                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3862                 if (i == npmk) {
3863                         npmk++;
3864                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3865                 }
3866         } else {
3867                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3868                 return -EINVAL;
3869         }
3870
3871         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3872         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3873                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3874                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3875                           pmk[npmk].pmkid[i + 3]);
3876
3877         err = brcmf_update_pmklist(cfg, ifp);
3878
3879         brcmf_dbg(TRACE, "Exit\n");
3880         return err;
3881 }
3882
3883 static s32
3884 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3885                          struct cfg80211_pmksa *pmksa)
3886 {
3887         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3888         struct brcmf_if *ifp = netdev_priv(ndev);
3889         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3890         s32 err;
3891         u32 npmk, i;
3892
3893         brcmf_dbg(TRACE, "Enter\n");
3894         if (!check_vif_up(ifp->vif))
3895                 return -EIO;
3896
3897         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3898
3899         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3900         for (i = 0; i < npmk; i++)
3901                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3902                         break;
3903
3904         if ((npmk > 0) && (i < npmk)) {
3905                 for (; i < (npmk - 1); i++) {
3906                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3907                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3908                                WLAN_PMKID_LEN);
3909                 }
3910                 memset(&pmk[i], 0, sizeof(*pmk));
3911                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3912         } else {
3913                 brcmf_err("Cache entry not found\n");
3914                 return -EINVAL;
3915         }
3916
3917         err = brcmf_update_pmklist(cfg, ifp);
3918
3919         brcmf_dbg(TRACE, "Exit\n");
3920         return err;
3921
3922 }
3923
3924 static s32
3925 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3926 {
3927         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3928         struct brcmf_if *ifp = netdev_priv(ndev);
3929         s32 err;
3930
3931         brcmf_dbg(TRACE, "Enter\n");
3932         if (!check_vif_up(ifp->vif))
3933                 return -EIO;
3934
3935         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3936         err = brcmf_update_pmklist(cfg, ifp);
3937
3938         brcmf_dbg(TRACE, "Exit\n");
3939         return err;
3940
3941 }
3942
3943 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3944 {
3945         s32 err;
3946         s32 wpa_val;
3947
3948         /* set auth */
3949         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3950         if (err < 0) {
3951                 brcmf_err("auth error %d\n", err);
3952                 return err;
3953         }
3954         /* set wsec */
3955         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3956         if (err < 0) {
3957                 brcmf_err("wsec error %d\n", err);
3958                 return err;
3959         }
3960         /* set upper-layer auth */
3961         if (brcmf_is_ibssmode(ifp->vif))
3962                 wpa_val = WPA_AUTH_NONE;
3963         else
3964                 wpa_val = WPA_AUTH_DISABLED;
3965         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
3966         if (err < 0) {
3967                 brcmf_err("wpa_auth error %d\n", err);
3968                 return err;
3969         }
3970
3971         return 0;
3972 }
3973
3974 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3975 {
3976         if (is_rsn_ie)
3977                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3978
3979         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3980 }
3981
3982 static s32
3983 brcmf_configure_wpaie(struct brcmf_if *ifp,
3984                       const struct brcmf_vs_tlv *wpa_ie,
3985                       bool is_rsn_ie)
3986 {
3987         u32 auth = 0; /* d11 open authentication */
3988         u16 count;
3989         s32 err = 0;
3990         s32 len;
3991         u32 i;
3992         u32 wsec;
3993         u32 pval = 0;
3994         u32 gval = 0;
3995         u32 wpa_auth = 0;
3996         u32 offset;
3997         u8 *data;
3998         u16 rsn_cap;
3999         u32 wme_bss_disable;
4000         u32 mfp;
4001
4002         brcmf_dbg(TRACE, "Enter\n");
4003         if (wpa_ie == NULL)
4004                 goto exit;
4005
4006         len = wpa_ie->len + TLV_HDR_LEN;
4007         data = (u8 *)wpa_ie;
4008         offset = TLV_HDR_LEN;
4009         if (!is_rsn_ie)
4010                 offset += VS_IE_FIXED_HDR_LEN;
4011         else
4012                 offset += WPA_IE_VERSION_LEN;
4013
4014         /* check for multicast cipher suite */
4015         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4016                 err = -EINVAL;
4017                 brcmf_err("no multicast cipher suite\n");
4018                 goto exit;
4019         }
4020
4021         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4022                 err = -EINVAL;
4023                 brcmf_err("ivalid OUI\n");
4024                 goto exit;
4025         }
4026         offset += TLV_OUI_LEN;
4027
4028         /* pick up multicast cipher */
4029         switch (data[offset]) {
4030         case WPA_CIPHER_NONE:
4031                 gval = 0;
4032                 break;
4033         case WPA_CIPHER_WEP_40:
4034         case WPA_CIPHER_WEP_104:
4035                 gval = WEP_ENABLED;
4036                 break;
4037         case WPA_CIPHER_TKIP:
4038                 gval = TKIP_ENABLED;
4039                 break;
4040         case WPA_CIPHER_AES_CCM:
4041                 gval = AES_ENABLED;
4042                 break;
4043         default:
4044                 err = -EINVAL;
4045                 brcmf_err("Invalid multi cast cipher info\n");
4046                 goto exit;
4047         }
4048
4049         offset++;
4050         /* walk thru unicast cipher list and pick up what we recognize */
4051         count = data[offset] + (data[offset + 1] << 8);
4052         offset += WPA_IE_SUITE_COUNT_LEN;
4053         /* Check for unicast suite(s) */
4054         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4055                 err = -EINVAL;
4056                 brcmf_err("no unicast cipher suite\n");
4057                 goto exit;
4058         }
4059         for (i = 0; i < count; i++) {
4060                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4061                         err = -EINVAL;
4062                         brcmf_err("ivalid OUI\n");
4063                         goto exit;
4064                 }
4065                 offset += TLV_OUI_LEN;
4066                 switch (data[offset]) {
4067                 case WPA_CIPHER_NONE:
4068                         break;
4069                 case WPA_CIPHER_WEP_40:
4070                 case WPA_CIPHER_WEP_104:
4071                         pval |= WEP_ENABLED;
4072                         break;
4073                 case WPA_CIPHER_TKIP:
4074                         pval |= TKIP_ENABLED;
4075                         break;
4076                 case WPA_CIPHER_AES_CCM:
4077                         pval |= AES_ENABLED;
4078                         break;
4079                 default:
4080                         brcmf_err("Invalid unicast security info\n");
4081                 }
4082                 offset++;
4083         }
4084         /* walk thru auth management suite list and pick up what we recognize */
4085         count = data[offset] + (data[offset + 1] << 8);
4086         offset += WPA_IE_SUITE_COUNT_LEN;
4087         /* Check for auth key management suite(s) */
4088         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4089                 err = -EINVAL;
4090                 brcmf_err("no auth key mgmt suite\n");
4091                 goto exit;
4092         }
4093         for (i = 0; i < count; i++) {
4094                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4095                         err = -EINVAL;
4096                         brcmf_err("ivalid OUI\n");
4097                         goto exit;
4098                 }
4099                 offset += TLV_OUI_LEN;
4100                 switch (data[offset]) {
4101                 case RSN_AKM_NONE:
4102                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4103                         wpa_auth |= WPA_AUTH_NONE;
4104                         break;
4105                 case RSN_AKM_UNSPECIFIED:
4106                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4107                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4108                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4109                         break;
4110                 case RSN_AKM_PSK:
4111                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4112                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4113                                     (wpa_auth |= WPA_AUTH_PSK);
4114                         break;
4115                 case RSN_AKM_SHA256_PSK:
4116                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4117                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4118                         break;
4119                 case RSN_AKM_SHA256_1X:
4120                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4121                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4122                         break;
4123                 default:
4124                         brcmf_err("Invalid key mgmt info\n");
4125                 }
4126                 offset++;
4127         }
4128
4129         mfp = BRCMF_MFP_NONE;
4130         if (is_rsn_ie) {
4131                 wme_bss_disable = 1;
4132                 if ((offset + RSN_CAP_LEN) <= len) {
4133                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4134                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4135                                 wme_bss_disable = 0;
4136                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4137                                 brcmf_dbg(TRACE, "MFP Required\n");
4138                                 mfp = BRCMF_MFP_REQUIRED;
4139                                 /* Firmware only supports mfp required in
4140                                  * combination with WPA2_AUTH_PSK_SHA256 or
4141                                  * WPA2_AUTH_1X_SHA256.
4142                                  */
4143                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4144                                                   WPA2_AUTH_1X_SHA256))) {
4145                                         err = -EINVAL;
4146                                         goto exit;
4147                                 }
4148                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4149                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4150                                  * is to be included in the rsn ie.
