drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "pno.h"
  36 #include "cfg80211.h"
  37 #include "feature.h"
  38 #include "fwil.h"
  39 #include "proto.h"
  40 #include "vendor.h"
  41 #include "bus.h"
  42 #include "common.h"
  43
  44 #define BRCMF_SCAN_IE_LEN_MAX           2048
  45
  46 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  47 #define WPA_OUI_TYPE                    1
  48 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  49 #define WME_OUI_TYPE                    2
  50 #define WPS_OUI_TYPE                    4
  51
  52 #define VS_IE_FIXED_HDR_LEN             6
  53 #define WPA_IE_VERSION_LEN              2
  54 #define WPA_IE_MIN_OUI_LEN              4
  55 #define WPA_IE_SUITE_COUNT_LEN          2
  56
  57 #define WPA_CIPHER_NONE                 0       /* None */
  58 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  59 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  60 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  61 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  62
  63 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  64 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  65 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  66 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  67 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  68 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  69 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  70 #define RSN_CAP_MFPR_MASK               BIT(6)
  71 #define RSN_CAP_MFPC_MASK               BIT(7)
  72 #define RSN_PMKID_COUNT_LEN             2
  73
  74 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  75                                                  * string :"add", "del" (+ NUL)
  76                                                  */
  77 #define VNDR_IE_COUNT_OFFSET            4
  78 #define VNDR_IE_PKTFLAG_OFFSET          8
  79 #define VNDR_IE_VSIE_OFFSET             12
  80 #define VNDR_IE_HDR_SIZE                12
  81 #define VNDR_IE_PARSE_LIMIT             5
  82
  83 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  84 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  85
  86 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  87 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  88 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  89
  90 #define BRCMF_SCAN_CHANNEL_TIME         40
  91 #define BRCMF_SCAN_UNASSOC_TIME         40
  92 #define BRCMF_SCAN_PASSIVE_TIME         120
  93
  94 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  95
  96 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  97         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  98
  99 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 100 {
 101         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 102                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 103                           vif->sme_state);
 104                 return false;
 105         }
 106         return true;
 107 }
 108
 109 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 110 #define RATETAB_ENT(_rateid, _flags) \
 111         {                                                               \
 112                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 113                 .hw_value       = (_rateid),                            \
 114                 .flags          = (_flags),                             \
 115         }
 116
 117 static struct ieee80211_rate __wl_rates[] = {
 118         RATETAB_ENT(BRCM_RATE_1M, 0),
 119         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 122         RATETAB_ENT(BRCM_RATE_6M, 0),
 123         RATETAB_ENT(BRCM_RATE_9M, 0),
 124         RATETAB_ENT(BRCM_RATE_12M, 0),
 125         RATETAB_ENT(BRCM_RATE_18M, 0),
 126         RATETAB_ENT(BRCM_RATE_24M, 0),
 127         RATETAB_ENT(BRCM_RATE_36M, 0),
 128         RATETAB_ENT(BRCM_RATE_48M, 0),
 129         RATETAB_ENT(BRCM_RATE_54M, 0),
 130 };
 131
 132 #define wl_g_rates              (__wl_rates + 0)
 133 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 134 #define wl_a_rates              (__wl_rates + 4)
 135 #define wl_a_rates_size         (wl_g_rates_size - 4)
 136
 137 #define CHAN2G(_channel, _freq) {                               \
 138         .band                   = NL80211_BAND_2GHZ,            \
 139         .center_freq            = (_freq),                      \
 140         .hw_value               = (_channel),                   \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144
 145 #define CHAN5G(_channel) {                                      \
 146         .band                   = NL80211_BAND_5GHZ,            \
 147         .center_freq            = 5000 + (5 * (_channel)),      \
 148         .hw_value               = (_channel),                   \
 149         .max_antenna_gain       = 0,                            \
 150         .max_power              = 30,                           \
 151 }
 152
 153 static struct ieee80211_channel __wl_2ghz_channels[] = {
 154         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 155         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 156         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 157         CHAN2G(13, 2472), CHAN2G(14, 2484)
 158 };
 159
 160 static struct ieee80211_channel __wl_5ghz_channels[] = {
 161         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 162         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 163         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 164         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 165         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 166         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 167 };
 168
 169 /* Band templates duplicated per wiphy. The channel info
 170  * above is added to the band during setup.
 171  */
 172 static const struct ieee80211_supported_band __wl_band_2ghz = {
 173         .band = NL80211_BAND_2GHZ,
 174         .bitrates = wl_g_rates,
 175         .n_bitrates = wl_g_rates_size,
 176 };
 177
 178 static const struct ieee80211_supported_band __wl_band_5ghz = {
 179         .band = NL80211_BAND_5GHZ,
 180         .bitrates = wl_a_rates,
 181         .n_bitrates = wl_a_rates_size,
 182 };
 183
 184 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 185  * By default world regulatory domain defined in reg.c puts the flags
 186  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 187  * With respect to these flags, wpa_supplicant doesn't * start p2p
 188  * operations on 5GHz channels. All the changes in world regulatory
 189  * domain are to be done here.
 190  */
 191 static const struct ieee80211_regdomain brcmf_regdom = {
 192         .n_reg_rules = 4,
 193         .alpha2 =  "99",
 194         .reg_rules = {
 195                 /* IEEE 802.11b/g, channels 1..11 */
 196                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 197                 /* If any */
 198                 /* IEEE 802.11 channel 14 - Only JP enables
 199                  * this and for 802.11b only
 200                  */
 201                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 202                 /* IEEE 802.11a, channel 36..64 */
 203                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 204                 /* IEEE 802.11a, channel 100..165 */
 205                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 206 };
 207
 208 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 209  * are supported. A pointer to this array and the number of entries is passed
 210  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 211  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 212  * device does not support MFP then the number of suites will be decreased by 1
 213  */
 214 static const u32 brcmf_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         /* Keep as last entry: */
 220         WLAN_CIPHER_SUITE_AES_CMAC
 221 };
 222
 223 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 224 struct brcmf_vs_tlv {
 225         u8 id;
 226         u8 len;
 227         u8 oui[3];
 228         u8 oui_type;
 229 };
 230
 231 struct parsed_vndr_ie_info {
 232         u8 *ie_ptr;
 233         u32 ie_len;     /* total length including id & length field */
 234         struct brcmf_vs_tlv vndrie;
 235 };
 236
 237 struct parsed_vndr_ies {
 238         u32 count;
 239         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 240 };
 241
 242 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 243 {
 244         switch (band) {
 245         case NL80211_BAND_2GHZ:
 246                 return WLC_BAND_2G;
 247         case NL80211_BAND_5GHZ:
 248                 return WLC_BAND_5G;
 249         default:
 250                 WARN_ON(1);
 251                 break;
 252         }
 253         return 0;
 254 }
 255
 256 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 257                                struct cfg80211_chan_def *ch)
 258 {
 259         struct brcmu_chan ch_inf;
 260         s32 primary_offset;
 261
 262         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 263                   ch->chan->center_freq, ch->center_freq1, ch->width);
 264         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 265         primary_offset = ch->chan->center_freq - ch->center_freq1;
 266         switch (ch->width) {
 267         case NL80211_CHAN_WIDTH_20:
 268         case NL80211_CHAN_WIDTH_20_NOHT:
 269                 ch_inf.bw = BRCMU_CHAN_BW_20;
 270                 WARN_ON(primary_offset != 0);
 271                 break;
 272         case NL80211_CHAN_WIDTH_40:
 273                 ch_inf.bw = BRCMU_CHAN_BW_40;
 274                 if (primary_offset > 0)
 275                         ch_inf.sb = BRCMU_CHAN_SB_U;
 276                 else
 277                         ch_inf.sb = BRCMU_CHAN_SB_L;
 278                 break;
 279         case NL80211_CHAN_WIDTH_80:
 280                 ch_inf.bw = BRCMU_CHAN_BW_80;
 281                 if (primary_offset == -30)
 282                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 283                 else if (primary_offset == -10)
 284                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 285                 else if (primary_offset == 10)
 286                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80P80:
 291         case NL80211_CHAN_WIDTH_160:
 292         case NL80211_CHAN_WIDTH_5:
 293         case NL80211_CHAN_WIDTH_10:
 294         default:
 295                 WARN_ON_ONCE(1);
 296         }
 297         switch (ch->chan->band) {
 298         case NL80211_BAND_2GHZ:
 299                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 300                 break;
 301         case NL80211_BAND_5GHZ:
 302                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 303                 break;
 304         case NL80211_BAND_60GHZ:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         d11inf->encchspec(&ch_inf);
 309
 310         return ch_inf.chspec;
 311 }
 312
 313 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 314                         struct ieee80211_channel *ch)
 315 {
 316         struct brcmu_chan ch_inf;
 317
 318         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 319         ch_inf.bw = BRCMU_CHAN_BW_20;
 320         d11inf->encchspec(&ch_inf);
 321
 322         return ch_inf.chspec;
 323 }
 324
 325 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 326  * triples, returning a pointer to the substring whose first element
 327  * matches tag
 328  */
 329 static const struct brcmf_tlv *
 330 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 331 {
 332         const struct brcmf_tlv *elt = buf;
 333         int totlen = buflen;
 334
 335         /* find tagged parameter */
 336         while (totlen >= TLV_HDR_LEN) {
 337                 int len = elt->len;
 338
 339                 /* validate remaining totlen */
 340                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 341                         return elt;
 342
 343                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 344                 totlen -= (len + TLV_HDR_LEN);
 345         }
 346
 347         return NULL;
 348 }
 349
 350 /* Is any of the tlvs the expected entry? If
 351  * not update the tlvs buffer pointer/length.
 352  */
 353 static bool
 354 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 355                  const u8 *oui, u32 oui_len, u8 type)
 356 {
 357         /* If the contents match the OUI and the type */
 358         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 359             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 360             type == ie[TLV_BODY_OFF + oui_len]) {
 361                 return true;
 362         }
 363
 364         if (tlvs == NULL)
 365                 return false;
 366         /* point to the next ie */
 367         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 368         /* calculate the length of the rest of the buffer */
 369         *tlvs_len -= (int)(ie - *tlvs);
 370         /* update the pointer to the start of the buffer */
 371         *tlvs = ie;
 372
 373         return false;
 374 }
 375
 376 static struct brcmf_vs_tlv *
 377 brcmf_find_wpaie(const u8 *parse, u32 len)
 378 {
 379         const struct brcmf_tlv *ie;
 380
 381         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 382                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 383                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 384                         return (struct brcmf_vs_tlv *)ie;
 385         }
 386         return NULL;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpsie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 403                                      struct brcmf_cfg80211_vif *vif,
 404                                      enum nl80211_iftype new_type)
 405 {
 406         struct brcmf_cfg80211_vif *pos;
 407         bool check_combos = false;
 408         int ret = 0;
 409         struct iface_combination_params params = {
 410                 .num_different_channels = 1,
 411         };
 412
 413         list_for_each_entry(pos, &cfg->vif_list, list)
 414                 if (pos == vif) {
 415                         params.iftype_num[new_type]++;
 416                 } else {
 417                         /* concurrent interfaces so need check combinations */
 418                         check_combos = true;
 419                         params.iftype_num[pos->wdev.iftype]++;
 420                 }
 421
 422         if (check_combos)
 423                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 424
 425         return ret;
 426 }
 427
 428 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 429                                   enum nl80211_iftype new_type)
 430 {
 431         struct brcmf_cfg80211_vif *pos;
 432         struct iface_combination_params params = {
 433                 .num_different_channels = 1,
 434         };
 435
 436         list_for_each_entry(pos, &cfg->vif_list, list)
 437                 params.iftype_num[pos->wdev.iftype]++;
 438
 439         params.iftype_num[new_type]++;
 440         return cfg80211_check_combinations(cfg->wiphy, &params);
 441 }
 442
 443 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 444                                  struct brcmf_wsec_key_le *key_le)
 445 {
 446         key_le->index = cpu_to_le32(key->index);
 447         key_le->len = cpu_to_le32(key->len);
 448         key_le->algo = cpu_to_le32(key->algo);
 449         key_le->flags = cpu_to_le32(key->flags);
 450         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 451         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 452         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 453         memcpy(key_le->data, key->data, sizeof(key->data));
 454         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 455 }
 456
 457 static int
 458 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 459 {
 460         int err;
 461         struct brcmf_wsec_key_le key_le;
 462
 463         convert_key_from_CPU(key, &key_le);
 464
 465         brcmf_netdev_wait_pend8021x(ifp);
 466
 467         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 468                                         sizeof(key_le));
 469
 470         if (err)
 471                 brcmf_err("wsec_key error (%d)\n", err);
 472         return err;
 473 }
 474
 475 static s32
 476 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 477 {
 478         s32 err;
 479         u32 mode;
 480
 481         if (enable)
 482                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 483         else
 484                 mode = 0;
 485
 486         /* Try to set and enable ARP offload feature, this may fail, then it  */
 487         /* is simply not supported and err 0 will be returned                 */
 488         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 489         if (err) {
 490                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 491                           mode, err);
 492                 err = 0;
 493         } else {
 494                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 495                 if (err) {
 496                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 497                                   enable, err);
 498                         err = 0;
 499                 } else
 500                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 501                                   enable, mode);
 502         }
 503
 504         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 505         if (err) {
 506                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 507                           enable, err);
 508                 err = 0;
 509         } else
 510                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 511                           enable, mode);
 512
 513         return err;
 514 }
 515
 516 static void
 517 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 518 {
 519         struct brcmf_cfg80211_vif *vif;
 520         struct brcmf_if *ifp;
 521
 522         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 523         ifp = vif->ifp;
 524
 525         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 526             (wdev->iftype == NL80211_IFTYPE_AP) ||
 527             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 528                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 529                                                 ADDR_DIRECT);
 530         else
 531                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 532                                                 ADDR_INDIRECT);
 533 }
 534
 535 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 536 {
 537         int bsscfgidx;
 538
 539         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 540                 /* bsscfgidx 1 is reserved for legacy P2P */
 541                 if (bsscfgidx == 1)
 542                         continue;
 543                 if (!drvr->iflist[bsscfgidx])
 544                         return bsscfgidx;
 545         }
 546
 547         return -ENOMEM;
 548 }
 549
 550 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 551 {
 552         struct brcmf_mbss_ssid_le mbss_ssid_le;
 553         int bsscfgidx;
 554         int err;
 555
 556         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 557         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 558         if (bsscfgidx < 0)
 559                 return bsscfgidx;
 560
 561         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 562         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 563         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 564
 565         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 566                                         sizeof(mbss_ssid_le));
 567         if (err < 0)
 568                 brcmf_err("setting ssid failed %d\n", err);
 569
 570         return err;
 571 }
 572
 573 /**
 574  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 575  *
 576  * @wiphy: wiphy device of new interface.
 577  * @name: name of the new interface.
 578  * @params: contains mac address for AP device.
 579  */
 580 static
 581 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 582                                       struct vif_params *params)
 583 {
 584         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 585         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 586         struct brcmf_cfg80211_vif *vif;
 587         int err;
 588
 589         if (brcmf_cfg80211_vif_event_armed(cfg))
 590                 return ERR_PTR(-EBUSY);
 591
 592         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 593
 594         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 595         if (IS_ERR(vif))
 596                 return (struct wireless_dev *)vif;
 597
 598         brcmf_cfg80211_arm_vif_event(cfg, vif);
 599
 600         err = brcmf_cfg80211_request_ap_if(ifp);
 601         if (err) {
 602                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 603                 goto fail;
 604         }
 605
 606         /* wait for firmware event */
 607         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 608                                             BRCMF_VIF_EVENT_TIMEOUT);
 609         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 610         if (!err) {
 611                 brcmf_err("timeout occurred\n");
 612                 err = -EIO;
 613                 goto fail;
 614         }
 615
 616         /* interface created in firmware */
 617         ifp = vif->ifp;
 618         if (!ifp) {
 619                 brcmf_err("no if pointer provided\n");
 620                 err = -ENOENT;
 621                 goto fail;
 622         }
 623
 624         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 625         err = brcmf_net_attach(ifp, true);
 626         if (err) {
 627                 brcmf_err("Registering netdevice failed\n");
 628                 free_netdev(ifp->ndev);
 629                 goto fail;
 630         }
 631
 632         return &ifp->vif->wdev;
 633
 634 fail:
 635         brcmf_free_vif(vif);
 636         return ERR_PTR(err);
 637 }
 638
 639 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 640 {
 641         enum nl80211_iftype iftype;
 642
 643         iftype = vif->wdev.iftype;
 644         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 645 }
 646
 647 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 648 {
 649         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 650 }
 651
 652 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 653                                                      const char *name,
 654                                                      unsigned char name_assign_type,
 655                                                      enum nl80211_iftype type,
 656                                                      struct vif_params *params)
 657 {
 658         struct wireless_dev *wdev;
 659         int err;
 660
 661         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 662         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 663         if (err) {
 664                 brcmf_err("iface validation failed: err=%d\n", err);
 665                 return ERR_PTR(err);
 666         }
 667         switch (type) {
 668         case NL80211_IFTYPE_ADHOC:
 669         case NL80211_IFTYPE_STATION:
 670         case NL80211_IFTYPE_AP_VLAN:
 671         case NL80211_IFTYPE_WDS:
 672         case NL80211_IFTYPE_MONITOR:
 673         case NL80211_IFTYPE_MESH_POINT:
 674                 return ERR_PTR(-EOPNOTSUPP);
 675         case NL80211_IFTYPE_AP:
 676                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 677                 break;
 678         case NL80211_IFTYPE_P2P_CLIENT:
 679         case NL80211_IFTYPE_P2P_GO:
 680         case NL80211_IFTYPE_P2P_DEVICE:
 681                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 682                 break;
 683         case NL80211_IFTYPE_UNSPECIFIED:
 684         default:
 685                 return ERR_PTR(-EINVAL);
 686         }
 687
 688         if (IS_ERR(wdev))
 689                 brcmf_err("add iface %s type %d failed: err=%d\n",
 690                           name, type, (int)PTR_ERR(wdev));
 691         else
 692                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 693
 694         return wdev;
 695 }
 696
 697 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 698 {
 699         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 700                 brcmf_set_mpc(ifp, mpc);
 701 }
 702
 703 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 704 {
 705         s32 err = 0;
 706
 707         if (check_vif_up(ifp->vif)) {
 708                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 709                 if (err) {
 710                         brcmf_err("fail to set mpc\n");
 711                         return;
 712                 }
 713                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 714         }
 715 }
 716
 717 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 718                                 struct brcmf_if *ifp, bool aborted,
 719                                 bool fw_abort)
 720 {
 721         struct brcmf_scan_params_le params_le;
 722         struct cfg80211_scan_request *scan_request;
 723         u64 reqid;
 724         u32 bucket;
 725         s32 err = 0;
 726
 727         brcmf_dbg(SCAN, "Enter\n");
 728
 729         /* clear scan request, because the FW abort can cause a second call */
 730         /* to this functon and might cause a double cfg80211_scan_done      */
 731         scan_request = cfg->scan_request;
 732         cfg->scan_request = NULL;
 733
 734         if (timer_pending(&cfg->escan_timeout))
 735                 del_timer_sync(&cfg->escan_timeout);
 736
 737         if (fw_abort) {
 738                 /* Do a scan abort to stop the driver's scan engine */
 739                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 740                 memset(&params_le, 0, sizeof(params_le));
 741                 eth_broadcast_addr(params_le.bssid);
 742                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 743                 params_le.scan_type = 0;
 744                 params_le.channel_num = cpu_to_le32(1);
 745                 params_le.nprobes = cpu_to_le32(1);
 746                 params_le.active_time = cpu_to_le32(-1);
 747                 params_le.passive_time = cpu_to_le32(-1);
 748                 params_le.home_time = cpu_to_le32(-1);
 749                 /* Scan is aborted by setting channel_list[0] to -1 */
 750                 params_le.channel_list[0] = cpu_to_le16(-1);
 751                 /* E-Scan (or anyother type) can be aborted by SCAN */
 752                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 753                                              &params_le, sizeof(params_le));
 754                 if (err)
 755                         brcmf_err("Scan abort failed\n");
 756         }
 757
 758         brcmf_scan_config_mpc(ifp, 1);
 759
 760         /*
 761          * e-scan can be initiated internally
 762          * which takes precedence.
 763          */
 764         if (cfg->int_escan_map) {
 765                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 766                           cfg->int_escan_map);
 767                 while (cfg->int_escan_map) {
 768                         bucket = __ffs(cfg->int_escan_map);
 769                         cfg->int_escan_map &= ~BIT(bucket);
 770                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 771                                                                bucket);
 772                         if (!aborted) {
 773                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 774                                           reqid);
 775                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 776                                                             reqid);
 777                         }
 778                 }
 779         } else if (scan_request) {
 780                 struct cfg80211_scan_info info = {
 781                         .aborted = aborted,
 782                 };
 783
 784                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 785                           aborted ? "Aborted" : "Done");
 786                 cfg80211_scan_done(scan_request, &info);
 787         }
 788         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 789                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 790
 791         return err;
 792 }
 793
 794 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 795                                        struct wireless_dev *wdev)
 796 {
 797         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 798         struct net_device *ndev = wdev->netdev;
 799         struct brcmf_if *ifp = netdev_priv(ndev);
 800         int ret;
 801         int err;
 802
 803         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 804
 805         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 806         if (err) {
 807                 brcmf_err("interface_remove failed %d\n", err);
 808                 goto err_unarm;
 809         }
 810
 811         /* wait for firmware event */
 812         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 813                                             BRCMF_VIF_EVENT_TIMEOUT);
 814         if (!ret) {
 815                 brcmf_err("timeout occurred\n");
 816                 err = -EIO;
 817                 goto err_unarm;
 818         }
 819
 820         brcmf_remove_interface(ifp, true);
 821
 822 err_unarm:
 823         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 824         return err;
 825 }
 826
 827 static
 828 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 829 {
 830         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 831         struct net_device *ndev = wdev->netdev;
 832
 833         if (ndev && ndev == cfg_to_ndev(cfg))
 834                 return -ENOTSUPP;
 835
 836         /* vif event pending in firmware */
 837         if (brcmf_cfg80211_vif_event_armed(cfg))
 838                 return -EBUSY;
 839
 840         if (ndev) {
 841                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 842                     cfg->escan_info.ifp == netdev_priv(ndev))
 843                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 844                                                     true, true);
 845
 846                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 847         }
 848
 849         switch (wdev->iftype) {
 850         case NL80211_IFTYPE_ADHOC:
 851         case NL80211_IFTYPE_STATION:
 852         case NL80211_IFTYPE_AP_VLAN:
 853         case NL80211_IFTYPE_WDS:
 854         case NL80211_IFTYPE_MONITOR:
 855         case NL80211_IFTYPE_MESH_POINT:
 856                 return -EOPNOTSUPP;
 857         case NL80211_IFTYPE_AP:
 858                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 859         case NL80211_IFTYPE_P2P_CLIENT:
 860         case NL80211_IFTYPE_P2P_GO:
 861         case NL80211_IFTYPE_P2P_DEVICE:
 862                 return brcmf_p2p_del_vif(wiphy, wdev);
 863         case NL80211_IFTYPE_UNSPECIFIED:
 864         default:
 865                 return -EINVAL;
 866         }
 867         return -EOPNOTSUPP;
 868 }
 869
 870 static s32
 871 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 872                          enum nl80211_iftype type,
 873                          struct vif_params *params)
 874 {
 875         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 876         struct brcmf_if *ifp = netdev_priv(ndev);
 877         struct brcmf_cfg80211_vif *vif = ifp->vif;
 878         s32 infra = 0;
 879         s32 ap = 0;
 880         s32 err = 0;
 881
 882         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 883                   type);
 884
 885         /* WAR: There are a number of p2p interface related problems which
 886          * need to be handled initially (before doing the validate).
 887          * wpa_supplicant tends to do iface changes on p2p device/client/go
 888          * which are not always possible/allowed. However we need to return
 889          * OK otherwise the wpa_supplicant wont start. The situation differs
 890          * on configuration and setup (p2pon=1 module param). The first check
 891          * is to see if the request is a change to station for p2p iface.
 892          */
 893         if ((type == NL80211_IFTYPE_STATION) &&
 894             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 895              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 896              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 897                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 898                 /* Now depending on whether module param p2pon=1 was used the
 899                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 900                  * that if p2pon=1 is used, but a newer supplicant is used then
 901                  * we should return an error, as this combination wont work.
 902                  * In other situations 0 is returned and supplicant will start
 903                  * normally. It will give a trace in cfg80211, but it is the
 904                  * only way to get it working. Unfortunately this will result
 905                  * in situation where we wont support new supplicant in
 906                  * combination with module param p2pon=1, but that is the way
 907                  * it is. If the user tries this then unloading of driver might
 908                  * fail/lock.
