drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 // SPDX-License-Identifier: ISC
   2 /*
   3  * Copyright (c) 2010 Broadcom Corporation
   4  */
   5
   6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/etherdevice.h>
  10 #include <linux/module.h>
  11 #include <linux/vmalloc.h>
  12 #include <net/cfg80211.h>
  13 #include <net/netlink.h>
  14 #include <uapi/linux/if_arp.h>
  15
  16 #include <brcmu_utils.h>
  17 #include <defs.h>
  18 #include <brcmu_wifi.h>
  19 #include <brcm_hw_ids.h>
  20 #include "core.h"
  21 #include "debug.h"
  22 #include "tracepoint.h"
  23 #include "fwil_types.h"
  24 #include "p2p.h"
  25 #include "btcoex.h"
  26 #include "pno.h"
  27 #include "fwsignal.h"
  28 #include "cfg80211.h"
  29 #include "feature.h"
  30 #include "fwil.h"
  31 #include "proto.h"
  32 #include "vendor.h"
  33 #include "bus.h"
  34 #include "common.h"
  35
  36 #define BRCMF_SCAN_IE_LEN_MAX           2048
  37
  38 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  39 #define WPA_OUI_TYPE                    1
  40 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  41 #define WME_OUI_TYPE                    2
  42 #define WPS_OUI_TYPE                    4
  43
  44 #define VS_IE_FIXED_HDR_LEN             6
  45 #define WPA_IE_VERSION_LEN              2
  46 #define WPA_IE_MIN_OUI_LEN              4
  47 #define WPA_IE_SUITE_COUNT_LEN          2
  48
  49 #define WPA_CIPHER_NONE                 0       /* None */
  50 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  51 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  52 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  53 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  54
  55 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  56 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  57 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  58 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  59 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  60 #define RSN_AKM_SAE                     8       /* SAE */
  61 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  62 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  63 #define RSN_CAP_MFPR_MASK               BIT(6)
  64 #define RSN_CAP_MFPC_MASK               BIT(7)
  65 #define RSN_PMKID_COUNT_LEN             2
  66
  67 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  68                                                  * string :"add", "del" (+ NUL)
  69                                                  */
  70 #define VNDR_IE_COUNT_OFFSET            4
  71 #define VNDR_IE_PKTFLAG_OFFSET          8
  72 #define VNDR_IE_VSIE_OFFSET             12
  73 #define VNDR_IE_HDR_SIZE                12
  74 #define VNDR_IE_PARSE_LIMIT             5
  75
  76 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  77 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  78
  79 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  80 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  81 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  82
  83 #define BRCMF_SCAN_CHANNEL_TIME         40
  84 #define BRCMF_SCAN_UNASSOC_TIME         40
  85 #define BRCMF_SCAN_PASSIVE_TIME         120
  86
  87 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  88
  89 #define BRCMF_PS_MAX_TIMEOUT_MS         2000
  90
  91 /* Dump obss definitions */
  92 #define ACS_MSRMNT_DELAY                80
  93 #define CHAN_NOISE_DUMMY                (-80)
  94 #define OBSS_TOKEN_IDX                  15
  95 #define IBSS_TOKEN_IDX                  15
  96 #define TX_TOKEN_IDX                    14
  97 #define CTG_TOKEN_IDX                   13
  98 #define PKT_TOKEN_IDX                   15
  99 #define IDLE_TOKEN_IDX                  12
 100
 101 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 102         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 103
 104 #define BRCMF_MAX_CHANSPEC_LIST \
 105         (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
 106
 107 struct brcmf_dump_survey {
 108         u32 obss;
 109         u32 ibss;
 110         u32 no_ctg;
 111         u32 no_pckt;
 112         u32 tx;
 113         u32 idle;
 114 };
 115
 116 struct cca_stats_n_flags {
 117         u32 msrmnt_time; /* Time for Measurement (msec) */
 118         u32 msrmnt_done; /* flag set when measurement complete */
 119         char buf[1];
 120 };
 121
 122 struct cca_msrmnt_query {
 123         u32 msrmnt_query;
 124         u32 time_req;
 125 };
 126
 127 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 128 {
 129         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 130                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 131                           vif->sme_state);
 132                 return false;
 133         }
 134         return true;
 135 }
 136
 137 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 138 #define RATETAB_ENT(_rateid, _flags) \
 139         {                                                               \
 140                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 141                 .hw_value       = (_rateid),                            \
 142                 .flags          = (_flags),                             \
 143         }
 144
 145 static struct ieee80211_rate __wl_rates[] = {
 146         RATETAB_ENT(BRCM_RATE_1M, 0),
 147         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 148         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 149         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 150         RATETAB_ENT(BRCM_RATE_6M, 0),
 151         RATETAB_ENT(BRCM_RATE_9M, 0),
 152         RATETAB_ENT(BRCM_RATE_12M, 0),
 153         RATETAB_ENT(BRCM_RATE_18M, 0),
 154         RATETAB_ENT(BRCM_RATE_24M, 0),
 155         RATETAB_ENT(BRCM_RATE_36M, 0),
 156         RATETAB_ENT(BRCM_RATE_48M, 0),
 157         RATETAB_ENT(BRCM_RATE_54M, 0),
 158 };
 159
 160 #define wl_g_rates              (__wl_rates + 0)
 161 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 162 #define wl_a_rates              (__wl_rates + 4)
 163 #define wl_a_rates_size         (wl_g_rates_size - 4)
 164
 165 #define CHAN2G(_channel, _freq) {                               \
 166         .band                   = NL80211_BAND_2GHZ,            \
 167         .center_freq            = (_freq),                      \
 168         .hw_value               = (_channel),                   \
 169         .max_antenna_gain       = 0,                            \
 170         .max_power              = 30,                           \
 171 }
 172
 173 #define CHAN5G(_channel) {                                      \
 174         .band                   = NL80211_BAND_5GHZ,            \
 175         .center_freq            = 5000 + (5 * (_channel)),      \
 176         .hw_value               = (_channel),                   \
 177         .max_antenna_gain       = 0,                            \
 178         .max_power              = 30,                           \
 179 }
 180
 181 static struct ieee80211_channel __wl_2ghz_channels[] = {
 182         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 183         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 184         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 185         CHAN2G(13, 2472), CHAN2G(14, 2484)
 186 };
 187
 188 static struct ieee80211_channel __wl_5ghz_channels[] = {
 189         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 190         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 191         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 192         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 193         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 194         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 195 };
 196
 197 /* Band templates duplicated per wiphy. The channel info
 198  * above is added to the band during setup.
 199  */
 200 static const struct ieee80211_supported_band __wl_band_2ghz = {
 201         .band = NL80211_BAND_2GHZ,
 202         .bitrates = wl_g_rates,
 203         .n_bitrates = wl_g_rates_size,
 204 };
 205
 206 static const struct ieee80211_supported_band __wl_band_5ghz = {
 207         .band = NL80211_BAND_5GHZ,
 208         .bitrates = wl_a_rates,
 209         .n_bitrates = wl_a_rates_size,
 210 };
 211
 212 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 213  * By default world regulatory domain defined in reg.c puts the flags
 214  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 215  * With respect to these flags, wpa_supplicant doesn't * start p2p
 216  * operations on 5GHz channels. All the changes in world regulatory
 217  * domain are to be done here.