4151                                  */
4152                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4153                                         wpa_auth |= WPA2_AUTH_PSK;
4154                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4155                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4156                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4157                                 brcmf_dbg(TRACE, "MFP Capable\n");
4158                                 mfp = BRCMF_MFP_CAPABLE;
4159                         }
4160                 }
4161                 offset += RSN_CAP_LEN;
4162                 /* set wme_bss_disable to sync RSN Capabilities */
4163                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4164                                                wme_bss_disable);
4165                 if (err < 0) {
4166                         brcmf_err("wme_bss_disable error %d\n", err);
4167                         goto exit;
4168                 }
4169
4170                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4171                 offset += RSN_PMKID_COUNT_LEN;
4172
4173                 /* See if there is BIP wpa suite left for MFP */
4174                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4175                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4176                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4177                                                         &data[offset],
4178                                                         WPA_IE_MIN_OUI_LEN);
4179                         if (err < 0) {
4180                                 brcmf_err("bip error %d\n", err);
4181                                 goto exit;
4182                         }
4183                 }
4184         }
4185         /* FOR WPS , set SES_OW_ENABLED */
4186         wsec = (pval | gval | SES_OW_ENABLED);
4187
4188         /* set auth */
4189         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4190         if (err < 0) {
4191                 brcmf_err("auth error %d\n", err);
4192                 goto exit;
4193         }
4194         /* set wsec */
4195         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4196         if (err < 0) {
4197                 brcmf_err("wsec error %d\n", err);
4198                 goto exit;
4199         }
4200         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4201          * will overwrite the values set by MFP
4202          */
4203         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4204                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4205                 if (err < 0) {
4206                         brcmf_err("mfp error %d\n", err);
4207                         goto exit;
4208                 }
4209         }
4210         /* set upper-layer auth */
4211         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4212         if (err < 0) {
4213                 brcmf_err("wpa_auth error %d\n", err);
4214                 goto exit;
4215         }
4216
4217 exit:
4218         return err;
4219 }
4220
4221 static s32
4222 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4223                      struct parsed_vndr_ies *vndr_ies)
4224 {
4225         struct brcmf_vs_tlv *vndrie;
4226         struct brcmf_tlv *ie;
4227         struct parsed_vndr_ie_info *parsed_info;
4228         s32 remaining_len;
4229
4230         remaining_len = (s32)vndr_ie_len;
4231         memset(vndr_ies, 0, sizeof(*vndr_ies));
4232
4233         ie = (struct brcmf_tlv *)vndr_ie_buf;
4234         while (ie) {
4235                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4236                         goto next;
4237                 vndrie = (struct brcmf_vs_tlv *)ie;
4238                 /* len should be bigger than OUI length + one */
4239                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4240                         brcmf_err("invalid vndr ie. length is too small %d\n",
4241                                   vndrie->len);
4242                         goto next;
4243                 }
4244                 /* if wpa or wme ie, do not add ie */
4245                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4246                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4247                     (vndrie->oui_type == WME_OUI_TYPE))) {
4248                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4249                         goto next;
4250                 }
4251
4252                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4253
4254                 /* save vndr ie information */
4255                 parsed_info->ie_ptr = (char *)vndrie;
4256                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4257                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4258
4259                 vndr_ies->count++;
4260
4261                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4262                           parsed_info->vndrie.oui[0],
4263                           parsed_info->vndrie.oui[1],
4264                           parsed_info->vndrie.oui[2],
4265                           parsed_info->vndrie.oui_type);
4266
4267                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4268                         break;
4269 next:
4270                 remaining_len -= (ie->len + TLV_HDR_LEN);
4271                 if (remaining_len <= TLV_HDR_LEN)
4272                         ie = NULL;
4273                 else
4274                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4275                                 TLV_HDR_LEN);
4276         }
4277         return 0;
4278 }
4279
4280 static u32
4281 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4282 {
4283
4284         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4285         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4286
4287         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4288
4289         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4290
4291         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4292
4293         return ie_len + VNDR_IE_HDR_SIZE;
4294 }
4295
4296 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4297                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4298 {
4299         struct brcmf_if *ifp;
4300         struct vif_saved_ie *saved_ie;
4301         s32 err = 0;
4302         u8  *iovar_ie_buf;
4303         u8  *curr_ie_buf;
4304         u8  *mgmt_ie_buf = NULL;
4305         int mgmt_ie_buf_len;
4306         u32 *mgmt_ie_len;
4307         u32 del_add_ie_buf_len = 0;
4308         u32 total_ie_buf_len = 0;
4309         u32 parsed_ie_buf_len = 0;
4310         struct parsed_vndr_ies old_vndr_ies;
4311         struct parsed_vndr_ies new_vndr_ies;
4312         struct parsed_vndr_ie_info *vndrie_info;
4313         s32 i;
4314         u8 *ptr;
4315         int remained_buf_len;
4316
4317         if (!vif)
4318                 return -ENODEV;
4319         ifp = vif->ifp;
4320         saved_ie = &vif->saved_ie;
4321
4322         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4323                   pktflag);
4324         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4325         if (!iovar_ie_buf)
4326                 return -ENOMEM;
4327         curr_ie_buf = iovar_ie_buf;
4328         switch (pktflag) {
4329         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4330                 mgmt_ie_buf = saved_ie->probe_req_ie;
4331                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4332                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4333                 break;
4334         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4335                 mgmt_ie_buf = saved_ie->probe_res_ie;
4336                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4337                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4338                 break;
4339         case BRCMF_VNDR_IE_BEACON_FLAG:
4340                 mgmt_ie_buf = saved_ie->beacon_ie;
4341                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4342                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4343                 break;
4344         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4345                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4346                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4347                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4348                 break;
4349         default:
4350                 err = -EPERM;
4351                 brcmf_err("not suitable type\n");
4352                 goto exit;
4353         }
4354
4355         if (vndr_ie_len > mgmt_ie_buf_len) {
4356                 err = -ENOMEM;
4357                 brcmf_err("extra IE size too big\n");
4358                 goto exit;
4359         }
4360
4361         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4362         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4363                 ptr = curr_ie_buf;
4364                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4365                 for (i = 0; i < new_vndr_ies.count; i++) {
4366                         vndrie_info = &new_vndr_ies.ie_info[i];
4367                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4368                                vndrie_info->ie_len);
4369                         parsed_ie_buf_len += vndrie_info->ie_len;
4370                 }
4371         }
4372
4373         if (mgmt_ie_buf && *mgmt_ie_len) {
4374                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4375                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4376                             parsed_ie_buf_len) == 0)) {
4377                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4378                         goto exit;
4379                 }
4380
4381                 /* parse old vndr_ie */
4382                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4383
4384                 /* make a command to delete old ie */
4385                 for (i = 0; i < old_vndr_ies.count; i++) {
4386                         vndrie_info = &old_vndr_ies.ie_info[i];
4387
4388                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4389                                   vndrie_info->vndrie.id,
4390                                   vndrie_info->vndrie.len,
4391                                   vndrie_info->vndrie.oui[0],
4392                                   vndrie_info->vndrie.oui[1],
4393                                   vndrie_info->vndrie.oui[2]);
4394
4395                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4396                                                            vndrie_info->ie_ptr,
4397                                                            vndrie_info->ie_len,
4398                                                            "del");
4399                         curr_ie_buf += del_add_ie_buf_len;
4400                         total_ie_buf_len += del_add_ie_buf_len;
4401                 }
4402         }
4403
4404         *mgmt_ie_len = 0;
4405         /* Add if there is any extra IE */
4406         if (mgmt_ie_buf && parsed_ie_buf_len) {
4407                 ptr = mgmt_ie_buf;
4408
4409                 remained_buf_len = mgmt_ie_buf_len;
4410
4411                 /* make a command to add new ie */
4412                 for (i = 0; i < new_vndr_ies.count; i++) {
4413                         vndrie_info = &new_vndr_ies.ie_info[i];
4414
4415                         /* verify remained buf size before copy data */
4416                         if (remained_buf_len < (vndrie_info->vndrie.len +
4417                                                         VNDR_IE_VSIE_OFFSET)) {
4418                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4419                                           remained_buf_len);
4420                                 break;
4421                         }
4422                         remained_buf_len -= (vndrie_info->ie_len +
4423                                              VNDR_IE_VSIE_OFFSET);
4424
4425                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4426                                   vndrie_info->vndrie.id,
4427                                   vndrie_info->vndrie.len,
4428                                   vndrie_info->vndrie.oui[0],
4429                                   vndrie_info->vndrie.oui[1],
4430                                   vndrie_info->vndrie.oui[2]);
4431
4432                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4433                                                            vndrie_info->ie_ptr,
4434                                                            vndrie_info->ie_len,
4435                                                            "add");
4436
4437                         /* save the parsed IE in wl struct */
4438                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4439                                vndrie_info->ie_len);
4440                         *mgmt_ie_len += vndrie_info->ie_len;
4441
4442                         curr_ie_buf += del_add_ie_buf_len;
4443                         total_ie_buf_len += del_add_ie_buf_len;
4444                 }
4445         }
4446         if (total_ie_buf_len) {
4447                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4448                                                  total_ie_buf_len);
4449                 if (err)
4450                         brcmf_err("vndr ie set error : %d\n", err);
4451         }
4452
4453 exit:
4454         kfree(iovar_ie_buf);
4455         return err;
4456 }
4457
4458 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4459 {
4460         s32 pktflags[] = {
4461                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4462                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4463                 BRCMF_VNDR_IE_BEACON_FLAG
4464         };
4465         int i;
4466
4467         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4468                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4469
4470         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4471         return 0;
4472 }
4473
4474 static s32
4475 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4476                         struct cfg80211_beacon_data *beacon)
4477 {
4478         s32 err;
4479
4480         /* Set Beacon IEs to FW */
4481         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4482                                     beacon->tail, beacon->tail_len);
4483         if (err) {
4484                 brcmf_err("Set Beacon IE Failed\n");
4485                 return err;
4486         }
4487         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4488
4489         /* Set Probe Response IEs to FW */
4490         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4491                                     beacon->proberesp_ies,
4492                                     beacon->proberesp_ies_len);
4493         if (err)
4494                 brcmf_err("Set Probe Resp IE Failed\n");
4495         else
4496                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4497
4498         return err;
4499 }
4500
4501 static s32
4502 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4503                         struct cfg80211_ap_settings *settings)
4504 {
4505         s32 ie_offset;
4506         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4507         struct brcmf_if *ifp = netdev_priv(ndev);
4508         const struct brcmf_tlv *ssid_ie;
4509         const struct brcmf_tlv *country_ie;
4510         struct brcmf_ssid_le ssid_le;
4511         s32 err = -EPERM;
4512         const struct brcmf_tlv *rsn_ie;
4513         const struct brcmf_vs_tlv *wpa_ie;
4514         struct brcmf_join_params join_params;
4515         enum nl80211_iftype dev_role;
4516         struct brcmf_fil_bss_enable_le bss_enable;
4517         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4518         bool mbss;
4519         int is_11d;
4520         bool supports_11d;
4521
4522         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4523                   settings->chandef.chan->hw_value,
4524                   settings->chandef.center_freq1, settings->chandef.width,
4525                   settings->beacon_interval, settings->dtim_period);
4526         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4527                   settings->ssid, settings->ssid_len, settings->auth_type,
4528                   settings->inactivity_timeout);
4529         dev_role = ifp->vif->wdev.iftype;
4530         mbss = ifp->vif->mbss;
4531
4532         /* store current 11d setting */
4533         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4534                                   &ifp->vif->is_11d)) {
4535                 is_11d = supports_11d = false;
4536         } else {
4537                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4538                                               settings->beacon.tail_len,
4539                                               WLAN_EID_COUNTRY);
4540                 is_11d = country_ie ? 1 : 0;
4541                 supports_11d = true;
4542         }
4543
4544         memset(&ssid_le, 0, sizeof(ssid_le));
4545         if (settings->ssid == NULL || settings->ssid_len == 0) {
4546                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4547                 ssid_ie = brcmf_parse_tlvs(
4548                                 (u8 *)&settings->beacon.head[ie_offset],
4549                                 settings->beacon.head_len - ie_offset,
4550                                 WLAN_EID_SSID);
4551                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4552                         return -EINVAL;
4553
4554                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4555                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4556                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4557         } else {
4558                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4559                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4560         }
4561
4562         if (!mbss) {
4563                 brcmf_set_mpc(ifp, 0);
4564                 brcmf_configure_arp_nd_offload(ifp, false);
4565         }
4566
4567         /* find the RSN_IE */
4568         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4569                                   settings->beacon.tail_len, WLAN_EID_RSN);
4570
4571         /* find the WPA_IE */
4572         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4573                                   settings->beacon.tail_len);
4574
4575         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4576                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4577                 if (wpa_ie != NULL) {
4578                         /* WPA IE */
4579                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4580                         if (err < 0)
4581                                 goto exit;
4582                 } else {
4583                         struct brcmf_vs_tlv *tmp_ie;
4584
4585                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4586
4587                         /* RSN IE */
4588                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4589                         if (err < 0)
4590                                 goto exit;
4591                 }
4592         } else {
4593                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4594                 brcmf_configure_opensecurity(ifp);
4595         }
4596
4597         /* Parameters shared by all radio interfaces */
4598         if (!mbss) {
4599                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4600                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4601                                                     is_11d);
4602                         if (err < 0) {
4603                                 brcmf_err("Regulatory Set Error, %d\n", err);
4604                                 goto exit;
4605                         }
4606                 }
4607                 if (settings->beacon_interval) {
4608                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4609                                                     settings->beacon_interval);
4610                         if (err < 0) {
4611                                 brcmf_err("Beacon Interval Set Error, %d\n",
4612                                           err);
4613                                 goto exit;
4614                         }
4615                 }
4616                 if (settings->dtim_period) {
4617                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4618                                                     settings->dtim_period);
4619                         if (err < 0) {
4620                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4621                                 goto exit;
4622                         }
4623                 }
4624
4625                 if ((dev_role == NL80211_IFTYPE_AP) &&
4626                     ((ifp->ifidx == 0) ||
4627                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4628                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4629                         if (err < 0) {
4630                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4631                                 goto exit;
4632                         }
4633                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4634                 }
4635
4636                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4637                 if (err < 0) {
4638                         brcmf_err("SET INFRA error %d\n", err);
4639                         goto exit;
4640                 }
4641         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4642                 /* Multiple-BSS should use same 11d configuration */
4643                 err = -EINVAL;
4644                 goto exit;
4645         }
4646
4647         /* Interface specific setup */
4648         if (dev_role == NL80211_IFTYPE_AP) {
4649                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4650                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4651
4652                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4653                 if (err < 0) {
4654                         brcmf_err("setting AP mode failed %d\n", err);
4655                         goto exit;
4656                 }
4657                 if (!mbss) {
4658                         /* Firmware 10.x requires setting channel after enabling
4659                          * AP and before bringing interface up.
4660                          */
4661                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4662                         if (err < 0) {
4663                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4664                                           chanspec, err);
4665                                 goto exit;
4666                         }
4667                 }
4668                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4669                 if (err < 0) {
4670                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4671                         goto exit;
4672                 }
4673                 /* On DOWN the firmware removes the WEP keys, reconfigure
4674                  * them if they were set.