 909                  */
 910                 if (cfg->p2p.p2pdev_dynamically)
 911                         return -EOPNOTSUPP;
 912                 else
 913                         return 0;
 914         }
 915         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 916         if (err) {
 917                 brcmf_err("iface validation failed: err=%d\n", err);
 918                 return err;
 919         }
 920         switch (type) {
 921         case NL80211_IFTYPE_MONITOR:
 922         case NL80211_IFTYPE_WDS:
 923                 brcmf_err("type (%d) : currently we do not support this type\n",
 924                           type);
 925                 return -EOPNOTSUPP;
 926         case NL80211_IFTYPE_ADHOC:
 927                 infra = 0;
 928                 break;
 929         case NL80211_IFTYPE_STATION:
 930                 infra = 1;
 931                 break;
 932         case NL80211_IFTYPE_AP:
 933         case NL80211_IFTYPE_P2P_GO:
 934                 ap = 1;
 935                 break;
 936         default:
 937                 err = -EINVAL;
 938                 goto done;
 939         }
 940
 941         if (ap) {
 942                 if (type == NL80211_IFTYPE_P2P_GO) {
 943                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 944                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 945                 }
 946                 if (!err) {
 947                         brcmf_dbg(INFO, "IF Type = AP\n");
 948                 }
 949         } else {
 950                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 951                 if (err) {
 952                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 953                         err = -EAGAIN;
 954                         goto done;
 955                 }
 956                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 957                           "Adhoc" : "Infra");
 958         }
 959         ndev->ieee80211_ptr->iftype = type;
 960
 961         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 962
 963 done:
 964         brcmf_dbg(TRACE, "Exit\n");
 965
 966         return err;
 967 }
 968
 969 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 970                              struct brcmf_scan_params_le *params_le,
 971                              struct cfg80211_scan_request *request)
 972 {
 973         u32 n_ssids;
 974         u32 n_channels;
 975         s32 i;
 976         s32 offset;
 977         u16 chanspec;
 978         char *ptr;
 979         struct brcmf_ssid_le ssid_le;
 980
 981         eth_broadcast_addr(params_le->bssid);
 982         params_le->bss_type = DOT11_BSSTYPE_ANY;
 983         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
 984         params_le->channel_num = 0;
 985         params_le->nprobes = cpu_to_le32(-1);
 986         params_le->active_time = cpu_to_le32(-1);
 987         params_le->passive_time = cpu_to_le32(-1);
 988         params_le->home_time = cpu_to_le32(-1);
 989         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 990
 991         n_ssids = request->n_ssids;
 992         n_channels = request->n_channels;
 993
 994         /* Copy channel array if applicable */
 995         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 996                   n_channels);
 997         if (n_channels > 0) {
 998                 for (i = 0; i < n_channels; i++) {
 999                         chanspec = channel_to_chanspec(&cfg->d11inf,
1000                                                        request->channels[i]);
1001                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1002                                   request->channels[i]->hw_value, chanspec);
1003                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1004                 }
1005         } else {
1006                 brcmf_dbg(SCAN, "Scanning all channels\n");
1007         }
1008         /* Copy ssid array if applicable */
1009         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1010         if (n_ssids > 0) {
1011                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1012                                 n_channels * sizeof(u16);
1013                 offset = roundup(offset, sizeof(u32));
1014                 ptr = (char *)params_le + offset;
1015                 for (i = 0; i < n_ssids; i++) {
1016                         memset(&ssid_le, 0, sizeof(ssid_le));
1017                         ssid_le.SSID_len =
1018                                         cpu_to_le32(request->ssids[i].ssid_len);
1019                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1020                                request->ssids[i].ssid_len);
1021                         if (!ssid_le.SSID_len)
1022                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1023                         else
1024                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1025                                           i, ssid_le.SSID, ssid_le.SSID_len);
1026                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1027                         ptr += sizeof(ssid_le);
1028                 }
1029         } else {
1030                 brcmf_dbg(SCAN, "Performing passive scan\n");
1031                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1032         }
1033         /* Adding mask to channel numbers */
1034         params_le->channel_num =
1035                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1036                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1037 }
1038
1039 static s32
1040 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1041                 struct cfg80211_scan_request *request)
1042 {
1043         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1044                           offsetof(struct brcmf_escan_params_le, params_le);
1045         struct brcmf_escan_params_le *params;
1046         s32 err = 0;
1047
1048         brcmf_dbg(SCAN, "E-SCAN START\n");
1049
1050         if (request != NULL) {
1051                 /* Allocate space for populating ssids in struct */
1052                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1053
1054                 /* Allocate space for populating ssids in struct */
1055                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1056         }
1057
1058         params = kzalloc(params_size, GFP_KERNEL);
1059         if (!params) {
1060                 err = -ENOMEM;
1061                 goto exit;
1062         }
1063         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1064         brcmf_escan_prep(cfg, &params->params_le, request);
1065         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1066         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1067         params->sync_id = cpu_to_le16(0x1234);
1068
1069         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1070         if (err) {
1071                 if (err == -EBUSY)
1072                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1073                 else
1074                         brcmf_err("error (%d)\n", err);
1075         }
1076
1077         kfree(params);
1078 exit:
1079         return err;
1080 }
1081
1082 static s32
1083 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1084 {
1085         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1086         s32 err;
1087         u32 passive_scan;
1088         struct brcmf_scan_results *results;
1089         struct escan_info *escan = &cfg->escan_info;
1090
1091         brcmf_dbg(SCAN, "Enter\n");
1092         escan->ifp = ifp;
1093         escan->wiphy = cfg->wiphy;
1094         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1095         passive_scan = cfg->active_scan ? 0 : 1;
1096         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1097                                     passive_scan);
1098         if (err) {
1099                 brcmf_err("error (%d)\n", err);
1100                 return err;
1101         }
1102         brcmf_scan_config_mpc(ifp, 0);
1103         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1104         results->version = 0;
1105         results->count = 0;
1106         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1107
1108         err = escan->run(cfg, ifp, request);
1109         if (err)
1110                 brcmf_scan_config_mpc(ifp, 1);
1111         return err;
1112 }
1113
1114 static s32
1115 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1116                      struct cfg80211_scan_request *request,
1117                      struct cfg80211_ssid *this_ssid)
1118 {
1119         struct brcmf_if *ifp = vif->ifp;
1120         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1121         struct cfg80211_ssid *ssids;
1122         u32 passive_scan;
1123         bool escan_req;
1124         bool spec_scan;
1125         s32 err;
1126         struct brcmf_ssid_le ssid_le;
1127         u32 SSID_len;
1128
1129         brcmf_dbg(SCAN, "START ESCAN\n");
1130
1131         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1132                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1133                 return -EAGAIN;
1134         }
1135         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1136                 brcmf_err("Scanning being aborted: status (%lu)\n",
1137                           cfg->scan_status);
1138                 return -EAGAIN;
1139         }
1140         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1141                 brcmf_err("Scanning suppressed: status (%lu)\n",
1142                           cfg->scan_status);
1143                 return -EAGAIN;
1144         }
1145         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1146                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1147                 return -EAGAIN;
1148         }
1149
1150         /* If scan req comes for p2p0, send it over primary I/F */
1151         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1152                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1153
1154         escan_req = false;
1155         if (request) {
1156                 /* scan bss */
1157                 ssids = request->ssids;
1158                 escan_req = true;
1159         } else {
1160                 /* scan in ibss */
1161                 /* we don't do escan in ibss */
1162                 ssids = this_ssid;
1163         }
1164
1165         cfg->scan_request = request;
1166         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1167         if (escan_req) {
1168                 cfg->escan_info.run = brcmf_run_escan;
1169                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1170                 if (err)
1171                         goto scan_out;
1172
1173                 err = brcmf_do_escan(vif->ifp, request);
1174                 if (err)
1175                         goto scan_out;
1176         } else {
1177                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1178                           ssids->ssid, ssids->ssid_len);
1179                 memset(&ssid_le, 0, sizeof(ssid_le));
1180                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1181                 ssid_le.SSID_len = cpu_to_le32(0);
1182                 spec_scan = false;
1183                 if (SSID_len) {
1184                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1185                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1186                         spec_scan = true;
1187                 } else
1188                         brcmf_dbg(SCAN, "Broadcast scan\n");
1189
1190                 passive_scan = cfg->active_scan ? 0 : 1;
1191                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1192                                             passive_scan);
1193                 if (err) {
1194                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1195                         goto scan_out;
1196                 }
1197                 brcmf_scan_config_mpc(ifp, 0);
1198                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1199                                              sizeof(ssid_le));
1200                 if (err) {
1201                         if (err == -EBUSY)
1202                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1203                                           ssid_le.SSID);
1204                         else
1205                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1206
1207                         brcmf_scan_config_mpc(ifp, 1);
1208                         goto scan_out;
1209                 }
1210         }
1211
1212         /* Arm scan timeout timer */
1213         mod_timer(&cfg->escan_timeout, jiffies +
1214                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1215
1216         return 0;
1217
1218 scan_out:
1219         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1220         cfg->scan_request = NULL;
1221         return err;
1222 }
1223
1224 static s32
1225 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1226 {
1227         struct brcmf_cfg80211_vif *vif;
1228         s32 err = 0;
1229
1230         brcmf_dbg(TRACE, "Enter\n");
1231         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1232         if (!check_vif_up(vif))
1233                 return -EIO;
1234
1235         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1236
1237         if (err)
1238                 brcmf_err("scan error (%d)\n", err);
1239
1240         brcmf_dbg(TRACE, "Exit\n");
1241         return err;
1242 }
1243
1244 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1245 {
1246         s32 err = 0;
1247
1248         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1249                                       rts_threshold);
1250         if (err)
1251                 brcmf_err("Error (%d)\n", err);
1252
1253         return err;
1254 }
1255
1256 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1257 {
1258         s32 err = 0;
1259
1260         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1261                                       frag_threshold);
1262         if (err)
1263                 brcmf_err("Error (%d)\n", err);
1264
1265         return err;
1266 }
1267
1268 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1269 {
1270         s32 err = 0;
1271         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1272
1273         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1274         if (err) {
1275                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1276                 return err;
1277         }
1278         return err;
1279 }
1280
1281 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1282 {
1283         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1284         struct net_device *ndev = cfg_to_ndev(cfg);
1285         struct brcmf_if *ifp = netdev_priv(ndev);
1286         s32 err = 0;
1287
1288         brcmf_dbg(TRACE, "Enter\n");
1289         if (!check_vif_up(ifp->vif))
1290                 return -EIO;
1291
1292         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1293             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1294                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1295                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1296                 if (!err)
1297                         goto done;
1298         }
1299         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1300             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1301                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1302                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1303                 if (!err)
1304                         goto done;
1305         }
1306         if (changed & WIPHY_PARAM_RETRY_LONG
1307             && (cfg->conf->retry_long != wiphy->retry_long)) {
1308                 cfg->conf->retry_long = wiphy->retry_long;
1309                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1310                 if (!err)
1311                         goto done;
1312         }
1313         if (changed & WIPHY_PARAM_RETRY_SHORT
1314             && (cfg->conf->retry_short != wiphy->retry_short)) {
1315                 cfg->conf->retry_short = wiphy->retry_short;
1316                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1317                 if (!err)
1318                         goto done;
1319         }
1320
1321 done:
1322         brcmf_dbg(TRACE, "Exit\n");
1323         return err;
1324 }
1325
1326 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1327 {
1328         memset(prof, 0, sizeof(*prof));
1329 }
1330
1331 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1332 {
1333         u16 reason;
1334
1335         switch (e->event_code) {
1336         case BRCMF_E_DEAUTH:
1337         case BRCMF_E_DEAUTH_IND:
1338         case BRCMF_E_DISASSOC_IND:
1339                 reason = e->reason;
1340                 break;
1341         case BRCMF_E_LINK:
1342         default:
1343                 reason = 0;
1344                 break;
1345         }
1346         return reason;
1347 }
1348
1349 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1350 {
1351         struct brcmf_wsec_pmk_le pmk;
1352         int i, err;
1353
1354         /* convert to firmware key format */
1355         pmk.key_len = cpu_to_le16(pmk_len << 1);
1356         pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1357         for (i = 0; i < pmk_len; i++)
1358                 snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1359
1360         /* store psk in firmware */
1361         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1362                                      &pmk, sizeof(pmk));
1363         if (err < 0)
1364                 brcmf_err("failed to change PSK in firmware (len=%u)\n",
1365                           pmk_len);
1366
1367         return err;
1368 }
1369
1370 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1371 {
1372         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1373         s32 err = 0;
1374
1375         brcmf_dbg(TRACE, "Enter\n");
1376
1377         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1378                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1379                 err = brcmf_fil_cmd_data_set(vif->ifp,
1380                                              BRCMF_C_DISASSOC, NULL, 0);
1381                 if (err) {
1382                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1383                 }
1384                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1385                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1386                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1387                                               true, GFP_KERNEL);
1388         }
1389         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1390         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1391         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1392         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1393                 brcmf_set_pmk(vif->ifp, NULL, 0);
1394                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1395         }
1396         brcmf_dbg(TRACE, "Exit\n");
1397 }
1398
1399 static s32
1400 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1401                       struct cfg80211_ibss_params *params)
1402 {
1403         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1404         struct brcmf_if *ifp = netdev_priv(ndev);
1405         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1406         struct brcmf_join_params join_params;
1407         size_t join_params_size = 0;
1408         s32 err = 0;
1409         s32 wsec = 0;
1410         s32 bcnprd;
1411         u16 chanspec;
1412         u32 ssid_len;
1413
1414         brcmf_dbg(TRACE, "Enter\n");
1415         if (!check_vif_up(ifp->vif))
1416                 return -EIO;
1417
1418         if (params->ssid)
1419                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1420         else {
1421                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1422                 return -EOPNOTSUPP;
1423         }
1424
1425         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1426
1427         if (params->bssid)
1428                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1429         else
1430                 brcmf_dbg(CONN, "No BSSID specified\n");
1431
1432         if (params->chandef.chan)
1433                 brcmf_dbg(CONN, "channel: %d\n",
1434                           params->chandef.chan->center_freq);
1435         else
1436                 brcmf_dbg(CONN, "no channel specified\n");
1437
1438         if (params->channel_fixed)
1439                 brcmf_dbg(CONN, "fixed channel required\n");
1440         else
1441                 brcmf_dbg(CONN, "no fixed channel required\n");
1442
1443         if (params->ie && params->ie_len)
1444                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1445         else
1446                 brcmf_dbg(CONN, "no ie specified\n");
1447
1448         if (params->beacon_interval)
1449                 brcmf_dbg(CONN, "beacon interval: %d\n",
1450                           params->beacon_interval);
1451         else
1452                 brcmf_dbg(CONN, "no beacon interval specified\n");
1453
1454         if (params->basic_rates)
1455                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1456         else
1457                 brcmf_dbg(CONN, "no basic rates specified\n");
1458
1459         if (params->privacy)
1460                 brcmf_dbg(CONN, "privacy required\n");
1461         else
1462                 brcmf_dbg(CONN, "no privacy required\n");
1463
1464         /* Configure Privacy for starter */
1465         if (params->privacy)
1466                 wsec |= WEP_ENABLED;
1467
1468         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1469         if (err) {
1470                 brcmf_err("wsec failed (%d)\n", err);
1471                 goto done;
1472         }
1473
1474         /* Configure Beacon Interval for starter */
1475         if (params->beacon_interval)
1476                 bcnprd = params->beacon_interval;
1477         else
1478                 bcnprd = 100;
1479
1480         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1481         if (err) {
1482                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1483                 goto done;
1484         }
1485
1486         /* Configure required join parameter */
1487         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1488
1489         /* SSID */
1490         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1491         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1492         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1493         join_params_size = sizeof(join_params.ssid_le);
1494
1495         /* BSSID */
1496         if (params->bssid) {
1497                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1498                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1499                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1500         } else {
1501                 eth_broadcast_addr(join_params.params_le.bssid);
1502                 eth_zero_addr(profile->bssid);
1503         }
1504
1505         /* Channel */
1506         if (params->chandef.chan) {
1507                 u32 target_channel;
1508
1509                 cfg->channel =
1510                         ieee80211_frequency_to_channel(
1511                                 params->chandef.chan->center_freq);
1512                 if (params->channel_fixed) {
1513                         /* adding chanspec */
1514                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1515                                                        &params->chandef);
1516                         join_params.params_le.chanspec_list[0] =
1517                                 cpu_to_le16(chanspec);
1518                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1519                         join_params_size += sizeof(join_params.params_le);
1520                 }
1521
1522                 /* set channel for starter */
1523                 target_channel = cfg->channel;
1524                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1525                                             target_channel);
1526                 if (err) {
1527                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1528                         goto done;
1529                 }
1530         } else
1531                 cfg->channel = 0;
1532
1533         cfg->ibss_starter = false;
1534
1535
1536         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1537                                      &join_params, join_params_size);
1538         if (err) {
1539                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1540                 goto done;
1541         }
1542
1543 done:
1544         if (err)
1545                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1546         brcmf_dbg(TRACE, "Exit\n");
1547         return err;
1548 }
1549
1550 static s32
1551 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1552 {
1553         struct brcmf_if *ifp = netdev_priv(ndev);
1554
1555         brcmf_dbg(TRACE, "Enter\n");
1556         if (!check_vif_up(ifp->vif)) {
1557                 /* When driver is being unloaded, it can end up here. If an
1558                  * error is returned then later on a debug trace in the wireless
1559                  * core module will be printed. To avoid this 0 is returned.
1560                  */
1561                 return 0;
1562         }
1563
1564         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1565         brcmf_net_setcarrier(ifp, false);
1566
1567         brcmf_dbg(TRACE, "Exit\n");
1568
1569         return 0;
1570 }
1571
1572 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1573                                  struct cfg80211_connect_params *sme)
1574 {
1575         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1576         struct brcmf_cfg80211_security *sec;
1577         s32 val = 0;
1578         s32 err = 0;
1579
1580         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1581                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1582         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1583                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1584         else
1585                 val = WPA_AUTH_DISABLED;
1586         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1587         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1588         if (err) {
1589                 brcmf_err("set wpa_auth failed (%d)\n", err);
1590                 return err;
1591         }
1592         sec = &profile->sec;
1593         sec->wpa_versions = sme->crypto.wpa_versions;
1594         return err;
1595 }
1596
1597 static s32 brcmf_set_auth_type(struct net_device *ndev,
1598                                struct cfg80211_connect_params *sme)
1599 {
1600         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1601         struct brcmf_cfg80211_security *sec;
1602         s32 val = 0;
1603         s32 err = 0;
1604
1605         switch (sme->auth_type) {
1606         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1607                 val = 0;
1608                 brcmf_dbg(CONN, "open system\n");
1609                 break;
1610         case NL80211_AUTHTYPE_SHARED_KEY:
1611                 val = 1;
1612                 brcmf_dbg(CONN, "shared key\n");
1613                 break;
1614         default:
1615                 val = 2;
1616                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1617                 break;
1618         }
1619
1620         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1621         if (err) {
1622                 brcmf_err("set auth failed (%d)\n", err);
1623                 return err;
1624         }
1625         sec = &profile->sec;
1626         sec->auth_type = sme->auth_type;
1627         return err;
1628 }
1629
1630 static s32
1631 brcmf_set_wsec_mode(struct net_device *ndev,
1632                     struct cfg80211_connect_params *sme)
1633 {
1634         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1635         struct brcmf_cfg80211_security *sec;
1636         s32 pval = 0;
1637         s32 gval = 0;
1638         s32 wsec;
1639         s32 err = 0;
1640
1641         if (sme->crypto.n_ciphers_pairwise) {
1642                 switch (sme->crypto.ciphers_pairwise[0]) {
1643                 case WLAN_CIPHER_SUITE_WEP40:
1644                 case WLAN_CIPHER_SUITE_WEP104:
1645                         pval = WEP_ENABLED;
1646                         break;
1647                 case WLAN_CIPHER_SUITE_TKIP:
1648                         pval = TKIP_ENABLED;
1649                         break;
1650                 case WLAN_CIPHER_SUITE_CCMP:
1651                         pval = AES_ENABLED;
1652                         break;
1653                 case WLAN_CIPHER_SUITE_AES_CMAC:
1654                         pval = AES_ENABLED;
1655                         break;
1656                 default:
1657                         brcmf_err("invalid cipher pairwise (%d)\n",
1658                                   sme->crypto.ciphers_pairwise[0]);
1659                         return -EINVAL;
1660                 }
1661         }
1662         if (sme->crypto.cipher_group) {
1663                 switch (sme->crypto.cipher_group) {
1664                 case WLAN_CIPHER_SUITE_WEP40:
1665                 case WLAN_CIPHER_SUITE_WEP104:
1666                         gval = WEP_ENABLED;
1667                         break;
1668                 case WLAN_CIPHER_SUITE_TKIP:
1669                         gval = TKIP_ENABLED;
1670                         break;
1671                 case WLAN_CIPHER_SUITE_CCMP:
1672                         gval = AES_ENABLED;
1673                         break;
1674                 case WLAN_CIPHER_SUITE_AES_CMAC:
1675                         gval = AES_ENABLED;
1676                         break;
1677                 default:
1678                         brcmf_err("invalid cipher group (%d)\n",
1679                                   sme->crypto.cipher_group);
1680                         return -EINVAL;
1681                 }
1682         }
1683
1684         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1685         /* In case of privacy, but no security and WPS then simulate */
1686         /* setting AES. WPS-2.0 allows no security                   */
1687         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1688             sme->privacy)
1689                 pval = AES_ENABLED;
1690
1691         wsec = pval | gval;
1692         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1693         if (err) {
1694                 brcmf_err("error (%d)\n", err);
1695                 return err;
1696         }
1697
1698         sec = &profile->sec;
1699         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1700         sec->cipher_group = sme->crypto.cipher_group;
1701
1702         return err;
1703 }
1704
1705 static s32
1706 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1707 {
1708         struct brcmf_if *ifp = netdev_priv(ndev);
1709         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1710         s32 val;
1711         s32 err;
1712         const struct brcmf_tlv *rsn_ie;
1713         const u8 *ie;
1714         u32 ie_len;
1715         u32 offset;
1716         u16 rsn_cap;
1717         u32 mfp;
1718         u16 count;
1719
1720         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1721
1722         if (!sme->crypto.n_akm_suites)
1723                 return 0;
1724
1725         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1726         if (err) {
1727                 brcmf_err("could not get wpa_auth (%d)\n", err);
1728                 return err;
1729         }
1730         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1731                 switch (sme->crypto.akm_suites[0]) {
1732                 case WLAN_AKM_SUITE_8021X:
1733                         val = WPA_AUTH_UNSPECIFIED;
1734                         if (sme->want_1x)
1735                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1736                         break;
1737                 case WLAN_AKM_SUITE_PSK:
1738                         val = WPA_AUTH_PSK;
1739                         break;
1740                 default:
1741                         brcmf_err("invalid cipher group (%d)\n",
1742                                   sme->crypto.cipher_group);
1743                         return -EINVAL;
1744                 }
1745         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1746                 switch (sme->crypto.akm_suites[0]) {
1747                 case WLAN_AKM_SUITE_8021X:
1748                         val = WPA2_AUTH_UNSPECIFIED;
1749                         if (sme->want_1x)
1750                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1751                         break;
1752                 case WLAN_AKM_SUITE_8021X_SHA256:
1753                         val = WPA2_AUTH_1X_SHA256;
1754                         if (sme->want_1x)
1755                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1756                         break;
1757                 case WLAN_AKM_SUITE_PSK_SHA256:
1758                         val = WPA2_AUTH_PSK_SHA256;
1759                         break;
1760                 case WLAN_AKM_SUITE_PSK:
1761                         val = WPA2_AUTH_PSK;
1762                         break;
1763                 default:
1764                         brcmf_err("invalid cipher group (%d)\n",
1765                                   sme->crypto.cipher_group);
1766                         return -EINVAL;
1767                 }
1768         }
1769
1770         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
1771                 brcmf_dbg(INFO, "using 1X offload\n");
1772
1773         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1774                 goto skip_mfp_config;
1775         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1776          * IE will not be verified, just a quick search for MFP config
1777          */
1778         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1779                                   WLAN_EID_RSN);
1780         if (!rsn_ie)
1781                 goto skip_mfp_config;
1782         ie = (const u8 *)rsn_ie;
1783         ie_len = rsn_ie->len + TLV_HDR_LEN;
1784         /* Skip unicast suite */
1785         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1786         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1787                 goto skip_mfp_config;
1788         /* Skip multicast suite */
1789         count = ie[offset] + (ie[offset + 1] << 8);
1790         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1791         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1792                 goto skip_mfp_config;
1793         /* Skip auth key management suite(s) */
1794         count = ie[offset] + (ie[offset + 1] << 8);
1795         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1796         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1797                 goto skip_mfp_config;
1798         /* Ready to read capabilities */
1799         mfp = BRCMF_MFP_NONE;
1800         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1801         if (rsn_cap & RSN_CAP_MFPR_MASK)
1802                 mfp = BRCMF_MFP_REQUIRED;
1803         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1804                 mfp = BRCMF_MFP_CAPABLE;
1805         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1806
1807 skip_mfp_config:
1808         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1809         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1810         if (err) {
1811                 brcmf_err("could not set wpa_auth (%d)\n", err);
1812                 return err;
1813         }
1814
1815         return err;
1816 }
1817
1818 static s32
1819 brcmf_set_sharedkey(struct net_device *ndev,
1820                     struct cfg80211_connect_params *sme)
1821 {
1822         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1823         struct brcmf_cfg80211_security *sec;
1824         struct brcmf_wsec_key key;
1825         s32 val;
1826         s32 err = 0;
1827
1828         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1829
1830         if (sme->key_len == 0)
1831                 return 0;
1832
1833         sec = &profile->sec;
1834         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1835                   sec->wpa_versions, sec->cipher_pairwise);
1836
1837         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1838                 return 0;
1839
1840         if (!(sec->cipher_pairwise &
1841             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1842                 return 0;
1843
1844         memset(&key, 0, sizeof(key));