 218  */
 219 static const struct ieee80211_regdomain brcmf_regdom = {
 220         .n_reg_rules = 4,
 221         .alpha2 =  "99",
 222         .reg_rules = {
 223                 /* IEEE 802.11b/g, channels 1..11 */
 224                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 225                 /* If any */
 226                 /* IEEE 802.11 channel 14 - Only JP enables
 227                  * this and for 802.11b only
 228                  */
 229                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 230                 /* IEEE 802.11a, channel 36..64 */
 231                 REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
 232                 /* IEEE 802.11a, channel 100..165 */
 233                 REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
 234 };
 235
 236 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 237  * are supported. A pointer to this array and the number of entries is passed
 238  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 239  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 240  * device does not support MFP then the number of suites will be decreased by 1
 241  */
 242 static const u32 brcmf_cipher_suites[] = {
 243         WLAN_CIPHER_SUITE_WEP40,
 244         WLAN_CIPHER_SUITE_WEP104,
 245         WLAN_CIPHER_SUITE_TKIP,
 246         WLAN_CIPHER_SUITE_CCMP,
 247         /* Keep as last entry: */
 248         WLAN_CIPHER_SUITE_AES_CMAC
 249 };
 250
 251 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 252 struct brcmf_vs_tlv {
 253         u8 id;
 254         u8 len;
 255         u8 oui[3];
 256         u8 oui_type;
 257 };
 258
 259 struct parsed_vndr_ie_info {
 260         u8 *ie_ptr;
 261         u32 ie_len;     /* total length including id & length field */
 262         struct brcmf_vs_tlv vndrie;
 263 };
 264
 265 struct parsed_vndr_ies {
 266         u32 count;
 267         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 268 };
 269
 270 #define WL_INTERFACE_CREATE_VER_1               1
 271 #define WL_INTERFACE_CREATE_VER_2               2
 272 #define WL_INTERFACE_CREATE_VER_3               3
 273 #define WL_INTERFACE_CREATE_VER_MAX             WL_INTERFACE_CREATE_VER_3
 274
 275 #define WL_INTERFACE_MAC_DONT_USE       0x0
 276 #define WL_INTERFACE_MAC_USE            0x2
 277
 278 #define WL_INTERFACE_CREATE_STA         0x0
 279 #define WL_INTERFACE_CREATE_AP          0x1
 280
 281 struct wl_interface_create_v1 {
 282         u16     ver;                    /* structure version */
 283         u32     flags;                  /* flags for operation */
 284         u8      mac_addr[ETH_ALEN];     /* MAC address */
 285         u32     wlc_index;              /* optional for wlc index */
 286 };
 287
 288 struct wl_interface_create_v2 {
 289         u16     ver;                    /* structure version */
 290         u8      pad1[2];
 291         u32     flags;                  /* flags for operation */
 292         u8      mac_addr[ETH_ALEN];     /* MAC address */
 293         u8      iftype;                 /* type of interface created */
 294         u8      pad2;
 295         u32     wlc_index;              /* optional for wlc index */
 296 };
 297
 298 struct wl_interface_create_v3 {
 299         u16 ver;                        /* structure version */
 300         u16 len;                        /* length of structure + data */
 301         u16 fixed_len;                  /* length of structure */
 302         u8 iftype;                      /* type of interface created */
 303         u8 wlc_index;                   /* optional for wlc index */
 304         u32 flags;                      /* flags for operation */
 305         u8 mac_addr[ETH_ALEN];          /* MAC address */
 306         u8 bssid[ETH_ALEN];             /* optional for BSSID */
 307         u8 if_index;                    /* interface index request */
 308         u8 pad[3];
 309         u8 data[];                      /* Optional for specific data */
 310 };
 311
 312 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 313 {
 314         switch (band) {
 315         case NL80211_BAND_2GHZ:
 316                 return WLC_BAND_2G;
 317         case NL80211_BAND_5GHZ:
 318                 return WLC_BAND_5G;
 319         default:
 320                 WARN_ON(1);
 321                 break;
 322         }
 323         return 0;
 324 }
 325
 326 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 327                                struct cfg80211_chan_def *ch)
 328 {
 329         struct brcmu_chan ch_inf;
 330         s32 primary_offset;
 331
 332         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 333                   ch->chan->center_freq, ch->center_freq1, ch->width);
 334         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 335         primary_offset = ch->chan->center_freq - ch->center_freq1;
 336         switch (ch->width) {
 337         case NL80211_CHAN_WIDTH_20:
 338         case NL80211_CHAN_WIDTH_20_NOHT:
 339                 ch_inf.bw = BRCMU_CHAN_BW_20;
 340                 WARN_ON(primary_offset != 0);
 341                 break;
 342         case NL80211_CHAN_WIDTH_40:
 343                 ch_inf.bw = BRCMU_CHAN_BW_40;
 344                 if (primary_offset > 0)
 345                         ch_inf.sb = BRCMU_CHAN_SB_U;
 346                 else
 347                         ch_inf.sb = BRCMU_CHAN_SB_L;
 348                 break;
 349         case NL80211_CHAN_WIDTH_80:
 350                 ch_inf.bw = BRCMU_CHAN_BW_80;
 351                 if (primary_offset == -30)
 352                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 353                 else if (primary_offset == -10)
 354                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 355                 else if (primary_offset == 10)
 356                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 357                 else
 358                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 359                 break;
 360         case NL80211_CHAN_WIDTH_160:
 361                 ch_inf.bw = BRCMU_CHAN_BW_160;
 362                 if (primary_offset == -70)
 363                         ch_inf.sb = BRCMU_CHAN_SB_LLL;
 364                 else if (primary_offset == -50)
 365                         ch_inf.sb = BRCMU_CHAN_SB_LLU;
 366                 else if (primary_offset == -30)
 367                         ch_inf.sb = BRCMU_CHAN_SB_LUL;
 368                 else if (primary_offset == -10)
 369                         ch_inf.sb = BRCMU_CHAN_SB_LUU;
 370                 else if (primary_offset == 10)
 371                         ch_inf.sb = BRCMU_CHAN_SB_ULL;
 372                 else if (primary_offset == 30)
 373                         ch_inf.sb = BRCMU_CHAN_SB_ULU;
 374                 else if (primary_offset == 50)
 375                         ch_inf.sb = BRCMU_CHAN_SB_UUL;
 376                 else
 377                         ch_inf.sb = BRCMU_CHAN_SB_UUU;
 378                 break;
 379         case NL80211_CHAN_WIDTH_80P80:
 380         case NL80211_CHAN_WIDTH_5:
 381         case NL80211_CHAN_WIDTH_10:
 382         default:
 383                 WARN_ON_ONCE(1);
 384         }
 385         switch (ch->chan->band) {
 386         case NL80211_BAND_2GHZ:
 387                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 388                 break;
 389         case NL80211_BAND_5GHZ:
 390                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 391                 break;
 392         case NL80211_BAND_60GHZ:
 393         default:
 394                 WARN_ON_ONCE(1);
 395         }
 396         d11inf->encchspec(&ch_inf);
 397
 398         brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
 399         return ch_inf.chspec;
 400 }
 401
 402 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 403                         struct ieee80211_channel *ch)
 404 {
 405         struct brcmu_chan ch_inf;
 406
 407         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 408         ch_inf.bw = BRCMU_CHAN_BW_20;
 409         d11inf->encchspec(&ch_inf);
 410
 411         return ch_inf.chspec;
 412 }
 413
 414 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 415  * triples, returning a pointer to the substring whose first element
 416  * matches tag
 417  */
 418 static const struct brcmf_tlv *
 419 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 420 {
 421         const struct brcmf_tlv *elt = buf;
 422         int totlen = buflen;
 423
 424         /* find tagged parameter */
 425         while (totlen >= TLV_HDR_LEN) {
 426                 int len = elt->len;
 427
 428                 /* validate remaining totlen */
 429                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 430                         return elt;
 431
 432                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 433                 totlen -= (len + TLV_HDR_LEN);
 434         }
 435
 436         return NULL;
 437 }
 438
 439 /* Is any of the tlvs the expected entry? If
 440  * not update the tlvs buffer pointer/length.
 441  */
 442 static bool
 443 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 444                  const u8 *oui, u32 oui_len, u8 type)
 445 {
 446         /* If the contents match the OUI and the type */
 447         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 448             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 449             type == ie[TLV_BODY_OFF + oui_len]) {
 450                 return true;
 451         }
 452
 453         if (tlvs == NULL)
 454                 return false;
 455         /* point to the next ie */
 456         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 457         /* calculate the length of the rest of the buffer */
 458         *tlvs_len -= (int)(ie - *tlvs);
 459         /* update the pointer to the start of the buffer */
 460         *tlvs = ie;
 461
 462         return false;
 463 }
 464
 465 static struct brcmf_vs_tlv *
 466 brcmf_find_wpaie(const u8 *parse, u32 len)
 467 {
 468         const struct brcmf_tlv *ie;
 469
 470         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 471                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 472                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 473                         return (struct brcmf_vs_tlv *)ie;
 474         }
 475         return NULL;
 476 }
 477
 478 static struct brcmf_vs_tlv *
 479 brcmf_find_wpsie(const u8 *parse, u32 len)
 480 {
 481         const struct brcmf_tlv *ie;
 482
 483         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 484                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 485                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 486                         return (struct brcmf_vs_tlv *)ie;
 487         }
 488         return NULL;
 489 }
 490
 491 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 492                                      struct brcmf_cfg80211_vif *vif,
 493                                      enum nl80211_iftype new_type)
 494 {
 495         struct brcmf_cfg80211_vif *pos;
 496         bool check_combos = false;
 497         int ret = 0;
 498         struct iface_combination_params params = {
 499                 .num_different_channels = 1,
 500         };
 501
 502         list_for_each_entry(pos, &cfg->vif_list, list)
 503                 if (pos == vif) {
 504                         params.iftype_num[new_type]++;
 505                 } else {
 506                         /* concurrent interfaces so need check combinations */
 507                         check_combos = true;
 508                         params.iftype_num[pos->wdev.iftype]++;
 509                 }
 510
 511         if (check_combos)
 512                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 513
 514         return ret;
 515 }
 516
 517 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 518                                   enum nl80211_iftype new_type)
 519 {
 520         struct brcmf_cfg80211_vif *pos;
 521         struct iface_combination_params params = {
 522                 .num_different_channels = 1,
 523         };
 524
 525         list_for_each_entry(pos, &cfg->vif_list, list)
 526                 params.iftype_num[pos->wdev.iftype]++;
 527
 528         params.iftype_num[new_type]++;
 529         return cfg80211_check_combinations(cfg->wiphy, &params);
 530 }
 531
 532 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 533                                  struct brcmf_wsec_key_le *key_le)
 534 {
 535         key_le->index = cpu_to_le32(key->index);
 536         key_le->len = cpu_to_le32(key->len);
 537         key_le->algo = cpu_to_le32(key->algo);
 538         key_le->flags = cpu_to_le32(key->flags);
 539         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 540         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 541         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 542         memcpy(key_le->data, key->data, sizeof(key->data));
 543         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 544 }
 545
 546 static int
 547 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 548 {
 549         struct brcmf_pub *drvr = ifp->drvr;
 550         int err;
 551         struct brcmf_wsec_key_le key_le;
 552
 553         convert_key_from_CPU(key, &key_le);
 554
 555         brcmf_netdev_wait_pend8021x(ifp);
 556
 557         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 558                                         sizeof(key_le));