4675                  */
4676                 brcmf_cfg80211_reconfigure_wep(ifp);
4677
4678                 memset(&join_params, 0, sizeof(join_params));
4679                 /* join parameters starts with ssid */
4680                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4681                 /* create softap */
4682                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4683                                              &join_params, sizeof(join_params));
4684                 if (err < 0) {
4685                         brcmf_err("SET SSID error (%d)\n", err);
4686                         goto exit;
4687                 }
4688
4689                 if (settings->hidden_ssid) {
4690                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4691                         if (err) {
4692                                 brcmf_err("closednet error (%d)\n", err);
4693                                 goto exit;
4694                         }
4695                 }
4696
4697                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4698         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4699                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4700                 if (err < 0) {
4701                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4702                                   chanspec, err);
4703                         goto exit;
4704                 }
4705                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4706                                                 sizeof(ssid_le));
4707                 if (err < 0) {
4708                         brcmf_err("setting ssid failed %d\n", err);
4709                         goto exit;
4710                 }
4711                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4712                 bss_enable.enable = cpu_to_le32(1);
4713                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4714                                                sizeof(bss_enable));
4715                 if (err < 0) {
4716                         brcmf_err("bss_enable config failed %d\n", err);
4717                         goto exit;
4718                 }
4719
4720                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4721         } else {
4722                 WARN_ON(1);
4723         }
4724
4725         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4726         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4727         brcmf_net_setcarrier(ifp, true);
4728
4729 exit:
4730         if ((err) && (!mbss)) {
4731                 brcmf_set_mpc(ifp, 1);
4732                 brcmf_configure_arp_nd_offload(ifp, true);
4733         }
4734         return err;
4735 }
4736
4737 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4738 {
4739         struct brcmf_if *ifp = netdev_priv(ndev);
4740         s32 err;
4741         struct brcmf_fil_bss_enable_le bss_enable;
4742         struct brcmf_join_params join_params;
4743
4744         brcmf_dbg(TRACE, "Enter\n");
4745
4746         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4747                 /* Due to most likely deauths outstanding we sleep */
4748                 /* first to make sure they get processed by fw. */
4749                 msleep(400);
4750
4751                 if (ifp->vif->mbss) {
4752                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4753                         return err;
4754                 }
4755
4756                 /* First BSS doesn't get a full reset */
4757                 if (ifp->bsscfgidx == 0)
4758                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4759
4760                 memset(&join_params, 0, sizeof(join_params));
4761                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4762                                              &join_params, sizeof(join_params));
4763                 if (err < 0)
4764                         brcmf_err("SET SSID error (%d)\n", err);
4765                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4766                 if (err < 0)
4767                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4768                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4769                 if (err < 0)
4770                         brcmf_err("setting AP mode failed %d\n", err);
4771                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4772                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4773                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4774                                       ifp->vif->is_11d);
4775                 /* Bring device back up so it can be used again */
4776                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4777                 if (err < 0)
4778                         brcmf_err("BRCMF_C_UP error %d\n", err);
4779
4780                 brcmf_vif_clear_mgmt_ies(ifp->vif);
4781         } else {
4782                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4783                 bss_enable.enable = cpu_to_le32(0);
4784                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4785                                                sizeof(bss_enable));
4786                 if (err < 0)
4787                         brcmf_err("bss_enable config failed %d\n", err);
4788         }
4789         brcmf_set_mpc(ifp, 1);
4790         brcmf_configure_arp_nd_offload(ifp, true);
4791         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4792         brcmf_net_setcarrier(ifp, false);
4793
4794         return err;
4795 }
4796
4797 static s32
4798 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4799                              struct cfg80211_beacon_data *info)
4800 {
4801         struct brcmf_if *ifp = netdev_priv(ndev);
4802         s32 err;
4803
4804         brcmf_dbg(TRACE, "Enter\n");
4805
4806         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4807
4808         return err;
4809 }
4810
4811 static int
4812 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4813                            struct station_del_parameters *params)
4814 {
4815         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4816         struct brcmf_scb_val_le scbval;
4817         struct brcmf_if *ifp = netdev_priv(ndev);
4818         s32 err;
4819
4820         if (!params->mac)
4821                 return -EFAULT;
4822
4823         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4824
4825         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4826                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4827         if (!check_vif_up(ifp->vif))
4828                 return -EIO;
4829
4830         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4831         scbval.val = cpu_to_le32(params->reason_code);
4832         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4833                                      &scbval, sizeof(scbval));
4834         if (err)
4835                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4836
4837         brcmf_dbg(TRACE, "Exit\n");
4838         return err;
4839 }
4840
4841 static int
4842 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4843                               const u8 *mac, struct station_parameters *params)
4844 {
4845         struct brcmf_if *ifp = netdev_priv(ndev);
4846         s32 err;
4847
4848         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4849                   params->sta_flags_mask, params->sta_flags_set);
4850
4851         /* Ignore all 00 MAC */
4852         if (is_zero_ether_addr(mac))
4853                 return 0;
4854
4855         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4856                 return 0;
4857
4858         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4859                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4860                                              (void *)mac, ETH_ALEN);
4861         else
4862                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4863                                              (void *)mac, ETH_ALEN);
4864         if (err < 0)
4865                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4866
4867         return err;
4868 }
4869
4870 static void
4871 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4872                                    struct wireless_dev *wdev,
4873                                    u16 frame_type, bool reg)
4874 {
4875         struct brcmf_cfg80211_vif *vif;
4876         u16 mgmt_type;
4877
4878         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4879
4880         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4881         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4882         if (reg)
4883                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4884         else
4885                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4886 }
4887
4888
4889 static int
4890 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4891                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4892 {
4893         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4894         struct ieee80211_channel *chan = params->chan;
4895         const u8 *buf = params->buf;
4896         size_t len = params->len;
4897         const struct ieee80211_mgmt *mgmt;
4898         struct brcmf_cfg80211_vif *vif;
4899         s32 err = 0;
4900         s32 ie_offset;
4901         s32 ie_len;
4902         struct brcmf_fil_action_frame_le *action_frame;
4903         struct brcmf_fil_af_params_le *af_params;
4904         bool ack;
4905         s32 chan_nr;
4906         u32 freq;
4907
4908         brcmf_dbg(TRACE, "Enter\n");
4909
4910         *cookie = 0;
4911
4912         mgmt = (const struct ieee80211_mgmt *)buf;
4913
4914         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4915                 brcmf_err("Driver only allows MGMT packet type\n");
4916                 return -EPERM;
4917         }
4918
4919         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4920
4921         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4922                 /* Right now the only reason to get a probe response */
4923                 /* is for p2p listen response or for p2p GO from     */
4924                 /* wpa_supplicant. Unfortunately the probe is send   */
4925                 /* on primary ndev, while dongle wants it on the p2p */
4926                 /* vif. Since this is only reason for a probe        */
4927                 /* response to be sent, the vif is taken from cfg.   */
4928                 /* If ever desired to send proberesp for non p2p     */
4929                 /* response then data should be checked for          */
4930                 /* "DIRECT-". Note in future supplicant will take    */
4931                 /* dedicated p2p wdev to do this and then this 'hack'*/
4932                 /* is not needed anymore.                            */
4933                 ie_offset =  DOT11_MGMT_HDR_LEN +
4934                              DOT11_BCN_PRB_FIXED_LEN;
4935                 ie_len = len - ie_offset;
4936                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4937                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4938                 err = brcmf_vif_set_mgmt_ie(vif,
4939                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4940                                             &buf[ie_offset],
4941                                             ie_len);
4942                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4943                                         GFP_KERNEL);
4944         } else if (ieee80211_is_action(mgmt->frame_control)) {
4945                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
4946                         brcmf_err("invalid action frame length\n");
4947                         err = -EINVAL;
4948                         goto exit;
4949                 }
4950                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4951                 if (af_params == NULL) {
4952                         brcmf_err("unable to allocate frame\n");
4953                         err = -ENOMEM;
4954                         goto exit;
4955                 }
4956                 action_frame = &af_params->action_frame;
4957                 /* Add the packet Id */
4958                 action_frame->packet_id = cpu_to_le32(*cookie);
4959                 /* Add BSSID */
4960                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4961                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4962                 /* Add the length exepted for 802.11 header  */
4963                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4964                 /* Add the channel. Use the one specified as parameter if any or
4965                  * the current one (got from the firmware) otherwise
4966                  */
4967                 if (chan)
4968                         freq = chan->center_freq;
4969                 else
4970                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4971                                               &freq);
4972                 chan_nr = ieee80211_frequency_to_channel(freq);
4973                 af_params->channel = cpu_to_le32(chan_nr);
4974
4975                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4976                        le16_to_cpu(action_frame->len));
4977
4978                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4979                           *cookie, le16_to_cpu(action_frame->len), freq);
4980
4981                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4982                                                   af_params);
4983
4984                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4985                                         GFP_KERNEL);
4986                 kfree(af_params);
4987         } else {
4988                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4989                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
4990         }
4991
4992 exit:
4993         return err;
4994 }
4995
4996
4997 static int
4998 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4999                                         struct wireless_dev *wdev,
5000                                         u64 cookie)
5001 {
5002         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5003         struct brcmf_cfg80211_vif *vif;
5004         int err = 0;
5005
5006         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5007
5008         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5009         if (vif == NULL) {
5010                 brcmf_err("No p2p device available for probe response\n");
5011                 err = -ENODEV;
5012                 goto exit;
5013         }
5014         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5015 exit:
5016         return err;
5017 }
5018
5019 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5020                                       struct wireless_dev *wdev,
5021                                       struct cfg80211_chan_def *chandef)
5022 {
5023         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5024         struct net_device *ndev = wdev->netdev;
5025         struct brcmf_if *ifp;
5026         struct brcmu_chan ch;
5027         enum nl80211_band band = 0;
5028         enum nl80211_chan_width width = 0;
5029         u32 chanspec;
5030         int freq, err;
5031
5032         if (!ndev)
5033                 return -ENODEV;
5034         ifp = netdev_priv(ndev);
5035
5036         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5037         if (err) {
5038                 brcmf_err("chanspec failed (%d)\n", err);
5039                 return err;
5040         }
5041
5042         ch.chspec = chanspec;
5043         cfg->d11inf.decchspec(&ch);
5044
5045         switch (ch.band) {
5046         case BRCMU_CHAN_BAND_2G:
5047                 band = NL80211_BAND_2GHZ;
5048                 break;
5049         case BRCMU_CHAN_BAND_5G:
5050                 band = NL80211_BAND_5GHZ;
5051                 break;
5052         }
5053
5054         switch (ch.bw) {
5055         case BRCMU_CHAN_BW_80:
5056                 width = NL80211_CHAN_WIDTH_80;
5057                 break;
5058         case BRCMU_CHAN_BW_40:
5059                 width = NL80211_CHAN_WIDTH_40;
5060                 break;
5061         case BRCMU_CHAN_BW_20:
5062                 width = NL80211_CHAN_WIDTH_20;
5063                 break;
5064         case BRCMU_CHAN_BW_80P80:
5065                 width = NL80211_CHAN_WIDTH_80P80;
5066                 break;
5067         case BRCMU_CHAN_BW_160:
5068                 width = NL80211_CHAN_WIDTH_160;
5069                 break;
5070         }
5071
5072         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5073         chandef->chan = ieee80211_get_channel(wiphy, freq);
5074         chandef->width = width;
5075         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5076         chandef->center_freq2 = 0;
5077
5078         return 0;
5079 }
5080
5081 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5082                                            struct wireless_dev *wdev,
5083                                            enum nl80211_crit_proto_id proto,
5084                                            u16 duration)