1845         key.len = (u32) sme->key_len;
1846         key.index = (u32) sme->key_idx;
1847         if (key.len > sizeof(key.data)) {
1848                 brcmf_err("Too long key length (%u)\n", key.len);
1849                 return -EINVAL;
1850         }
1851         memcpy(key.data, sme->key, key.len);
1852         key.flags = BRCMF_PRIMARY_KEY;
1853         switch (sec->cipher_pairwise) {
1854         case WLAN_CIPHER_SUITE_WEP40:
1855                 key.algo = CRYPTO_ALGO_WEP1;
1856                 break;
1857         case WLAN_CIPHER_SUITE_WEP104:
1858                 key.algo = CRYPTO_ALGO_WEP128;
1859                 break;
1860         default:
1861                 brcmf_err("Invalid algorithm (%d)\n",
1862                           sme->crypto.ciphers_pairwise[0]);
1863                 return -EINVAL;
1864         }
1865         /* Set the new key/index */
1866         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1867                   key.len, key.index, key.algo);
1868         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1869         err = send_key_to_dongle(netdev_priv(ndev), &key);
1870         if (err)
1871                 return err;
1872
1873         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1874                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1875                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1876                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1877                 if (err)
1878                         brcmf_err("set auth failed (%d)\n", err);
1879         }
1880         return err;
1881 }
1882
1883 static
1884 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1885                                            enum nl80211_auth_type type)
1886 {
1887         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1888             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1889                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1890                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1891         }
1892         return type;
1893 }
1894
1895 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1896                                 struct cfg80211_bss_selection *bss_select)
1897 {
1898         struct brcmf_join_pref_params join_pref_params[2];
1899         enum nl80211_band band;
1900         int err, i = 0;
1901
1902         join_pref_params[i].len = 2;
1903         join_pref_params[i].rssi_gain = 0;
1904
1905         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1906                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1907
1908         switch (bss_select->behaviour) {
1909         case __NL80211_BSS_SELECT_ATTR_INVALID:
1910                 brcmf_c_set_joinpref_default(ifp);
1911                 return;
1912         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1913                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1914                 band = bss_select->param.band_pref;
1915                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1916                 i++;
1917                 break;
1918         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1919                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1920                 band = bss_select->param.adjust.band;
1921                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1922                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1923                 i++;
1924                 break;
1925         case NL80211_BSS_SELECT_ATTR_RSSI:
1926         default:
1927                 break;
1928         }
1929         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1930         join_pref_params[i].len = 2;
1931         join_pref_params[i].rssi_gain = 0;
1932         join_pref_params[i].band = 0;
1933         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1934                                        sizeof(join_pref_params));
1935         if (err)
1936                 brcmf_err("Set join_pref error (%d)\n", err);
1937 }
1938
1939 static s32
1940 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1941                        struct cfg80211_connect_params *sme)
1942 {
1943         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1944         struct brcmf_if *ifp = netdev_priv(ndev);
1945         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1946         struct ieee80211_channel *chan = sme->channel;
1947         struct brcmf_join_params join_params;
1948         size_t join_params_size;
1949         const struct brcmf_tlv *rsn_ie;
1950         const struct brcmf_vs_tlv *wpa_ie;
1951         const void *ie;
1952         u32 ie_len;
1953         struct brcmf_ext_join_params_le *ext_join_params;
1954         u16 chanspec;
1955         s32 err = 0;
1956         u32 ssid_len;
1957
1958         brcmf_dbg(TRACE, "Enter\n");
1959         if (!check_vif_up(ifp->vif))
1960                 return -EIO;
1961
1962         if (!sme->ssid) {
1963                 brcmf_err("Invalid ssid\n");
1964                 return -EOPNOTSUPP;
1965         }
1966
1967         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1968                 /* A normal (non P2P) connection request setup. */
1969                 ie = NULL;
1970                 ie_len = 0;
1971                 /* find the WPA_IE */
1972                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1973                 if (wpa_ie) {
1974                         ie = wpa_ie;
1975                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1976                 } else {
1977                         /* find the RSN_IE */
1978                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1979                                                   sme->ie_len,
1980                                                   WLAN_EID_RSN);
1981                         if (rsn_ie) {
1982                                 ie = rsn_ie;
1983                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1984                         }
1985                 }
1986                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1987         }
1988
1989         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1990                                     sme->ie, sme->ie_len);
1991         if (err)
1992                 brcmf_err("Set Assoc REQ IE Failed\n");
1993         else
1994                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1995
1996         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1997
1998         if (chan) {
1999                 cfg->channel =
2000                         ieee80211_frequency_to_channel(chan->center_freq);
2001                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2002                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2003                           cfg->channel, chan->center_freq, chanspec);
2004         } else {
2005                 cfg->channel = 0;
2006                 chanspec = 0;
2007         }
2008
2009         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2010
2011         err = brcmf_set_wpa_version(ndev, sme);
2012         if (err) {
2013                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
2014                 goto done;
2015         }
2016
2017         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2018         err = brcmf_set_auth_type(ndev, sme);
2019         if (err) {
2020                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
2021                 goto done;
2022         }
2023
2024         err = brcmf_set_wsec_mode(ndev, sme);
2025         if (err) {
2026                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
2027                 goto done;
2028         }
2029
2030         err = brcmf_set_key_mgmt(ndev, sme);
2031         if (err) {
2032                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2033                 goto done;
2034         }
2035
2036         err = brcmf_set_sharedkey(ndev, sme);
2037         if (err) {
2038                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2039                 goto done;
2040         }
2041
2042         if (sme->crypto.psk) {
2043                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2044                         err = -EINVAL;
2045                         goto done;
2046                 }
2047                 brcmf_dbg(INFO, "using PSK offload\n");
2048                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2049         }
2050
2051         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2052                 /* enable firmware supplicant for this interface */
2053                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2054                 if (err < 0) {
2055                         brcmf_err("failed to enable fw supplicant\n");
2056                         goto done;
2057                 }
2058         }
2059
2060         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
2061                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2062                                     BRCMF_WSEC_MAX_PSK_LEN);
2063                 if (err)
2064                         goto done;
2065         }
2066
2067         /* Join with specific BSSID and cached SSID
2068          * If SSID is zero join based on BSSID only
2069          */
2070         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2071                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2072         if (cfg->channel)
2073                 join_params_size += sizeof(u16);
2074         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2075         if (ext_join_params == NULL) {
2076                 err = -ENOMEM;
2077                 goto done;
2078         }
2079         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2080         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2081         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2082         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2083                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2084                           ext_join_params->ssid_le.SSID, ssid_len);
2085
2086         /* Set up join scan parameters */
2087         ext_join_params->scan_le.scan_type = -1;
2088         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2089
2090         if (sme->bssid)
2091                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2092         else
2093                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2094
2095         if (cfg->channel) {
2096                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2097
2098                 ext_join_params->assoc_le.chanspec_list[0] =
2099                         cpu_to_le16(chanspec);
2100                 /* Increase dwell time to receive probe response or detect
2101                  * beacon from target AP at a noisy air only during connect
2102                  * command.
2103                  */
2104                 ext_join_params->scan_le.active_time =
2105                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2106                 ext_join_params->scan_le.passive_time =
2107                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2108                 /* To sync with presence period of VSDB GO send probe request
2109                  * more frequently. Probe request will be stopped when it gets
2110                  * probe response from target AP/GO.
2111                  */
2112                 ext_join_params->scan_le.nprobes =
2113                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2114                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2115         } else {
2116                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2117                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2118                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2119         }
2120
2121         brcmf_set_join_pref(ifp, &sme->bss_select);
2122
2123         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2124                                          join_params_size);
2125         kfree(ext_join_params);
2126         if (!err)
2127                 /* This is it. join command worked, we are done */
2128                 goto done;
2129
2130         /* join command failed, fallback to set ssid */
2131         memset(&join_params, 0, sizeof(join_params));
2132         join_params_size = sizeof(join_params.ssid_le);
2133
2134         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2135         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2136
2137         if (sme->bssid)
2138                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2139         else
2140                 eth_broadcast_addr(join_params.params_le.bssid);
2141
2142         if (cfg->channel) {
2143                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2144                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2145                 join_params_size += sizeof(join_params.params_le);
2146         }
2147         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2148                                      &join_params, join_params_size);
2149         if (err)
2150                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2151
2152 done:
2153         if (err)
2154                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2155         brcmf_dbg(TRACE, "Exit\n");
2156         return err;
2157 }
2158
2159 static s32
2160 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2161                        u16 reason_code)
2162 {
2163         struct brcmf_if *ifp = netdev_priv(ndev);
2164         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2165         struct brcmf_scb_val_le scbval;
2166         s32 err = 0;
2167
2168         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2169         if (!check_vif_up(ifp->vif))
2170                 return -EIO;
2171
2172         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2173         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2174         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2175
2176         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2177         scbval.val = cpu_to_le32(reason_code);
2178         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2179                                      &scbval, sizeof(scbval));
2180         if (err)
2181                 brcmf_err("error (%d)\n", err);
2182
2183         brcmf_dbg(TRACE, "Exit\n");
2184         return err;
2185 }
2186
2187 static s32
2188 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2189                             enum nl80211_tx_power_setting type, s32 mbm)
2190 {
2191         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2192         struct net_device *ndev = cfg_to_ndev(cfg);
2193         struct brcmf_if *ifp = netdev_priv(ndev);
2194         s32 err;
2195         s32 disable;
2196         u32 qdbm = 127;
2197
2198         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2199         if (!check_vif_up(ifp->vif))
2200                 return -EIO;
2201
2202         switch (type) {
2203         case NL80211_TX_POWER_AUTOMATIC:
2204                 break;
2205         case NL80211_TX_POWER_LIMITED:
2206         case NL80211_TX_POWER_FIXED:
2207                 if (mbm < 0) {
2208                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2209                         err = -EINVAL;
2210                         goto done;
2211                 }
2212                 qdbm =  MBM_TO_DBM(4 * mbm);
2213                 if (qdbm > 127)
2214                         qdbm = 127;
2215                 qdbm |= WL_TXPWR_OVERRIDE;
2216                 break;
2217         default:
2218                 brcmf_err("Unsupported type %d\n", type);
2219                 err = -EINVAL;
2220                 goto done;
2221         }
2222         /* Make sure radio is off or on as far as software is concerned */
2223         disable = WL_RADIO_SW_DISABLE << 16;
2224         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2225         if (err)
2226                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2227
2228         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2229         if (err)
2230                 brcmf_err("qtxpower error (%d)\n", err);
2231
2232 done:
2233         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2234         return err;
2235 }
2236
2237 static s32
2238 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2239                             s32 *dbm)
2240 {
2241         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2242         struct net_device *ndev = cfg_to_ndev(cfg);
2243         struct brcmf_if *ifp = netdev_priv(ndev);
2244         s32 qdbm = 0;
2245         s32 err;
2246
2247         brcmf_dbg(TRACE, "Enter\n");
2248         if (!check_vif_up(ifp->vif))
2249                 return -EIO;
2250
2251         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2252         if (err) {
2253                 brcmf_err("error (%d)\n", err);
2254                 goto done;
2255         }
2256         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2257
2258 done:
2259         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2260         return err;
2261 }
2262
2263 static s32
2264 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2265                                   u8 key_idx, bool unicast, bool multicast)
2266 {
2267         struct brcmf_if *ifp = netdev_priv(ndev);
2268         u32 index;
2269         u32 wsec;
2270         s32 err = 0;
2271
2272         brcmf_dbg(TRACE, "Enter\n");
2273         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2274         if (!check_vif_up(ifp->vif))
2275                 return -EIO;
2276
2277         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2278         if (err) {
2279                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2280                 goto done;
2281         }
2282
2283         if (wsec & WEP_ENABLED) {
2284                 /* Just select a new current key */
2285                 index = key_idx;
2286                 err = brcmf_fil_cmd_int_set(ifp,
2287                                             BRCMF_C_SET_KEY_PRIMARY, index);
2288                 if (err)
2289                         brcmf_err("error (%d)\n", err);
2290         }
2291 done:
2292         brcmf_dbg(TRACE, "Exit\n");
2293         return err;
2294 }
2295
2296 static s32
2297 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2298                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2299 {
2300         struct brcmf_if *ifp = netdev_priv(ndev);
2301         struct brcmf_wsec_key *key;
2302         s32 err;
2303
2304         brcmf_dbg(TRACE, "Enter\n");
2305         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2306
2307         if (!check_vif_up(ifp->vif))
2308                 return -EIO;
2309
2310         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2311                 /* we ignore this key index in this case */
2312                 return -EINVAL;
2313         }
2314
2315         key = &ifp->vif->profile.key[key_idx];
2316
2317         if (key->algo == CRYPTO_ALGO_OFF) {
2318                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2319                 return -EINVAL;
2320         }
2321
2322         memset(key, 0, sizeof(*key));
2323         key->index = (u32)key_idx;
2324         key->flags = BRCMF_PRIMARY_KEY;
2325
2326         /* Clear the key/index */
2327         err = send_key_to_dongle(ifp, key);
2328
2329         brcmf_dbg(TRACE, "Exit\n");
2330         return err;
2331 }
2332
2333 static s32
2334 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2335                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2336                        struct key_params *params)
2337 {
2338         struct brcmf_if *ifp = netdev_priv(ndev);
2339         struct brcmf_wsec_key *key;
2340         s32 val;
2341         s32 wsec;
2342         s32 err;
2343         u8 keybuf[8];
2344         bool ext_key;
2345
2346         brcmf_dbg(TRACE, "Enter\n");
2347         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2348         if (!check_vif_up(ifp->vif))
2349                 return -EIO;
2350
2351         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2352                 /* we ignore this key index in this case */
2353                 brcmf_err("invalid key index (%d)\n", key_idx);
2354                 return -EINVAL;
2355         }
2356
2357         if (params->key_len == 0)
2358                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2359                                               mac_addr);
2360
2361         if (params->key_len > sizeof(key->data)) {
2362                 brcmf_err("Too long key length (%u)\n", params->key_len);
2363                 return -EINVAL;
2364         }
2365
2366         ext_key = false;
2367         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2368             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2369                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2370                 ext_key = true;
2371         }
2372
2373         key = &ifp->vif->profile.key[key_idx];
2374         memset(key, 0, sizeof(*key));
2375         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2376                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2377         key->len = params->key_len;
2378         key->index = key_idx;
2379         memcpy(key->data, params->key, key->len);
2380         if (!ext_key)
2381                 key->flags = BRCMF_PRIMARY_KEY;
2382
2383         switch (params->cipher) {
2384         case WLAN_CIPHER_SUITE_WEP40:
2385                 key->algo = CRYPTO_ALGO_WEP1;
2386                 val = WEP_ENABLED;
2387                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2388                 break;
2389         case WLAN_CIPHER_SUITE_WEP104:
2390                 key->algo = CRYPTO_ALGO_WEP128;
2391                 val = WEP_ENABLED;
2392                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2393                 break;
2394         case WLAN_CIPHER_SUITE_TKIP:
2395                 if (!brcmf_is_apmode(ifp->vif)) {
2396                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2397                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2398                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2399                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2400                 }
2401                 key->algo = CRYPTO_ALGO_TKIP;
2402                 val = TKIP_ENABLED;
2403                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2404                 break;
2405         case WLAN_CIPHER_SUITE_AES_CMAC:
2406                 key->algo = CRYPTO_ALGO_AES_CCM;
2407                 val = AES_ENABLED;
2408                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2409                 break;
2410         case WLAN_CIPHER_SUITE_CCMP:
2411                 key->algo = CRYPTO_ALGO_AES_CCM;
2412                 val = AES_ENABLED;
2413                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2414                 break;
2415         default:
2416                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2417                 err = -EINVAL;
2418                 goto done;
2419         }
2420
2421         err = send_key_to_dongle(ifp, key);
2422         if (ext_key || err)
2423                 goto done;
2424
2425         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2426         if (err) {
2427                 brcmf_err("get wsec error (%d)\n", err);
2428                 goto done;
2429         }
2430         wsec |= val;
2431         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2432         if (err) {
2433                 brcmf_err("set wsec error (%d)\n", err);
2434                 goto done;
2435         }
2436
2437 done:
2438         brcmf_dbg(TRACE, "Exit\n");
2439         return err;
2440 }
2441
2442 static s32
2443 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2444                        bool pairwise, const u8 *mac_addr, void *cookie,
2445                        void (*callback)(void *cookie,
2446                                         struct key_params *params))
2447 {
2448         struct key_params params;
2449         struct brcmf_if *ifp = netdev_priv(ndev);
2450         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2451         struct brcmf_cfg80211_security *sec;
2452         s32 wsec;
2453         s32 err = 0;
2454
2455         brcmf_dbg(TRACE, "Enter\n");
2456         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2457         if (!check_vif_up(ifp->vif))
2458                 return -EIO;
2459
2460         memset(&params, 0, sizeof(params));
2461
2462         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2463         if (err) {
2464                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2465                 /* Ignore this error, may happen during DISASSOC */
2466                 err = -EAGAIN;
2467                 goto done;
2468         }
2469         if (wsec & WEP_ENABLED) {
2470                 sec = &profile->sec;
2471                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2472                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2473                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2474                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2475                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2476                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2477                 }
2478         } else if (wsec & TKIP_ENABLED) {
2479                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2480                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2481         } else if (wsec & AES_ENABLED) {
2482                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2483                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2484         } else  {
2485                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2486                 err = -EINVAL;
2487                 goto done;
2488         }
2489         callback(cookie, &params);
2490
2491 done:
2492         brcmf_dbg(TRACE, "Exit\n");
2493         return err;
2494 }
2495
2496 static s32
2497 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2498                                        struct net_device *ndev, u8 key_idx)
2499 {
2500         struct brcmf_if *ifp = netdev_priv(ndev);
2501
2502         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2503
2504         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2505                 return 0;
2506
2507         brcmf_dbg(INFO, "Not supported\n");
2508
2509         return -EOPNOTSUPP;
2510 }
2511
2512 static void
2513 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2514 {
2515         s32 err;
2516         u8 key_idx;
2517         struct brcmf_wsec_key *key;
2518         s32 wsec;
2519
2520         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2521                 key = &ifp->vif->profile.key[key_idx];
2522                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2523                     (key->algo == CRYPTO_ALGO_WEP128))
2524                         break;
2525         }
2526         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2527                 return;
2528
2529         err = send_key_to_dongle(ifp, key);
2530         if (err) {
2531                 brcmf_err("Setting WEP key failed (%d)\n", err);
2532                 return;
2533         }
2534         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2535         if (err) {
2536                 brcmf_err("get wsec error (%d)\n", err);
2537                 return;
2538         }
2539         wsec |= WEP_ENABLED;
2540         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2541         if (err)
2542                 brcmf_err("set wsec error (%d)\n", err);
2543 }
2544
2545 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2546 {
2547         struct nl80211_sta_flag_update *sfu;
2548
2549         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2550         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2551         sfu = &si->sta_flags;
2552         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2553                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2554                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2555                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2556         if (fw_sta_flags & BRCMF_STA_WME)
2557                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2558         if (fw_sta_flags & BRCMF_STA_AUTHE)
2559                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2560         if (fw_sta_flags & BRCMF_STA_ASSOC)
2561                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2562         if (fw_sta_flags & BRCMF_STA_AUTHO)
2563                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2564 }
2565
2566 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2567 {
2568         struct {
2569                 __le32 len;
2570                 struct brcmf_bss_info_le bss_le;
2571         } *buf;
2572         u16 capability;
2573         int err;
2574
2575         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2576         if (!buf)
2577                 return;
2578
2579         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2580         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2581                                      WL_BSS_INFO_MAX);
2582         if (err) {
2583                 brcmf_err("Failed to get bss info (%d)\n", err);
2584                 goto out_kfree;
2585         }
2586         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2587         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2588         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2589         capability = le16_to_cpu(buf->bss_le.capability);
2590         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2591                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2592         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2593                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2594         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2595                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2596
2597 out_kfree:
2598         kfree(buf);
2599 }
2600
2601 static s32
2602 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2603                                 struct station_info *sinfo)
2604 {
2605         struct brcmf_scb_val_le scbval;
2606         struct brcmf_pktcnt_le pktcnt;
2607         s32 err;
2608         u32 rate;
2609         u32 rssi;
2610
2611         /* Get the current tx rate */
2612         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2613         if (err < 0) {
2614                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2615                 return err;
2616         }
2617         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2618         sinfo->txrate.legacy = rate * 5;
2619
2620         memset(&scbval, 0, sizeof(scbval));
2621         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2622                                      sizeof(scbval));
2623         if (err) {
2624                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2625                 return err;
2626         }
2627         rssi = le32_to_cpu(scbval.val);
2628         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2629         sinfo->signal = rssi;
2630
2631         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2632                                      sizeof(pktcnt));
2633         if (err) {
2634                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2635                 return err;
2636         }
2637         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2638                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2639                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2640                          BIT(NL80211_STA_INFO_TX_FAILED);
2641         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2642         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2643         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2644         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2645
2646         return 0;
2647 }
2648
2649 static s32
2650 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2651                            const u8 *mac, struct station_info *sinfo)
2652 {
2653         struct brcmf_if *ifp = netdev_priv(ndev);
2654         struct brcmf_scb_val_le scb_val;
2655         s32 err = 0;
2656         struct brcmf_sta_info_le sta_info_le;
2657         u32 sta_flags;
2658         u32 is_tdls_peer;
2659         s32 total_rssi;
2660         s32 count_rssi;
2661         int rssi;
2662         u32 i;
2663
2664         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2665         if (!check_vif_up(ifp->vif))
2666                 return -EIO;
2667
2668         if (brcmf_is_ibssmode(ifp->vif))
2669                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2670
2671         memset(&sta_info_le, 0, sizeof(sta_info_le));
2672         memcpy(&sta_info_le, mac, ETH_ALEN);
2673         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2674                                        &sta_info_le,
2675                                        sizeof(sta_info_le));
2676         is_tdls_peer = !err;
2677         if (err) {
2678                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2679                                                &sta_info_le,
2680                                                sizeof(sta_info_le));
2681                 if (err < 0) {
2682                         brcmf_err("GET STA INFO failed, %d\n", err);
2683                         goto done;
2684                 }
2685         }
2686         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2687         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2688         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2689         sta_flags = le32_to_cpu(sta_info_le.flags);
2690         brcmf_convert_sta_flags(sta_flags, sinfo);
2691         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2692         if (is_tdls_peer)
2693                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2694         else
2695                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2696         if (sta_flags & BRCMF_STA_ASSOC) {
2697                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2698                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2699                 brcmf_fill_bss_param(ifp, sinfo);
2700         }
2701         if (sta_flags & BRCMF_STA_SCBSTATS) {
2702                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2703                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2704                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2705                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2706                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2707                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2708                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2709                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2710                 if (sinfo->tx_packets) {
2711                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2712                         sinfo->txrate.legacy =
2713                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2714                 }
2715                 if (sinfo->rx_packets) {
2716                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2717                         sinfo->rxrate.legacy =
2718                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2719                 }
2720                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2721                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2722                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2723                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2724                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2725                 }
2726                 total_rssi = 0;
2727                 count_rssi = 0;
2728                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2729                         if (sta_info_le.rssi[i]) {
2730                                 sinfo->chain_signal_avg[count_rssi] =
2731                                         sta_info_le.rssi[i];
2732                                 sinfo->chain_signal[count_rssi] =
2733                                         sta_info_le.rssi[i];
2734                                 total_rssi += sta_info_le.rssi[i];
2735                                 count_rssi++;
2736                         }
2737                 }
2738                 if (count_rssi) {