 559
 560         if (err)
 561                 bphy_err(drvr, "wsec_key error (%d)\n", err);
 562         return err;
 563 }
 564
 565 static void
 566 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 567 {
 568         struct brcmf_cfg80211_vif *vif;
 569         struct brcmf_if *ifp;
 570
 571         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 572         ifp = vif->ifp;
 573
 574         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 575             (wdev->iftype == NL80211_IFTYPE_AP) ||
 576             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 577                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 578                                                 ADDR_DIRECT);
 579         else
 580                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 581                                                 ADDR_INDIRECT);
 582 }
 583
 584 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 585 {
 586         int bsscfgidx;
 587
 588         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 589                 /* bsscfgidx 1 is reserved for legacy P2P */
 590                 if (bsscfgidx == 1)
 591                         continue;
 592                 if (!drvr->iflist[bsscfgidx])
 593                         return bsscfgidx;
 594         }
 595
 596         return -ENOMEM;
 597 }
 598
 599 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
 600 {
 601         u8 mac_idx = ifp->drvr->sta_mac_idx;
 602
 603         /* set difference MAC address with locally administered bit */
 604         memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
 605         mac_addr[0] |= 0x02;
 606         mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
 607         mac_idx++;
 608         mac_idx = mac_idx % 2;
 609         ifp->drvr->sta_mac_idx = mac_idx;
 610 }
 611
 612 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
 613 {
 614         struct wl_interface_create_v1 iface_v1;
 615         struct wl_interface_create_v2 iface_v2;
 616         struct wl_interface_create_v3 iface_v3;
 617         u32 iface_create_ver;
 618         int err;
 619
 620         /* interface_create version 1 */
 621         memset(&iface_v1, 0, sizeof(iface_v1));
 622         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 623         iface_v1.flags = WL_INTERFACE_CREATE_STA |
 624                          WL_INTERFACE_MAC_USE;
 625         if (!is_zero_ether_addr(macaddr))
 626                 memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
 627         else
 628                 brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 629
 630         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 631                                        &iface_v1,
 632                                        sizeof(iface_v1));
 633         if (err) {
 634                 brcmf_info("failed to create interface(v1), err=%d\n",
 635                            err);
 636         } else {
 637                 brcmf_dbg(INFO, "interface created(v1)\n");
 638                 return 0;
 639         }
 640
 641         /* interface_create version 2 */
 642         memset(&iface_v2, 0, sizeof(iface_v2));
 643         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 644         iface_v2.flags = WL_INTERFACE_MAC_USE;
 645         iface_v2.iftype = WL_INTERFACE_CREATE_STA;
 646         if (!is_zero_ether_addr(macaddr))
 647                 memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
 648         else
 649                 brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 650
 651         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 652                                        &iface_v2,
 653                                        sizeof(iface_v2));
 654         if (err) {
 655                 brcmf_info("failed to create interface(v2), err=%d\n",
 656                            err);
 657         } else {
 658                 brcmf_dbg(INFO, "interface created(v2)\n");
 659                 return 0;
 660         }
 661
 662         /* interface_create version 3+ */
 663         /* get supported version from firmware side */
 664         iface_create_ver = 0;
 665         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 666                                        &iface_create_ver);
 667         if (err) {
 668                 brcmf_err("fail to get supported version, err=%d\n", err);
 669                 return -EOPNOTSUPP;
 670         }
 671
 672         switch (iface_create_ver) {
 673         case WL_INTERFACE_CREATE_VER_3:
 674                 memset(&iface_v3, 0, sizeof(iface_v3));
 675                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 676                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 677                 iface_v3.iftype = WL_INTERFACE_CREATE_STA;
 678                 if (!is_zero_ether_addr(macaddr))
 679                         memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
 680                 else
 681                         brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 682
 683                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 684                                                &iface_v3,
 685                                                sizeof(iface_v3));
 686
 687                 if (!err)
 688                         brcmf_dbg(INFO, "interface created(v3)\n");
 689                 break;
 690         default:
 691                 brcmf_err("not support interface create(v%d)\n",
 692                           iface_create_ver);
 693                 err = -EOPNOTSUPP;
 694                 break;
 695         }
 696
 697         if (err) {
 698                 brcmf_info("station interface creation failed (%d)\n",
 699                            err);
 700                 return -EIO;
 701         }
 702
 703         return 0;
 704 }
 705
 706 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 707 {
 708         struct wl_interface_create_v1 iface_v1;
 709         struct wl_interface_create_v2 iface_v2;
 710         struct wl_interface_create_v3 iface_v3;
 711         u32 iface_create_ver;
 712         struct brcmf_pub *drvr = ifp->drvr;
 713         struct brcmf_mbss_ssid_le mbss_ssid_le;
 714         int bsscfgidx;
 715         int err;
 716
 717         /* interface_create version 1 */
 718         memset(&iface_v1, 0, sizeof(iface_v1));
 719         iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
 720         iface_v1.flags = WL_INTERFACE_CREATE_AP |
 721                          WL_INTERFACE_MAC_USE;
 722
 723         brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
 724
 725         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 726                                        &iface_v1,
 727                                        sizeof(iface_v1));
 728         if (err) {
 729                 brcmf_info("failed to create interface(v1), err=%d\n",
 730                            err);
 731         } else {
 732                 brcmf_dbg(INFO, "interface created(v1)\n");
 733                 return 0;
 734         }
 735
 736         /* interface_create version 2 */
 737         memset(&iface_v2, 0, sizeof(iface_v2));
 738         iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
 739         iface_v2.flags = WL_INTERFACE_MAC_USE;
 740         iface_v2.iftype = WL_INTERFACE_CREATE_AP;
 741
 742         brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
 743
 744         err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 745                                        &iface_v2,
 746                                        sizeof(iface_v2));
 747         if (err) {
 748                 brcmf_info("failed to create interface(v2), err=%d\n",
 749                            err);
 750         } else {
 751                 brcmf_dbg(INFO, "interface created(v2)\n");
 752                 return 0;
 753         }
 754
 755         /* interface_create version 3+ */
 756         /* get supported version from firmware side */
 757         iface_create_ver = 0;
 758         err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
 759                                        &iface_create_ver);
 760         if (err) {
 761                 brcmf_err("fail to get supported version, err=%d\n", err);
 762                 return -EOPNOTSUPP;
 763         }
 764
 765         switch (iface_create_ver) {
 766         case WL_INTERFACE_CREATE_VER_3:
 767                 memset(&iface_v3, 0, sizeof(iface_v3));
 768                 iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
 769                 iface_v3.flags = WL_INTERFACE_MAC_USE;
 770                 iface_v3.iftype = WL_INTERFACE_CREATE_AP;
 771                 brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
 772
 773                 err = brcmf_fil_iovar_data_get(ifp, "interface_create",
 774                                                &iface_v3,
 775                                                sizeof(iface_v3));
 776
 777                 if (!err)
 778                         brcmf_dbg(INFO, "interface created(v3)\n");
 779                 break;
 780         default:
 781                 brcmf_err("not support interface create(v%d)\n",
 782                           iface_create_ver);
 783                 err = -EOPNOTSUPP;
 784                 break;
 785         }
 786
 787         if (err) {
 788                 brcmf_info("Does not support interface_create (%d)\n",
 789                            err);
 790                 memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 791                 bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 792                 if (bsscfgidx < 0)
 793                         return bsscfgidx;
 794
 795                 mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 796                 mbss_ssid_le.SSID_len = cpu_to_le32(5);
 797                 sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
 798
 799                 err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 800                                                 sizeof(mbss_ssid_le));
 801
 802                 if (err < 0)
 803                         bphy_err(drvr, "setting ssid failed %d\n", err);
 804         }
 805
 806         return err;
 807 }
 808
 809 /**
 810  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
 811  *
 812  * @wiphy: wiphy device of new interface.
 813  * @name: name of the new interface.
 814  * @params: contains mac address for AP or STA device.
 815  * @type: interface type.
 816  */
 817 static
 818 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
 819                                          struct vif_params *params,
 820                                          enum nl80211_iftype type)
 821 {
 822         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 823         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 824         struct brcmf_pub *drvr = cfg->pub;
 825         struct brcmf_cfg80211_vif *vif;
 826         int err;
 827
 828         if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
 829                 return ERR_PTR(-EINVAL);
 830
 831         if (brcmf_cfg80211_vif_event_armed(cfg))
 832                 return ERR_PTR(-EBUSY);
 833
 834         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 835
 836         vif = brcmf_alloc_vif(cfg, type);
 837         if (IS_ERR(vif))
 838                 return (struct wireless_dev *)vif;
 839
 840         brcmf_cfg80211_arm_vif_event(cfg, vif);
 841
 842         if (type == NL80211_IFTYPE_STATION)
 843                 err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
 844         else
 845                 err = brcmf_cfg80211_request_ap_if(ifp);
 846         if (err) {
 847                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 848                 goto fail;
 849         }
 850
 851         /* wait for firmware event */
 852         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 853                                             BRCMF_VIF_EVENT_TIMEOUT);
 854         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 855         if (!err) {
 856                 bphy_err(drvr, "timeout occurred\n");
 857                 err = -EIO;
 858                 goto fail;
 859         }
 860
 861         /* interface created in firmware */
 862         ifp = vif->ifp;
 863         if (!ifp) {
 864                 bphy_err(drvr, "no if pointer provided\n");
 865                 err = -ENOENT;
 866                 goto fail;
 867         }
 868
 869         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 870         err = brcmf_net_attach(ifp, true);
 871         if (err) {
 872                 bphy_err(drvr, "Registering netdevice failed\n");
 873                 free_netdev(ifp->ndev);
 874                 goto fail;
 875         }
 876
 877         return &ifp->vif->wdev;
 878
 879 fail:
 880         brcmf_free_vif(vif);
 881         return ERR_PTR(err);
 882 }
 883
 884 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 885 {
 886         enum nl80211_iftype iftype;
 887
 888         iftype = vif->wdev.iftype;
 889         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 890 }
 891
 892 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 893 {
 894         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 895 }
 896
 897 /**
 898  * brcmf_mon_add_vif() - create monitor mode virtual interface
 899  *
 900  * @wiphy: wiphy device of new interface.
 901  * @name: name of the new interface.