5085 {
5086         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5087         struct brcmf_cfg80211_vif *vif;
5088
5089         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5090
5091         /* only DHCP support for now */
5092         if (proto != NL80211_CRIT_PROTO_DHCP)
5093                 return -EINVAL;
5094
5095         /* suppress and abort scanning */
5096         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5097         brcmf_abort_scanning(cfg);
5098
5099         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5100 }
5101
5102 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5103                                            struct wireless_dev *wdev)
5104 {
5105         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5106         struct brcmf_cfg80211_vif *vif;
5107
5108         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5109
5110         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5111         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5112 }
5113
5114 static s32
5115 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5116                              const struct brcmf_event_msg *e, void *data)
5117 {
5118         switch (e->reason) {
5119         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5120                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5121                 break;
5122         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5123                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5124                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5125                 break;
5126         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5127                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5128                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5129                 break;
5130         }
5131
5132         return 0;
5133 }
5134
5135 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5136 {
5137         int ret;
5138
5139         switch (oper) {
5140         case NL80211_TDLS_DISCOVERY_REQ:
5141                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5142                 break;
5143         case NL80211_TDLS_SETUP:
5144                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5145                 break;
5146         case NL80211_TDLS_TEARDOWN:
5147                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5148                 break;
5149         default:
5150                 brcmf_err("unsupported operation: %d\n", oper);
5151                 ret = -EOPNOTSUPP;
5152         }
5153         return ret;
5154 }
5155
5156 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5157                                     struct net_device *ndev, const u8 *peer,
5158                                     enum nl80211_tdls_operation oper)
5159 {
5160         struct brcmf_if *ifp;
5161         struct brcmf_tdls_iovar_le info;
5162         int ret = 0;
5163
5164         ret = brcmf_convert_nl80211_tdls_oper(oper);
5165         if (ret < 0)
5166                 return ret;
5167
5168         ifp = netdev_priv(ndev);
5169         memset(&info, 0, sizeof(info));
5170         info.mode = (u8)ret;
5171         if (peer)
5172                 memcpy(info.ea, peer, ETH_ALEN);
5173
5174         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5175                                        &info, sizeof(info));
5176         if (ret < 0)
5177                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5178
5179         return ret;
5180 }
5181
5182 static int
5183 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5184                                   struct net_device *ndev,
5185                                   struct cfg80211_connect_params *sme,
5186                                   u32 changed)
5187 {
5188         struct brcmf_if *ifp;
5189         int err;
5190
5191         if (!(changed & UPDATE_ASSOC_IES))
5192                 return 0;
5193
5194         ifp = netdev_priv(ndev);
5195         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5196                                     sme->ie, sme->ie_len);
5197         if (err)
5198                 brcmf_err("Set Assoc REQ IE Failed\n");
5199         else
5200                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5201
5202         return err;
5203 }
5204
5205 #ifdef CONFIG_PM
5206 static int
5207 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5208                               struct cfg80211_gtk_rekey_data *gtk)
5209 {
5210         struct brcmf_if *ifp = netdev_priv(ndev);
5211         struct brcmf_gtk_keyinfo_le gtk_le;
5212         int ret;
5213
5214         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5215
5216         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5217         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5218         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5219                sizeof(gtk_le.replay_counter));
5220
5221         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5222                                        sizeof(gtk_le));
5223         if (ret < 0)
5224                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5225
5226         return ret;
5227 }
5228 #endif
5229
5230 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5231                                   const struct cfg80211_pmk_conf *conf)
5232 {
5233         struct brcmf_if *ifp;
5234
5235         brcmf_dbg(TRACE, "enter\n");
5236
5237         /* expect using firmware supplicant for 1X */
5238         ifp = netdev_priv(dev);
5239         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5240                 return -EINVAL;
5241
5242         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5243 }
5244
5245 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5246                                   const u8 *aa)
5247 {
5248         struct brcmf_if *ifp;
5249
5250         brcmf_dbg(TRACE, "enter\n");
5251         ifp = netdev_priv(dev);
5252         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5253                 return -EINVAL;
5254
5255         return brcmf_set_pmk(ifp, NULL, 0);
5256 }
5257
5258 static struct cfg80211_ops brcmf_cfg80211_ops = {
5259         .add_virtual_intf = brcmf_cfg80211_add_iface,
5260         .del_virtual_intf = brcmf_cfg80211_del_iface,
5261         .change_virtual_intf = brcmf_cfg80211_change_iface,
5262         .scan = brcmf_cfg80211_scan,
5263         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5264         .join_ibss = brcmf_cfg80211_join_ibss,
5265         .leave_ibss = brcmf_cfg80211_leave_ibss,
5266         .get_station = brcmf_cfg80211_get_station,
5267         .dump_station = brcmf_cfg80211_dump_station,
5268         .set_tx_power = brcmf_cfg80211_set_tx_power,
5269         .get_tx_power = brcmf_cfg80211_get_tx_power,
5270         .add_key = brcmf_cfg80211_add_key,
5271         .del_key = brcmf_cfg80211_del_key,
5272         .get_key = brcmf_cfg80211_get_key,
5273         .set_default_key = brcmf_cfg80211_config_default_key,
5274         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5275         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5276         .connect = brcmf_cfg80211_connect,
5277         .disconnect = brcmf_cfg80211_disconnect,
5278         .suspend = brcmf_cfg80211_suspend,
5279         .resume = brcmf_cfg80211_resume,
5280         .set_pmksa = brcmf_cfg80211_set_pmksa,
5281         .del_pmksa = brcmf_cfg80211_del_pmksa,
5282         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5283         .start_ap = brcmf_cfg80211_start_ap,
5284         .stop_ap = brcmf_cfg80211_stop_ap,
5285         .change_beacon = brcmf_cfg80211_change_beacon,
5286         .del_station = brcmf_cfg80211_del_station,
5287         .change_station = brcmf_cfg80211_change_station,
5288         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5289         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5290         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5291         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5292         .remain_on_channel = brcmf_p2p_remain_on_channel,
5293         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5294         .get_channel = brcmf_cfg80211_get_channel,
5295         .start_p2p_device = brcmf_p2p_start_device,
5296         .stop_p2p_device = brcmf_p2p_stop_device,
5297         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5298         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5299         .tdls_oper = brcmf_cfg80211_tdls_oper,
5300         .update_connect_params = brcmf_cfg80211_update_conn_params,
5301         .set_pmk = brcmf_cfg80211_set_pmk,
5302         .del_pmk = brcmf_cfg80211_del_pmk,
5303 };
5304
5305 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5306                                            enum nl80211_iftype type)
5307 {
5308         struct brcmf_cfg80211_vif *vif_walk;
5309         struct brcmf_cfg80211_vif *vif;
5310         bool mbss;
5311
5312         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5313                   sizeof(*vif));
5314         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5315         if (!vif)
5316                 return ERR_PTR(-ENOMEM);
5317
5318         vif->wdev.wiphy = cfg->wiphy;
5319         vif->wdev.iftype = type;
5320
5321         brcmf_init_prof(&vif->profile);
5322
5323         if (type == NL80211_IFTYPE_AP) {
5324                 mbss = false;
5325                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5326                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5327                                 mbss = true;
5328                                 break;
5329                         }
5330                 }
5331                 vif->mbss = mbss;
5332         }
5333
5334         list_add_tail(&vif->list, &cfg->vif_list);
5335         return vif;
5336 }
5337
5338 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5339 {
5340         list_del(&vif->list);
5341         kfree(vif);
5342 }
5343
5344 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5345 {
5346         struct brcmf_cfg80211_vif *vif;
5347         struct brcmf_if *ifp;
5348
5349         ifp = netdev_priv(ndev);
5350         vif = ifp->vif;
5351
5352         if (vif)
5353                 brcmf_free_vif(vif);
5354 }
5355
5356 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5357                             const struct brcmf_event_msg *e)
5358 {
5359         u32 event = e->event_code;
5360         u32 status = e->status;
5361
5362         if (vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK &&
5363             event == BRCMF_E_PSK_SUP &&
5364             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5365                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5366         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5367                 brcmf_dbg(CONN, "Processing set ssid\n");
5368                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5369                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK)
5370                         return true;
5371
5372                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5373         }
5374
5375         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5376             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5377                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5378                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5379                 return true;
5380         }
5381         return false;
5382 }
5383
5384 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
5385                             const struct brcmf_event_msg *e)
5386 {
5387         u32 event = e->event_code;
5388         u16 flags = e->flags;
5389
5390         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5391             (event == BRCMF_E_DISASSOC_IND) ||
5392             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5393                 brcmf_dbg(CONN, "Processing link down\n");
5394                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5395                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5396                 return true;
5397         }
5398         return false;
5399 }
5400
5401 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5402                                const struct brcmf_event_msg *e)
5403 {
5404         u32 event = e->event_code;
5405         u32 status = e->status;
5406
5407         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5408                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5409                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5410                 return true;
5411         }
5412
5413         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5414                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5415                 return true;
5416         }
5417
5418         if (event == BRCMF_E_PSK_SUP &&
5419             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5420                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5421                           status);
5422                 return true;
5423         }
5424
5425         return false;
5426 }
5427
5428 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5429 {
5430         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5431
5432         kfree(conn_info->req_ie);
5433         conn_info->req_ie = NULL;
5434         conn_info->req_ie_len = 0;
5435         kfree(conn_info->resp_ie);
5436         conn_info->resp_ie = NULL;
5437         conn_info->resp_ie_len = 0;
5438 }
5439
5440 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5441                                struct brcmf_if *ifp)
5442 {
5443         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5444         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5445         u32 req_len;
5446         u32 resp_len;
5447         s32 err = 0;
5448
5449         brcmf_clear_assoc_ies(cfg);
5450
5451         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5452                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5453         if (err) {
5454                 brcmf_err("could not get assoc info (%d)\n", err);
5455                 return err;
5456         }
5457         assoc_info =
5458                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5459         req_len = le32_to_cpu(assoc_info->req_len);
5460         resp_len = le32_to_cpu(assoc_info->resp_len);
5461         if (req_len) {
5462                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5463                                                cfg->extra_buf,
5464                                                WL_ASSOC_INFO_MAX);
5465                 if (err) {
5466                         brcmf_err("could not get assoc req (%d)\n", err);
5467                         return err;
5468                 }
5469                 conn_info->req_ie_len = req_len;
5470                 conn_info->req_ie =
5471                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5472                             GFP_KERNEL);
5473                 if (!conn_info->req_ie)
5474                         conn_info->req_ie_len = 0;
5475         } else {
5476                 conn_info->req_ie_len = 0;
5477                 conn_info->req_ie = NULL;
5478         }
5479         if (resp_len) {
5480                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5481                                                cfg->extra_buf,
5482                                                WL_ASSOC_INFO_MAX);
5483                 if (err) {
5484                         brcmf_err("could not get assoc resp (%d)\n", err);
5485                         return err;
5486                 }
5487                 conn_info->resp_ie_len = resp_len;
5488                 conn_info->resp_ie =
5489                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5490                             GFP_KERNEL);
5491                 if (!conn_info->resp_ie)
5492                         conn_info->resp_ie_len = 0;
5493         } else {
5494                 conn_info->resp_ie_len = 0;
5495                 conn_info->resp_ie = NULL;
5496         }
5497         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5498                   conn_info->req_ie_len, conn_info->resp_ie_len);
5499
5500         return err;
5501 }
5502
5503 static s32
5504 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5505                        struct net_device *ndev,
5506                        const struct brcmf_event_msg *e)
5507 {
5508         struct brcmf_if *ifp = netdev_priv(ndev);
5509         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5510         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5511         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5512         struct ieee80211_channel *notify_channel = NULL;
5513         struct ieee80211_supported_band *band;
5514         struct brcmf_bss_info_le *bi;
5515         struct brcmu_chan ch;
5516         struct cfg80211_roam_info roam_info = {};
5517         u32 freq;
5518         s32 err = 0;
5519         u8 *buf;
5520
5521         brcmf_dbg(TRACE, "Enter\n");
5522
5523         brcmf_get_assoc_ies(cfg, ifp);
5524         memcpy(profile->bssid, e->addr, ETH_ALEN);
5525         brcmf_update_bss_info(cfg, ifp);