2739                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2740                         sinfo->chains = count_rssi;
2741
2742                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2743                         total_rssi /= count_rssi;
2744                         sinfo->signal = total_rssi;
2745                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2746                         &ifp->vif->sme_state)) {
2747                         memset(&scb_val, 0, sizeof(scb_val));
2748                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2749                                                      &scb_val, sizeof(scb_val));
2750                         if (err) {
2751                                 brcmf_err("Could not get rssi (%d)\n", err);
2752                                 goto done;
2753                         } else {
2754                                 rssi = le32_to_cpu(scb_val.val);
2755                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2756                                 sinfo->signal = rssi;
2757                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2758                         }
2759                 }
2760         }
2761 done:
2762         brcmf_dbg(TRACE, "Exit\n");
2763         return err;
2764 }
2765
2766 static int
2767 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2768                             int idx, u8 *mac, struct station_info *sinfo)
2769 {
2770         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2771         struct brcmf_if *ifp = netdev_priv(ndev);
2772         s32 err;
2773
2774         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2775
2776         if (idx == 0) {
2777                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2778                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2779                                              &cfg->assoclist,
2780                                              sizeof(cfg->assoclist));
2781                 if (err) {
2782                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2783                                   err);
2784                         cfg->assoclist.count = 0;
2785                         return -EOPNOTSUPP;
2786                 }
2787         }
2788         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2789                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2790                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2791         }
2792         return -ENOENT;
2793 }
2794
2795 static s32
2796 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2797                            bool enabled, s32 timeout)
2798 {
2799         s32 pm;
2800         s32 err = 0;
2801         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2802         struct brcmf_if *ifp = netdev_priv(ndev);
2803
2804         brcmf_dbg(TRACE, "Enter\n");
2805
2806         /*
2807          * Powersave enable/disable request is coming from the
2808          * cfg80211 even before the interface is up. In that
2809          * scenario, driver will be storing the power save
2810          * preference in cfg struct to apply this to
2811          * FW later while initializing the dongle
2812          */
2813         cfg->pwr_save = enabled;
2814         if (!check_vif_up(ifp->vif)) {
2815
2816                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2817                 goto done;
2818         }
2819
2820         pm = enabled ? PM_FAST : PM_OFF;
2821         /* Do not enable the power save after assoc if it is a p2p interface */
2822         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2823                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2824                 pm = PM_OFF;
2825         }
2826         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2827
2828         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2829         if (err) {
2830                 if (err == -ENODEV)
2831                         brcmf_err("net_device is not ready yet\n");
2832                 else
2833                         brcmf_err("error (%d)\n", err);
2834         }
2835 done:
2836         brcmf_dbg(TRACE, "Exit\n");
2837         return err;
2838 }
2839
2840 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2841                                    struct brcmf_bss_info_le *bi)
2842 {
2843         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2844         struct ieee80211_channel *notify_channel;
2845         struct cfg80211_bss *bss;
2846         struct ieee80211_supported_band *band;
2847         struct brcmu_chan ch;
2848         u16 channel;
2849         u32 freq;
2850         u16 notify_capability;
2851         u16 notify_interval;
2852         u8 *notify_ie;
2853         size_t notify_ielen;
2854         s32 notify_signal;
2855
2856         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2857                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2858                 return 0;
2859         }
2860
2861         if (!bi->ctl_ch) {
2862                 ch.chspec = le16_to_cpu(bi->chanspec);
2863                 cfg->d11inf.decchspec(&ch);
2864                 bi->ctl_ch = ch.control_ch_num;
2865         }
2866         channel = bi->ctl_ch;
2867
2868         if (channel <= CH_MAX_2G_CHANNEL)
2869                 band = wiphy->bands[NL80211_BAND_2GHZ];
2870         else
2871                 band = wiphy->bands[NL80211_BAND_5GHZ];
2872
2873         freq = ieee80211_channel_to_frequency(channel, band->band);
2874         notify_channel = ieee80211_get_channel(wiphy, freq);
2875
2876         notify_capability = le16_to_cpu(bi->capability);
2877         notify_interval = le16_to_cpu(bi->beacon_period);
2878         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2879         notify_ielen = le32_to_cpu(bi->ie_length);
2880         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2881
2882         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2883         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2884         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2885         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2886         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2887
2888         bss = cfg80211_inform_bss(wiphy, notify_channel,
2889                                   CFG80211_BSS_FTYPE_UNKNOWN,
2890                                   (const u8 *)bi->BSSID,
2891                                   0, notify_capability,
2892                                   notify_interval, notify_ie,
2893                                   notify_ielen, notify_signal,
2894                                   GFP_KERNEL);
2895
2896         if (!bss)
2897                 return -ENOMEM;
2898
2899         cfg80211_put_bss(wiphy, bss);
2900
2901         return 0;
2902 }
2903
2904 static struct brcmf_bss_info_le *
2905 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2906 {
2907         if (bss == NULL)
2908                 return list->bss_info_le;
2909         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2910                                             le32_to_cpu(bss->length));
2911 }
2912
2913 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2914 {
2915         struct brcmf_scan_results *bss_list;
2916         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2917         s32 err = 0;
2918         int i;
2919
2920         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2921         if (bss_list->count != 0 &&
2922             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2923                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2924                           bss_list->version);
2925                 return -EOPNOTSUPP;
2926         }
2927         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2928         for (i = 0; i < bss_list->count; i++) {
2929                 bi = next_bss_le(bss_list, bi);
2930                 err = brcmf_inform_single_bss(cfg, bi);
2931                 if (err)
2932                         break;
2933         }
2934         return err;
2935 }
2936
2937 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2938                              struct net_device *ndev, const u8 *bssid)
2939 {
2940         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2941         struct ieee80211_channel *notify_channel;
2942         struct brcmf_bss_info_le *bi = NULL;
2943         struct ieee80211_supported_band *band;
2944         struct cfg80211_bss *bss;
2945         struct brcmu_chan ch;
2946         u8 *buf = NULL;
2947         s32 err = 0;
2948         u32 freq;
2949         u16 notify_capability;
2950         u16 notify_interval;
2951         u8 *notify_ie;
2952         size_t notify_ielen;
2953         s32 notify_signal;
2954
2955         brcmf_dbg(TRACE, "Enter\n");
2956
2957         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2958         if (buf == NULL) {
2959                 err = -ENOMEM;
2960                 goto CleanUp;
2961         }
2962
2963         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2964
2965         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2966                                      buf, WL_BSS_INFO_MAX);
2967         if (err) {
2968                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2969                 goto CleanUp;
2970         }
2971
2972         bi = (struct brcmf_bss_info_le *)(buf + 4);
2973
2974         ch.chspec = le16_to_cpu(bi->chanspec);
2975         cfg->d11inf.decchspec(&ch);
2976
2977         if (ch.band == BRCMU_CHAN_BAND_2G)
2978                 band = wiphy->bands[NL80211_BAND_2GHZ];
2979         else
2980                 band = wiphy->bands[NL80211_BAND_5GHZ];
2981
2982         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2983         cfg->channel = freq;
2984         notify_channel = ieee80211_get_channel(wiphy, freq);
2985
2986         notify_capability = le16_to_cpu(bi->capability);
2987         notify_interval = le16_to_cpu(bi->beacon_period);
2988         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2989         notify_ielen = le32_to_cpu(bi->ie_length);
2990         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2991
2992         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2993         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2994         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2995         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2996
2997         bss = cfg80211_inform_bss(wiphy, notify_channel,
2998                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2999                                   notify_capability, notify_interval,
3000                                   notify_ie, notify_ielen, notify_signal,
3001                                   GFP_KERNEL);
3002
3003         if (!bss) {
3004                 err = -ENOMEM;
3005                 goto CleanUp;
3006         }
3007
3008         cfg80211_put_bss(wiphy, bss);
3009
3010 CleanUp:
3011
3012         kfree(buf);
3013
3014         brcmf_dbg(TRACE, "Exit\n");
3015
3016         return err;
3017 }
3018
3019 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3020                                  struct brcmf_if *ifp)
3021 {
3022         struct brcmf_bss_info_le *bi;
3023         const struct brcmf_tlv *tim;
3024         u16 beacon_interval;
3025         u8 dtim_period;
3026         size_t ie_len;
3027         u8 *ie;
3028         s32 err = 0;
3029
3030         brcmf_dbg(TRACE, "Enter\n");
3031         if (brcmf_is_ibssmode(ifp->vif))
3032                 return err;
3033
3034         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3035         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3036                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3037         if (err) {
3038                 brcmf_err("Could not get bss info %d\n", err);
3039                 goto update_bss_info_out;
3040         }
3041
3042         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3043         err = brcmf_inform_single_bss(cfg, bi);
3044         if (err)
3045                 goto update_bss_info_out;
3046
3047         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
3048         ie_len = le32_to_cpu(bi->ie_length);
3049         beacon_interval = le16_to_cpu(bi->beacon_period);
3050
3051         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
3052         if (tim)
3053                 dtim_period = tim->data[1];
3054         else {
3055                 /*
3056                 * active scan was done so we could not get dtim
3057                 * information out of probe response.
3058                 * so we speficially query dtim information to dongle.
3059                 */
3060                 u32 var;
3061                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3062                 if (err) {
3063                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3064                         goto update_bss_info_out;
3065                 }
3066                 dtim_period = (u8)var;
3067         }
3068
3069 update_bss_info_out:
3070         brcmf_dbg(TRACE, "Exit");
3071         return err;
3072 }
3073
3074 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3075 {
3076         struct escan_info *escan = &cfg->escan_info;
3077
3078         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3079         if (cfg->int_escan_map || cfg->scan_request) {
3080                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3081                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3082         }
3083         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3084         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3085 }
3086
3087 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3088 {
3089         struct brcmf_cfg80211_info *cfg =
3090                         container_of(work, struct brcmf_cfg80211_info,
3091                                      escan_timeout_work);
3092
3093         brcmf_inform_bss(cfg);
3094         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3095 }
3096
3097 static void brcmf_escan_timeout(unsigned long data)
3098 {
3099         struct brcmf_cfg80211_info *cfg =
3100                         (struct brcmf_cfg80211_info *)data;
3101
3102         if (cfg->int_escan_map || cfg->scan_request) {
3103                 brcmf_err("timer expired\n");
3104                 schedule_work(&cfg->escan_timeout_work);
3105         }
3106 }
3107
3108 static s32
3109 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3110                               struct brcmf_bss_info_le *bss,
3111                               struct brcmf_bss_info_le *bss_info_le)
3112 {
3113         struct brcmu_chan ch_bss, ch_bss_info_le;
3114
3115         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3116         cfg->d11inf.decchspec(&ch_bss);
3117         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3118         cfg->d11inf.decchspec(&ch_bss_info_le);
3119
3120         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3121                 ch_bss.band == ch_bss_info_le.band &&
3122                 bss_info_le->SSID_len == bss->SSID_len &&
3123                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3124                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3125                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3126                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3127                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3128
3129                         /* preserve max RSSI if the measurements are
3130                         * both on-channel or both off-channel
3131                         */
3132                         if (bss_info_rssi > bss_rssi)
3133                                 bss->RSSI = bss_info_le->RSSI;
3134                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3135                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3136                         /* preserve the on-channel rssi measurement
3137                         * if the new measurement is off channel
3138                         */
3139                         bss->RSSI = bss_info_le->RSSI;
3140                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3141                 }
3142                 return 1;
3143         }
3144         return 0;
3145 }
3146
3147 static s32
3148 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3149                              const struct brcmf_event_msg *e, void *data)
3150 {
3151         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3152         s32 status;
3153         struct brcmf_escan_result_le *escan_result_le;
3154         u32 escan_buflen;
3155         struct brcmf_bss_info_le *bss_info_le;
3156         struct brcmf_bss_info_le *bss = NULL;
3157         u32 bi_length;
3158         struct brcmf_scan_results *list;
3159         u32 i;
3160         bool aborted;
3161
3162         status = e->status;
3163
3164         if (status == BRCMF_E_STATUS_ABORT)
3165                 goto exit;
3166
3167         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3168                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3169                 return -EPERM;
3170         }
3171
3172         if (status == BRCMF_E_STATUS_PARTIAL) {
3173                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3174                 if (e->datalen < sizeof(*escan_result_le)) {
3175                         brcmf_err("invalid event data length\n");
3176                         goto exit;
3177                 }
3178                 escan_result_le = (struct brcmf_escan_result_le *) data;
3179                 if (!escan_result_le) {
3180                         brcmf_err("Invalid escan result (NULL pointer)\n");
3181                         goto exit;
3182                 }
3183                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3184                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3185                     escan_buflen > e->datalen ||
3186                     escan_buflen < sizeof(*escan_result_le)) {
3187                         brcmf_err("Invalid escan buffer length: %d\n",
3188                                   escan_buflen);
3189                         goto exit;
3190                 }
3191                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3192                         brcmf_err("Invalid bss_count %d: ignoring\n",
3193                                   escan_result_le->bss_count);
3194                         goto exit;
3195                 }
3196                 bss_info_le = &escan_result_le->bss_info_le;
3197
3198                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3199                         goto exit;
3200
3201                 if (!cfg->int_escan_map && !cfg->scan_request) {
3202                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3203                         goto exit;
3204                 }
3205
3206                 bi_length = le32_to_cpu(bss_info_le->length);
3207                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3208                         brcmf_err("Ignoring invalid bss_info length: %d\n",
3209                                   bi_length);
3210                         goto exit;
3211                 }
3212
3213                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3214                                         BIT(NL80211_IFTYPE_ADHOC))) {
3215                         if (le16_to_cpu(bss_info_le->capability) &
3216                                                 WLAN_CAPABILITY_IBSS) {
3217                                 brcmf_err("Ignoring IBSS result\n");
3218                                 goto exit;
3219                         }
3220                 }
3221
3222                 list = (struct brcmf_scan_results *)
3223                                 cfg->escan_info.escan_buf;
3224                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3225                         brcmf_err("Buffer is too small: ignoring\n");
3226                         goto exit;
3227                 }
3228
3229                 for (i = 0; i < list->count; i++) {
3230                         bss = bss ? (struct brcmf_bss_info_le *)
3231                                 ((unsigned char *)bss +
3232                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3233                         if (brcmf_compare_update_same_bss(cfg, bss,
3234                                                           bss_info_le))
3235                                 goto exit;
3236                 }
3237                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3238                        bi_length);
3239                 list->version = le32_to_cpu(bss_info_le->version);
3240                 list->buflen += bi_length;
3241                 list->count++;
3242         } else {
3243                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3244                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3245                         goto exit;
3246                 if (cfg->int_escan_map || cfg->scan_request) {
3247                         brcmf_inform_bss(cfg);
3248                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3249                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3250                 } else
3251                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3252                                   status);
3253         }
3254 exit:
3255         return 0;
3256 }
3257
3258 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3259 {
3260         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3261                             brcmf_cfg80211_escan_handler);
3262         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3263         /* Init scan_timeout timer */
3264         setup_timer(&cfg->escan_timeout, brcmf_escan_timeout,
3265                     (unsigned long)cfg);
3266         INIT_WORK(&cfg->escan_timeout_work,
3267                   brcmf_cfg80211_escan_timeout_worker);
3268 }
3269
3270 static struct cfg80211_scan_request *
3271 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3272         struct cfg80211_scan_request *req;
3273         size_t req_size;
3274
3275         req_size = sizeof(*req) +
3276                    n_netinfo * sizeof(req->channels[0]) +
3277                    n_netinfo * sizeof(*req->ssids);
3278
3279         req = kzalloc(req_size, GFP_KERNEL);
3280         if (req) {
3281                 req->wiphy = wiphy;
3282                 req->ssids = (void *)(&req->channels[0]) +
3283                              n_netinfo * sizeof(req->channels[0]);
3284         }
3285         return req;
3286 }
3287
3288 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3289                                          u8 *ssid, u8 ssid_len, u8 channel)
3290 {
3291         struct ieee80211_channel *chan;
3292         enum nl80211_band band;
3293         int freq, i;
3294
3295         if (channel <= CH_MAX_2G_CHANNEL)
3296                 band = NL80211_BAND_2GHZ;
3297         else
3298                 band = NL80211_BAND_5GHZ;
3299
3300         freq = ieee80211_channel_to_frequency(channel, band);
3301         if (!freq)
3302                 return -EINVAL;
3303
3304         chan = ieee80211_get_channel(req->wiphy, freq);
3305         if (!chan)
3306                 return -EINVAL;
3307
3308         for (i = 0; i < req->n_channels; i++) {
3309                 if (req->channels[i] == chan)
3310                         break;
3311         }
3312         if (i == req->n_channels)
3313                 req->channels[req->n_channels++] = chan;
3314
3315         for (i = 0; i < req->n_ssids; i++) {
3316                 if (req->ssids[i].ssid_len == ssid_len &&
3317                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3318                         break;
3319         }
3320         if (i == req->n_ssids) {
3321                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3322                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3323         }
3324         return 0;
3325 }
3326
3327 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3328                                       struct cfg80211_scan_request *request)
3329 {
3330         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3331         int err;
3332
3333         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3334                 if (cfg->int_escan_map)
3335                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3336                                   cfg->int_escan_map);
3337                 /* Abort any on-going scan */
3338                 brcmf_abort_scanning(cfg);
3339         }
3340
3341         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3342         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3343         cfg->escan_info.run = brcmf_run_escan;
3344         err = brcmf_do_escan(ifp, request);
3345         if (err) {
3346                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3347                 return err;
3348         }
3349         cfg->int_escan_map = fwmap;
3350         return 0;
3351 }
3352
3353 static struct brcmf_pno_net_info_le *
3354 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3355 {
3356         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3357         struct brcmf_pno_net_info_le *netinfo;
3358
3359         switch (pfn_v1->version) {
3360         default:
3361                 WARN_ON(1);
3362                 /* fall-thru */
3363         case cpu_to_le32(1):
3364                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3365                 break;
3366         case cpu_to_le32(2):
3367                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3368                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3369                 break;
3370         }
3371
3372         return netinfo;
3373 }
3374
3375 /* PFN result doesn't have all the info which are required by the supplicant
3376  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3377  * via wl_inform_single_bss in the required format. Escan does require the
3378  * scan request in the form of cfg80211_scan_request. For timebeing, create
3379  * cfg80211_scan_request one out of the received PNO event.
3380  */
3381 static s32
3382 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3383                                 const struct brcmf_event_msg *e, void *data)
3384 {
3385         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3386         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3387         struct cfg80211_scan_request *request = NULL;
3388         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3389         int i, err = 0;
3390         struct brcmf_pno_scanresults_le *pfn_result;
3391         u32 bucket_map;
3392         u32 result_count;
3393         u32 status;
3394         u32 datalen;
3395
3396         brcmf_dbg(SCAN, "Enter\n");
3397
3398         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3399                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3400                 return 0;
3401         }
3402
3403         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3404                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3405                 return 0;
3406         }
3407
3408         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3409         result_count = le32_to_cpu(pfn_result->count);
3410         status = le32_to_cpu(pfn_result->status);
3411
3412         /* PFN event is limited to fit 512 bytes so we may get
3413          * multiple NET_FOUND events. For now place a warning here.
3414          */
3415         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3416         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3417         if (!result_count) {
3418                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3419                 goto out_err;
3420         }
3421
3422         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3423         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3424         if (datalen < result_count * sizeof(*netinfo)) {
3425                 brcmf_err("insufficient event data\n");
3426                 goto out_err;
3427         }
3428
3429         request = brcmf_alloc_internal_escan_request(wiphy,
3430                                                      result_count);
3431         if (!request) {
3432                 err = -ENOMEM;
3433                 goto out_err;
3434         }
3435
3436         bucket_map = 0;
3437         for (i = 0; i < result_count; i++) {
3438                 netinfo = &netinfo_start[i];
3439
3440                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3441                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3442                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3443                           netinfo->SSID, netinfo->channel);
3444                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3445                 err = brcmf_internal_escan_add_info(request,
3446                                                     netinfo->SSID,
3447                                                     netinfo->SSID_len,
3448                                                     netinfo->channel);
3449                 if (err)
3450                         goto out_err;
3451         }
3452
3453         if (!bucket_map)
3454                 goto free_req;
3455
3456         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3457         if (!err)
3458                 goto free_req;
3459
3460 out_err:
3461         cfg80211_sched_scan_stopped(wiphy, 0);
3462 free_req:
3463         kfree(request);
3464         return err;
3465 }
3466
3467 static int
3468 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3469                                 struct net_device *ndev,
3470                                 struct cfg80211_sched_scan_request *req)
3471 {
3472         struct brcmf_if *ifp = netdev_priv(ndev);
3473         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3474
3475         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3476                   req->n_match_sets, req->n_ssids);
3477
3478         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3479                 brcmf_err("Scanning suppressed: status=%lu\n",
3480                           cfg->scan_status);
3481                 return -EAGAIN;
3482         }
3483
3484         if (req->n_match_sets <= 0) {
3485                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3486                           req->n_match_sets);
3487                 return -EINVAL;
3488         }
3489
3490         return brcmf_pno_start_sched_scan(ifp, req);
3491 }
3492
3493 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3494                                           struct net_device *ndev, u64 reqid)
3495 {
3496         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3497         struct brcmf_if *ifp = netdev_priv(ndev);
3498
3499         brcmf_dbg(SCAN, "enter\n");
3500         brcmf_pno_stop_sched_scan(ifp, reqid);
3501         if (cfg->int_escan_map)
3502                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3503         return 0;
3504 }
3505
3506 static __always_inline void brcmf_delay(u32 ms)
3507 {
3508         if (ms < 1000 / HZ) {
3509                 cond_resched();
3510                 mdelay(ms);
3511         } else {
3512                 msleep(ms);
3513         }
3514 }
3515
3516 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3517                                      u8 *pattern, u32 patternsize, u8 *mask,
3518                                      u32 packet_offset)
3519 {
3520         struct brcmf_fil_wowl_pattern_le *filter;
3521         u32 masksize;
3522         u32 patternoffset;
3523         u8 *buf;
3524         u32 bufsize;
3525         s32 ret;
3526
3527         masksize = (patternsize + 7) / 8;
3528         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3529
3530         bufsize = sizeof(*filter) + patternsize + masksize;
3531         buf = kzalloc(bufsize, GFP_KERNEL);
3532         if (!buf)
3533                 return -ENOMEM;
3534         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3535
3536         memcpy(filter->cmd, cmd, 4);
3537         filter->masksize = cpu_to_le32(masksize);
3538         filter->offset = cpu_to_le32(packet_offset);
3539         filter->patternoffset = cpu_to_le32(patternoffset);
3540         filter->patternsize = cpu_to_le32(patternsize);
3541         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3542
3543         if ((mask) && (masksize))
3544                 memcpy(buf + sizeof(*filter), mask, masksize);
3545         if ((pattern) && (patternsize))
3546                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3547
3548         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3549
3550         kfree(buf);
3551         return ret;
3552 }
3553
3554 static s32
3555 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3556                       void *data)
3557 {
3558         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3559         struct brcmf_pno_scanresults_le *pfn_result;
3560         struct brcmf_pno_net_info_le *netinfo;
3561
3562         brcmf_dbg(SCAN, "Enter\n");
3563
3564         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3565                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3566                 return 0;
3567         }
3568
3569         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3570
3571         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3572                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3573                 return 0;
3574         }
3575
3576         if (le32_to_cpu(pfn_result->count) < 1) {
3577                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3578                           le32_to_cpu(pfn_result->count));
3579                 return -EINVAL;
3580         }
3581
3582         netinfo = brcmf_get_netinfo_array(pfn_result);
3583         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3584         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3585         cfg->wowl.nd->n_channels = 1;
3586         cfg->wowl.nd->channels[0] =
3587                 ieee80211_channel_to_frequency(netinfo->channel,
3588                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3589                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3590         cfg->wowl.nd_info->n_matches = 1;
3591         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3592
3593         /* Inform (the resume task) that the net detect information was recvd */
3594         cfg->wowl.nd_data_completed = true;
3595         wake_up(&cfg->wowl.nd_data_wait);
3596
3597         return 0;
3598 }
3599
3600 #ifdef CONFIG_PM
3601
3602 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3603 {
3604         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3605         struct brcmf_wowl_wakeind_le wake_ind_le;
3606         struct cfg80211_wowlan_wakeup wakeup_data;
3607         struct cfg80211_wowlan_wakeup *wakeup;
3608         u32 wakeind;
3609         s32 err;
3610         int timeout;
3611
3612         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3613                                        sizeof(wake_ind_le));
3614         if (err) {
3615                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3616                 return;
3617         }
3618
3619         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3620         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3621                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3622                        BRCMF_WOWL_PFN_FOUND)) {
3623                 wakeup = &wakeup_data;
3624                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3625                 wakeup_data.pattern_idx = -1;
3626
3627                 if (wakeind & BRCMF_WOWL_MAGIC) {
3628                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3629                         wakeup_data.magic_pkt = true;
3630                 }
3631                 if (wakeind & BRCMF_WOWL_DIS) {
3632                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3633                         wakeup_data.disconnect = true;
3634                 }
3635                 if (wakeind & BRCMF_WOWL_BCN) {
3636                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3637                         wakeup_data.disconnect = true;
3638                 }
3639                 if (wakeind & BRCMF_WOWL_RETR) {
3640                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3641                         wakeup_data.disconnect = true;
3642                 }
3643                 if (wakeind & BRCMF_WOWL_NET) {
3644                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3645                         /* For now always map to pattern 0, no API to get
3646                          * correct information available at the moment.