 902  */
 903 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
 904                                               const char *name)
 905 {
 906         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 907         struct brcmf_cfg80211_vif *vif;
 908         struct net_device *ndev;
 909         struct brcmf_if *ifp;
 910         int err;
 911
 912         if (cfg->pub->mon_if) {
 913                 err = -EEXIST;
 914                 goto err_out;
 915         }
 916
 917         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
 918         if (IS_ERR(vif)) {
 919                 err = PTR_ERR(vif);
 920                 goto err_out;
 921         }
 922
 923         ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
 924         if (!ndev) {
 925                 err = -ENOMEM;
 926                 goto err_free_vif;
 927         }
 928         ndev->type = ARPHRD_IEEE80211_RADIOTAP;
 929         ndev->ieee80211_ptr = &vif->wdev;
 930         ndev->needs_free_netdev = true;
 931         ndev->priv_destructor = brcmf_cfg80211_free_netdev;
 932         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
 933
 934         ifp = netdev_priv(ndev);
 935         ifp->vif = vif;
 936         ifp->ndev = ndev;
 937         ifp->drvr = cfg->pub;
 938
 939         vif->ifp = ifp;
 940         vif->wdev.netdev = ndev;
 941
 942         err = brcmf_net_mon_attach(ifp);
 943         if (err) {
 944                 brcmf_err("Failed to attach %s device\n", ndev->name);
 945                 free_netdev(ndev);
 946                 goto err_free_vif;
 947         }
 948
 949         cfg->pub->mon_if = ifp;
 950
 951         return &vif->wdev;
 952
 953 err_free_vif:
 954         brcmf_free_vif(vif);
 955 err_out:
 956         return ERR_PTR(err);
 957 }
 958
 959 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 960 {
 961         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 962         struct net_device *ndev = wdev->netdev;
 963
 964         ndev->netdev_ops->ndo_stop(ndev);
 965
 966         brcmf_net_detach(ndev, true);
 967
 968         cfg->pub->mon_if = NULL;
 969
 970         return 0;
 971 }
 972
 973 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 974                                                      const char *name,
 975                                                      unsigned char name_assign_type,
 976                                                      enum nl80211_iftype type,
 977                                                      struct vif_params *params)
 978 {
 979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 980         struct brcmf_pub *drvr = cfg->pub;
 981         struct wireless_dev *wdev;
 982         int err;
 983
 984         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 985         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 986         if (err) {
 987                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
 988                 return ERR_PTR(err);
 989         }
 990         switch (type) {
 991         case NL80211_IFTYPE_ADHOC:
 992         case NL80211_IFTYPE_AP_VLAN:
 993         case NL80211_IFTYPE_WDS:
 994         case NL80211_IFTYPE_MESH_POINT:
 995                 return ERR_PTR(-EOPNOTSUPP);
 996         case NL80211_IFTYPE_MONITOR:
 997                 return brcmf_mon_add_vif(wiphy, name);
 998         case NL80211_IFTYPE_STATION:
 999         case NL80211_IFTYPE_AP:
1000                 wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1001                 break;
1002         case NL80211_IFTYPE_P2P_CLIENT:
1003         case NL80211_IFTYPE_P2P_GO:
1004         case NL80211_IFTYPE_P2P_DEVICE:
1005                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1006                 break;
1007         case NL80211_IFTYPE_UNSPECIFIED:
1008         default:
1009                 return ERR_PTR(-EINVAL);
1010         }
1011
1012         if (IS_ERR(wdev))
1013                 bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1014                          type, (int)PTR_ERR(wdev));
1015         else
1016                 brcmf_cfg80211_update_proto_addr_mode(wdev);
1017
1018         return wdev;
1019 }
1020
1021 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1022 {
1023         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1024                 brcmf_set_mpc(ifp, mpc);
1025 }
1026
1027 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1028 {
1029         struct brcmf_pub *drvr = ifp->drvr;
1030         s32 err = 0;
1031
1032         if (check_vif_up(ifp->vif)) {
1033                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1034                 if (err) {
1035                         bphy_err(drvr, "fail to set mpc\n");
1036                         return;
1037                 }
1038                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
1039         }
1040 }
1041
1042 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1043                                 struct brcmf_if *ifp, bool aborted,
1044                                 bool fw_abort)
1045 {
1046         struct brcmf_pub *drvr = cfg->pub;
1047         struct brcmf_scan_params_le params_le;
1048         struct cfg80211_scan_request *scan_request;
1049         u64 reqid;
1050         u32 bucket;
1051         s32 err = 0;
1052
1053         brcmf_dbg(SCAN, "Enter\n");
1054
1055         /* clear scan request, because the FW abort can cause a second call */
1056         /* to this functon and might cause a double cfg80211_scan_done      */
1057         scan_request = cfg->scan_request;
1058         cfg->scan_request = NULL;
1059
1060         if (timer_pending(&cfg->escan_timeout))
1061                 del_timer_sync(&cfg->escan_timeout);
1062
1063         if (fw_abort) {
1064                 /* Do a scan abort to stop the driver's scan engine */
1065                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1066                 memset(&params_le, 0, sizeof(params_le));
1067                 eth_broadcast_addr(params_le.bssid);
1068                 params_le.bss_type = DOT11_BSSTYPE_ANY;
1069                 params_le.scan_type = 0;
1070                 params_le.channel_num = cpu_to_le32(1);
1071                 params_le.nprobes = cpu_to_le32(1);
1072                 params_le.active_time = cpu_to_le32(-1);
1073                 params_le.passive_time = cpu_to_le32(-1);
1074                 params_le.home_time = cpu_to_le32(-1);
1075                 /* Scan is aborted by setting channel_list[0] to -1 */
1076                 params_le.channel_list[0] = cpu_to_le16(-1);
1077                 /* E-Scan (or anyother type) can be aborted by SCAN */
1078                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1079                                              &params_le, sizeof(params_le));
1080                 if (err)
1081                         bphy_err(drvr, "Scan abort failed\n");
1082         }
1083
1084         brcmf_scan_config_mpc(ifp, 1);
1085
1086         /*
1087          * e-scan can be initiated internally
1088          * which takes precedence.
1089          */
1090         if (cfg->int_escan_map) {
1091                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1092                           cfg->int_escan_map);
1093                 while (cfg->int_escan_map) {
1094                         bucket = __ffs(cfg->int_escan_map);
1095                         cfg->int_escan_map &= ~BIT(bucket);
1096                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1097                                                                bucket);
1098                         if (!aborted) {
1099                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1100                                           reqid);
1101                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1102                                                             reqid);
1103                         }
1104                 }
1105         } else if (scan_request) {
1106                 struct cfg80211_scan_info info = {
1107                         .aborted = aborted,
1108                 };
1109
1110                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1111                           aborted ? "Aborted" : "Done");
1112                 cfg80211_scan_done(scan_request, &info);
1113         }
1114         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1115                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1116
1117         return err;
1118 }
1119
1120 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1121                                           struct wireless_dev *wdev)
1122 {
1123         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1124         struct net_device *ndev = wdev->netdev;
1125         struct brcmf_if *ifp = netdev_priv(ndev);
1126         struct brcmf_pub *drvr = cfg->pub;
1127         int ret;
1128         int err;
1129
1130         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1131
1132         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1133         if (err) {
1134                 bphy_err(drvr, "interface_remove failed %d\n", err);
1135                 goto err_unarm;
1136         }
1137
1138         /* wait for firmware event */
1139         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1140                                             BRCMF_VIF_EVENT_TIMEOUT);
1141         if (!ret) {
1142                 bphy_err(drvr, "timeout occurred\n");
1143                 err = -EIO;
1144                 goto err_unarm;
1145         }
1146
1147         brcmf_remove_interface(ifp, true);
1148
1149 err_unarm:
1150         brcmf_cfg80211_arm_vif_event(cfg, NULL);
1151         return err;
1152 }
1153
1154 static
1155 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1156 {
1157         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1158         struct net_device *ndev = wdev->netdev;
1159
1160         if (ndev && ndev == cfg_to_ndev(cfg))
1161                 return -ENOTSUPP;
1162
1163         /* vif event pending in firmware */
1164         if (brcmf_cfg80211_vif_event_armed(cfg))
1165                 return -EBUSY;
1166
1167         if (ndev) {
1168                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1169                     cfg->escan_info.ifp == netdev_priv(ndev))
1170                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1171                                                     true, true);
1172
1173                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1174         }
1175
1176         switch (wdev->iftype) {
1177         case NL80211_IFTYPE_ADHOC:
1178         case NL80211_IFTYPE_AP_VLAN:
1179         case NL80211_IFTYPE_WDS:
1180         case NL80211_IFTYPE_MESH_POINT:
1181                 return -EOPNOTSUPP;
1182         case NL80211_IFTYPE_MONITOR:
1183                 return brcmf_mon_del_vif(wiphy, wdev);
1184         case NL80211_IFTYPE_STATION:
1185         case NL80211_IFTYPE_AP:
1186                 return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1187         case NL80211_IFTYPE_P2P_CLIENT:
1188         case NL80211_IFTYPE_P2P_GO:
1189         case NL80211_IFTYPE_P2P_DEVICE:
1190                 return brcmf_p2p_del_vif(wiphy, wdev);
1191         case NL80211_IFTYPE_UNSPECIFIED:
1192         default:
1193                 return -EINVAL;
1194         }
1195         return -EOPNOTSUPP;
1196 }
1197
1198 static s32
1199 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1200                          enum nl80211_iftype type,
1201                          struct vif_params *params)
1202 {
1203         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1204         struct brcmf_if *ifp = netdev_priv(ndev);
1205         struct brcmf_cfg80211_vif *vif = ifp->vif;
1206         struct brcmf_pub *drvr = cfg->pub;
1207         s32 infra = 0;
1208         s32 ap = 0;
1209         s32 err = 0;
1210
1211         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1212                   type);
1213
1214         /* WAR: There are a number of p2p interface related problems which
1215          * need to be handled initially (before doing the validate).
1216          * wpa_supplicant tends to do iface changes on p2p device/client/go
1217          * which are not always possible/allowed. However we need to return
1218          * OK otherwise the wpa_supplicant wont start. The situation differs
1219          * on configuration and setup (p2pon=1 module param). The first check
1220          * is to see if the request is a change to station for p2p iface.