5526
5527         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5528         if (buf == NULL) {
5529                 err = -ENOMEM;
5530                 goto done;
5531         }
5532
5533         /* data sent to dongle has to be little endian */
5534         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5535         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5536                                      buf, WL_BSS_INFO_MAX);
5537
5538         if (err)
5539                 goto done;
5540
5541         bi = (struct brcmf_bss_info_le *)(buf + 4);
5542         ch.chspec = le16_to_cpu(bi->chanspec);
5543         cfg->d11inf.decchspec(&ch);
5544
5545         if (ch.band == BRCMU_CHAN_BAND_2G)
5546                 band = wiphy->bands[NL80211_BAND_2GHZ];
5547         else
5548                 band = wiphy->bands[NL80211_BAND_5GHZ];
5549
5550         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5551         notify_channel = ieee80211_get_channel(wiphy, freq);
5552
5553 done:
5554         kfree(buf);
5555
5556         roam_info.channel = notify_channel;
5557         roam_info.bssid = profile->bssid;
5558         roam_info.req_ie = conn_info->req_ie;
5559         roam_info.req_ie_len = conn_info->req_ie_len;
5560         roam_info.resp_ie = conn_info->resp_ie;
5561         roam_info.resp_ie_len = conn_info->resp_ie_len;
5562
5563         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
5564         brcmf_dbg(CONN, "Report roaming result\n");
5565
5566         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5567         brcmf_dbg(TRACE, "Exit\n");
5568         return err;
5569 }
5570
5571 static s32
5572 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5573                        struct net_device *ndev, const struct brcmf_event_msg *e,
5574                        bool completed)
5575 {
5576         struct brcmf_if *ifp = netdev_priv(ndev);
5577         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5578         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5579         struct cfg80211_connect_resp_params conn_params;
5580
5581         brcmf_dbg(TRACE, "Enter\n");
5582
5583         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5584                                &ifp->vif->sme_state)) {
5585                 memset(&conn_params, 0, sizeof(conn_params));
5586                 if (completed) {
5587                         brcmf_get_assoc_ies(cfg, ifp);
5588                         brcmf_update_bss_info(cfg, ifp);
5589                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5590                                 &ifp->vif->sme_state);
5591                         conn_params.status = WLAN_STATUS_SUCCESS;
5592                 } else {
5593                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
5594                 }
5595                 conn_params.bssid = profile->bssid;
5596                 conn_params.req_ie = conn_info->req_ie;
5597                 conn_params.req_ie_len = conn_info->req_ie_len;
5598                 conn_params.resp_ie = conn_info->resp_ie;
5599                 conn_params.resp_ie_len = conn_info->resp_ie_len;
5600                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
5601                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5602                           completed ? "succeeded" : "failed");
5603         }
5604         brcmf_dbg(TRACE, "Exit\n");
5605         return 0;
5606 }
5607
5608 static s32
5609 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5610                                struct net_device *ndev,
5611                                const struct brcmf_event_msg *e, void *data)
5612 {
5613         static int generation;
5614         u32 event = e->event_code;
5615         u32 reason = e->reason;
5616         struct station_info sinfo;
5617
5618         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
5619                   brcmf_fweh_event_name(event), event, reason);
5620         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5621             ndev != cfg_to_ndev(cfg)) {
5622                 brcmf_dbg(CONN, "AP mode link down\n");
5623                 complete(&cfg->vif_disabled);
5624                 return 0;
5625         }
5626
5627         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5628             (reason == BRCMF_E_STATUS_SUCCESS)) {
5629                 memset(&sinfo, 0, sizeof(sinfo));
5630                 if (!data) {
5631                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5632                         return -EINVAL;
5633                 }
5634                 sinfo.assoc_req_ies = data;
5635                 sinfo.assoc_req_ies_len = e->datalen;
5636                 generation++;
5637                 sinfo.generation = generation;
5638                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5639         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5640                    (event == BRCMF_E_DEAUTH_IND) ||
5641                    (event == BRCMF_E_DEAUTH)) {
5642                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5643         }
5644         return 0;
5645 }
5646
5647 static s32
5648 brcmf_notify_connect_status(struct brcmf_if *ifp,
5649                             const struct brcmf_event_msg *e, void *data)
5650 {
5651         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5652         struct net_device *ndev = ifp->ndev;
5653         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5654         struct ieee80211_channel *chan;
5655         s32 err = 0;
5656
5657         if ((e->event_code == BRCMF_E_DEAUTH) ||
5658             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5659             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5660             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5661                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5662         }
5663
5664         if (brcmf_is_apmode(ifp->vif)) {
5665                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5666         } else if (brcmf_is_linkup(ifp->vif, e)) {
5667                 brcmf_dbg(CONN, "Linkup\n");
5668                 if (brcmf_is_ibssmode(ifp->vif)) {
5669                         brcmf_inform_ibss(cfg, ndev, e->addr);
5670                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5671                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5672                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5673                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5674                                   &ifp->vif->sme_state);
5675                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5676                                 &ifp->vif->sme_state);
5677                 } else
5678                         brcmf_bss_connect_done(cfg, ndev, e, true);
5679                 brcmf_net_setcarrier(ifp, true);
5680         } else if (brcmf_is_linkdown(ifp->vif, e)) {
5681                 brcmf_dbg(CONN, "Linkdown\n");
5682                 if (!brcmf_is_ibssmode(ifp->vif)) {
5683                         brcmf_bss_connect_done(cfg, ndev, e, false);
5684                         brcmf_link_down(ifp->vif,
5685                                         brcmf_map_fw_linkdown_reason(e));
5686                         brcmf_init_prof(ndev_to_prof(ndev));
5687                         if (ndev != cfg_to_ndev(cfg))
5688                                 complete(&cfg->vif_disabled);
5689                         brcmf_net_setcarrier(ifp, false);
5690                 }
5691         } else if (brcmf_is_nonetwork(cfg, e)) {
5692                 if (brcmf_is_ibssmode(ifp->vif))
5693                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5694                                   &ifp->vif->sme_state);
5695                 else
5696                         brcmf_bss_connect_done(cfg, ndev, e, false);
5697         }
5698
5699         return err;
5700 }
5701
5702 static s32
5703 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5704                             const struct brcmf_event_msg *e, void *data)
5705 {
5706         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5707         u32 event = e->event_code;
5708         u32 status = e->status;
5709
5710         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5711                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
5712                              &ifp->vif->sme_state)) {
5713                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5714                 } else {
5715                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5716                         brcmf_net_setcarrier(ifp, true);
5717                 }
5718         }
5719
5720         return 0;
5721 }
5722
5723 static s32
5724 brcmf_notify_mic_status(struct brcmf_if *ifp,
5725                         const struct brcmf_event_msg *e, void *data)
5726 {
5727         u16 flags = e->flags;
5728         enum nl80211_key_type key_type;
5729
5730         if (flags & BRCMF_EVENT_MSG_GROUP)
5731                 key_type = NL80211_KEYTYPE_GROUP;
5732         else
5733                 key_type = NL80211_KEYTYPE_PAIRWISE;
5734
5735         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5736                                      NULL, GFP_KERNEL);
5737
5738         return 0;
5739 }
5740
5741 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5742                                   const struct brcmf_event_msg *e, void *data)
5743 {
5744         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5745         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5746         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5747         struct brcmf_cfg80211_vif *vif;
5748
5749         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5750                   ifevent->action, ifevent->flags, ifevent->ifidx,
5751                   ifevent->bsscfgidx);
5752
5753         spin_lock(&event->vif_event_lock);
5754         event->action = ifevent->action;
5755         vif = event->vif;
5756
5757         switch (ifevent->action) {
5758         case BRCMF_E_IF_ADD:
5759                 /* waiting process may have timed out */
5760                 if (!cfg->vif_event.vif) {
5761                         spin_unlock(&event->vif_event_lock);
5762                         return -EBADF;
5763                 }
5764
5765                 ifp->vif = vif;
5766                 vif->ifp = ifp;
5767                 if (ifp->ndev) {
5768                         vif->wdev.netdev = ifp->ndev;
5769                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5770                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5771                 }
5772                 spin_unlock(&event->vif_event_lock);
5773                 wake_up(&event->vif_wq);
5774                 return 0;
5775
5776         case BRCMF_E_IF_DEL:
5777                 spin_unlock(&event->vif_event_lock);
5778                 /* event may not be upon user request */
5779                 if (brcmf_cfg80211_vif_event_armed(cfg))
5780                         wake_up(&event->vif_wq);
5781                 return 0;
5782
5783         case BRCMF_E_IF_CHANGE:
5784                 spin_unlock(&event->vif_event_lock);
5785                 wake_up(&event->vif_wq);
5786                 return 0;
5787
5788         default:
5789                 spin_unlock(&event->vif_event_lock);
5790                 break;
5791         }
5792         return -EINVAL;
5793 }
5794
5795 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5796 {
5797         conf->frag_threshold = (u32)-1;
5798         conf->rts_threshold = (u32)-1;
5799         conf->retry_short = (u32)-1;
5800         conf->retry_long = (u32)-1;
5801 }
5802
5803 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5804 {
5805         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5806                             brcmf_notify_connect_status);
5807         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5808                             brcmf_notify_connect_status);
5809         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5810                             brcmf_notify_connect_status);
5811         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5812                             brcmf_notify_connect_status);
5813         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5814                             brcmf_notify_connect_status);
5815         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5816                             brcmf_notify_connect_status);
5817         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5818                             brcmf_notify_roaming_status);
5819         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5820                             brcmf_notify_mic_status);
5821         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5822                             brcmf_notify_connect_status);
5823         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5824                             brcmf_notify_sched_scan_results);
5825         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5826                             brcmf_notify_vif_event);
5827         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5828                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5829         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5830                             brcmf_p2p_notify_listen_complete);
5831         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5832                             brcmf_p2p_notify_action_frame_rx);
5833         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5834                             brcmf_p2p_notify_action_tx_complete);
5835         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5836                             brcmf_p2p_notify_action_tx_complete);
5837         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
5838                             brcmf_notify_connect_status);
5839 }
5840
5841 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5842 {
5843         kfree(cfg->conf);
5844         cfg->conf = NULL;
5845         kfree(cfg->extra_buf);
5846         cfg->extra_buf = NULL;
5847         kfree(cfg->wowl.nd);
5848         cfg->wowl.nd = NULL;
5849         kfree(cfg->wowl.nd_info);
5850         cfg->wowl.nd_info = NULL;
5851         kfree(cfg->escan_info.escan_buf);
5852         cfg->escan_info.escan_buf = NULL;
5853 }
5854
5855 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5856 {
5857         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5858         if (!cfg->conf)
5859                 goto init_priv_mem_out;
5860         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5861         if (!cfg->extra_buf)
5862                 goto init_priv_mem_out;
5863         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5864         if (!cfg->wowl.nd)
5865                 goto init_priv_mem_out;
5866         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5867                                     sizeof(struct cfg80211_wowlan_nd_match *),
5868                                     GFP_KERNEL);
5869         if (!cfg->wowl.nd_info)
5870                 goto init_priv_mem_out;
5871         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5872         if (!cfg->escan_info.escan_buf)
5873                 goto init_priv_mem_out;
5874
5875         return 0;
5876
5877 init_priv_mem_out:
5878         brcmf_deinit_priv_mem(cfg);
5879
5880         return -ENOMEM;
5881 }
5882
5883 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5884 {
5885         s32 err = 0;
5886
5887         cfg->scan_request = NULL;
5888         cfg->pwr_save = true;
5889         cfg->active_scan = true;        /* we do active scan per default */
5890         cfg->dongle_up = false;         /* dongle is not up yet */
5891         err = brcmf_init_priv_mem(cfg);
5892         if (err)
5893                 return err;
5894         brcmf_register_event_handlers(cfg);
5895         mutex_init(&cfg->usr_sync);
5896         brcmf_init_escan(cfg);
5897         brcmf_init_conf(cfg->conf);
5898         init_completion(&cfg->vif_disabled);
5899         return err;
5900 }
5901
5902 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5903 {
5904         cfg->dongle_up = false; /* dongle down */
5905         brcmf_abort_scanning(cfg);
5906         brcmf_deinit_priv_mem(cfg);
5907 }
5908
5909 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5910 {
5911         init_waitqueue_head(&event->vif_wq);
5912         spin_lock_init(&event->vif_event_lock);
5913 }
5914
5915 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5916 {
5917         s32 err;
5918         u32 bcn_timeout;
5919         __le32 roamtrigger[2];
5920         __le32 roam_delta[2];
5921
5922         /* Configure beacon timeout value based upon roaming setting */
5923         if (ifp->drvr->settings->roamoff)
5924                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5925         else
5926                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5927         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5928         if (err) {
5929                 brcmf_err("bcn_timeout error (%d)\n", err);
5930                 goto roam_setup_done;
5931         }
5932
5933         /* Enable/Disable built-in roaming to allow supplicant to take care of
5934          * roaming.