3647                          */
3648                         wakeup_data.pattern_idx = 0;
3649                 }
3650                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3651                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3652                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3653                                 cfg->wowl.nd_data_completed,
3654                                 BRCMF_ND_INFO_TIMEOUT);
3655                         if (!timeout)
3656                                 brcmf_err("No result for wowl net detect\n");
3657                         else
3658                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3659                 }
3660                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3661                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3662                         wakeup_data.gtk_rekey_failure = true;
3663                 }
3664         } else {
3665                 wakeup = NULL;
3666         }
3667         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3668 }
3669
3670 #else
3671
3672 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3673 {
3674 }
3675
3676 #endif /* CONFIG_PM */
3677
3678 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3679 {
3680         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3681         struct net_device *ndev = cfg_to_ndev(cfg);
3682         struct brcmf_if *ifp = netdev_priv(ndev);
3683
3684         brcmf_dbg(TRACE, "Enter\n");
3685
3686         if (cfg->wowl.active) {
3687                 brcmf_report_wowl_wakeind(wiphy, ifp);
3688                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3689                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3690                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3691                         brcmf_configure_arp_nd_offload(ifp, true);
3692                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3693                                       cfg->wowl.pre_pmmode);
3694                 cfg->wowl.active = false;
3695                 if (cfg->wowl.nd_enabled) {
3696                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3697                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3698                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3699                                             brcmf_notify_sched_scan_results);
3700                         cfg->wowl.nd_enabled = false;
3701                 }
3702         }
3703         return 0;
3704 }
3705
3706 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3707                                  struct brcmf_if *ifp,
3708                                  struct cfg80211_wowlan *wowl)
3709 {
3710         u32 wowl_config;
3711         struct brcmf_wowl_wakeind_le wowl_wakeind;
3712         u32 i;
3713
3714         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3715
3716         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3717                 brcmf_configure_arp_nd_offload(ifp, false);
3718         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3719         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3720
3721         wowl_config = 0;
3722         if (wowl->disconnect)
3723                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3724         if (wowl->magic_pkt)
3725                 wowl_config |= BRCMF_WOWL_MAGIC;
3726         if ((wowl->patterns) && (wowl->n_patterns)) {
3727                 wowl_config |= BRCMF_WOWL_NET;
3728                 for (i = 0; i < wowl->n_patterns; i++) {
3729                         brcmf_config_wowl_pattern(ifp, "add",
3730                                 (u8 *)wowl->patterns[i].pattern,
3731                                 wowl->patterns[i].pattern_len,
3732                                 (u8 *)wowl->patterns[i].mask,
3733                                 wowl->patterns[i].pkt_offset);
3734                 }
3735         }
3736         if (wowl->nd_config) {
3737                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3738                                                 wowl->nd_config);
3739                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3740
3741                 cfg->wowl.nd_data_completed = false;
3742                 cfg->wowl.nd_enabled = true;
3743                 /* Now reroute the event for PFN to the wowl function. */
3744                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3745                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3746                                     brcmf_wowl_nd_results);
3747         }
3748         if (wowl->gtk_rekey_failure)
3749                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3750         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3751                 wowl_config |= BRCMF_WOWL_UNASSOC;
3752
3753         memcpy(&wowl_wakeind, "clear", 6);
3754         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3755                                  sizeof(wowl_wakeind));
3756         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3757         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3758         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3759         cfg->wowl.active = true;
3760 }
3761
3762 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3763                                   struct cfg80211_wowlan *wowl)
3764 {
3765         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3766         struct net_device *ndev = cfg_to_ndev(cfg);
3767         struct brcmf_if *ifp = netdev_priv(ndev);
3768         struct brcmf_cfg80211_vif *vif;
3769
3770         brcmf_dbg(TRACE, "Enter\n");
3771
3772         /* if the primary net_device is not READY there is nothing
3773          * we can do but pray resume goes smoothly.
3774          */
3775         if (!check_vif_up(ifp->vif))
3776                 goto exit;
3777
3778         /* Stop scheduled scan */
3779         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3780                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3781
3782         /* end any scanning */
3783         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3784                 brcmf_abort_scanning(cfg);
3785
3786         if (wowl == NULL) {
3787                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3788                 list_for_each_entry(vif, &cfg->vif_list, list) {
3789                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3790                                 continue;
3791                         /* While going to suspend if associated with AP
3792                          * disassociate from AP to save power while system is
3793                          * in suspended state
3794                          */
3795                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3796                         /* Make sure WPA_Supplicant receives all the event
3797                          * generated due to DISASSOC call to the fw to keep
3798                          * the state fw and WPA_Supplicant state consistent
3799                          */
3800                         brcmf_delay(500);
3801                 }
3802                 /* Configure MPC */
3803                 brcmf_set_mpc(ifp, 1);
3804
3805         } else {
3806                 /* Configure WOWL paramaters */
3807                 brcmf_configure_wowl(cfg, ifp, wowl);
3808         }
3809
3810 exit:
3811         brcmf_dbg(TRACE, "Exit\n");
3812         /* clear any scanning activity */
3813         cfg->scan_status = 0;
3814         return 0;
3815 }
3816
3817 static __used s32
3818 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3819 {
3820         struct brcmf_pmk_list_le *pmk_list;
3821         int i;
3822         u32 npmk;
3823         s32 err;
3824
3825         pmk_list = &cfg->pmk_list;
3826         npmk = le32_to_cpu(pmk_list->npmk);
3827
3828         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3829         for (i = 0; i < npmk; i++)
3830                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3831
3832         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3833                                        sizeof(*pmk_list));
3834
3835         return err;
3836 }
3837
3838 static s32
3839 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3840                          struct cfg80211_pmksa *pmksa)
3841 {
3842         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3843         struct brcmf_if *ifp = netdev_priv(ndev);
3844         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3845         s32 err;
3846         u32 npmk, i;
3847
3848         brcmf_dbg(TRACE, "Enter\n");
3849         if (!check_vif_up(ifp->vif))
3850                 return -EIO;
3851
3852         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3853         for (i = 0; i < npmk; i++)
3854                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3855                         break;
3856         if (i < BRCMF_MAXPMKID) {
3857                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3858                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3859                 if (i == npmk) {
3860                         npmk++;
3861                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3862                 }
3863         } else {
3864                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3865                 return -EINVAL;
3866         }
3867
3868         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3869         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3870                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3871                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3872                           pmk[npmk].pmkid[i + 3]);
3873
3874         err = brcmf_update_pmklist(cfg, ifp);
3875
3876         brcmf_dbg(TRACE, "Exit\n");
3877         return err;
3878 }
3879
3880 static s32
3881 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3882                          struct cfg80211_pmksa *pmksa)
3883 {
3884         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3885         struct brcmf_if *ifp = netdev_priv(ndev);
3886         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3887         s32 err;
3888         u32 npmk, i;
3889
3890         brcmf_dbg(TRACE, "Enter\n");
3891         if (!check_vif_up(ifp->vif))
3892                 return -EIO;
3893
3894         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3895
3896         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3897         for (i = 0; i < npmk; i++)
3898                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3899                         break;
3900
3901         if ((npmk > 0) && (i < npmk)) {
3902                 for (; i < (npmk - 1); i++) {
3903                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3904                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3905                                WLAN_PMKID_LEN);
3906                 }
3907                 memset(&pmk[i], 0, sizeof(*pmk));
3908                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3909         } else {
3910                 brcmf_err("Cache entry not found\n");
3911                 return -EINVAL;
3912         }
3913
3914         err = brcmf_update_pmklist(cfg, ifp);
3915
3916         brcmf_dbg(TRACE, "Exit\n");
3917         return err;
3918
3919 }
3920
3921 static s32
3922 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3923 {
3924         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3925         struct brcmf_if *ifp = netdev_priv(ndev);
3926         s32 err;
3927
3928         brcmf_dbg(TRACE, "Enter\n");
3929         if (!check_vif_up(ifp->vif))
3930                 return -EIO;
3931
3932         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3933         err = brcmf_update_pmklist(cfg, ifp);
3934
3935         brcmf_dbg(TRACE, "Exit\n");
3936         return err;
3937
3938 }
3939
3940 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3941 {
3942         s32 err;
3943         s32 wpa_val;
3944
3945         /* set auth */
3946         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3947         if (err < 0) {
3948                 brcmf_err("auth error %d\n", err);
3949                 return err;
3950         }
3951         /* set wsec */
3952         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3953         if (err < 0) {
3954                 brcmf_err("wsec error %d\n", err);
3955                 return err;
3956         }
3957         /* set upper-layer auth */
3958         if (brcmf_is_ibssmode(ifp->vif))
3959                 wpa_val = WPA_AUTH_NONE;
3960         else
3961                 wpa_val = WPA_AUTH_DISABLED;
3962         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
3963         if (err < 0) {
3964                 brcmf_err("wpa_auth error %d\n", err);
3965                 return err;
3966         }
3967
3968         return 0;
3969 }
3970
3971 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3972 {
3973         if (is_rsn_ie)
3974                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3975
3976         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3977 }
3978
3979 static s32
3980 brcmf_configure_wpaie(struct brcmf_if *ifp,
3981                       const struct brcmf_vs_tlv *wpa_ie,
3982                       bool is_rsn_ie)
3983 {
3984         u32 auth = 0; /* d11 open authentication */
3985         u16 count;
3986         s32 err = 0;
3987         s32 len;
3988         u32 i;
3989         u32 wsec;
3990         u32 pval = 0;
3991         u32 gval = 0;
3992         u32 wpa_auth = 0;
3993         u32 offset;
3994         u8 *data;
3995         u16 rsn_cap;
3996         u32 wme_bss_disable;
3997         u32 mfp;
3998
3999         brcmf_dbg(TRACE, "Enter\n");
4000         if (wpa_ie == NULL)
4001                 goto exit;
4002
4003         len = wpa_ie->len + TLV_HDR_LEN;
4004         data = (u8 *)wpa_ie;
4005         offset = TLV_HDR_LEN;
4006         if (!is_rsn_ie)
4007                 offset += VS_IE_FIXED_HDR_LEN;
4008         else
4009                 offset += WPA_IE_VERSION_LEN;
4010
4011         /* check for multicast cipher suite */
4012         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4013                 err = -EINVAL;
4014                 brcmf_err("no multicast cipher suite\n");
4015                 goto exit;
4016         }
4017
4018         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4019                 err = -EINVAL;
4020                 brcmf_err("ivalid OUI\n");
4021                 goto exit;
4022         }
4023         offset += TLV_OUI_LEN;
4024
4025         /* pick up multicast cipher */
4026         switch (data[offset]) {
4027         case WPA_CIPHER_NONE:
4028                 gval = 0;
4029                 break;
4030         case WPA_CIPHER_WEP_40:
4031         case WPA_CIPHER_WEP_104:
4032                 gval = WEP_ENABLED;
4033                 break;
4034         case WPA_CIPHER_TKIP:
4035                 gval = TKIP_ENABLED;
4036                 break;
4037         case WPA_CIPHER_AES_CCM:
4038                 gval = AES_ENABLED;
4039                 break;
4040         default:
4041                 err = -EINVAL;
4042                 brcmf_err("Invalid multi cast cipher info\n");
4043                 goto exit;
4044         }
4045
4046         offset++;
4047         /* walk thru unicast cipher list and pick up what we recognize */
4048         count = data[offset] + (data[offset + 1] << 8);
4049         offset += WPA_IE_SUITE_COUNT_LEN;
4050         /* Check for unicast suite(s) */
4051         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4052                 err = -EINVAL;
4053                 brcmf_err("no unicast cipher suite\n");
4054                 goto exit;
4055         }
4056         for (i = 0; i < count; i++) {
4057                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4058                         err = -EINVAL;
4059                         brcmf_err("ivalid OUI\n");
4060                         goto exit;
4061                 }
4062                 offset += TLV_OUI_LEN;
4063                 switch (data[offset]) {
4064                 case WPA_CIPHER_NONE:
4065                         break;
4066                 case WPA_CIPHER_WEP_40:
4067                 case WPA_CIPHER_WEP_104:
4068                         pval |= WEP_ENABLED;
4069                         break;
4070                 case WPA_CIPHER_TKIP:
4071                         pval |= TKIP_ENABLED;
4072                         break;
4073                 case WPA_CIPHER_AES_CCM:
4074                         pval |= AES_ENABLED;
4075                         break;
4076                 default:
4077                         brcmf_err("Invalid unicast security info\n");
4078                 }
4079                 offset++;
4080         }
4081         /* walk thru auth management suite list and pick up what we recognize */
4082         count = data[offset] + (data[offset + 1] << 8);
4083         offset += WPA_IE_SUITE_COUNT_LEN;
4084         /* Check for auth key management suite(s) */
4085         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4086                 err = -EINVAL;
4087                 brcmf_err("no auth key mgmt suite\n");
4088                 goto exit;
4089         }
4090         for (i = 0; i < count; i++) {
4091                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4092                         err = -EINVAL;
4093                         brcmf_err("ivalid OUI\n");
4094                         goto exit;
4095                 }
4096                 offset += TLV_OUI_LEN;
4097                 switch (data[offset]) {
4098                 case RSN_AKM_NONE:
4099                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4100                         wpa_auth |= WPA_AUTH_NONE;
4101                         break;
4102                 case RSN_AKM_UNSPECIFIED:
4103                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4104                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4105                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4106                         break;
4107                 case RSN_AKM_PSK:
4108                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4109                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4110                                     (wpa_auth |= WPA_AUTH_PSK);
4111                         break;
4112                 case RSN_AKM_SHA256_PSK:
4113                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4114                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4115                         break;
4116                 case RSN_AKM_SHA256_1X:
4117                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4118                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4119                         break;
4120                 default:
4121                         brcmf_err("Invalid key mgmt info\n");
4122                 }
4123                 offset++;
4124         }
4125
4126         mfp = BRCMF_MFP_NONE;
4127         if (is_rsn_ie) {
4128                 wme_bss_disable = 1;
4129                 if ((offset + RSN_CAP_LEN) <= len) {
4130                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4131                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4132                                 wme_bss_disable = 0;
4133                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4134                                 brcmf_dbg(TRACE, "MFP Required\n");
4135                                 mfp = BRCMF_MFP_REQUIRED;
4136                                 /* Firmware only supports mfp required in
4137                                  * combination with WPA2_AUTH_PSK_SHA256 or
4138                                  * WPA2_AUTH_1X_SHA256.
4139                                  */
4140                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4141                                                   WPA2_AUTH_1X_SHA256))) {
4142                                         err = -EINVAL;
4143                                         goto exit;
4144                                 }
4145                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4146                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4147                                  * is to be included in the rsn ie.
4148                                  */
4149                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4150                                         wpa_auth |= WPA2_AUTH_PSK;
4151                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4152                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4153                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4154                                 brcmf_dbg(TRACE, "MFP Capable\n");
4155                                 mfp = BRCMF_MFP_CAPABLE;
4156                         }
4157                 }
4158                 offset += RSN_CAP_LEN;
4159                 /* set wme_bss_disable to sync RSN Capabilities */
4160                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4161                                                wme_bss_disable);
4162                 if (err < 0) {
4163                         brcmf_err("wme_bss_disable error %d\n", err);
4164                         goto exit;
4165                 }
4166
4167                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4168                 offset += RSN_PMKID_COUNT_LEN;
4169
4170                 /* See if there is BIP wpa suite left for MFP */
4171                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4172                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4173                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4174                                                         &data[offset],
4175                                                         WPA_IE_MIN_OUI_LEN);
4176                         if (err < 0) {
4177                                 brcmf_err("bip error %d\n", err);
4178                                 goto exit;
4179                         }
4180                 }
4181         }
4182         /* FOR WPS , set SES_OW_ENABLED */
4183         wsec = (pval | gval | SES_OW_ENABLED);
4184
4185         /* set auth */
4186         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4187         if (err < 0) {
4188                 brcmf_err("auth error %d\n", err);
4189                 goto exit;
4190         }
4191         /* set wsec */
4192         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4193         if (err < 0) {
4194                 brcmf_err("wsec error %d\n", err);
4195                 goto exit;
4196         }
4197         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4198          * will overwrite the values set by MFP
4199          */
4200         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4201                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4202                 if (err < 0) {
4203                         brcmf_err("mfp error %d\n", err);
4204                         goto exit;
4205                 }
4206         }
4207         /* set upper-layer auth */
4208         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4209         if (err < 0) {
4210                 brcmf_err("wpa_auth error %d\n", err);
4211                 goto exit;
4212         }
4213
4214 exit:
4215         return err;
4216 }
4217
4218 static s32
4219 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4220                      struct parsed_vndr_ies *vndr_ies)
4221 {
4222         struct brcmf_vs_tlv *vndrie;
4223         struct brcmf_tlv *ie;
4224         struct parsed_vndr_ie_info *parsed_info;
4225         s32 remaining_len;
4226
4227         remaining_len = (s32)vndr_ie_len;
4228         memset(vndr_ies, 0, sizeof(*vndr_ies));
4229
4230         ie = (struct brcmf_tlv *)vndr_ie_buf;
4231         while (ie) {
4232                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4233                         goto next;
4234                 vndrie = (struct brcmf_vs_tlv *)ie;
4235                 /* len should be bigger than OUI length + one */
4236                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4237                         brcmf_err("invalid vndr ie. length is too small %d\n",
4238                                   vndrie->len);
4239                         goto next;
4240                 }
4241                 /* if wpa or wme ie, do not add ie */
4242                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4243                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4244                     (vndrie->oui_type == WME_OUI_TYPE))) {
4245                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4246                         goto next;
4247                 }
4248
4249                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4250
4251                 /* save vndr ie information */
4252                 parsed_info->ie_ptr = (char *)vndrie;
4253                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4254                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4255
4256                 vndr_ies->count++;
4257
4258                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4259                           parsed_info->vndrie.oui[0],
4260                           parsed_info->vndrie.oui[1],
4261                           parsed_info->vndrie.oui[2],
4262                           parsed_info->vndrie.oui_type);
4263
4264                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4265                         break;
4266 next:
4267                 remaining_len -= (ie->len + TLV_HDR_LEN);
4268                 if (remaining_len <= TLV_HDR_LEN)
4269                         ie = NULL;
4270                 else
4271                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4272                                 TLV_HDR_LEN);
4273         }
4274         return 0;
4275 }
4276
4277 static u32
4278 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4279 {
4280
4281         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4282         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4283
4284         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4285
4286         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4287
4288         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4289
4290         return ie_len + VNDR_IE_HDR_SIZE;
4291 }
4292
4293 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4294                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4295 {
4296         struct brcmf_if *ifp;
4297         struct vif_saved_ie *saved_ie;
4298         s32 err = 0;
4299         u8  *iovar_ie_buf;
4300         u8  *curr_ie_buf;
4301         u8  *mgmt_ie_buf = NULL;
4302         int mgmt_ie_buf_len;
4303         u32 *mgmt_ie_len;
4304         u32 del_add_ie_buf_len = 0;
4305         u32 total_ie_buf_len = 0;
4306         u32 parsed_ie_buf_len = 0;
4307         struct parsed_vndr_ies old_vndr_ies;
4308         struct parsed_vndr_ies new_vndr_ies;
4309         struct parsed_vndr_ie_info *vndrie_info;
4310         s32 i;
4311         u8 *ptr;
4312         int remained_buf_len;
4313
4314         if (!vif)
4315                 return -ENODEV;
4316         ifp = vif->ifp;
4317         saved_ie = &vif->saved_ie;
4318
4319         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4320                   pktflag);
4321         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4322         if (!iovar_ie_buf)
4323                 return -ENOMEM;
4324         curr_ie_buf = iovar_ie_buf;
4325         switch (pktflag) {
4326         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4327                 mgmt_ie_buf = saved_ie->probe_req_ie;
4328                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4329                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4330                 break;
4331         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4332                 mgmt_ie_buf = saved_ie->probe_res_ie;
4333                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4334                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4335                 break;
4336         case BRCMF_VNDR_IE_BEACON_FLAG:
4337                 mgmt_ie_buf = saved_ie->beacon_ie;
4338                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4339                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4340                 break;
4341         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4342                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4343                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4344                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4345                 break;
4346         default:
4347                 err = -EPERM;
4348                 brcmf_err("not suitable type\n");
4349                 goto exit;
4350         }
4351
4352         if (vndr_ie_len > mgmt_ie_buf_len) {
4353                 err = -ENOMEM;
4354                 brcmf_err("extra IE size too big\n");
4355                 goto exit;
4356         }
4357
4358         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4359         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4360                 ptr = curr_ie_buf;
4361                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4362                 for (i = 0; i < new_vndr_ies.count; i++) {
4363                         vndrie_info = &new_vndr_ies.ie_info[i];
4364                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4365                                vndrie_info->ie_len);
4366                         parsed_ie_buf_len += vndrie_info->ie_len;
4367                 }
4368         }
4369
4370         if (mgmt_ie_buf && *mgmt_ie_len) {
4371                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4372                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4373                             parsed_ie_buf_len) == 0)) {
4374                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4375                         goto exit;
4376                 }
4377
4378                 /* parse old vndr_ie */
4379                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4380
4381                 /* make a command to delete old ie */
4382                 for (i = 0; i < old_vndr_ies.count; i++) {
4383                         vndrie_info = &old_vndr_ies.ie_info[i];
4384
4385                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4386                                   vndrie_info->vndrie.id,
4387                                   vndrie_info->vndrie.len,
4388                                   vndrie_info->vndrie.oui[0],
4389                                   vndrie_info->vndrie.oui[1],
4390                                   vndrie_info->vndrie.oui[2]);
4391
4392                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4393                                                            vndrie_info->ie_ptr,
4394                                                            vndrie_info->ie_len,
4395                                                            "del");
4396                         curr_ie_buf += del_add_ie_buf_len;
4397                         total_ie_buf_len += del_add_ie_buf_len;
4398                 }
4399         }
4400
4401         *mgmt_ie_len = 0;
4402         /* Add if there is any extra IE */
4403         if (mgmt_ie_buf && parsed_ie_buf_len) {
4404                 ptr = mgmt_ie_buf;
4405
4406                 remained_buf_len = mgmt_ie_buf_len;
4407
4408                 /* make a command to add new ie */
4409                 for (i = 0; i < new_vndr_ies.count; i++) {
4410                         vndrie_info = &new_vndr_ies.ie_info[i];
4411
4412                         /* verify remained buf size before copy data */
4413                         if (remained_buf_len < (vndrie_info->vndrie.len +
4414                                                         VNDR_IE_VSIE_OFFSET)) {
4415                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4416                                           remained_buf_len);
4417                                 break;
4418                         }
4419                         remained_buf_len -= (vndrie_info->ie_len +
4420                                              VNDR_IE_VSIE_OFFSET);
4421
4422                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4423                                   vndrie_info->vndrie.id,
4424                                   vndrie_info->vndrie.len,
4425                                   vndrie_info->vndrie.oui[0],
4426                                   vndrie_info->vndrie.oui[1],
4427                                   vndrie_info->vndrie.oui[2]);
4428
4429                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4430                                                            vndrie_info->ie_ptr,
4431                                                            vndrie_info->ie_len,
4432                                                            "add");
4433
4434                         /* save the parsed IE in wl struct */
4435                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4436                                vndrie_info->ie_len);
4437                         *mgmt_ie_len += vndrie_info->ie_len;
4438
4439                         curr_ie_buf += del_add_ie_buf_len;
4440                         total_ie_buf_len += del_add_ie_buf_len;
4441                 }
4442         }
4443         if (total_ie_buf_len) {
4444                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4445                                                  total_ie_buf_len);
4446                 if (err)
4447                         brcmf_err("vndr ie set error : %d\n", err);
4448         }
4449
4450 exit:
4451         kfree(iovar_ie_buf);
4452         return err;
4453 }
4454
4455 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4456 {
4457         s32 pktflags[] = {
4458                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4459                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4460                 BRCMF_VNDR_IE_BEACON_FLAG
4461         };
4462         int i;
4463
4464         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4465                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4466
4467         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4468         return 0;
4469 }
4470
4471 static s32
4472 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4473                         struct cfg80211_beacon_data *beacon)
4474 {
4475         s32 err;
4476
4477         /* Set Beacon IEs to FW */
4478         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4479                                     beacon->tail, beacon->tail_len);
4480         if (err) {
4481                 brcmf_err("Set Beacon IE Failed\n");
4482                 return err;
4483         }
4484         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4485
4486         /* Set Probe Response IEs to FW */
4487         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4488                                     beacon->proberesp_ies,
4489                                     beacon->proberesp_ies_len);
4490         if (err)
4491                 brcmf_err("Set Probe Resp IE Failed\n");
4492         else
4493                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4494
4495         return err;
4496 }
4497
4498 static s32
4499 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4500                         struct cfg80211_ap_settings *settings)
4501 {
4502         s32 ie_offset;
4503         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4504         struct brcmf_if *ifp = netdev_priv(ndev);
4505         const struct brcmf_tlv *ssid_ie;
4506         const struct brcmf_tlv *country_ie;
4507         struct brcmf_ssid_le ssid_le;
4508         s32 err = -EPERM;
4509         const struct brcmf_tlv *rsn_ie;
4510         const struct brcmf_vs_tlv *wpa_ie;
4511         struct brcmf_join_params join_params;
4512         enum nl80211_iftype dev_role;
4513         struct brcmf_fil_bss_enable_le bss_enable;
4514         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4515         bool mbss;
4516         int is_11d;
4517         bool supports_11d;
4518
4519         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4520                   settings->chandef.chan->hw_value,
4521                   settings->chandef.center_freq1, settings->chandef.width,
4522                   settings->beacon_interval, settings->dtim_period);
4523         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4524                   settings->ssid, settings->ssid_len, settings->auth_type,
4525                   settings->inactivity_timeout);
4526         dev_role = ifp->vif->wdev.iftype;
4527         mbss = ifp->vif->mbss;
4528
4529         /* store current 11d setting */
4530         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4531                                   &ifp->vif->is_11d)) {
4532                 is_11d = supports_11d = false;
4533         } else {
4534                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4535                                               settings->beacon.tail_len,
4536                                               WLAN_EID_COUNTRY);
4537                 is_11d = country_ie ? 1 : 0;
4538                 supports_11d = true;
4539         }
4540
4541         memset(&ssid_le, 0, sizeof(ssid_le));
4542         if (settings->ssid == NULL || settings->ssid_len == 0) {
4543                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4544                 ssid_ie = brcmf_parse_tlvs(
4545                                 (u8 *)&settings->beacon.head[ie_offset],
4546                                 settings->beacon.head_len - ie_offset,
4547                                 WLAN_EID_SSID);
4548                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4549                         return -EINVAL;
4550
4551                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4552                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4553                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4554         } else {
4555                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4556                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4557         }
4558
4559         if (!mbss) {
4560                 brcmf_set_mpc(ifp, 0);
4561                 brcmf_configure_arp_nd_offload(ifp, false);
4562         }
4563
4564         /* find the RSN_IE */
4565         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4566                                   settings->beacon.tail_len, WLAN_EID_RSN);
4567
4568         /* find the WPA_IE */
4569         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4570                                   settings->beacon.tail_len);
4571
4572         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4573                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4574                 if (wpa_ie != NULL) {
4575                         /* WPA IE */
4576                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4577                         if (err < 0)
4578                                 goto exit;
4579                 } else {
4580                         struct brcmf_vs_tlv *tmp_ie;
4581
4582                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4583
4584                         /* RSN IE */
4585                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4586                         if (err < 0)
4587                                 goto exit;
4588                 }
4589         } else {
4590                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4591                 brcmf_configure_opensecurity(ifp);
4592         }
4593
4594         /* Parameters shared by all radio interfaces */
4595         if (!mbss) {
4596                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4597                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4598                                                     is_11d);
4599                         if (err < 0) {
4600                                 brcmf_err("Regulatory Set Error, %d\n", err);
4601                                 goto exit;
4602                         }
4603                 }
4604                 if (settings->beacon_interval) {
4605                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4606                                                     settings->beacon_interval);
4607                         if (err < 0) {
4608                                 brcmf_err("Beacon Interval Set Error, %d\n",
4609                                           err);
4610                                 goto exit;
4611                         }
4612                 }
4613                 if (settings->dtim_period) {
4614                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4615                                                     settings->dtim_period);
4616                         if (err < 0) {
4617                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4618                                 goto exit;
4619                         }
4620                 }
4621
4622                 if ((dev_role == NL80211_IFTYPE_AP) &&
4623                     ((ifp->ifidx == 0) ||
4624                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4625                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4626                         if (err < 0) {
4627                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4628                                 goto exit;
4629                         }
4630                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4631                 }
4632
4633                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4634                 if (err < 0) {
4635                         brcmf_err("SET INFRA error %d\n", err);
4636                         goto exit;
4637                 }
4638         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4639                 /* Multiple-BSS should use same 11d configuration */
4640                 err = -EINVAL;
4641                 goto exit;
4642         }
4643
4644         /* Interface specific setup */
4645         if (dev_role == NL80211_IFTYPE_AP) {
4646                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4647                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4648
4649                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4650                 if (err < 0) {
4651                         brcmf_err("setting AP mode failed %d\n", err);
4652                         goto exit;
4653                 }
4654                 if (!mbss) {
4655                         /* Firmware 10.x requires setting channel after enabling
4656                          * AP and before bringing interface up.