1221          */
1222         if ((type == NL80211_IFTYPE_STATION) &&
1223             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1224              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1225              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1226                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1227                 /* Now depending on whether module param p2pon=1 was used the
1228                  * response needs to be either 0 or EOPNOTSUPP. The reason is
1229                  * that if p2pon=1 is used, but a newer supplicant is used then
1230                  * we should return an error, as this combination wont work.
1231                  * In other situations 0 is returned and supplicant will start
1232                  * normally. It will give a trace in cfg80211, but it is the
1233                  * only way to get it working. Unfortunately this will result
1234                  * in situation where we wont support new supplicant in
1235                  * combination with module param p2pon=1, but that is the way
1236                  * it is. If the user tries this then unloading of driver might
1237                  * fail/lock.
1238                  */
1239                 if (cfg->p2p.p2pdev_dynamically)
1240                         return -EOPNOTSUPP;
1241                 else
1242                         return 0;
1243         }
1244         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1245         if (err) {
1246                 bphy_err(drvr, "iface validation failed: err=%d\n", err);
1247                 return err;
1248         }
1249         switch (type) {
1250         case NL80211_IFTYPE_MONITOR:
1251         case NL80211_IFTYPE_WDS:
1252                 bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1253                          type);
1254                 return -EOPNOTSUPP;
1255         case NL80211_IFTYPE_ADHOC:
1256                 infra = 0;
1257                 break;
1258         case NL80211_IFTYPE_STATION:
1259                 infra = 1;
1260                 break;
1261         case NL80211_IFTYPE_AP:
1262         case NL80211_IFTYPE_P2P_GO:
1263                 ap = 1;
1264                 break;
1265         default:
1266                 err = -EINVAL;
1267                 goto done;
1268         }
1269
1270         if (ap) {
1271                 if (type == NL80211_IFTYPE_P2P_GO) {
1272                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
1273                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1274                 }
1275                 if (!err) {
1276                         brcmf_dbg(INFO, "IF Type = AP\n");
1277                 }
1278         } else {
1279                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1280                 if (err) {
1281                         bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1282                         err = -EAGAIN;
1283                         goto done;
1284                 }
1285                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1286                           "Adhoc" : "Infra");
1287         }
1288         ndev->ieee80211_ptr->iftype = type;
1289
1290         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1291
1292 done:
1293         brcmf_dbg(TRACE, "Exit\n");
1294
1295         return err;
1296 }
1297
1298 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1299                              struct brcmf_scan_params_le *params_le,
1300                              struct cfg80211_scan_request *request)
1301 {
1302         u32 n_ssids;
1303         u32 n_channels;
1304         s32 i;
1305         s32 offset;
1306         u16 chanspec;
1307         char *ptr;
1308         struct brcmf_ssid_le ssid_le;
1309
1310         eth_broadcast_addr(params_le->bssid);
1311         params_le->bss_type = DOT11_BSSTYPE_ANY;
1312         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
1313         params_le->channel_num = 0;
1314         params_le->nprobes = cpu_to_le32(-1);
1315         params_le->active_time = cpu_to_le32(-1);
1316         params_le->passive_time = cpu_to_le32(-1);
1317         params_le->home_time = cpu_to_le32(-1);
1318         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1319
1320         n_ssids = request->n_ssids;
1321         n_channels = request->n_channels;
1322
1323         /* Copy channel array if applicable */
1324         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1325                   n_channels);
1326         if (n_channels > 0) {
1327                 for (i = 0; i < n_channels; i++) {
1328                         chanspec = channel_to_chanspec(&cfg->d11inf,
1329                                                        request->channels[i]);
1330                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1331                                   request->channels[i]->hw_value, chanspec);
1332                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1333                 }
1334         } else {
1335                 brcmf_dbg(SCAN, "Scanning all channels\n");
1336         }
1337         /* Copy ssid array if applicable */
1338         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1339         if (n_ssids > 0) {
1340                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1341                                 n_channels * sizeof(u16);
1342                 offset = roundup(offset, sizeof(u32));
1343                 ptr = (char *)params_le + offset;
1344                 for (i = 0; i < n_ssids; i++) {
1345                         memset(&ssid_le, 0, sizeof(ssid_le));
1346                         ssid_le.SSID_len =
1347                                         cpu_to_le32(request->ssids[i].ssid_len);
1348                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1349                                request->ssids[i].ssid_len);
1350                         if (!ssid_le.SSID_len)
1351                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1352                         else
1353                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1354                                           i, ssid_le.SSID, ssid_le.SSID_len);
1355                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1356                         ptr += sizeof(ssid_le);
1357                 }
1358         } else {
1359                 brcmf_dbg(SCAN, "Performing passive scan\n");
1360                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1361         }
1362         /* Adding mask to channel numbers */
1363         params_le->channel_num =
1364                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1365                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1366 }
1367
1368 static s32
1369 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1370                 struct cfg80211_scan_request *request)
1371 {
1372         struct brcmf_pub *drvr = cfg->pub;
1373         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1374                           offsetof(struct brcmf_escan_params_le, params_le);
1375         struct brcmf_escan_params_le *params;
1376         s32 err = 0;
1377
1378         brcmf_dbg(SCAN, "E-SCAN START\n");
1379
1380         if (request != NULL) {
1381                 /* Allocate space for populating ssids in struct */
1382                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1383
1384                 /* Allocate space for populating ssids in struct */
1385                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1386         }
1387
1388         params = kzalloc(params_size, GFP_KERNEL);
1389         if (!params) {
1390                 err = -ENOMEM;
1391                 goto exit;
1392         }
1393         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1394         brcmf_escan_prep(cfg, &params->params_le, request);
1395         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1396         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1397         params->sync_id = cpu_to_le16(0x1234);
1398
1399         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1400         if (err) {
1401                 if (err == -EBUSY)
1402                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1403                 else
1404                         bphy_err(drvr, "error (%d)\n", err);
1405         }
1406
1407         kfree(params);
1408 exit:
1409         return err;
1410 }
1411
1412 static s32
1413 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1414 {
1415         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1416         s32 err;
1417         struct brcmf_scan_results *results;
1418         struct escan_info *escan = &cfg->escan_info;
1419
1420         brcmf_dbg(SCAN, "Enter\n");
1421         escan->ifp = ifp;
1422         escan->wiphy = cfg->wiphy;
1423         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1424
1425         brcmf_scan_config_mpc(ifp, 0);
1426         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1427         results->version = 0;
1428         results->count = 0;
1429         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1430
1431         err = escan->run(cfg, ifp, request);
1432         if (err)
1433                 brcmf_scan_config_mpc(ifp, 1);
1434         return err;
1435 }
1436
1437 static s32
1438 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1439 {
1440         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1441         struct brcmf_pub *drvr = cfg->pub;
1442         struct brcmf_cfg80211_vif *vif;
1443         s32 err = 0;
1444
1445         brcmf_dbg(TRACE, "Enter\n");
1446         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1447         if (!check_vif_up(vif))
1448                 return -EIO;
1449
1450         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1451                 bphy_err(drvr, "Scanning already: status (%lu)\n",
1452                          cfg->scan_status);
1453                 return -EAGAIN;
1454         }
1455         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1456                 bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1457                          cfg->scan_status);
1458                 return -EAGAIN;
1459         }
1460         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1461                 bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1462                          cfg->scan_status);
1463                 return -EAGAIN;
1464         }
1465         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1466                 bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1467                 return -EAGAIN;
1468         }
1469
1470         /* If scan req comes for p2p0, send it over primary I/F */
1471         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1472                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1473
1474         brcmf_dbg(SCAN, "START ESCAN\n");
1475
1476         cfg->scan_request = request;
1477         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1478
1479         cfg->escan_info.run = brcmf_run_escan;
1480         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1481         if (err)
1482                 goto scan_out;
1483
1484         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1485                                     request->ie, request->ie_len);
1486         if (err)
1487                 goto scan_out;
1488
1489         err = brcmf_do_escan(vif->ifp, request);
1490         if (err)
1491                 goto scan_out;
1492
1493         /* Arm scan timeout timer */
1494         mod_timer(&cfg->escan_timeout,
1495                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1496
1497         return 0;
1498
1499 scan_out:
1500         bphy_err(drvr, "scan error (%d)\n", err);
1501         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1502         cfg->scan_request = NULL;
1503         return err;
1504 }
1505
1506 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1507 {
1508         struct brcmf_if *ifp = netdev_priv(ndev);
1509         struct brcmf_pub *drvr = ifp->drvr;
1510         s32 err = 0;
1511
1512         err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1513         if (err)
1514                 bphy_err(drvr, "Error (%d)\n", err);
1515
1516         return err;
1517 }
1518
1519 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1520 {
1521         struct brcmf_if *ifp = netdev_priv(ndev);
1522         struct brcmf_pub *drvr = ifp->drvr;
1523         s32 err = 0;
1524
1525         err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1526                                       frag_threshold);
1527         if (err)
1528                 bphy_err(drvr, "Error (%d)\n", err);
1529
1530         return err;
1531 }
1532
1533 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1534 {
1535         struct brcmf_if *ifp = netdev_priv(ndev);
1536         struct brcmf_pub *drvr = ifp->drvr;