5935          */
5936         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5937                   ifp->drvr->settings->roamoff ? "Off" : "On");
5938         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5939                                       ifp->drvr->settings->roamoff);
5940         if (err) {
5941                 brcmf_err("roam_off error (%d)\n", err);
5942                 goto roam_setup_done;
5943         }
5944
5945         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5946         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5947         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5948                                      (void *)roamtrigger, sizeof(roamtrigger));
5949         if (err) {
5950                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5951                 goto roam_setup_done;
5952         }
5953
5954         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5955         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5956         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5957                                      (void *)roam_delta, sizeof(roam_delta));
5958         if (err) {
5959                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5960                 goto roam_setup_done;
5961         }
5962
5963 roam_setup_done:
5964         return err;
5965 }
5966
5967 static s32
5968 brcmf_dongle_scantime(struct brcmf_if *ifp)
5969 {
5970         s32 err = 0;
5971
5972         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5973                                     BRCMF_SCAN_CHANNEL_TIME);
5974         if (err) {
5975                 brcmf_err("Scan assoc time error (%d)\n", err);
5976                 goto dongle_scantime_out;
5977         }
5978         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5979                                     BRCMF_SCAN_UNASSOC_TIME);
5980         if (err) {
5981                 brcmf_err("Scan unassoc time error (%d)\n", err);
5982                 goto dongle_scantime_out;
5983         }
5984
5985         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5986                                     BRCMF_SCAN_PASSIVE_TIME);
5987         if (err) {
5988                 brcmf_err("Scan passive time error (%d)\n", err);
5989                 goto dongle_scantime_out;
5990         }
5991
5992 dongle_scantime_out:
5993         return err;
5994 }
5995
5996 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5997                                            struct brcmu_chan *ch)
5998 {
5999         u32 ht40_flag;
6000
6001         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6002         if (ch->sb == BRCMU_CHAN_SB_U) {
6003                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6004                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6005                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6006         } else {
6007                 /* It should be one of
6008                  * IEEE80211_CHAN_NO_HT40 or
6009                  * IEEE80211_CHAN_NO_HT40PLUS
6010                  */
6011                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6012                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6013                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6014         }
6015 }
6016
6017 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6018                                     u32 bw_cap[])
6019 {
6020         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6021         struct ieee80211_supported_band *band;
6022         struct ieee80211_channel *channel;
6023         struct wiphy *wiphy;
6024         struct brcmf_chanspec_list *list;
6025         struct brcmu_chan ch;
6026         int err;
6027         u8 *pbuf;
6028         u32 i, j;
6029         u32 total;
6030         u32 chaninfo;
6031
6032         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6033
6034         if (pbuf == NULL)
6035                 return -ENOMEM;
6036
6037         list = (struct brcmf_chanspec_list *)pbuf;
6038
6039         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6040                                        BRCMF_DCMD_MEDLEN);
6041         if (err) {
6042                 brcmf_err("get chanspecs error (%d)\n", err);
6043                 goto fail_pbuf;
6044         }
6045
6046         wiphy = cfg_to_wiphy(cfg);
6047         band = wiphy->bands[NL80211_BAND_2GHZ];
6048         if (band)
6049                 for (i = 0; i < band->n_channels; i++)
6050                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6051         band = wiphy->bands[NL80211_BAND_5GHZ];
6052         if (band)
6053                 for (i = 0; i < band->n_channels; i++)
6054                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6055
6056         total = le32_to_cpu(list->count);
6057         for (i = 0; i < total; i++) {
6058                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6059                 cfg->d11inf.decchspec(&ch);
6060
6061                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6062                         band = wiphy->bands[NL80211_BAND_2GHZ];
6063                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6064                         band = wiphy->bands[NL80211_BAND_5GHZ];
6065                 } else {
6066                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
6067                         continue;
6068                 }
6069                 if (!band)
6070                         continue;
6071                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6072                     ch.bw == BRCMU_CHAN_BW_40)
6073                         continue;
6074                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6075                     ch.bw == BRCMU_CHAN_BW_80)
6076                         continue;
6077
6078                 channel = NULL;
6079                 for (j = 0; j < band->n_channels; j++) {
6080                         if (band->channels[j].hw_value == ch.control_ch_num) {
6081                                 channel = &band->channels[j];
6082                                 break;
6083                         }
6084                 }
6085                 if (!channel) {
6086                         /* It seems firmware supports some channel we never
6087                          * considered. Something new in IEEE standard?
6088                          */
6089                         brcmf_err("Ignoring unexpected firmware channel %d\n",
6090                                   ch.control_ch_num);
6091                         continue;
6092                 }
6093
6094                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
6095                         continue;
6096
6097                 /* assuming the chanspecs order is HT20,
6098                  * HT40 upper, HT40 lower, and VHT80.
6099                  */
6100                 if (ch.bw == BRCMU_CHAN_BW_80) {
6101                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6102                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
6103                         brcmf_update_bw40_channel_flag(channel, &ch);
6104                 } else {
6105                         /* enable the channel and disable other bandwidths
6106                          * for now as mentioned order assure they are enabled
6107                          * for subsequent chanspecs.
6108                          */
6109                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6110                                          IEEE80211_CHAN_NO_80MHZ |
6111                                          IEEE80211_CHAN_NO_160MHZ;
6112                         ch.bw = BRCMU_CHAN_BW_20;
6113                         cfg->d11inf.encchspec(&ch);
6114                         chaninfo = ch.chspec;
6115                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6116                                                        &chaninfo);
6117                         if (!err) {
6118                                 if (chaninfo & WL_CHAN_RADAR)
6119                                         channel->flags |=
6120                                                 (IEEE80211_CHAN_RADAR |
6121                                                  IEEE80211_CHAN_NO_IR);
6122                                 if (chaninfo & WL_CHAN_PASSIVE)
6123                                         channel->flags |=
6124                                                 IEEE80211_CHAN_NO_IR;
6125                         }
6126                 }
6127         }
6128
6129 fail_pbuf:
6130         kfree(pbuf);
6131         return err;
6132 }
6133
6134 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6135 {
6136         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6137         struct ieee80211_supported_band *band;
6138         struct brcmf_fil_bwcap_le band_bwcap;
6139         struct brcmf_chanspec_list *list;
6140         u8 *pbuf;
6141         u32 val;
6142         int err;
6143         struct brcmu_chan ch;
6144         u32 num_chan;
6145         int i, j;
6146
6147         /* verify support for bw_cap command */
6148         val = WLC_BAND_5G;
6149         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6150
6151         if (!err) {
6152                 /* only set 2G bandwidth using bw_cap command */
6153                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6154                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6155                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6156                                                sizeof(band_bwcap));
6157         } else {
6158                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6159                 val = WLC_N_BW_40ALL;
6160                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6161         }
6162
6163         if (!err) {
6164                 /* update channel info in 2G band */
6165                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6166
6167                 if (pbuf == NULL)
6168                         return -ENOMEM;
6169
6170                 ch.band = BRCMU_CHAN_BAND_2G;
6171                 ch.bw = BRCMU_CHAN_BW_40;
6172                 ch.sb = BRCMU_CHAN_SB_NONE;
6173                 ch.chnum = 0;
6174                 cfg->d11inf.encchspec(&ch);
6175
6176                 /* pass encoded chanspec in query */
6177                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6178
6179                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6180                                                BRCMF_DCMD_MEDLEN);
6181                 if (err) {
6182                         brcmf_err("get chanspecs error (%d)\n", err);
6183                         kfree(pbuf);
6184                         return err;
6185                 }
6186
6187                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6188                 list = (struct brcmf_chanspec_list *)pbuf;
6189                 num_chan = le32_to_cpu(list->count);
6190                 for (i = 0; i < num_chan; i++) {
6191                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6192                         cfg->d11inf.decchspec(&ch);
6193                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6194                                 continue;
6195                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6196                                 continue;
6197                         for (j = 0; j < band->n_channels; j++) {
6198                                 if (band->channels[j].hw_value == ch.control_ch_num)
6199                                         break;
6200                         }
6201                         if (WARN_ON(j == band->n_channels))
6202                                 continue;
6203
6204                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6205                 }
6206                 kfree(pbuf);
6207         }
6208         return err;
6209 }
6210
6211 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6212 {
6213         u32 band, mimo_bwcap;
6214         int err;
6215
6216         band = WLC_BAND_2G;
6217         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6218         if (!err) {
6219                 bw_cap[NL80211_BAND_2GHZ] = band;
6220                 band = WLC_BAND_5G;
6221                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6222                 if (!err) {
6223                         bw_cap[NL80211_BAND_5GHZ] = band;
6224                         return;
6225                 }
6226                 WARN_ON(1);
6227                 return;
6228         }
6229         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6230         mimo_bwcap = 0;
6231         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6232         if (err)
6233                 /* assume 20MHz if firmware does not give a clue */
6234                 mimo_bwcap = WLC_N_BW_20ALL;
6235
6236         switch (mimo_bwcap) {
6237         case WLC_N_BW_40ALL:
6238                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6239                 /* fall-thru */
6240         case WLC_N_BW_20IN2G_40IN5G:
6241                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6242                 /* fall-thru */
6243         case WLC_N_BW_20ALL:
6244                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6245                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6246                 break;
6247         default:
6248                 brcmf_err("invalid mimo_bw_cap value\n");
6249         }
6250 }
6251
6252 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6253                                 u32 bw_cap[2], u32 nchain)
6254 {
6255         band->ht_cap.ht_supported = true;
6256         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6257                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6258                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6259         }
6260         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6261         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6262         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6263         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6264         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6265         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6266 }
6267
6268 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6269 {
6270         u16 mcs_map;
6271         int i;
6272
6273         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6274                 mcs_map = (mcs_map << 2) | supp;
6275
6276         return cpu_to_le16(mcs_map);
6277 }
6278
6279 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6280                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6281                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6282 {
6283         __le16 mcs_map;
6284
6285         /* not allowed in 2.4G band */
6286         if (band->band == NL80211_BAND_2GHZ)
6287                 return;
6288
6289         band->vht_cap.vht_supported = true;
6290         /* 80MHz is mandatory */
6291         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6292         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6293                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6294                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6295         }
6296         /* all support 256-QAM */
6297         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6298         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6299         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6300
6301         /* Beamforming support information */
6302         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6303                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6304         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6305                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6306         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6307                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6308         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6309                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6310
6311         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6312                 band->vht_cap.cap |=
6313                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6314                 band->vht_cap.cap |= ((txstreams - 1) <<
6315                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6316                 band->vht_cap.cap |=
6317                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6318         }
6319 }
6320
6321 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6322 {
6323         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6324         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6325         u32 nmode = 0;
6326         u32 vhtmode = 0;
6327         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6328         u32 rxchain;
6329         u32 nchain;
6330         int err;
6331         s32 i;
6332         struct ieee80211_supported_band *band;
6333         u32 txstreams = 0;
6334         u32 txbf_bfe_cap = 0;
6335         u32 txbf_bfr_cap = 0;
6336
6337         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6338         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6339         if (err) {
6340                 brcmf_err("nmode error (%d)\n", err);
6341         } else {
6342                 brcmf_get_bwcap(ifp, bw_cap);
6343         }
6344         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6345                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6346                   bw_cap[NL80211_BAND_5GHZ]);
6347
6348         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6349         if (err) {
6350                 brcmf_err("rxchain error (%d)\n", err);
6351                 nchain = 1;
6352         } else {
6353                 for (nchain = 0; rxchain; nchain++)
6354                         rxchain = rxchain & (rxchain - 1);
6355         }
6356         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6357
6358         err = brcmf_construct_chaninfo(cfg, bw_cap);
6359         if (err) {
6360                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6361                 return err;
6362         }
6363
6364         if (vhtmode) {
6365                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6366                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6367                                               &txbf_bfe_cap);
6368                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6369                                               &txbf_bfr_cap);
6370         }
6371
6372         wiphy = cfg_to_wiphy(cfg);
6373         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6374                 band = wiphy->bands[i];
6375                 if (band == NULL)
6376                         continue;
6377
6378                 if (nmode)
6379                         brcmf_update_ht_cap(band, bw_cap, nchain);
6380                 if (vhtmode)
6381                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6382                                              txbf_bfe_cap, txbf_bfr_cap);
6383         }
6384
6385         return 0;
6386 }
6387
6388 static const struct ieee80211_txrx_stypes
6389 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6390         [NL80211_IFTYPE_STATION] = {
6391                 .tx = 0xffff,
6392                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6393                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6394         },
6395         [NL80211_IFTYPE_P2P_CLIENT] = {
6396                 .tx = 0xffff,
6397                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6398                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6399         },
6400         [NL80211_IFTYPE_P2P_GO] = {
6401                 .tx = 0xffff,
6402                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6403                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6404                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6405                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6406                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6407                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6408                       BIT(IEEE80211_STYPE_ACTION >> 4)
6409         },
6410         [NL80211_IFTYPE_P2P_DEVICE] = {
6411                 .tx = 0xffff,
6412                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6413                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6414         }
6415 };
6416
6417 /**
6418  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6419  *
6420  * @wiphy: wiphy object.