4657                          */
4658                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4659                         if (err < 0) {
4660                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4661                                           chanspec, err);
4662                                 goto exit;
4663                         }
4664                 }
4665                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4666                 if (err < 0) {
4667                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4668                         goto exit;
4669                 }
4670                 /* On DOWN the firmware removes the WEP keys, reconfigure
4671                  * them if they were set.
4672                  */
4673                 brcmf_cfg80211_reconfigure_wep(ifp);
4674
4675                 memset(&join_params, 0, sizeof(join_params));
4676                 /* join parameters starts with ssid */
4677                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4678                 /* create softap */
4679                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4680                                              &join_params, sizeof(join_params));
4681                 if (err < 0) {
4682                         brcmf_err("SET SSID error (%d)\n", err);
4683                         goto exit;
4684                 }
4685
4686                 if (settings->hidden_ssid) {
4687                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4688                         if (err) {
4689                                 brcmf_err("closednet error (%d)\n", err);
4690                                 goto exit;
4691                         }
4692                 }
4693
4694                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4695         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4696                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4697                 if (err < 0) {
4698                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4699                                   chanspec, err);
4700                         goto exit;
4701                 }
4702                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4703                                                 sizeof(ssid_le));
4704                 if (err < 0) {
4705                         brcmf_err("setting ssid failed %d\n", err);
4706                         goto exit;
4707                 }
4708                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4709                 bss_enable.enable = cpu_to_le32(1);
4710                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4711                                                sizeof(bss_enable));
4712                 if (err < 0) {
4713                         brcmf_err("bss_enable config failed %d\n", err);
4714                         goto exit;
4715                 }
4716
4717                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4718         } else {
4719                 WARN_ON(1);
4720         }
4721
4722         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4723         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4724         brcmf_net_setcarrier(ifp, true);
4725
4726 exit:
4727         if ((err) && (!mbss)) {
4728                 brcmf_set_mpc(ifp, 1);
4729                 brcmf_configure_arp_nd_offload(ifp, true);
4730         }
4731         return err;
4732 }
4733
4734 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4735 {
4736         struct brcmf_if *ifp = netdev_priv(ndev);
4737         s32 err;
4738         struct brcmf_fil_bss_enable_le bss_enable;
4739         struct brcmf_join_params join_params;
4740
4741         brcmf_dbg(TRACE, "Enter\n");
4742
4743         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4744                 /* Due to most likely deauths outstanding we sleep */
4745                 /* first to make sure they get processed by fw. */
4746                 msleep(400);
4747
4748                 if (ifp->vif->mbss) {
4749                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4750                         return err;
4751                 }
4752
4753                 /* First BSS doesn't get a full reset */
4754                 if (ifp->bsscfgidx == 0)
4755                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4756
4757                 memset(&join_params, 0, sizeof(join_params));
4758                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4759                                              &join_params, sizeof(join_params));
4760                 if (err < 0)
4761                         brcmf_err("SET SSID error (%d)\n", err);
4762                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4763                 if (err < 0)
4764                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4765                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4766                 if (err < 0)
4767                         brcmf_err("setting AP mode failed %d\n", err);
4768                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4769                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4770                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4771                                       ifp->vif->is_11d);
4772                 /* Bring device back up so it can be used again */
4773                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4774                 if (err < 0)
4775                         brcmf_err("BRCMF_C_UP error %d\n", err);
4776
4777                 brcmf_vif_clear_mgmt_ies(ifp->vif);
4778         } else {
4779                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4780                 bss_enable.enable = cpu_to_le32(0);
4781                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4782                                                sizeof(bss_enable));
4783                 if (err < 0)
4784                         brcmf_err("bss_enable config failed %d\n", err);
4785         }
4786         brcmf_set_mpc(ifp, 1);
4787         brcmf_configure_arp_nd_offload(ifp, true);
4788         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4789         brcmf_net_setcarrier(ifp, false);
4790
4791         return err;
4792 }
4793
4794 static s32
4795 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4796                              struct cfg80211_beacon_data *info)
4797 {
4798         struct brcmf_if *ifp = netdev_priv(ndev);
4799         s32 err;
4800
4801         brcmf_dbg(TRACE, "Enter\n");
4802
4803         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4804
4805         return err;
4806 }
4807
4808 static int
4809 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4810                            struct station_del_parameters *params)
4811 {
4812         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4813         struct brcmf_scb_val_le scbval;
4814         struct brcmf_if *ifp = netdev_priv(ndev);
4815         s32 err;
4816
4817         if (!params->mac)
4818                 return -EFAULT;
4819
4820         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4821
4822         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4823                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4824         if (!check_vif_up(ifp->vif))
4825                 return -EIO;
4826
4827         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4828         scbval.val = cpu_to_le32(params->reason_code);
4829         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4830                                      &scbval, sizeof(scbval));
4831         if (err)
4832                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4833
4834         brcmf_dbg(TRACE, "Exit\n");
4835         return err;
4836 }
4837
4838 static int
4839 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4840                               const u8 *mac, struct station_parameters *params)
4841 {
4842         struct brcmf_if *ifp = netdev_priv(ndev);
4843         s32 err;
4844
4845         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4846                   params->sta_flags_mask, params->sta_flags_set);
4847
4848         /* Ignore all 00 MAC */
4849         if (is_zero_ether_addr(mac))
4850                 return 0;
4851
4852         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4853                 return 0;
4854
4855         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4856                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4857                                              (void *)mac, ETH_ALEN);
4858         else
4859                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4860                                              (void *)mac, ETH_ALEN);
4861         if (err < 0)
4862                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4863
4864         return err;
4865 }
4866
4867 static void
4868 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4869                                    struct wireless_dev *wdev,
4870                                    u16 frame_type, bool reg)
4871 {
4872         struct brcmf_cfg80211_vif *vif;
4873         u16 mgmt_type;
4874
4875         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4876
4877         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4878         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4879         if (reg)
4880                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4881         else
4882                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4883 }
4884
4885
4886 static int
4887 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4888                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4889 {
4890         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4891         struct ieee80211_channel *chan = params->chan;
4892         const u8 *buf = params->buf;
4893         size_t len = params->len;
4894         const struct ieee80211_mgmt *mgmt;
4895         struct brcmf_cfg80211_vif *vif;
4896         s32 err = 0;
4897         s32 ie_offset;
4898         s32 ie_len;
4899         struct brcmf_fil_action_frame_le *action_frame;
4900         struct brcmf_fil_af_params_le *af_params;
4901         bool ack;
4902         s32 chan_nr;
4903         u32 freq;
4904
4905         brcmf_dbg(TRACE, "Enter\n");
4906
4907         *cookie = 0;
4908
4909         mgmt = (const struct ieee80211_mgmt *)buf;
4910
4911         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4912                 brcmf_err("Driver only allows MGMT packet type\n");
4913                 return -EPERM;
4914         }
4915
4916         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4917
4918         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4919                 /* Right now the only reason to get a probe response */
4920                 /* is for p2p listen response or for p2p GO from     */
4921                 /* wpa_supplicant. Unfortunately the probe is send   */
4922                 /* on primary ndev, while dongle wants it on the p2p */
4923                 /* vif. Since this is only reason for a probe        */
4924                 /* response to be sent, the vif is taken from cfg.   */
4925                 /* If ever desired to send proberesp for non p2p     */
4926                 /* response then data should be checked for          */
4927                 /* "DIRECT-". Note in future supplicant will take    */
4928                 /* dedicated p2p wdev to do this and then this 'hack'*/
4929                 /* is not needed anymore.                            */
4930                 ie_offset =  DOT11_MGMT_HDR_LEN +
4931                              DOT11_BCN_PRB_FIXED_LEN;
4932                 ie_len = len - ie_offset;
4933                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4934                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4935                 err = brcmf_vif_set_mgmt_ie(vif,
4936                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4937                                             &buf[ie_offset],
4938                                             ie_len);
4939                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4940                                         GFP_KERNEL);
4941         } else if (ieee80211_is_action(mgmt->frame_control)) {
4942                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
4943                         brcmf_err("invalid action frame length\n");
4944                         err = -EINVAL;
4945                         goto exit;
4946                 }
4947                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4948                 if (af_params == NULL) {
4949                         brcmf_err("unable to allocate frame\n");
4950                         err = -ENOMEM;
4951                         goto exit;
4952                 }
4953                 action_frame = &af_params->action_frame;
4954                 /* Add the packet Id */
4955                 action_frame->packet_id = cpu_to_le32(*cookie);
4956                 /* Add BSSID */
4957                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4958                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4959                 /* Add the length exepted for 802.11 header  */
4960                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4961                 /* Add the channel. Use the one specified as parameter if any or
4962                  * the current one (got from the firmware) otherwise
4963                  */
4964                 if (chan)
4965                         freq = chan->center_freq;
4966                 else
4967                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4968                                               &freq);
4969                 chan_nr = ieee80211_frequency_to_channel(freq);
4970                 af_params->channel = cpu_to_le32(chan_nr);
4971
4972                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4973                        le16_to_cpu(action_frame->len));
4974
4975                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4976                           *cookie, le16_to_cpu(action_frame->len), freq);
4977
4978                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4979                                                   af_params);
4980
4981                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4982                                         GFP_KERNEL);
4983                 kfree(af_params);
4984         } else {
4985                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4986                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
4987         }
4988
4989 exit:
4990         return err;
4991 }
4992
4993
4994 static int
4995 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4996                                         struct wireless_dev *wdev,
4997                                         u64 cookie)
4998 {
4999         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5000         struct brcmf_cfg80211_vif *vif;
5001         int err = 0;
5002
5003         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5004
5005         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5006         if (vif == NULL) {
5007                 brcmf_err("No p2p device available for probe response\n");
5008                 err = -ENODEV;
5009                 goto exit;
5010         }
5011         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5012 exit:
5013         return err;
5014 }
5015
5016 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5017                                       struct wireless_dev *wdev,
5018                                       struct cfg80211_chan_def *chandef)
5019 {
5020         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5021         struct net_device *ndev = wdev->netdev;
5022         struct brcmf_if *ifp;
5023         struct brcmu_chan ch;
5024         enum nl80211_band band = 0;
5025         enum nl80211_chan_width width = 0;
5026         u32 chanspec;
5027         int freq, err;
5028
5029         if (!ndev)
5030                 return -ENODEV;
5031         ifp = netdev_priv(ndev);
5032
5033         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5034         if (err) {
5035                 brcmf_err("chanspec failed (%d)\n", err);
5036                 return err;
5037         }
5038
5039         ch.chspec = chanspec;
5040         cfg->d11inf.decchspec(&ch);
5041
5042         switch (ch.band) {
5043         case BRCMU_CHAN_BAND_2G:
5044                 band = NL80211_BAND_2GHZ;
5045                 break;
5046         case BRCMU_CHAN_BAND_5G:
5047                 band = NL80211_BAND_5GHZ;
5048                 break;
5049         }
5050
5051         switch (ch.bw) {
5052         case BRCMU_CHAN_BW_80:
5053                 width = NL80211_CHAN_WIDTH_80;
5054                 break;
5055         case BRCMU_CHAN_BW_40:
5056                 width = NL80211_CHAN_WIDTH_40;
5057                 break;
5058         case BRCMU_CHAN_BW_20:
5059                 width = NL80211_CHAN_WIDTH_20;
5060                 break;
5061         case BRCMU_CHAN_BW_80P80:
5062                 width = NL80211_CHAN_WIDTH_80P80;
5063                 break;
5064         case BRCMU_CHAN_BW_160:
5065                 width = NL80211_CHAN_WIDTH_160;
5066                 break;
5067         }
5068
5069         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5070         chandef->chan = ieee80211_get_channel(wiphy, freq);
5071         chandef->width = width;
5072         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5073         chandef->center_freq2 = 0;
5074
5075         return 0;
5076 }
5077
5078 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5079                                            struct wireless_dev *wdev,
5080                                            enum nl80211_crit_proto_id proto,
5081                                            u16 duration)
5082 {
5083         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5084         struct brcmf_cfg80211_vif *vif;
5085
5086         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5087
5088         /* only DHCP support for now */
5089         if (proto != NL80211_CRIT_PROTO_DHCP)
5090                 return -EINVAL;
5091
5092         /* suppress and abort scanning */
5093         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5094         brcmf_abort_scanning(cfg);
5095
5096         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5097 }
5098
5099 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5100                                            struct wireless_dev *wdev)
5101 {
5102         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5103         struct brcmf_cfg80211_vif *vif;
5104
5105         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5106
5107         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5108         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5109 }
5110
5111 static s32
5112 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5113                              const struct brcmf_event_msg *e, void *data)
5114 {
5115         switch (e->reason) {
5116         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5117                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5118                 break;
5119         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5120                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5121                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5122                 break;
5123         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5124                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5125                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5126                 break;
5127         }
5128
5129         return 0;
5130 }
5131
5132 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5133 {
5134         int ret;
5135
5136         switch (oper) {
5137         case NL80211_TDLS_DISCOVERY_REQ:
5138                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5139                 break;
5140         case NL80211_TDLS_SETUP:
5141                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5142                 break;
5143         case NL80211_TDLS_TEARDOWN:
5144                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5145                 break;
5146         default:
5147                 brcmf_err("unsupported operation: %d\n", oper);
5148                 ret = -EOPNOTSUPP;
5149         }
5150         return ret;
5151 }
5152
5153 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5154                                     struct net_device *ndev, const u8 *peer,
5155                                     enum nl80211_tdls_operation oper)
5156 {
5157         struct brcmf_if *ifp;
5158         struct brcmf_tdls_iovar_le info;
5159         int ret = 0;
5160
5161         ret = brcmf_convert_nl80211_tdls_oper(oper);
5162         if (ret < 0)
5163                 return ret;
5164
5165         ifp = netdev_priv(ndev);
5166         memset(&info, 0, sizeof(info));
5167         info.mode = (u8)ret;
5168         if (peer)
5169                 memcpy(info.ea, peer, ETH_ALEN);
5170
5171         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5172                                        &info, sizeof(info));
5173         if (ret < 0)
5174                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5175
5176         return ret;
5177 }
5178
5179 static int
5180 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5181                                   struct net_device *ndev,
5182                                   struct cfg80211_connect_params *sme,
5183                                   u32 changed)
5184 {
5185         struct brcmf_if *ifp;
5186         int err;
5187
5188         if (!(changed & UPDATE_ASSOC_IES))
5189                 return 0;
5190
5191         ifp = netdev_priv(ndev);
5192         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5193                                     sme->ie, sme->ie_len);
5194         if (err)
5195                 brcmf_err("Set Assoc REQ IE Failed\n");
5196         else
5197                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5198
5199         return err;
5200 }
5201
5202 #ifdef CONFIG_PM
5203 static int
5204 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5205                               struct cfg80211_gtk_rekey_data *gtk)
5206 {
5207         struct brcmf_if *ifp = netdev_priv(ndev);
5208         struct brcmf_gtk_keyinfo_le gtk_le;
5209         int ret;
5210
5211         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5212
5213         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5214         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5215         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5216                sizeof(gtk_le.replay_counter));
5217
5218         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5219                                        sizeof(gtk_le));
5220         if (ret < 0)
5221                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5222
5223         return ret;
5224 }
5225 #endif
5226
5227 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5228                                   const struct cfg80211_pmk_conf *conf)
5229 {
5230         struct brcmf_if *ifp;
5231
5232         brcmf_dbg(TRACE, "enter\n");
5233
5234         /* expect using firmware supplicant for 1X */
5235         ifp = netdev_priv(dev);
5236         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5237                 return -EINVAL;
5238
5239         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5240 }
5241
5242 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5243                                   const u8 *aa)
5244 {
5245         struct brcmf_if *ifp;
5246
5247         brcmf_dbg(TRACE, "enter\n");
5248         ifp = netdev_priv(dev);
5249         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5250                 return -EINVAL;
5251
5252         return brcmf_set_pmk(ifp, NULL, 0);
5253 }
5254
5255 static struct cfg80211_ops brcmf_cfg80211_ops = {
5256         .add_virtual_intf = brcmf_cfg80211_add_iface,
5257         .del_virtual_intf = brcmf_cfg80211_del_iface,
5258         .change_virtual_intf = brcmf_cfg80211_change_iface,
5259         .scan = brcmf_cfg80211_scan,
5260         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5261         .join_ibss = brcmf_cfg80211_join_ibss,
5262         .leave_ibss = brcmf_cfg80211_leave_ibss,
5263         .get_station = brcmf_cfg80211_get_station,
5264         .dump_station = brcmf_cfg80211_dump_station,
5265         .set_tx_power = brcmf_cfg80211_set_tx_power,
5266         .get_tx_power = brcmf_cfg80211_get_tx_power,
5267         .add_key = brcmf_cfg80211_add_key,
5268         .del_key = brcmf_cfg80211_del_key,
5269         .get_key = brcmf_cfg80211_get_key,
5270         .set_default_key = brcmf_cfg80211_config_default_key,
5271         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5272         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5273         .connect = brcmf_cfg80211_connect,
5274         .disconnect = brcmf_cfg80211_disconnect,
5275         .suspend = brcmf_cfg80211_suspend,
5276         .resume = brcmf_cfg80211_resume,
5277         .set_pmksa = brcmf_cfg80211_set_pmksa,
5278         .del_pmksa = brcmf_cfg80211_del_pmksa,
5279         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5280         .start_ap = brcmf_cfg80211_start_ap,
5281         .stop_ap = brcmf_cfg80211_stop_ap,
5282         .change_beacon = brcmf_cfg80211_change_beacon,
5283         .del_station = brcmf_cfg80211_del_station,
5284         .change_station = brcmf_cfg80211_change_station,
5285         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5286         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5287         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5288         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5289         .remain_on_channel = brcmf_p2p_remain_on_channel,
5290         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5291         .get_channel = brcmf_cfg80211_get_channel,
5292         .start_p2p_device = brcmf_p2p_start_device,
5293         .stop_p2p_device = brcmf_p2p_stop_device,
5294         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5295         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5296         .tdls_oper = brcmf_cfg80211_tdls_oper,
5297         .update_connect_params = brcmf_cfg80211_update_conn_params,
5298         .set_pmk = brcmf_cfg80211_set_pmk,
5299         .del_pmk = brcmf_cfg80211_del_pmk,
5300 };
5301
5302 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5303                                            enum nl80211_iftype type)
5304 {
5305         struct brcmf_cfg80211_vif *vif_walk;
5306         struct brcmf_cfg80211_vif *vif;
5307         bool mbss;
5308
5309         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5310                   sizeof(*vif));
5311         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5312         if (!vif)
5313                 return ERR_PTR(-ENOMEM);
5314
5315         vif->wdev.wiphy = cfg->wiphy;
5316         vif->wdev.iftype = type;
5317
5318         brcmf_init_prof(&vif->profile);
5319
5320         if (type == NL80211_IFTYPE_AP) {
5321                 mbss = false;
5322                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5323                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5324                                 mbss = true;
5325                                 break;
5326                         }
5327                 }
5328                 vif->mbss = mbss;
5329         }
5330
5331         list_add_tail(&vif->list, &cfg->vif_list);
5332         return vif;
5333 }
5334
5335 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5336 {
5337         list_del(&vif->list);
5338         kfree(vif);
5339 }
5340
5341 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5342 {
5343         struct brcmf_cfg80211_vif *vif;
5344         struct brcmf_if *ifp;
5345
5346         ifp = netdev_priv(ndev);
5347         vif = ifp->vif;
5348
5349         if (vif)
5350                 brcmf_free_vif(vif);
5351 }
5352
5353 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5354                             const struct brcmf_event_msg *e)
5355 {
5356         u32 event = e->event_code;
5357         u32 status = e->status;
5358
5359         if (vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK &&
5360             event == BRCMF_E_PSK_SUP &&
5361             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5362                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5363         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5364                 brcmf_dbg(CONN, "Processing set ssid\n");
5365                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5366                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK)
5367                         return true;
5368
5369                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5370         }
5371
5372         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5373             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5374                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5375                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5376                 return true;
5377         }
5378         return false;
5379 }
5380
5381 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5382 {
5383         u32 event = e->event_code;
5384         u16 flags = e->flags;
5385
5386         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5387             (event == BRCMF_E_DISASSOC_IND) ||
5388             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5389                 brcmf_dbg(CONN, "Processing link down\n");
5390                 return true;
5391         }
5392         return false;
5393 }
5394
5395 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5396                                const struct brcmf_event_msg *e)
5397 {
5398         u32 event = e->event_code;
5399         u32 status = e->status;
5400
5401         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5402                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5403                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5404                 return true;
5405         }
5406
5407         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5408                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5409                 return true;
5410         }
5411
5412         if (event == BRCMF_E_PSK_SUP &&
5413             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5414                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5415                           status);
5416                 return true;
5417         }
5418
5419         return false;
5420 }
5421
5422 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5423 {
5424         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5425
5426         kfree(conn_info->req_ie);
5427         conn_info->req_ie = NULL;
5428         conn_info->req_ie_len = 0;
5429         kfree(conn_info->resp_ie);
5430         conn_info->resp_ie = NULL;
5431         conn_info->resp_ie_len = 0;
5432 }
5433
5434 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5435                                struct brcmf_if *ifp)
5436 {
5437         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5438         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5439         u32 req_len;
5440         u32 resp_len;
5441         s32 err = 0;
5442
5443         brcmf_clear_assoc_ies(cfg);
5444
5445         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5446                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5447         if (err) {
5448                 brcmf_err("could not get assoc info (%d)\n", err);
5449                 return err;
5450         }
5451         assoc_info =
5452                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5453         req_len = le32_to_cpu(assoc_info->req_len);
5454         resp_len = le32_to_cpu(assoc_info->resp_len);
5455         if (req_len) {
5456                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5457                                                cfg->extra_buf,
5458                                                WL_ASSOC_INFO_MAX);
5459                 if (err) {
5460                         brcmf_err("could not get assoc req (%d)\n", err);
5461                         return err;
5462                 }
5463                 conn_info->req_ie_len = req_len;
5464                 conn_info->req_ie =
5465                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5466                             GFP_KERNEL);
5467         } else {
5468                 conn_info->req_ie_len = 0;
5469                 conn_info->req_ie = NULL;
5470         }
5471         if (resp_len) {
5472                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5473                                                cfg->extra_buf,
5474                                                WL_ASSOC_INFO_MAX);
5475                 if (err) {
5476                         brcmf_err("could not get assoc resp (%d)\n", err);
5477                         return err;
5478                 }
5479                 conn_info->resp_ie_len = resp_len;
5480                 conn_info->resp_ie =
5481                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5482                             GFP_KERNEL);
5483         } else {
5484                 conn_info->resp_ie_len = 0;
5485                 conn_info->resp_ie = NULL;
5486         }
5487         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5488                   conn_info->req_ie_len, conn_info->resp_ie_len);
5489
5490         return err;
5491 }
5492
5493 static s32
5494 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5495                        struct net_device *ndev,
5496                        const struct brcmf_event_msg *e)
5497 {
5498         struct brcmf_if *ifp = netdev_priv(ndev);
5499         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5500         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5501         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5502         struct ieee80211_channel *notify_channel = NULL;
5503         struct ieee80211_supported_band *band;
5504         struct brcmf_bss_info_le *bi;
5505         struct brcmu_chan ch;
5506         struct cfg80211_roam_info roam_info = {};
5507         u32 freq;
5508         s32 err = 0;
5509         u8 *buf;
5510
5511         brcmf_dbg(TRACE, "Enter\n");
5512
5513         brcmf_get_assoc_ies(cfg, ifp);
5514         memcpy(profile->bssid, e->addr, ETH_ALEN);
5515         brcmf_update_bss_info(cfg, ifp);
5516
5517         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5518         if (buf == NULL) {
5519                 err = -ENOMEM;
5520                 goto done;
5521         }
5522
5523         /* data sent to dongle has to be little endian */
5524         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5525         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5526                                      buf, WL_BSS_INFO_MAX);
5527
5528         if (err)
5529                 goto done;
5530
5531         bi = (struct brcmf_bss_info_le *)(buf + 4);
5532         ch.chspec = le16_to_cpu(bi->chanspec);
5533         cfg->d11inf.decchspec(&ch);
5534
5535         if (ch.band == BRCMU_CHAN_BAND_2G)
5536                 band = wiphy->bands[NL80211_BAND_2GHZ];
5537         else
5538                 band = wiphy->bands[NL80211_BAND_5GHZ];
5539
5540         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5541         notify_channel = ieee80211_get_channel(wiphy, freq);
5542
5543 done:
5544         kfree(buf);
5545
5546         roam_info.channel = notify_channel;
5547         roam_info.bssid = profile->bssid;
5548         roam_info.req_ie = conn_info->req_ie;
5549         roam_info.req_ie_len = conn_info->req_ie_len;
5550         roam_info.resp_ie = conn_info->resp_ie;
5551         roam_info.resp_ie_len = conn_info->resp_ie_len;
5552
5553         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
5554         brcmf_dbg(CONN, "Report roaming result\n");
5555
5556         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5557         brcmf_dbg(TRACE, "Exit\n");