1537         s32 err = 0;
1538         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1539
1540         err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1541         if (err) {
1542                 bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1543                 return err;
1544         }
1545         return err;
1546 }
1547
1548 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1549 {
1550         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1551         struct net_device *ndev = cfg_to_ndev(cfg);
1552         struct brcmf_if *ifp = netdev_priv(ndev);
1553         s32 err = 0;
1554
1555         brcmf_dbg(TRACE, "Enter\n");
1556         if (!check_vif_up(ifp->vif))
1557                 return -EIO;
1558
1559         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1560             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1561                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1562                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1563                 if (!err)
1564                         goto done;
1565         }
1566         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1567             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1568                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1569                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1570                 if (!err)
1571                         goto done;
1572         }
1573         if (changed & WIPHY_PARAM_RETRY_LONG
1574             && (cfg->conf->retry_long != wiphy->retry_long)) {
1575                 cfg->conf->retry_long = wiphy->retry_long;
1576                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1577                 if (!err)
1578                         goto done;
1579         }
1580         if (changed & WIPHY_PARAM_RETRY_SHORT
1581             && (cfg->conf->retry_short != wiphy->retry_short)) {
1582                 cfg->conf->retry_short = wiphy->retry_short;
1583                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1584                 if (!err)
1585                         goto done;
1586         }
1587
1588 done:
1589         brcmf_dbg(TRACE, "Exit\n");
1590         return err;
1591 }
1592
1593 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1594 {
1595         memset(prof, 0, sizeof(*prof));
1596 }
1597
1598 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1599 {
1600         u16 reason;
1601
1602         switch (e->event_code) {
1603         case BRCMF_E_DEAUTH:
1604         case BRCMF_E_DEAUTH_IND:
1605         case BRCMF_E_DISASSOC_IND:
1606                 reason = e->reason;
1607                 break;
1608         case BRCMF_E_LINK:
1609         default:
1610                 reason = 0;
1611                 break;
1612         }
1613         return reason;
1614 }
1615
1616 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1617 {
1618         struct brcmf_pub *drvr = ifp->drvr;
1619         struct brcmf_wsec_pmk_le pmk;
1620         int i, err;
1621
1622         /* convert to firmware key format */
1623         pmk.key_len = cpu_to_le16(pmk_len << 1);
1624         pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1625         for (i = 0; i < pmk_len; i++)
1626                 snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1627
1628         /* store psk in firmware */
1629         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1630                                      &pmk, sizeof(pmk));
1631         if (err < 0)
1632                 bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1633                          pmk_len);
1634
1635         return err;
1636 }
1637
1638 static int brcmf_set_sae_password(struct brcmf_if *ifp, const u8 *pwd_data,
1639                                   u16 pwd_len)
1640 {
1641         struct brcmf_pub *drvr = ifp->drvr;
1642         struct brcmf_wsec_sae_pwd_le sae_pwd;
1643         int err;
1644
1645         if (pwd_len > BRCMF_WSEC_MAX_SAE_PASSWORD_LEN) {
1646                 bphy_err(drvr, "sae_password must be less than %d\n",
1647                          BRCMF_WSEC_MAX_SAE_PASSWORD_LEN);
1648                 return -EINVAL;
1649         }
1650
1651         sae_pwd.key_len = cpu_to_le16(pwd_len);
1652         memcpy(sae_pwd.key, pwd_data, pwd_len);
1653
1654         err = brcmf_fil_iovar_data_set(ifp, "sae_password", &sae_pwd,
1655                                        sizeof(sae_pwd));
1656         if (err < 0)
1657                 bphy_err(drvr, "failed to set SAE password in firmware (len=%u)\n",
1658                          pwd_len);
1659
1660         return err;
1661 }
1662
1663 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1664                             bool locally_generated)
1665 {
1666         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1667         struct brcmf_pub *drvr = cfg->pub;
1668         bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1669         s32 err = 0;
1670
1671         brcmf_dbg(TRACE, "Enter\n");
1672
1673         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1674                 if (bus_up) {
1675                         brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1676                         err = brcmf_fil_cmd_data_set(vif->ifp,
1677                                                      BRCMF_C_DISASSOC, NULL, 0);
1678                         if (err)
1679                                 bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1680                                          err);
1681                 }
1682
1683                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1684                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1685                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1686                                               locally_generated, GFP_KERNEL);
1687         }
1688         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1689         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1690         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1691         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1692         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1693         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1694                 if (bus_up)
1695                         brcmf_set_pmk(vif->ifp, NULL, 0);
1696                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1697         }
1698         brcmf_dbg(TRACE, "Exit\n");
1699 }
1700
1701 static s32
1702 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1703                       struct cfg80211_ibss_params *params)
1704 {
1705         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1706         struct brcmf_if *ifp = netdev_priv(ndev);
1707         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1708         struct brcmf_pub *drvr = cfg->pub;
1709         struct brcmf_join_params join_params;
1710         size_t join_params_size = 0;
1711         s32 err = 0;
1712         s32 wsec = 0;
1713         s32 bcnprd;
1714         u16 chanspec;
1715         u32 ssid_len;
1716
1717         brcmf_dbg(TRACE, "Enter\n");
1718         if (!check_vif_up(ifp->vif))
1719                 return -EIO;
1720
1721         if (params->ssid)
1722                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1723         else {
1724                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1725                 return -EOPNOTSUPP;
1726         }
1727
1728         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1729
1730         if (params->bssid)
1731                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1732         else
1733                 brcmf_dbg(CONN, "No BSSID specified\n");
1734
1735         if (params->chandef.chan)
1736                 brcmf_dbg(CONN, "channel: %d\n",
1737                           params->chandef.chan->center_freq);
1738         else
1739                 brcmf_dbg(CONN, "no channel specified\n");
1740
1741         if (params->channel_fixed)
1742                 brcmf_dbg(CONN, "fixed channel required\n");
1743         else
1744                 brcmf_dbg(CONN, "no fixed channel required\n");
1745
1746         if (params->ie && params->ie_len)
1747                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1748         else
1749                 brcmf_dbg(CONN, "no ie specified\n");
1750
1751         if (params->beacon_interval)
1752                 brcmf_dbg(CONN, "beacon interval: %d\n",
1753                           params->beacon_interval);
1754         else
1755                 brcmf_dbg(CONN, "no beacon interval specified\n");
1756
1757         if (params->basic_rates)
1758                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1759         else
1760                 brcmf_dbg(CONN, "no basic rates specified\n");
1761
1762         if (params->privacy)
1763                 brcmf_dbg(CONN, "privacy required\n");
1764         else
1765                 brcmf_dbg(CONN, "no privacy required\n");
1766
1767         /* Configure Privacy for starter */
1768         if (params->privacy)
1769                 wsec |= WEP_ENABLED;
1770
1771         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1772         if (err) {
1773                 bphy_err(drvr, "wsec failed (%d)\n", err);
1774                 goto done;
1775         }
1776
1777         /* Configure Beacon Interval for starter */
1778         if (params->beacon_interval)
1779                 bcnprd = params->beacon_interval;
1780         else
1781                 bcnprd = 100;
1782
1783         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1784         if (err) {
1785                 bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1786                 goto done;
1787         }
1788
1789         /* Configure required join parameter */
1790         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1791
1792         /* SSID */
1793         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1794         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1795         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1796         join_params_size = sizeof(join_params.ssid_le);
1797
1798         /* BSSID */
1799         if (params->bssid) {
1800                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1801                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1802                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1803         } else {
1804                 eth_broadcast_addr(join_params.params_le.bssid);
1805                 eth_zero_addr(profile->bssid);
1806         }
1807
1808         /* Channel */
1809         if (params->chandef.chan) {
1810                 u32 target_channel;
1811
1812                 cfg->channel =
1813                         ieee80211_frequency_to_channel(
1814                                 params->chandef.chan->center_freq);
1815                 if (params->channel_fixed) {
1816                         /* adding chanspec */
1817                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1818                                                        &params->chandef);
1819                         join_params.params_le.chanspec_list[0] =
1820                                 cpu_to_le16(chanspec);
1821                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1822                         join_params_size += sizeof(join_params.params_le);
1823                 }
1824
1825                 /* set channel for starter */
1826                 target_channel = cfg->channel;
1827                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1828                                             target_channel);
1829                 if (err) {
1830                         bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1831                         goto done;
1832                 }
1833         } else
1834                 cfg->channel = 0;
1835
1836         cfg->ibss_starter = false;
1837
1838
1839         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1840                                      &join_params, join_params_size);
1841         if (err) {
1842                 bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1843                 goto done;
1844         }
1845
1846 done:
1847         if (err)
1848                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1849         brcmf_dbg(TRACE, "Exit\n");
1850         return err;
1851 }
1852
1853 static s32
1854 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1855 {
1856         struct brcmf_if *ifp = netdev_priv(ndev);
1857
1858         brcmf_dbg(TRACE, "Enter\n");
1859         if (!check_vif_up(ifp->vif)) {
1860                 /* When driver is being unloaded, it can end up here. If an
1861                  * error is returned then later on a debug trace in the wireless
1862                  * core module will be printed. To avoid this 0 is returned.