6421  * @ifp: interface object needed for feat module api.
6422  *
6423  * The interface modes and combinations are determined dynamically here
6424  * based on firmware functionality.
6425  *
6426  * no p2p and no mbss:
6427  *
6428  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6429  *
6430  * no p2p and mbss:
6431  *
6432  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6433  *      #AP <= 4, matching BI, channels = 1, 4 total
6434  *
6435  * p2p, no mchan, and mbss:
6436  *
6437  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6438  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6439  *      #AP <= 4, matching BI, channels = 1, 4 total
6440  *
6441  * p2p, mchan, and mbss:
6442  *
6443  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6444  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6445  *      #AP <= 4, matching BI, channels = 1, 4 total
6446  */
6447 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6448 {
6449         struct ieee80211_iface_combination *combo = NULL;
6450         struct ieee80211_iface_limit *c0_limits = NULL;
6451         struct ieee80211_iface_limit *p2p_limits = NULL;
6452         struct ieee80211_iface_limit *mbss_limits = NULL;
6453         bool mbss, p2p;
6454         int i, c, n_combos;
6455
6456         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6457         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6458
6459         n_combos = 1 + !!p2p + !!mbss;
6460         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6461         if (!combo)
6462                 goto err;
6463
6464         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6465                                  BIT(NL80211_IFTYPE_ADHOC) |
6466                                  BIT(NL80211_IFTYPE_AP);
6467
6468         c = 0;
6469         i = 0;
6470         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6471         if (!c0_limits)
6472                 goto err;
6473         c0_limits[i].max = 1;
6474         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6475         if (p2p) {
6476                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6477                         combo[c].num_different_channels = 2;
6478                 else
6479                         combo[c].num_different_channels = 1;
6480                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6481                                           BIT(NL80211_IFTYPE_P2P_GO) |
6482                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6483                 c0_limits[i].max = 1;
6484                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6485                 c0_limits[i].max = 1;
6486                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6487                                        BIT(NL80211_IFTYPE_P2P_GO);
6488         } else {
6489                 combo[c].num_different_channels = 1;
6490                 c0_limits[i].max = 1;
6491                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6492         }
6493         combo[c].max_interfaces = i;
6494         combo[c].n_limits = i;
6495         combo[c].limits = c0_limits;
6496
6497         if (p2p) {
6498                 c++;
6499                 i = 0;
6500                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6501                 if (!p2p_limits)
6502                         goto err;
6503                 p2p_limits[i].max = 1;
6504                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6505                 p2p_limits[i].max = 1;
6506                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6507                 p2p_limits[i].max = 1;
6508                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6509                 p2p_limits[i].max = 1;
6510                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6511                 combo[c].num_different_channels = 1;
6512                 combo[c].max_interfaces = i;
6513                 combo[c].n_limits = i;
6514                 combo[c].limits = p2p_limits;
6515         }
6516
6517         if (mbss) {
6518                 c++;
6519                 i = 0;
6520                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6521                 if (!mbss_limits)
6522                         goto err;
6523                 mbss_limits[i].max = 4;
6524                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6525                 combo[c].beacon_int_infra_match = true;
6526                 combo[c].num_different_channels = 1;
6527                 combo[c].max_interfaces = 4;
6528                 combo[c].n_limits = i;
6529                 combo[c].limits = mbss_limits;
6530         }
6531
6532         wiphy->n_iface_combinations = n_combos;
6533         wiphy->iface_combinations = combo;
6534         return 0;
6535
6536 err:
6537         kfree(c0_limits);
6538         kfree(p2p_limits);
6539         kfree(mbss_limits);
6540         kfree(combo);
6541         return -ENOMEM;
6542 }
6543
6544 #ifdef CONFIG_PM
6545 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
6546         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6547         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6548         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6549         .pattern_min_len = 1,
6550         .max_pkt_offset = 1500,
6551 };
6552 #endif
6553
6554 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6555 {
6556 #ifdef CONFIG_PM
6557         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6558         struct wiphy_wowlan_support *wowl;
6559
6560         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
6561                        GFP_KERNEL);
6562         if (!wowl) {
6563                 brcmf_err("only support basic wowlan features\n");
6564                 wiphy->wowlan = &brcmf_wowlan_support;
6565                 return;
6566         }
6567
6568         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6569                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6570                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
6571                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6572                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6573                 }
6574         }
6575         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6576                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6577                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6578         }
6579
6580         wiphy->wowlan = wowl;
6581 #endif
6582 }
6583
6584 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6585 {
6586         struct brcmf_pub *drvr = ifp->drvr;
6587         const struct ieee80211_iface_combination *combo;
6588         struct ieee80211_supported_band *band;
6589         u16 max_interfaces = 0;
6590         bool gscan;
6591         __le32 bandlist[3];
6592         u32 n_bands;
6593         int err, i;
6594
6595         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6596         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6597         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6598
6599         err = brcmf_setup_ifmodes(wiphy, ifp);
6600         if (err)
6601                 return err;
6602
6603         for (i = 0, combo = wiphy->iface_combinations;
6604              i < wiphy->n_iface_combinations; i++, combo++) {
6605                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6606         }
6607
6608         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6609              i++) {
6610                 u8 *addr = drvr->addresses[i].addr;
6611
6612                 memcpy(addr, drvr->mac, ETH_ALEN);
6613                 if (i) {
6614                         addr[0] |= BIT(1);
6615                         addr[ETH_ALEN - 1] ^= i;
6616                 }
6617         }
6618         wiphy->addresses = drvr->addresses;
6619         wiphy->n_addresses = i;
6620
6621         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6622         wiphy->cipher_suites = brcmf_cipher_suites;
6623         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6624         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6625                 wiphy->n_cipher_suites--;
6626         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6627                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6628                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6629
6630         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
6631                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
6632                         WIPHY_FLAG_OFFCHAN_TX |
6633                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6634         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6635                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6636         if (!ifp->drvr->settings->roamoff)
6637                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6638         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
6639                 wiphy_ext_feature_set(wiphy,
6640                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
6641                 wiphy_ext_feature_set(wiphy,
6642                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
6643         }
6644         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6645         wiphy->max_remain_on_channel_duration = 5000;
6646         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6647                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
6648                 brcmf_pno_wiphy_params(wiphy, gscan);
6649         }
6650         /* vendor commands/events support */
6651         wiphy->vendor_commands = brcmf_vendor_cmds;
6652         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6653
6654         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6655                 brcmf_wiphy_wowl_params(wiphy, ifp);
6656         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6657                                      sizeof(bandlist));
6658         if (err) {
6659                 brcmf_err("could not obtain band info: err=%d\n", err);
6660                 return err;
6661         }
6662         /* first entry in bandlist is number of bands */
6663         n_bands = le32_to_cpu(bandlist[0]);
6664         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6665                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6666                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6667                                        GFP_KERNEL);
6668                         if (!band)
6669                                 return -ENOMEM;
6670
6671                         band->channels = kmemdup(&__wl_2ghz_channels,
6672                                                  sizeof(__wl_2ghz_channels),
6673                                                  GFP_KERNEL);
6674                         if (!band->channels) {
6675                                 kfree(band);
6676                                 return -ENOMEM;
6677                         }
6678
6679                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6680                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6681                 }
6682                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6683                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6684                                        GFP_KERNEL);
6685                         if (!band)
6686                                 return -ENOMEM;
6687
6688                         band->channels = kmemdup(&__wl_5ghz_channels,
6689                                                  sizeof(__wl_5ghz_channels),
6690                                                  GFP_KERNEL);
6691                         if (!band->channels) {
6692                                 kfree(band);
6693                                 return -ENOMEM;
6694                         }
6695
6696                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6697                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6698                 }
6699         }
6700
6701         wiphy_read_of_freq_limits(wiphy);
6702
6703         return 0;
6704 }
6705
6706 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6707 {
6708         struct net_device *ndev;
6709         struct wireless_dev *wdev;
6710         struct brcmf_if *ifp;
6711         s32 power_mode;
6712         s32 err = 0;
6713
6714         if (cfg->dongle_up)
6715                 return err;
6716
6717         ndev = cfg_to_ndev(cfg);
6718         wdev = ndev->ieee80211_ptr;
6719         ifp = netdev_priv(ndev);
6720
6721         /* make sure RF is ready for work */
6722         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6723
6724         brcmf_dongle_scantime(ifp);
6725
6726         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6727         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6728         if (err)
6729                 goto default_conf_out;
6730         brcmf_dbg(INFO, "power save set to %s\n",
6731                   (power_mode ? "enabled" : "disabled"));
6732
6733         err = brcmf_dongle_roam(ifp);
6734         if (err)
6735                 goto default_conf_out;
6736         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6737                                           NULL);
6738         if (err)
6739                 goto default_conf_out;
6740
6741         brcmf_configure_arp_nd_offload(ifp, true);
6742
6743         cfg->dongle_up = true;
6744 default_conf_out:
6745
6746         return err;
6747
6748 }
6749
6750 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6751 {
6752         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6753
6754         return brcmf_config_dongle(ifp->drvr->config);
6755 }
6756
6757 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6758 {
6759         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6760
6761         /*
6762          * While going down, if associated with AP disassociate
6763          * from AP to save power
6764          */
6765         if (check_vif_up(ifp->vif)) {
6766                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6767
6768                 /* Make sure WPA_Supplicant receives all the event
6769                    generated due to DISASSOC call to the fw to keep
6770                    the state fw and WPA_Supplicant state consistent
6771                  */
6772                 brcmf_delay(500);
6773         }
6774
6775         brcmf_abort_scanning(cfg);
6776         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6777
6778         return 0;
6779 }
6780
6781 s32 brcmf_cfg80211_up(struct net_device *ndev)
6782 {
6783         struct brcmf_if *ifp = netdev_priv(ndev);