5558         return err;
5559 }
5560
5561 static s32
5562 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5563                        struct net_device *ndev, const struct brcmf_event_msg *e,
5564                        bool completed)
5565 {
5566         struct brcmf_if *ifp = netdev_priv(ndev);
5567         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5568         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5569         struct cfg80211_connect_resp_params conn_params;
5570
5571         brcmf_dbg(TRACE, "Enter\n");
5572
5573         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5574                                &ifp->vif->sme_state)) {
5575                 memset(&conn_params, 0, sizeof(conn_params));
5576                 if (completed) {
5577                         brcmf_get_assoc_ies(cfg, ifp);
5578                         brcmf_update_bss_info(cfg, ifp);
5579                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5580                                 &ifp->vif->sme_state);
5581                         conn_params.status = WLAN_STATUS_SUCCESS;
5582                 } else {
5583                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
5584                 }
5585                 conn_params.bssid = profile->bssid;
5586                 conn_params.req_ie = conn_info->req_ie;
5587                 conn_params.req_ie_len = conn_info->req_ie_len;
5588                 conn_params.resp_ie = conn_info->resp_ie;
5589                 conn_params.resp_ie_len = conn_info->resp_ie_len;
5590                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
5591                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5592                           completed ? "succeeded" : "failed");
5593         }
5594         brcmf_dbg(TRACE, "Exit\n");
5595         return 0;
5596 }
5597
5598 static s32
5599 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5600                                struct net_device *ndev,
5601                                const struct brcmf_event_msg *e, void *data)
5602 {
5603         static int generation;
5604         u32 event = e->event_code;
5605         u32 reason = e->reason;
5606         struct station_info sinfo;
5607
5608         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
5609                   brcmf_fweh_event_name(event), event, reason);
5610         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5611             ndev != cfg_to_ndev(cfg)) {
5612                 brcmf_dbg(CONN, "AP mode link down\n");
5613                 complete(&cfg->vif_disabled);
5614                 return 0;
5615         }
5616
5617         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5618             (reason == BRCMF_E_STATUS_SUCCESS)) {
5619                 memset(&sinfo, 0, sizeof(sinfo));
5620                 if (!data) {
5621                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5622                         return -EINVAL;
5623                 }
5624                 sinfo.assoc_req_ies = data;
5625                 sinfo.assoc_req_ies_len = e->datalen;
5626                 generation++;
5627                 sinfo.generation = generation;
5628                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5629         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5630                    (event == BRCMF_E_DEAUTH_IND) ||
5631                    (event == BRCMF_E_DEAUTH)) {
5632                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5633         }
5634         return 0;
5635 }
5636
5637 static s32
5638 brcmf_notify_connect_status(struct brcmf_if *ifp,
5639                             const struct brcmf_event_msg *e, void *data)
5640 {
5641         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5642         struct net_device *ndev = ifp->ndev;
5643         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5644         struct ieee80211_channel *chan;
5645         s32 err = 0;
5646
5647         if ((e->event_code == BRCMF_E_DEAUTH) ||
5648             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5649             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5650             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5651                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5652         }
5653
5654         if (brcmf_is_apmode(ifp->vif)) {
5655                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5656         } else if (brcmf_is_linkup(ifp->vif, e)) {
5657                 brcmf_dbg(CONN, "Linkup\n");
5658                 if (brcmf_is_ibssmode(ifp->vif)) {
5659                         brcmf_inform_ibss(cfg, ndev, e->addr);
5660                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5661                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5662                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5663                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5664                                   &ifp->vif->sme_state);
5665                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5666                                 &ifp->vif->sme_state);
5667                 } else
5668                         brcmf_bss_connect_done(cfg, ndev, e, true);
5669                 brcmf_net_setcarrier(ifp, true);
5670         } else if (brcmf_is_linkdown(e)) {
5671                 brcmf_dbg(CONN, "Linkdown\n");
5672                 if (!brcmf_is_ibssmode(ifp->vif)) {
5673                         brcmf_bss_connect_done(cfg, ndev, e, false);
5674                         brcmf_link_down(ifp->vif,
5675                                         brcmf_map_fw_linkdown_reason(e));
5676                         brcmf_init_prof(ndev_to_prof(ndev));
5677                         if (ndev != cfg_to_ndev(cfg))
5678                                 complete(&cfg->vif_disabled);
5679                         brcmf_net_setcarrier(ifp, false);
5680                 }
5681         } else if (brcmf_is_nonetwork(cfg, e)) {
5682                 if (brcmf_is_ibssmode(ifp->vif))
5683                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5684                                   &ifp->vif->sme_state);
5685                 else
5686                         brcmf_bss_connect_done(cfg, ndev, e, false);
5687         }
5688
5689         return err;
5690 }
5691
5692 static s32
5693 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5694                             const struct brcmf_event_msg *e, void *data)
5695 {
5696         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5697         u32 event = e->event_code;
5698         u32 status = e->status;
5699
5700         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5701                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
5702                              &ifp->vif->sme_state)) {
5703                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5704                 } else {
5705                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5706                         brcmf_net_setcarrier(ifp, true);
5707                 }
5708         }
5709
5710         return 0;
5711 }
5712
5713 static s32
5714 brcmf_notify_mic_status(struct brcmf_if *ifp,
5715                         const struct brcmf_event_msg *e, void *data)
5716 {
5717         u16 flags = e->flags;
5718         enum nl80211_key_type key_type;
5719
5720         if (flags & BRCMF_EVENT_MSG_GROUP)
5721                 key_type = NL80211_KEYTYPE_GROUP;
5722         else
5723                 key_type = NL80211_KEYTYPE_PAIRWISE;
5724
5725         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5726                                      NULL, GFP_KERNEL);
5727
5728         return 0;
5729 }
5730
5731 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5732                                   const struct brcmf_event_msg *e, void *data)
5733 {
5734         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5735         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5736         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5737         struct brcmf_cfg80211_vif *vif;
5738
5739         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5740                   ifevent->action, ifevent->flags, ifevent->ifidx,
5741                   ifevent->bsscfgidx);
5742
5743         spin_lock(&event->vif_event_lock);
5744         event->action = ifevent->action;
5745         vif = event->vif;
5746
5747         switch (ifevent->action) {
5748         case BRCMF_E_IF_ADD:
5749                 /* waiting process may have timed out */
5750                 if (!cfg->vif_event.vif) {
5751                         spin_unlock(&event->vif_event_lock);
5752                         return -EBADF;
5753                 }
5754
5755                 ifp->vif = vif;
5756                 vif->ifp = ifp;
5757                 if (ifp->ndev) {
5758                         vif->wdev.netdev = ifp->ndev;
5759                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5760                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5761                 }
5762                 spin_unlock(&event->vif_event_lock);
5763                 wake_up(&event->vif_wq);
5764                 return 0;
5765
5766         case BRCMF_E_IF_DEL:
5767                 spin_unlock(&event->vif_event_lock);
5768                 /* event may not be upon user request */
5769                 if (brcmf_cfg80211_vif_event_armed(cfg))
5770                         wake_up(&event->vif_wq);
5771                 return 0;
5772
5773         case BRCMF_E_IF_CHANGE:
5774                 spin_unlock(&event->vif_event_lock);
5775                 wake_up(&event->vif_wq);
5776                 return 0;
5777
5778         default:
5779                 spin_unlock(&event->vif_event_lock);
5780                 break;
5781         }
5782         return -EINVAL;
5783 }
5784
5785 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5786 {
5787         conf->frag_threshold = (u32)-1;
5788         conf->rts_threshold = (u32)-1;
5789         conf->retry_short = (u32)-1;
5790         conf->retry_long = (u32)-1;
5791 }
5792
5793 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5794 {
5795         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5796                             brcmf_notify_connect_status);
5797         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5798                             brcmf_notify_connect_status);
5799         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5800                             brcmf_notify_connect_status);
5801         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5802                             brcmf_notify_connect_status);
5803         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5804                             brcmf_notify_connect_status);
5805         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5806                             brcmf_notify_connect_status);
5807         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5808                             brcmf_notify_roaming_status);
5809         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5810                             brcmf_notify_mic_status);
5811         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5812                             brcmf_notify_connect_status);
5813         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5814                             brcmf_notify_sched_scan_results);
5815         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5816                             brcmf_notify_vif_event);
5817         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5818                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5819         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5820                             brcmf_p2p_notify_listen_complete);
5821         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5822                             brcmf_p2p_notify_action_frame_rx);
5823         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5824                             brcmf_p2p_notify_action_tx_complete);
5825         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5826                             brcmf_p2p_notify_action_tx_complete);
5827         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
5828                             brcmf_notify_connect_status);
5829 }
5830
5831 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5832 {
5833         kfree(cfg->conf);
5834         cfg->conf = NULL;
5835         kfree(cfg->extra_buf);
5836         cfg->extra_buf = NULL;
5837         kfree(cfg->wowl.nd);
5838         cfg->wowl.nd = NULL;
5839         kfree(cfg->wowl.nd_info);
5840         cfg->wowl.nd_info = NULL;
5841         kfree(cfg->escan_info.escan_buf);
5842         cfg->escan_info.escan_buf = NULL;
5843 }
5844
5845 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5846 {
5847         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5848         if (!cfg->conf)
5849                 goto init_priv_mem_out;
5850         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5851         if (!cfg->extra_buf)
5852                 goto init_priv_mem_out;
5853         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5854         if (!cfg->wowl.nd)
5855                 goto init_priv_mem_out;
5856         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5857                                     sizeof(struct cfg80211_wowlan_nd_match *),
5858                                     GFP_KERNEL);
5859         if (!cfg->wowl.nd_info)
5860                 goto init_priv_mem_out;
5861         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5862         if (!cfg->escan_info.escan_buf)
5863                 goto init_priv_mem_out;
5864
5865         return 0;
5866
5867 init_priv_mem_out:
5868         brcmf_deinit_priv_mem(cfg);
5869
5870         return -ENOMEM;
5871 }
5872
5873 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5874 {
5875         s32 err = 0;
5876
5877         cfg->scan_request = NULL;
5878         cfg->pwr_save = true;
5879         cfg->active_scan = true;        /* we do active scan per default */
5880         cfg->dongle_up = false;         /* dongle is not up yet */
5881         err = brcmf_init_priv_mem(cfg);
5882         if (err)
5883                 return err;
5884         brcmf_register_event_handlers(cfg);
5885         mutex_init(&cfg->usr_sync);
5886         brcmf_init_escan(cfg);
5887         brcmf_init_conf(cfg->conf);
5888         init_completion(&cfg->vif_disabled);
5889         return err;
5890 }
5891
5892 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5893 {
5894         cfg->dongle_up = false; /* dongle down */
5895         brcmf_abort_scanning(cfg);
5896         brcmf_deinit_priv_mem(cfg);
5897 }
5898
5899 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5900 {
5901         init_waitqueue_head(&event->vif_wq);
5902         spin_lock_init(&event->vif_event_lock);
5903 }
5904
5905 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5906 {
5907         s32 err;
5908         u32 bcn_timeout;
5909         __le32 roamtrigger[2];
5910         __le32 roam_delta[2];
5911
5912         /* Configure beacon timeout value based upon roaming setting */
5913         if (ifp->drvr->settings->roamoff)
5914                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5915         else
5916                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5917         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5918         if (err) {
5919                 brcmf_err("bcn_timeout error (%d)\n", err);
5920                 goto roam_setup_done;
5921         }
5922
5923         /* Enable/Disable built-in roaming to allow supplicant to take care of
5924          * roaming.
5925          */
5926         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5927                   ifp->drvr->settings->roamoff ? "Off" : "On");
5928         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5929                                       ifp->drvr->settings->roamoff);
5930         if (err) {
5931                 brcmf_err("roam_off error (%d)\n", err);
5932                 goto roam_setup_done;
5933         }
5934
5935         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5936         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5937         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5938                                      (void *)roamtrigger, sizeof(roamtrigger));
5939         if (err) {
5940                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5941                 goto roam_setup_done;
5942         }
5943
5944         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5945         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5946         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5947                                      (void *)roam_delta, sizeof(roam_delta));
5948         if (err) {
5949                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5950                 goto roam_setup_done;
5951         }
5952
5953 roam_setup_done:
5954         return err;
5955 }
5956
5957 static s32
5958 brcmf_dongle_scantime(struct brcmf_if *ifp)
5959 {
5960         s32 err = 0;
5961
5962         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5963                                     BRCMF_SCAN_CHANNEL_TIME);
5964         if (err) {
5965                 brcmf_err("Scan assoc time error (%d)\n", err);
5966                 goto dongle_scantime_out;
5967         }
5968         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5969                                     BRCMF_SCAN_UNASSOC_TIME);
5970         if (err) {
5971                 brcmf_err("Scan unassoc time error (%d)\n", err);
5972                 goto dongle_scantime_out;
5973         }
5974
5975         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5976                                     BRCMF_SCAN_PASSIVE_TIME);
5977         if (err) {
5978                 brcmf_err("Scan passive time error (%d)\n", err);
5979                 goto dongle_scantime_out;
5980         }
5981
5982 dongle_scantime_out:
5983         return err;
5984 }
5985
5986 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5987                                            struct brcmu_chan *ch)
5988 {
5989         u32 ht40_flag;
5990
5991         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5992         if (ch->sb == BRCMU_CHAN_SB_U) {
5993                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5994                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5995                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5996         } else {
5997                 /* It should be one of
5998                  * IEEE80211_CHAN_NO_HT40 or
5999                  * IEEE80211_CHAN_NO_HT40PLUS
6000                  */
6001                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6002                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6003                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6004         }
6005 }
6006
6007 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6008                                     u32 bw_cap[])
6009 {
6010         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6011         struct ieee80211_supported_band *band;
6012         struct ieee80211_channel *channel;
6013         struct wiphy *wiphy;
6014         struct brcmf_chanspec_list *list;
6015         struct brcmu_chan ch;
6016         int err;
6017         u8 *pbuf;
6018         u32 i, j;
6019         u32 total;
6020         u32 chaninfo;
6021
6022         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6023
6024         if (pbuf == NULL)
6025                 return -ENOMEM;
6026
6027         list = (struct brcmf_chanspec_list *)pbuf;
6028
6029         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6030                                        BRCMF_DCMD_MEDLEN);
6031         if (err) {
6032                 brcmf_err("get chanspecs error (%d)\n", err);
6033                 goto fail_pbuf;
6034         }
6035
6036         wiphy = cfg_to_wiphy(cfg);
6037         band = wiphy->bands[NL80211_BAND_2GHZ];
6038         if (band)
6039                 for (i = 0; i < band->n_channels; i++)
6040                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6041         band = wiphy->bands[NL80211_BAND_5GHZ];
6042         if (band)
6043                 for (i = 0; i < band->n_channels; i++)
6044                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6045
6046         total = le32_to_cpu(list->count);
6047         for (i = 0; i < total; i++) {
6048                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6049                 cfg->d11inf.decchspec(&ch);
6050
6051                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6052                         band = wiphy->bands[NL80211_BAND_2GHZ];
6053                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6054                         band = wiphy->bands[NL80211_BAND_5GHZ];
6055                 } else {
6056                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
6057                         continue;
6058                 }
6059                 if (!band)
6060                         continue;
6061                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6062                     ch.bw == BRCMU_CHAN_BW_40)
6063                         continue;
6064                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6065                     ch.bw == BRCMU_CHAN_BW_80)
6066                         continue;
6067
6068                 channel = NULL;
6069                 for (j = 0; j < band->n_channels; j++) {
6070                         if (band->channels[j].hw_value == ch.control_ch_num) {
6071                                 channel = &band->channels[j];
6072                                 break;
6073                         }
6074                 }
6075                 if (!channel) {
6076                         /* It seems firmware supports some channel we never
6077                          * considered. Something new in IEEE standard?
6078                          */
6079                         brcmf_err("Ignoring unexpected firmware channel %d\n",
6080                                   ch.control_ch_num);
6081                         continue;
6082                 }
6083
6084                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
6085                         continue;
6086
6087                 /* assuming the chanspecs order is HT20,
6088                  * HT40 upper, HT40 lower, and VHT80.
6089                  */
6090                 if (ch.bw == BRCMU_CHAN_BW_80) {
6091                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6092                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
6093                         brcmf_update_bw40_channel_flag(channel, &ch);
6094                 } else {
6095                         /* enable the channel and disable other bandwidths
6096                          * for now as mentioned order assure they are enabled
6097                          * for subsequent chanspecs.
6098                          */
6099                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6100                                          IEEE80211_CHAN_NO_80MHZ;
6101                         ch.bw = BRCMU_CHAN_BW_20;
6102                         cfg->d11inf.encchspec(&ch);
6103                         chaninfo = ch.chspec;
6104                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6105                                                        &chaninfo);
6106                         if (!err) {
6107                                 if (chaninfo & WL_CHAN_RADAR)
6108                                         channel->flags |=
6109                                                 (IEEE80211_CHAN_RADAR |
6110                                                  IEEE80211_CHAN_NO_IR);
6111                                 if (chaninfo & WL_CHAN_PASSIVE)
6112                                         channel->flags |=
6113                                                 IEEE80211_CHAN_NO_IR;
6114                         }
6115                 }
6116         }
6117
6118 fail_pbuf:
6119         kfree(pbuf);
6120         return err;
6121 }
6122
6123 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6124 {
6125         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6126         struct ieee80211_supported_band *band;
6127         struct brcmf_fil_bwcap_le band_bwcap;
6128         struct brcmf_chanspec_list *list;
6129         u8 *pbuf;
6130         u32 val;
6131         int err;
6132         struct brcmu_chan ch;
6133         u32 num_chan;
6134         int i, j;
6135
6136         /* verify support for bw_cap command */
6137         val = WLC_BAND_5G;
6138         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6139
6140         if (!err) {
6141                 /* only set 2G bandwidth using bw_cap command */
6142                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6143                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6144                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6145                                                sizeof(band_bwcap));
6146         } else {
6147                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6148                 val = WLC_N_BW_40ALL;
6149                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6150         }
6151
6152         if (!err) {
6153                 /* update channel info in 2G band */
6154                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6155
6156                 if (pbuf == NULL)
6157                         return -ENOMEM;
6158
6159                 ch.band = BRCMU_CHAN_BAND_2G;
6160                 ch.bw = BRCMU_CHAN_BW_40;
6161                 ch.sb = BRCMU_CHAN_SB_NONE;
6162                 ch.chnum = 0;
6163                 cfg->d11inf.encchspec(&ch);
6164
6165                 /* pass encoded chanspec in query */
6166                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6167
6168                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6169                                                BRCMF_DCMD_MEDLEN);
6170                 if (err) {
6171                         brcmf_err("get chanspecs error (%d)\n", err);
6172                         kfree(pbuf);
6173                         return err;
6174                 }
6175
6176                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6177                 list = (struct brcmf_chanspec_list *)pbuf;
6178                 num_chan = le32_to_cpu(list->count);
6179                 for (i = 0; i < num_chan; i++) {
6180                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6181                         cfg->d11inf.decchspec(&ch);
6182                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6183                                 continue;
6184                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6185                                 continue;
6186                         for (j = 0; j < band->n_channels; j++) {
6187                                 if (band->channels[j].hw_value == ch.control_ch_num)
6188                                         break;
6189                         }
6190                         if (WARN_ON(j == band->n_channels))
6191                                 continue;
6192
6193                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6194                 }
6195                 kfree(pbuf);
6196         }
6197         return err;
6198 }
6199
6200 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6201 {
6202         u32 band, mimo_bwcap;
6203         int err;
6204
6205         band = WLC_BAND_2G;
6206         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6207         if (!err) {
6208                 bw_cap[NL80211_BAND_2GHZ] = band;
6209                 band = WLC_BAND_5G;
6210                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6211                 if (!err) {
6212                         bw_cap[NL80211_BAND_5GHZ] = band;
6213                         return;
6214                 }
6215                 WARN_ON(1);
6216                 return;
6217         }
6218         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6219         mimo_bwcap = 0;
6220         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6221         if (err)
6222                 /* assume 20MHz if firmware does not give a clue */
6223                 mimo_bwcap = WLC_N_BW_20ALL;
6224
6225         switch (mimo_bwcap) {
6226         case WLC_N_BW_40ALL:
6227                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6228                 /* fall-thru */
6229         case WLC_N_BW_20IN2G_40IN5G:
6230                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6231                 /* fall-thru */
6232         case WLC_N_BW_20ALL:
6233                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6234                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6235                 break;
6236         default:
6237                 brcmf_err("invalid mimo_bw_cap value\n");
6238         }
6239 }
6240
6241 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6242                                 u32 bw_cap[2], u32 nchain)
6243 {
6244         band->ht_cap.ht_supported = true;
6245         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6246                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6247                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6248         }
6249         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6250         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6251         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6252         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6253         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6254         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6255 }
6256
6257 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6258 {
6259         u16 mcs_map;
6260         int i;
6261
6262         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6263                 mcs_map = (mcs_map << 2) | supp;
6264
6265         return cpu_to_le16(mcs_map);
6266 }
6267
6268 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6269                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6270                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6271 {
6272         __le16 mcs_map;
6273
6274         /* not allowed in 2.4G band */
6275         if (band->band == NL80211_BAND_2GHZ)
6276                 return;
6277
6278         band->vht_cap.vht_supported = true;
6279         /* 80MHz is mandatory */
6280         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6281         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6282                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6283                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6284         }
6285         /* all support 256-QAM */
6286         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6287         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6288         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6289
6290         /* Beamforming support information */
6291         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6292                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6293         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6294                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6295         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6296                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6297         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6298                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6299
6300         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6301                 band->vht_cap.cap |=
6302                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6303                 band->vht_cap.cap |= ((txstreams - 1) <<
6304                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6305                 band->vht_cap.cap |=
6306                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6307         }
6308 }
6309
6310 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6311 {
6312         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6313         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6314         u32 nmode = 0;
6315         u32 vhtmode = 0;
6316         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6317         u32 rxchain;
6318         u32 nchain;
6319         int err;
6320         s32 i;
6321         struct ieee80211_supported_band *band;
6322         u32 txstreams = 0;
6323         u32 txbf_bfe_cap = 0;
6324         u32 txbf_bfr_cap = 0;
6325
6326         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6327         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6328         if (err) {
6329                 brcmf_err("nmode error (%d)\n", err);
6330         } else {
6331                 brcmf_get_bwcap(ifp, bw_cap);
6332         }
6333         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6334                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6335                   bw_cap[NL80211_BAND_5GHZ]);
6336
6337         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6338         if (err) {
6339                 brcmf_err("rxchain error (%d)\n", err);
6340                 nchain = 1;
6341         } else {
6342                 for (nchain = 0; rxchain; nchain++)
6343                         rxchain = rxchain & (rxchain - 1);
6344         }
6345         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6346
6347         err = brcmf_construct_chaninfo(cfg, bw_cap);
6348         if (err) {
6349                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6350                 return err;
6351         }
6352
6353         if (vhtmode) {
6354                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6355                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6356                                               &txbf_bfe_cap);
6357                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6358                                               &txbf_bfr_cap);
6359         }
6360
6361         wiphy = cfg_to_wiphy(cfg);
6362         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6363                 band = wiphy->bands[i];
6364                 if (band == NULL)
6365                         continue;
6366
6367                 if (nmode)
6368                         brcmf_update_ht_cap(band, bw_cap, nchain);
6369                 if (vhtmode)
6370                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6371                                              txbf_bfe_cap, txbf_bfr_cap);
6372         }
6373
6374         return 0;
6375 }
6376
6377 static const struct ieee80211_txrx_stypes
6378 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6379         [NL80211_IFTYPE_STATION] = {
6380                 .tx = 0xffff,
6381                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6382                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6383         },
6384         [NL80211_IFTYPE_P2P_CLIENT] = {
6385                 .tx = 0xffff,
6386                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6387                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6388         },
6389         [NL80211_IFTYPE_P2P_GO] = {
6390                 .tx = 0xffff,
6391                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6392                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6393                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6394                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6395                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6396                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6397                       BIT(IEEE80211_STYPE_ACTION >> 4)
6398         },
6399         [NL80211_IFTYPE_P2P_DEVICE] = {
6400                 .tx = 0xffff,
6401                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6402                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6403         }
6404 };
6405
6406 /**
6407  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6408  *
6409  * @wiphy: wiphy object.