1863                  */
1864                 return 0;
1865         }
1866
1867         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1868         brcmf_net_setcarrier(ifp, false);
1869
1870         brcmf_dbg(TRACE, "Exit\n");
1871
1872         return 0;
1873 }
1874
1875 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1876                                  struct cfg80211_connect_params *sme)
1877 {
1878         struct brcmf_if *ifp = netdev_priv(ndev);
1879         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1880         struct brcmf_pub *drvr = ifp->drvr;
1881         struct brcmf_cfg80211_security *sec;
1882         s32 val = 0;
1883         s32 err = 0;
1884
1885         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1886                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1887         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1888                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1889         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1890                 val = WPA3_AUTH_SAE_PSK;
1891         else
1892                 val = WPA_AUTH_DISABLED;
1893         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1894         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1895         if (err) {
1896                 bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1897                 return err;
1898         }
1899         sec = &profile->sec;
1900         sec->wpa_versions = sme->crypto.wpa_versions;
1901         return err;
1902 }
1903
1904 static s32 brcmf_set_auth_type(struct net_device *ndev,
1905                                struct cfg80211_connect_params *sme)
1906 {
1907         struct brcmf_if *ifp = netdev_priv(ndev);
1908         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1909         struct brcmf_pub *drvr = ifp->drvr;
1910         struct brcmf_cfg80211_security *sec;
1911         s32 val = 0;
1912         s32 err = 0;
1913
1914         switch (sme->auth_type) {
1915         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1916                 val = 0;
1917                 brcmf_dbg(CONN, "open system\n");
1918                 break;
1919         case NL80211_AUTHTYPE_SHARED_KEY:
1920                 val = 1;
1921                 brcmf_dbg(CONN, "shared key\n");
1922                 break;
1923         case NL80211_AUTHTYPE_SAE:
1924                 val = 3;
1925                 brcmf_dbg(CONN, "SAE authentication\n");
1926                 break;
1927         default:
1928                 val = 2;
1929                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1930                 break;
1931         }
1932
1933         err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
1934         if (err) {
1935                 bphy_err(drvr, "set auth failed (%d)\n", err);
1936                 return err;
1937         }
1938         sec = &profile->sec;
1939         sec->auth_type = sme->auth_type;
1940         return err;
1941 }
1942
1943 static s32
1944 brcmf_set_wsec_mode(struct net_device *ndev,
1945                     struct cfg80211_connect_params *sme)
1946 {
1947         struct brcmf_if *ifp = netdev_priv(ndev);
1948         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1949         struct brcmf_pub *drvr = ifp->drvr;
1950         struct brcmf_cfg80211_security *sec;
1951         s32 pval = 0;
1952         s32 gval = 0;
1953         s32 wsec;
1954         s32 err = 0;
1955
1956         if (sme->crypto.n_ciphers_pairwise) {
1957                 switch (sme->crypto.ciphers_pairwise[0]) {
1958                 case WLAN_CIPHER_SUITE_WEP40:
1959                 case WLAN_CIPHER_SUITE_WEP104:
1960                         pval = WEP_ENABLED;
1961                         break;
1962                 case WLAN_CIPHER_SUITE_TKIP:
1963                         pval = TKIP_ENABLED;
1964                         break;
1965                 case WLAN_CIPHER_SUITE_CCMP:
1966                         pval = AES_ENABLED;
1967                         break;
1968                 case WLAN_CIPHER_SUITE_AES_CMAC:
1969                         pval = AES_ENABLED;
1970                         break;
1971                 default:
1972                         bphy_err(drvr, "invalid cipher pairwise (%d)\n",
1973                                  sme->crypto.ciphers_pairwise[0]);
1974                         return -EINVAL;
1975                 }
1976         }
1977         if (sme->crypto.cipher_group) {
1978                 switch (sme->crypto.cipher_group) {
1979                 case WLAN_CIPHER_SUITE_WEP40:
1980                 case WLAN_CIPHER_SUITE_WEP104:
1981                         gval = WEP_ENABLED;
1982                         break;
1983                 case WLAN_CIPHER_SUITE_TKIP:
1984                         gval = TKIP_ENABLED;
1985                         break;
1986                 case WLAN_CIPHER_SUITE_CCMP:
1987                         gval = AES_ENABLED;
1988                         break;
1989                 case WLAN_CIPHER_SUITE_AES_CMAC:
1990                         gval = AES_ENABLED;
1991                         break;
1992                 default:
1993                         bphy_err(drvr, "invalid cipher group (%d)\n",
1994                                  sme->crypto.cipher_group);
1995                         return -EINVAL;
1996                 }
1997         }
1998
1999         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2000         /* In case of privacy, but no security and WPS then simulate */
2001         /* setting AES. WPS-2.0 allows no security                   */
2002         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2003             sme->privacy)
2004                 pval = AES_ENABLED;
2005
2006         wsec = pval | gval;
2007         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2008         if (err) {
2009                 bphy_err(drvr, "error (%d)\n", err);
2010                 return err;
2011         }
2012
2013         sec = &profile->sec;
2014         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2015         sec->cipher_group = sme->crypto.cipher_group;
2016
2017         return err;
2018 }
2019
2020 static s32
2021 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2022 {
2023         struct brcmf_if *ifp = netdev_priv(ndev);
2024         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2025         struct brcmf_pub *drvr = ifp->drvr;
2026         s32 val;
2027         s32 err;
2028         const struct brcmf_tlv *rsn_ie;
2029         const u8 *ie;
2030         u32 ie_len;
2031         u32 offset;
2032         u16 rsn_cap;
2033         u32 mfp;
2034         u16 count;
2035
2036         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2037         profile->is_ft = false;
2038
2039         if (!sme->crypto.n_akm_suites)
2040                 return 0;
2041
2042         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2043         if (err) {
2044                 bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2045                 return err;
2046         }
2047         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2048                 switch (sme->crypto.akm_suites[0]) {
2049                 case WLAN_AKM_SUITE_8021X:
2050                         val = WPA_AUTH_UNSPECIFIED;
2051                         if (sme->want_1x)
2052                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2053                         break;
2054                 case WLAN_AKM_SUITE_PSK:
2055                         val = WPA_AUTH_PSK;
2056                         break;
2057                 default:
2058                         bphy_err(drvr, "invalid akm suite (%d)\n",
2059                                  sme->crypto.akm_suites[0]);
2060                         return -EINVAL;
2061                 }
2062         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2063                 switch (sme->crypto.akm_suites[0]) {
2064                 case WLAN_AKM_SUITE_8021X:
2065                         val = WPA2_AUTH_UNSPECIFIED;
2066                         if (sme->want_1x)
2067                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2068                         break;
2069                 case WLAN_AKM_SUITE_8021X_SHA256:
2070                         val = WPA2_AUTH_1X_SHA256;
2071                         if (sme->want_1x)
2072                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2073                         break;
2074                 case WLAN_AKM_SUITE_PSK_SHA256:
2075                         val = WPA2_AUTH_PSK_SHA256;
2076                         break;
2077                 case WLAN_AKM_SUITE_PSK:
2078                         val = WPA2_AUTH_PSK;
2079                         break;
2080                 case WLAN_AKM_SUITE_FT_8021X:
2081                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2082                         profile->is_ft = true;
2083                         if (sme->want_1x)
2084                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2085                         break;
2086                 case WLAN_AKM_SUITE_FT_PSK:
2087                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2088                         profile->is_ft = true;
2089                         break;
2090                 default:
2091                         bphy_err(drvr, "invalid akm suite (%d)\n",
2092                                  sme->crypto.akm_suites[0]);
2093                         return -EINVAL;
2094                 }
2095         } else if (val & WPA3_AUTH_SAE_PSK) {
2096                 switch (sme->crypto.akm_suites[0]) {
2097                 case WLAN_AKM_SUITE_SAE:
2098                         val = WPA3_AUTH_SAE_PSK;
2099                         if (sme->crypto.sae_pwd) {
2100                                 brcmf_dbg(INFO, "using SAE offload\n");
2101                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2102                         }
2103                         break;
2104                 case WLAN_AKM_SUITE_FT_OVER_SAE:
2105                         val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2106                         profile->is_ft = true;
2107                         if (sme->crypto.sae_pwd) {
2108                                 brcmf_dbg(INFO, "using SAE offload\n");
2109                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2110                         }
2111                         break;
2112                 default:
2113                         bphy_err(drvr, "invalid akm suite (%d)\n",
2114                                  sme->crypto.akm_suites[0]);
2115                         return -EINVAL;
2116                 }
2117         }
2118
2119         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2120                 brcmf_dbg(INFO, "using 1X offload\n");
2121
2122         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2123                 goto skip_mfp_config;
2124         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2125          * IE will not be verified, just a quick search for MFP config
2126          */
2127         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2128                                   WLAN_EID_RSN);
2129         if (!rsn_ie)
2130                 goto skip_mfp_config;
2131         ie = (const u8 *)rsn_ie;
2132         ie_len = rsn_ie->len + TLV_HDR_LEN;
2133         /* Skip unicast suite */
2134         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2135         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2136                 goto skip_mfp_config;
2137         /* Skip multicast suite */
2138         count = ie[offset] + (ie[offset + 1] << 8);
2139         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2140         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2141                 goto skip_mfp_config;
2142         /* Skip auth key management suite(s) */
2143         count = ie[offset] + (ie[offset + 1] << 8);
2144         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2145         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2146                 goto skip_mfp_config;
2147         /* Ready to read capabilities */
2148         mfp = BRCMF_MFP_NONE;
2149         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2150         if (rsn_cap & RSN_CAP_MFPR_MASK)
2151                 mfp = BRCMF_MFP_REQUIRED;
2152         else if (rsn_cap & RSN_CAP_MFPC_MASK)
2153                 mfp = BRCMF_MFP_CAPABLE;
2154         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2155
2156 skip_mfp_config:
2157         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
2158         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2159         if (err) {
2160                 bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2161                 return err;
2162         }
2163
2164         return err;
2165 }
2166
2167 static s32
2168 brcmf_set_sharedkey(struct net_device *ndev,
2169                     struct cfg80211_connect_params *sme)
2170 {
2171         struct brcmf_if *ifp = netdev_priv(ndev);
2172         struct brcmf_pub *drvr = ifp->drvr;
2173         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2174         struct brcmf_cfg80211_security *sec;
2175         struct brcmf_wsec_key key;
2176         s32 val;
2177         s32 err = 0;
2178
2179         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2180
2181         if (sme->key_len == 0)
2182                 return 0;
2183
2184         sec = &profile->sec;
2185         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2186                   sec->wpa_versions, sec->cipher_pairwise);
2187
2188         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2189                                  NL80211_WPA_VERSION_3))
2190                 return 0;
2191
2192         if (!(sec->cipher_pairwise &
2193             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2194                 return 0;
2195
2196         memset(&key, 0, sizeof(key));
2197         key.len = (u32) sme->key_len;
2198         key.index = (u32) sme->key_idx;
2199         if (key.len > sizeof(key.data)) {
2200                 bphy_err(drvr, "Too long key length (%u)\n", key.len);
2201                 return -EINVAL;
2202         }
2203         memcpy(key.data, sme->key, key.len);
2204         key.flags = BRCMF_PRIMARY_KEY;
2205         switch (sec->cipher_pairwise) {
2206         case WLAN_CIPHER_SUITE_WEP40:
2207                 key.algo = CRYPTO_ALGO_WEP1;
2208                 break;
2209         case WLAN_CIPHER_SUITE_WEP104:
2210                 key.algo = CRYPTO_ALGO_WEP128;
2211                 break;
2212         default:
2213                 bphy_err(drvr, "Invalid algorithm (%d)\n",
2214                          sme->crypto.ciphers_pairwise[0]);
2215                 return -EINVAL;
2216         }
2217         /* Set the new key/index */