6784         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6785         s32 err = 0;
6786
6787         mutex_lock(&cfg->usr_sync);
6788         err = __brcmf_cfg80211_up(ifp);
6789         mutex_unlock(&cfg->usr_sync);
6790
6791         return err;
6792 }
6793
6794 s32 brcmf_cfg80211_down(struct net_device *ndev)
6795 {
6796         struct brcmf_if *ifp = netdev_priv(ndev);
6797         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6798         s32 err = 0;
6799
6800         mutex_lock(&cfg->usr_sync);
6801         err = __brcmf_cfg80211_down(ifp);
6802         mutex_unlock(&cfg->usr_sync);
6803
6804         return err;
6805 }
6806
6807 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6808 {
6809         struct wireless_dev *wdev = &ifp->vif->wdev;
6810
6811         return wdev->iftype;
6812 }
6813
6814 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6815                              unsigned long state)
6816 {
6817         struct brcmf_cfg80211_vif *vif;
6818
6819         list_for_each_entry(vif, &cfg->vif_list, list) {
6820                 if (test_bit(state, &vif->sme_state))
6821                         return true;
6822         }
6823         return false;
6824 }
6825
6826 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6827                                     u8 action)
6828 {
6829         u8 evt_action;
6830
6831         spin_lock(&event->vif_event_lock);
6832         evt_action = event->action;
6833         spin_unlock(&event->vif_event_lock);
6834         return evt_action == action;
6835 }
6836
6837 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6838                                   struct brcmf_cfg80211_vif *vif)
6839 {
6840         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6841
6842         spin_lock(&event->vif_event_lock);
6843         event->vif = vif;
6844         event->action = 0;
6845         spin_unlock(&event->vif_event_lock);
6846 }
6847
6848 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6849 {
6850         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6851         bool armed;
6852
6853         spin_lock(&event->vif_event_lock);
6854         armed = event->vif != NULL;
6855         spin_unlock(&event->vif_event_lock);
6856
6857         return armed;
6858 }
6859
6860 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6861                                   u8 action, ulong timeout)
6862 {
6863         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6864
6865         return wait_event_timeout(event->vif_wq,
6866                                   vif_event_equals(event, action), timeout);
6867 }
6868
6869 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6870                                         struct brcmf_fil_country_le *ccreq)
6871 {
6872         struct brcmfmac_pd_cc *country_codes;
6873         struct brcmfmac_pd_cc_entry *cc;
6874         s32 found_index;
6875         int i;
6876
6877         country_codes = drvr->settings->country_codes;
6878         if (!country_codes) {
6879                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6880                 return -EINVAL;
6881         }
6882
6883         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6884             (alpha2[1] == ccreq->country_abbrev[1])) {
6885                 brcmf_dbg(TRACE, "Country code already set\n");
6886                 return -EAGAIN;
6887         }
6888
6889         found_index = -1;
6890         for (i = 0; i < country_codes->table_size; i++) {
6891                 cc = &country_codes->table[i];
6892                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6893                         found_index = i;
6894                 if ((cc->iso3166[0] == alpha2[0]) &&
6895                     (cc->iso3166[1] == alpha2[1])) {
6896                         found_index = i;
6897                         break;
6898                 }
6899         }
6900         if (found_index == -1) {
6901                 brcmf_dbg(TRACE, "No country code match found\n");
6902                 return -EINVAL;
6903         }
6904         memset(ccreq, 0, sizeof(*ccreq));
6905         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6906         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6907                BRCMF_COUNTRY_BUF_SZ);
6908         ccreq->country_abbrev[0] = alpha2[0];
6909         ccreq->country_abbrev[1] = alpha2[1];
6910         ccreq->country_abbrev[2] = 0;
6911
6912         return 0;
6913 }
6914
6915 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6916                                         struct regulatory_request *req)
6917 {
6918         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6919         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6920         struct brcmf_fil_country_le ccreq;
6921         s32 err;
6922         int i;
6923
6924         /* The country code gets set to "00" by default at boot, ignore */
6925         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
6926                 return;
6927
6928         /* ignore non-ISO3166 country codes */
6929         for (i = 0; i < 2; i++)
6930                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6931                         brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
6932                                   req->alpha2[0], req->alpha2[1]);
6933                         return;
6934                 }
6935
6936         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6937                   req->alpha2[0], req->alpha2[1]);
6938
6939         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6940         if (err) {
6941                 brcmf_err("Country code iovar returned err = %d\n", err);
6942                 return;
6943         }
6944
6945         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6946         if (err)
6947                 return;
6948
6949         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6950         if (err) {
6951                 brcmf_err("Firmware rejected country setting\n");
6952                 return;
6953         }
6954         brcmf_setup_wiphybands(wiphy);
6955 }
6956
6957 static void brcmf_free_wiphy(struct wiphy *wiphy)
6958 {
6959         int i;
6960
6961         if (!wiphy)
6962                 return;
6963
6964         if (wiphy->iface_combinations) {
6965                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6966                         kfree(wiphy->iface_combinations[i].limits);
6967         }
6968         kfree(wiphy->iface_combinations);
6969         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6970                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6971                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6972         }
6973         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6974                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6975                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6976         }
6977 #if IS_ENABLED(CONFIG_PM)
6978         if (wiphy->wowlan != &brcmf_wowlan_support)
6979                 kfree(wiphy->wowlan);
6980 #endif
6981         wiphy_free(wiphy);
6982 }
6983
6984 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6985                                                   struct device *busdev,
6986                                                   bool p2pdev_forced)
6987 {
6988         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6989         struct brcmf_cfg80211_info *cfg;
6990         struct wiphy *wiphy;
6991         struct cfg80211_ops *ops;
6992         struct brcmf_cfg80211_vif *vif;
6993         struct brcmf_if *ifp;
6994         s32 err = 0;
6995         s32 io_type;
6996         u16 *cap = NULL;
6997
6998         if (!ndev) {
6999                 brcmf_err("ndev is invalid\n");
7000                 return NULL;
7001         }
7002
7003         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
7004         if (!ops)
7005                 return NULL;
7006
7007         ifp = netdev_priv(ndev);
7008 #ifdef CONFIG_PM
7009         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
7010                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
7011 #endif
7012         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
7013         if (!wiphy) {
7014                 brcmf_err("Could not allocate wiphy device\n");
7015                 goto ops_out;
7016         }
7017         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
7018         set_wiphy_dev(wiphy, busdev);
7019
7020         cfg = wiphy_priv(wiphy);
7021         cfg->wiphy = wiphy;
7022         cfg->ops = ops;
7023         cfg->pub = drvr;
7024         init_vif_event(&cfg->vif_event);
7025         INIT_LIST_HEAD(&cfg->vif_list);
7026
7027         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
7028         if (IS_ERR(vif))
7029                 goto wiphy_out;
7030
7031         vif->ifp = ifp;
7032         vif->wdev.netdev = ndev;
7033         ndev->ieee80211_ptr = &vif->wdev;
7034         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
7035
7036         err = wl_init_priv(cfg);
7037         if (err) {
7038                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
7039                 brcmf_free_vif(vif);
7040                 goto wiphy_out;
7041         }
7042         ifp->vif = vif;
7043
7044         /* determine d11 io type before wiphy setup */
7045         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
7046         if (err) {
7047                 brcmf_err("Failed to get D11 version (%d)\n", err);
7048                 goto priv_out;
7049         }
7050         cfg->d11inf.io_type = (u8)io_type;
7051         brcmu_d11_attach(&cfg->d11inf);
7052
7053         err = brcmf_setup_wiphy(wiphy, ifp);
7054         if (err < 0)
7055                 goto priv_out;
7056
7057         brcmf_dbg(INFO, "Registering custom regulatory\n");
7058         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
7059         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
7060         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
7061
7062         /* firmware defaults to 40MHz disabled in 2G band. We signal
7063          * cfg80211 here that we do and have it decide we can enable
7064          * it. But first check if device does support 2G operation.
7065          */
7066         if (wiphy->bands[NL80211_BAND_2GHZ]) {
7067                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
7068                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7069         }
7070         err = wiphy_register(wiphy);
7071         if (err < 0) {
7072                 brcmf_err("Could not register wiphy device (%d)\n", err);
7073                 goto priv_out;
7074         }
7075
7076         err = brcmf_setup_wiphybands(wiphy);
7077         if (err) {
7078                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
7079                 goto wiphy_unreg_out;
7080         }
7081
7082         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
7083          * setup 40MHz in 2GHz band and enable OBSS scanning.
7084          */
7085         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
7086                 err = brcmf_enable_bw40_2g(cfg);
7087                 if (!err)
7088                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
7089                                                       BRCMF_OBSS_COEX_AUTO);
7090                 else
7091                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7092         }
7093         /* p2p might require that "if-events" get processed by fweh. So
7094          * activate the already registered event handlers now and activate
7095          * the rest when initialization has completed. drvr->config needs to
7096          * be assigned before activating events.
7097          */
7098         drvr->config = cfg;
7099         err = brcmf_fweh_activate_events(ifp);
7100         if (err) {
7101                 brcmf_err("FWEH activation failed (%d)\n", err);
7102                 goto wiphy_unreg_out;
7103         }
7104
7105         err = brcmf_p2p_attach(cfg, p2pdev_forced);
7106         if (err) {
7107                 brcmf_err("P2P initialisation failed (%d)\n", err);
7108                 goto wiphy_unreg_out;
7109         }
7110         err = brcmf_btcoex_attach(cfg);
7111         if (err) {
7112                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
7113                 brcmf_p2p_detach(&cfg->p2p);
7114                 goto wiphy_unreg_out;
7115         }
7116         err = brcmf_pno_attach(cfg);
7117         if (err) {
7118                 brcmf_err("PNO initialisation failed (%d)\n", err);
7119                 brcmf_btcoex_detach(cfg);
7120                 brcmf_p2p_detach(&cfg->p2p);
7121                 goto wiphy_unreg_out;
7122         }
7123
7124         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
7125                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
7126                 if (err) {
7127                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
7128                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
7129                 } else {
7130                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
7131                                             brcmf_notify_tdls_peer_event);
7132                 }
7133         }
7134
7135         /* (re-) activate FWEH event handling */
7136         err = brcmf_fweh_activate_events(ifp);
7137         if (err) {
7138                 brcmf_err("FWEH activation failed (%d)\n", err);
7139                 goto detach;
7140         }
7141
7142         /* Fill in some of the advertised nl80211 supported features */
7143         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7144                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7145 #ifdef CONFIG_PM
7146                 if (wiphy->wowlan &&
7147                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7148                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7149 #endif
7150         }
7151
7152         return cfg;
7153
7154 detach:
7155         brcmf_pno_detach(cfg);
7156         brcmf_btcoex_detach(cfg);
7157         brcmf_p2p_detach(&cfg->p2p);
7158 wiphy_unreg_out:
7159         wiphy_unregister(cfg->wiphy);
7160 priv_out:
7161         wl_deinit_priv(cfg);
7162         brcmf_free_vif(vif);
7163         ifp->vif = NULL;
7164 wiphy_out:
7165         brcmf_free_wiphy(wiphy);
7166 ops_out:
7167         kfree(ops);
7168         return NULL;
7169 }
7170
7171 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7172 {
7173         if (!cfg)
7174                 return;
7175
7176         brcmf_pno_detach(cfg);
7177         brcmf_btcoex_detach(cfg);
7178         wiphy_unregister(cfg->wiphy);
7179         kfree(cfg->ops);
7180         wl_deinit_priv(cfg);
7181         brcmf_free_wiphy(cfg->wiphy);
7182 }