6410  * @ifp: interface object needed for feat module api.
6411  *
6412  * The interface modes and combinations are determined dynamically here
6413  * based on firmware functionality.
6414  *
6415  * no p2p and no mbss:
6416  *
6417  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6418  *
6419  * no p2p and mbss:
6420  *
6421  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6422  *      #AP <= 4, matching BI, channels = 1, 4 total
6423  *
6424  * p2p, no mchan, and mbss:
6425  *
6426  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6427  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6428  *      #AP <= 4, matching BI, channels = 1, 4 total
6429  *
6430  * p2p, mchan, and mbss:
6431  *
6432  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6433  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6434  *      #AP <= 4, matching BI, channels = 1, 4 total
6435  */
6436 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6437 {
6438         struct ieee80211_iface_combination *combo = NULL;
6439         struct ieee80211_iface_limit *c0_limits = NULL;
6440         struct ieee80211_iface_limit *p2p_limits = NULL;
6441         struct ieee80211_iface_limit *mbss_limits = NULL;
6442         bool mbss, p2p;
6443         int i, c, n_combos;
6444
6445         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6446         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6447
6448         n_combos = 1 + !!p2p + !!mbss;
6449         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6450         if (!combo)
6451                 goto err;
6452
6453         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6454                                  BIT(NL80211_IFTYPE_ADHOC) |
6455                                  BIT(NL80211_IFTYPE_AP);
6456
6457         c = 0;
6458         i = 0;
6459         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6460         if (!c0_limits)
6461                 goto err;
6462         c0_limits[i].max = 1;
6463         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6464         if (p2p) {
6465                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6466                         combo[c].num_different_channels = 2;
6467                 else
6468                         combo[c].num_different_channels = 1;
6469                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6470                                           BIT(NL80211_IFTYPE_P2P_GO) |
6471                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6472                 c0_limits[i].max = 1;
6473                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6474                 c0_limits[i].max = 1;
6475                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6476                                        BIT(NL80211_IFTYPE_P2P_GO);
6477         } else {
6478                 combo[c].num_different_channels = 1;
6479                 c0_limits[i].max = 1;
6480                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6481         }
6482         combo[c].max_interfaces = i;
6483         combo[c].n_limits = i;
6484         combo[c].limits = c0_limits;
6485
6486         if (p2p) {
6487                 c++;
6488                 i = 0;
6489                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6490                 if (!p2p_limits)
6491                         goto err;
6492                 p2p_limits[i].max = 1;
6493                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6494                 p2p_limits[i].max = 1;
6495                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6496                 p2p_limits[i].max = 1;
6497                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6498                 p2p_limits[i].max = 1;
6499                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6500                 combo[c].num_different_channels = 1;
6501                 combo[c].max_interfaces = i;
6502                 combo[c].n_limits = i;
6503                 combo[c].limits = p2p_limits;
6504         }
6505
6506         if (mbss) {
6507                 c++;
6508                 i = 0;
6509                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6510                 if (!mbss_limits)
6511                         goto err;
6512                 mbss_limits[i].max = 4;
6513                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6514                 combo[c].beacon_int_infra_match = true;
6515                 combo[c].num_different_channels = 1;
6516                 combo[c].max_interfaces = 4;
6517                 combo[c].n_limits = i;
6518                 combo[c].limits = mbss_limits;
6519         }
6520
6521         wiphy->n_iface_combinations = n_combos;
6522         wiphy->iface_combinations = combo;
6523         return 0;
6524
6525 err:
6526         kfree(c0_limits);
6527         kfree(p2p_limits);
6528         kfree(mbss_limits);
6529         kfree(combo);
6530         return -ENOMEM;
6531 }
6532
6533 #ifdef CONFIG_PM
6534 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
6535         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6536         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6537         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6538         .pattern_min_len = 1,
6539         .max_pkt_offset = 1500,
6540 };
6541 #endif
6542
6543 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6544 {
6545 #ifdef CONFIG_PM
6546         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6547         struct wiphy_wowlan_support *wowl;
6548
6549         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
6550                        GFP_KERNEL);
6551         if (!wowl) {
6552                 brcmf_err("only support basic wowlan features\n");
6553                 wiphy->wowlan = &brcmf_wowlan_support;
6554                 return;
6555         }
6556
6557         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6558                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6559                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
6560                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6561                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6562                 }
6563         }
6564         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6565                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6566                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6567         }
6568
6569         wiphy->wowlan = wowl;
6570 #endif
6571 }
6572
6573 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6574 {
6575         struct brcmf_pub *drvr = ifp->drvr;
6576         const struct ieee80211_iface_combination *combo;
6577         struct ieee80211_supported_band *band;
6578         u16 max_interfaces = 0;
6579         bool gscan;
6580         __le32 bandlist[3];
6581         u32 n_bands;
6582         int err, i;
6583
6584         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6585         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6586         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6587
6588         err = brcmf_setup_ifmodes(wiphy, ifp);
6589         if (err)
6590                 return err;
6591
6592         for (i = 0, combo = wiphy->iface_combinations;
6593              i < wiphy->n_iface_combinations; i++, combo++) {
6594                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6595         }
6596
6597         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6598              i++) {
6599                 u8 *addr = drvr->addresses[i].addr;
6600
6601                 memcpy(addr, drvr->mac, ETH_ALEN);
6602                 if (i) {
6603                         addr[0] |= BIT(1);
6604                         addr[ETH_ALEN - 1] ^= i;
6605                 }
6606         }
6607         wiphy->addresses = drvr->addresses;
6608         wiphy->n_addresses = i;
6609
6610         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6611         wiphy->cipher_suites = brcmf_cipher_suites;
6612         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6613         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6614                 wiphy->n_cipher_suites--;
6615         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6616                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6617                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6618
6619         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
6620                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
6621                         WIPHY_FLAG_OFFCHAN_TX |
6622                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6623         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6624                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6625         if (!ifp->drvr->settings->roamoff)
6626                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6627         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
6628                 wiphy_ext_feature_set(wiphy,
6629                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
6630                 wiphy_ext_feature_set(wiphy,
6631                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
6632         }
6633         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6634         wiphy->max_remain_on_channel_duration = 5000;
6635         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6636                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
6637                 brcmf_pno_wiphy_params(wiphy, gscan);
6638         }
6639         /* vendor commands/events support */
6640         wiphy->vendor_commands = brcmf_vendor_cmds;
6641         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6642
6643         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6644                 brcmf_wiphy_wowl_params(wiphy, ifp);
6645         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6646                                      sizeof(bandlist));
6647         if (err) {
6648                 brcmf_err("could not obtain band info: err=%d\n", err);
6649                 return err;
6650         }
6651         /* first entry in bandlist is number of bands */
6652         n_bands = le32_to_cpu(bandlist[0]);
6653         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6654                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6655                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6656                                        GFP_KERNEL);
6657                         if (!band)
6658                                 return -ENOMEM;
6659
6660                         band->channels = kmemdup(&__wl_2ghz_channels,
6661                                                  sizeof(__wl_2ghz_channels),
6662                                                  GFP_KERNEL);
6663                         if (!band->channels) {
6664                                 kfree(band);
6665                                 return -ENOMEM;
6666                         }
6667
6668                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6669                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6670                 }
6671                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6672                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6673                                        GFP_KERNEL);
6674                         if (!band)
6675                                 return -ENOMEM;
6676
6677                         band->channels = kmemdup(&__wl_5ghz_channels,
6678                                                  sizeof(__wl_5ghz_channels),
6679                                                  GFP_KERNEL);
6680                         if (!band->channels) {
6681                                 kfree(band);
6682                                 return -ENOMEM;
6683                         }
6684
6685                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6686                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6687                 }
6688         }
6689
6690         wiphy_read_of_freq_limits(wiphy);
6691
6692         return 0;
6693 }
6694
6695 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6696 {
6697         struct net_device *ndev;
6698         struct wireless_dev *wdev;
6699         struct brcmf_if *ifp;
6700         s32 power_mode;
6701         s32 err = 0;
6702
6703         if (cfg->dongle_up)
6704                 return err;
6705
6706         ndev = cfg_to_ndev(cfg);
6707         wdev = ndev->ieee80211_ptr;
6708         ifp = netdev_priv(ndev);
6709
6710         /* make sure RF is ready for work */
6711         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6712
6713         brcmf_dongle_scantime(ifp);
6714
6715         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6716         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6717         if (err)
6718                 goto default_conf_out;
6719         brcmf_dbg(INFO, "power save set to %s\n",
6720                   (power_mode ? "enabled" : "disabled"));
6721
6722         err = brcmf_dongle_roam(ifp);
6723         if (err)
6724                 goto default_conf_out;
6725         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6726                                           NULL);
6727         if (err)
6728                 goto default_conf_out;
6729
6730         brcmf_configure_arp_nd_offload(ifp, true);
6731
6732         cfg->dongle_up = true;
6733 default_conf_out:
6734
6735         return err;
6736
6737 }
6738
6739 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6740 {
6741         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6742
6743         return brcmf_config_dongle(ifp->drvr->config);
6744 }
6745
6746 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6747 {
6748         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6749
6750         /*
6751          * While going down, if associated with AP disassociate
6752          * from AP to save power
6753          */
6754         if (check_vif_up(ifp->vif)) {
6755                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6756
6757                 /* Make sure WPA_Supplicant receives all the event
6758                    generated due to DISASSOC call to the fw to keep
6759                    the state fw and WPA_Supplicant state consistent
6760                  */
6761                 brcmf_delay(500);
6762         }
6763
6764         brcmf_abort_scanning(cfg);
6765         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6766
6767         return 0;
6768 }
6769
6770 s32 brcmf_cfg80211_up(struct net_device *ndev)
6771 {
6772         struct brcmf_if *ifp = netdev_priv(ndev);
6773         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6774         s32 err = 0;
6775
6776         mutex_lock(&cfg->usr_sync);
6777         err = __brcmf_cfg80211_up(ifp);
6778         mutex_unlock(&cfg->usr_sync);
6779
6780         return err;
6781 }
6782
6783 s32 brcmf_cfg80211_down(struct net_device *ndev)
6784 {
6785         struct brcmf_if *ifp = netdev_priv(ndev);
6786         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6787         s32 err = 0;
6788
6789         mutex_lock(&cfg->usr_sync);
6790         err = __brcmf_cfg80211_down(ifp);
6791         mutex_unlock(&cfg->usr_sync);
6792
6793         return err;
6794 }
6795
6796 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6797 {
6798         struct wireless_dev *wdev = &ifp->vif->wdev;
6799
6800         return wdev->iftype;
6801 }
6802
6803 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6804                              unsigned long state)
6805 {
6806         struct brcmf_cfg80211_vif *vif;
6807
6808         list_for_each_entry(vif, &cfg->vif_list, list) {
6809                 if (test_bit(state, &vif->sme_state))
6810                         return true;
6811         }
6812         return false;
6813 }
6814
6815 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6816                                     u8 action)
6817 {
6818         u8 evt_action;
6819
6820         spin_lock(&event->vif_event_lock);
6821         evt_action = event->action;
6822         spin_unlock(&event->vif_event_lock);
6823         return evt_action == action;
6824 }
6825
6826 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6827                                   struct brcmf_cfg80211_vif *vif)
6828 {
6829         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6830
6831         spin_lock(&event->vif_event_lock);
6832         event->vif = vif;
6833         event->action = 0;
6834         spin_unlock(&event->vif_event_lock);
6835 }
6836
6837 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6838 {
6839         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6840         bool armed;
6841
6842         spin_lock(&event->vif_event_lock);
6843         armed = event->vif != NULL;
6844         spin_unlock(&event->vif_event_lock);
6845
6846         return armed;
6847 }
6848
6849 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6850                                   u8 action, ulong timeout)
6851 {
6852         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6853
6854         return wait_event_timeout(event->vif_wq,
6855                                   vif_event_equals(event, action), timeout);
6856 }
6857
6858 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6859                                         struct brcmf_fil_country_le *ccreq)
6860 {
6861         struct brcmfmac_pd_cc *country_codes;
6862         struct brcmfmac_pd_cc_entry *cc;
6863         s32 found_index;
6864         int i;
6865
6866         country_codes = drvr->settings->country_codes;
6867         if (!country_codes) {
6868                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6869                 return -EINVAL;
6870         }
6871
6872         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6873             (alpha2[1] == ccreq->country_abbrev[1])) {
6874                 brcmf_dbg(TRACE, "Country code already set\n");
6875                 return -EAGAIN;
6876         }
6877
6878         found_index = -1;
6879         for (i = 0; i < country_codes->table_size; i++) {
6880                 cc = &country_codes->table[i];
6881                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6882                         found_index = i;
6883                 if ((cc->iso3166[0] == alpha2[0]) &&
6884                     (cc->iso3166[1] == alpha2[1])) {
6885                         found_index = i;
6886                         break;
6887                 }
6888         }
6889         if (found_index == -1) {
6890                 brcmf_dbg(TRACE, "No country code match found\n");
6891                 return -EINVAL;
6892         }
6893         memset(ccreq, 0, sizeof(*ccreq));
6894         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6895         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6896                BRCMF_COUNTRY_BUF_SZ);
6897         ccreq->country_abbrev[0] = alpha2[0];
6898         ccreq->country_abbrev[1] = alpha2[1];
6899         ccreq->country_abbrev[2] = 0;
6900
6901         return 0;
6902 }
6903
6904 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6905                                         struct regulatory_request *req)
6906 {
6907         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6908         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6909         struct brcmf_fil_country_le ccreq;
6910         s32 err;
6911         int i;
6912
6913         /* The country code gets set to "00" by default at boot, ignore */
6914         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
6915                 return;
6916
6917         /* ignore non-ISO3166 country codes */
6918         for (i = 0; i < sizeof(req->alpha2); i++)
6919                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6920                         brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
6921                                   req->alpha2[0], req->alpha2[1]);
6922                         return;
6923                 }
6924
6925         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6926                   req->alpha2[0], req->alpha2[1]);
6927
6928         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6929         if (err) {
6930                 brcmf_err("Country code iovar returned err = %d\n", err);
6931                 return;
6932         }
6933
6934         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6935         if (err)
6936                 return;
6937
6938         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6939         if (err) {
6940                 brcmf_err("Firmware rejected country setting\n");
6941                 return;
6942         }
6943         brcmf_setup_wiphybands(wiphy);
6944 }
6945
6946 static void brcmf_free_wiphy(struct wiphy *wiphy)
6947 {
6948         int i;
6949
6950         if (!wiphy)
6951                 return;
6952
6953         if (wiphy->iface_combinations) {
6954                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6955                         kfree(wiphy->iface_combinations[i].limits);
6956         }
6957         kfree(wiphy->iface_combinations);
6958         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6959                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6960                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6961         }
6962         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6963                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6964                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6965         }
6966 #if IS_ENABLED(CONFIG_PM)
6967         if (wiphy->wowlan != &brcmf_wowlan_support)
6968                 kfree(wiphy->wowlan);
6969 #endif
6970         wiphy_free(wiphy);
6971 }
6972
6973 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6974                                                   struct device *busdev,
6975                                                   bool p2pdev_forced)
6976 {
6977         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6978         struct brcmf_cfg80211_info *cfg;
6979         struct wiphy *wiphy;
6980         struct cfg80211_ops *ops;
6981         struct brcmf_cfg80211_vif *vif;
6982         struct brcmf_if *ifp;
6983         s32 err = 0;
6984         s32 io_type;
6985         u16 *cap = NULL;
6986
6987         if (!ndev) {
6988                 brcmf_err("ndev is invalid\n");
6989                 return NULL;
6990         }
6991
6992         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6993         if (!ops)
6994                 return NULL;
6995
6996         ifp = netdev_priv(ndev);
6997 #ifdef CONFIG_PM
6998         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6999                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
7000 #endif
7001         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
7002         if (!wiphy) {
7003                 brcmf_err("Could not allocate wiphy device\n");
7004                 goto ops_out;
7005         }
7006         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
7007         set_wiphy_dev(wiphy, busdev);
7008
7009         cfg = wiphy_priv(wiphy);
7010         cfg->wiphy = wiphy;
7011         cfg->ops = ops;
7012         cfg->pub = drvr;
7013         init_vif_event(&cfg->vif_event);
7014         INIT_LIST_HEAD(&cfg->vif_list);
7015
7016         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
7017         if (IS_ERR(vif))
7018                 goto wiphy_out;
7019
7020         vif->ifp = ifp;
7021         vif->wdev.netdev = ndev;
7022         ndev->ieee80211_ptr = &vif->wdev;
7023         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
7024
7025         err = wl_init_priv(cfg);
7026         if (err) {
7027                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
7028                 brcmf_free_vif(vif);
7029                 goto wiphy_out;
7030         }
7031         ifp->vif = vif;
7032
7033         /* determine d11 io type before wiphy setup */
7034         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
7035         if (err) {
7036                 brcmf_err("Failed to get D11 version (%d)\n", err);
7037                 goto priv_out;
7038         }
7039         cfg->d11inf.io_type = (u8)io_type;
7040         brcmu_d11_attach(&cfg->d11inf);
7041
7042         err = brcmf_setup_wiphy(wiphy, ifp);
7043         if (err < 0)
7044                 goto priv_out;
7045
7046         brcmf_dbg(INFO, "Registering custom regulatory\n");
7047         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
7048         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
7049         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
7050
7051         /* firmware defaults to 40MHz disabled in 2G band. We signal
7052          * cfg80211 here that we do and have it decide we can enable
7053          * it. But first check if device does support 2G operation.
7054          */
7055         if (wiphy->bands[NL80211_BAND_2GHZ]) {
7056                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
7057                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7058         }
7059         err = wiphy_register(wiphy);
7060         if (err < 0) {
7061                 brcmf_err("Could not register wiphy device (%d)\n", err);
7062                 goto priv_out;
7063         }
7064
7065         err = brcmf_setup_wiphybands(wiphy);
7066         if (err) {
7067                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
7068                 goto wiphy_unreg_out;
7069         }
7070
7071         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
7072          * setup 40MHz in 2GHz band and enable OBSS scanning.
7073          */
7074         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
7075                 err = brcmf_enable_bw40_2g(cfg);
7076                 if (!err)
7077                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
7078                                                       BRCMF_OBSS_COEX_AUTO);
7079                 else
7080                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7081         }
7082         /* p2p might require that "if-events" get processed by fweh. So
7083          * activate the already registered event handlers now and activate
7084          * the rest when initialization has completed. drvr->config needs to
7085          * be assigned before activating events.
7086          */
7087         drvr->config = cfg;
7088         err = brcmf_fweh_activate_events(ifp);
7089         if (err) {
7090                 brcmf_err("FWEH activation failed (%d)\n", err);
7091                 goto wiphy_unreg_out;
7092         }
7093
7094         err = brcmf_p2p_attach(cfg, p2pdev_forced);
7095         if (err) {
7096                 brcmf_err("P2P initialisation failed (%d)\n", err);
7097                 goto wiphy_unreg_out;
7098         }
7099         err = brcmf_btcoex_attach(cfg);
7100         if (err) {
7101                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
7102                 brcmf_p2p_detach(&cfg->p2p);
7103                 goto wiphy_unreg_out;
7104         }
7105         err = brcmf_pno_attach(cfg);
7106         if (err) {
7107                 brcmf_err("PNO initialisation failed (%d)\n", err);
7108                 brcmf_btcoex_detach(cfg);
7109                 brcmf_p2p_detach(&cfg->p2p);
7110                 goto wiphy_unreg_out;
7111         }
7112
7113         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
7114                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
7115                 if (err) {
7116                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
7117                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
7118                 } else {
7119                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
7120                                             brcmf_notify_tdls_peer_event);
7121                 }
7122         }
7123
7124         /* (re-) activate FWEH event handling */
7125         err = brcmf_fweh_activate_events(ifp);
7126         if (err) {
7127                 brcmf_err("FWEH activation failed (%d)\n", err);
7128                 goto detach;
7129         }
7130
7131         /* Fill in some of the advertised nl80211 supported features */
7132         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7133                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7134 #ifdef CONFIG_PM
7135                 if (wiphy->wowlan &&
7136                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7137                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7138 #endif
7139         }
7140
7141         return cfg;
7142
7143 detach:
7144         brcmf_pno_detach(cfg);
7145         brcmf_btcoex_detach(cfg);
7146         brcmf_p2p_detach(&cfg->p2p);
7147 wiphy_unreg_out:
7148         wiphy_unregister(cfg->wiphy);
7149 priv_out:
7150         wl_deinit_priv(cfg);
7151         brcmf_free_vif(vif);
7152         ifp->vif = NULL;
7153 wiphy_out:
7154         brcmf_free_wiphy(wiphy);
7155 ops_out:
7156         kfree(ops);
7157         return NULL;
7158 }
7159
7160 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7161 {
7162         if (!cfg)
7163                 return;
7164
7165         brcmf_pno_detach(cfg);
7166         brcmf_btcoex_detach(cfg);
7167         wiphy_unregister(cfg->wiphy);
7168         kfree(cfg->ops);
7169         wl_deinit_priv(cfg);
7170         brcmf_free_wiphy(cfg->wiphy);
7171 }