2218         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2219                   key.len, key.index, key.algo);
2220         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2221         err = send_key_to_dongle(ifp, &key);
2222         if (err)
2223                 return err;
2224
2225         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2226                 brcmf_dbg(CONN, "set auth_type to shared key\n");
2227                 val = WL_AUTH_SHARED_KEY;       /* shared key */
2228                 err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2229                 if (err)
2230                         bphy_err(drvr, "set auth failed (%d)\n", err);
2231         }
2232         return err;
2233 }
2234
2235 static
2236 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2237                                            enum nl80211_auth_type type)
2238 {
2239         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2240             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2241                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2242                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2243         }
2244         return type;
2245 }
2246
2247 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2248                                 struct cfg80211_bss_selection *bss_select)
2249 {
2250         struct brcmf_pub *drvr = ifp->drvr;
2251         struct brcmf_join_pref_params join_pref_params[2];
2252         enum nl80211_band band;
2253         int err, i = 0;
2254
2255         join_pref_params[i].len = 2;
2256         join_pref_params[i].rssi_gain = 0;
2257
2258         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2259                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2260
2261         switch (bss_select->behaviour) {
2262         case __NL80211_BSS_SELECT_ATTR_INVALID:
2263                 brcmf_c_set_joinpref_default(ifp);
2264                 return;
2265         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2266                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2267                 band = bss_select->param.band_pref;
2268                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2269                 i++;
2270                 break;
2271         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2272                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2273                 band = bss_select->param.adjust.band;
2274                 join_pref_params[i].band = nl80211_band_to_fwil(band);
2275                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2276                 i++;
2277                 break;
2278         case NL80211_BSS_SELECT_ATTR_RSSI:
2279         default:
2280                 break;
2281         }
2282         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2283         join_pref_params[i].len = 2;
2284         join_pref_params[i].rssi_gain = 0;
2285         join_pref_params[i].band = 0;
2286         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2287                                        sizeof(join_pref_params));
2288         if (err)
2289                 bphy_err(drvr, "Set join_pref error (%d)\n", err);
2290 }
2291
2292 static s32
2293 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2294                        struct cfg80211_connect_params *sme)
2295 {
2296         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2297         struct brcmf_if *ifp = netdev_priv(ndev);
2298         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2299         struct ieee80211_channel *chan = sme->channel;
2300         struct brcmf_pub *drvr = ifp->drvr;
2301         struct brcmf_join_params join_params;
2302         size_t join_params_size;
2303         const struct brcmf_tlv *rsn_ie;
2304         const struct brcmf_vs_tlv *wpa_ie;
2305         const void *ie;
2306         u32 ie_len;
2307         struct brcmf_ext_join_params_le *ext_join_params;
2308         u16 chanspec;
2309         s32 err = 0;
2310         u32 ssid_len;
2311
2312         brcmf_dbg(TRACE, "Enter\n");
2313         if (!check_vif_up(ifp->vif))
2314                 return -EIO;
2315
2316         if (!sme->ssid) {
2317                 bphy_err(drvr, "Invalid ssid\n");
2318                 return -EOPNOTSUPP;
2319         }
2320
2321         if (sme->channel_hint)
2322                 chan = sme->channel_hint;
2323
2324         if (sme->bssid_hint)
2325                 sme->bssid = sme->bssid_hint;
2326
2327         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2328                 /* A normal (non P2P) connection request setup. */
2329                 ie = NULL;
2330                 ie_len = 0;
2331                 /* find the WPA_IE */
2332                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2333                 if (wpa_ie) {
2334                         ie = wpa_ie;
2335                         ie_len = wpa_ie->len + TLV_HDR_LEN;
2336                 } else {
2337                         /* find the RSN_IE */
2338                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2339                                                   sme->ie_len,
2340                                                   WLAN_EID_RSN);
2341                         if (rsn_ie) {
2342                                 ie = rsn_ie;
2343                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
2344                         }
2345                 }
2346                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2347         }
2348
2349         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2350                                     sme->ie, sme->ie_len);
2351         if (err)
2352                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2353         else
2354                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2355
2356         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2357
2358         if (chan) {
2359                 cfg->channel =
2360                         ieee80211_frequency_to_channel(chan->center_freq);
2361                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2362                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2363                           cfg->channel, chan->center_freq, chanspec);
2364         } else {
2365                 cfg->channel = 0;
2366                 chanspec = 0;
2367         }
2368
2369         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2370
2371         err = brcmf_set_wpa_version(ndev, sme);
2372         if (err) {
2373                 bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2374                 goto done;
2375         }
2376
2377         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2378         err = brcmf_set_auth_type(ndev, sme);
2379         if (err) {
2380                 bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2381                 goto done;
2382         }
2383
2384         err = brcmf_set_wsec_mode(ndev, sme);
2385         if (err) {
2386                 bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2387                 goto done;
2388         }
2389
2390         err = brcmf_set_key_mgmt(ndev, sme);
2391         if (err) {
2392                 bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2393                 goto done;
2394         }
2395
2396         err = brcmf_set_sharedkey(ndev, sme);
2397         if (err) {
2398                 bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2399                 goto done;
2400         }
2401
2402         if (sme->crypto.psk &&
2403             profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2404                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2405                         err = -EINVAL;
2406                         goto done;
2407                 }
2408                 brcmf_dbg(INFO, "using PSK offload\n");
2409                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2410         }
2411
2412         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2413                 /* enable firmware supplicant for this interface */
2414                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2415                 if (err < 0) {
2416                         bphy_err(drvr, "failed to enable fw supplicant\n");
2417                         goto done;
2418                 }
2419         }
2420
2421         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2422                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
2423                                     BRCMF_WSEC_MAX_PSK_LEN);
2424         else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2425                 /* clean up user-space RSNE */
2426                 err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
2427                 if (err) {
2428                         bphy_err(drvr, "failed to clean up user-space RSNE\n");
2429                         goto done;
2430                 }
2431                 err = brcmf_set_sae_password(ifp, sme->crypto.sae_pwd,
2432                                              sme->crypto.sae_pwd_len);
2433                 if (!err && sme->crypto.psk)
2434                         err = brcmf_set_pmk(ifp, sme->crypto.psk,
2435                                             BRCMF_WSEC_MAX_PSK_LEN);
2436         }
2437         if (err)
2438                 goto done;
2439
2440         /* Join with specific BSSID and cached SSID
2441          * If SSID is zero join based on BSSID only
2442          */
2443         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2444                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2445         if (cfg->channel)
2446                 join_params_size += sizeof(u16);
2447         ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2448         if (ext_join_params == NULL) {
2449                 err = -ENOMEM;
2450                 goto done;
2451         }
2452         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2453         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2454         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2455         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2456                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2457                           ext_join_params->ssid_le.SSID, ssid_len);
2458
2459         /* Set up join scan parameters */
2460         ext_join_params->scan_le.scan_type = -1;
2461         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2462
2463         if (sme->bssid)
2464                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2465         else
2466                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2467
2468         if (cfg->channel) {
2469                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2470
2471                 ext_join_params->assoc_le.chanspec_list[0] =
2472                         cpu_to_le16(chanspec);
2473                 /* Increase dwell time to receive probe response or detect
2474                  * beacon from target AP at a noisy air only during connect
2475                  * command.
2476                  */
2477                 ext_join_params->scan_le.active_time =
2478                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2479                 ext_join_params->scan_le.passive_time =
2480                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2481                 /* To sync with presence period of VSDB GO send probe request
2482                  * more frequently. Probe request will be stopped when it gets
2483                  * probe response from target AP/GO.
2484                  */
2485                 ext_join_params->scan_le.nprobes =
2486                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2487                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2488         } else {
2489                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2490                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2491                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2492         }
2493
2494         brcmf_set_join_pref(ifp, &sme->bss_select);
2495
2496         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2497                                          join_params_size);
2498         kfree(ext_join_params);
2499         if (!err)
2500                 /* This is it. join command worked, we are done */
2501                 goto done;
2502
2503         /* join command failed, fallback to set ssid */
2504         memset(&join_params, 0, sizeof(join_params));
2505         join_params_size = sizeof(join_params.ssid_le);
2506
2507         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2508         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2509
2510         if (sme->bssid)
2511                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2512         else
2513                 eth_broadcast_addr(join_params.params_le.bssid);
2514
2515         if (cfg->channel) {
2516                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2517                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2518                 join_params_size += sizeof(join_params.params_le);
2519         }
2520         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2521                                      &join_params, join_params_size);
2522         if (err)
2523                 bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2524
2525 done:
2526         if (err)
2527                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2528         brcmf_dbg(TRACE, "Exit\n");
2529         return err;
2530 }
2531
2532 static s32
2533 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2534                        u16 reason_code)
2535 {
2536         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2537         struct brcmf_if *ifp = netdev_priv(ndev);
2538         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2539         struct brcmf_pub *drvr = cfg->pub;
2540         struct brcmf_scb_val_le scbval;
2541         s32 err = 0;
2542
2543         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2544         if (!check_vif_up(ifp->vif))
2545                 return -EIO;
2546
2547         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2548         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2549         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2550         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2551         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2552
2553         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2554         scbval.val = cpu_to_le32(reason_code);
2555         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2556                                      &scbval, sizeof(scbval));
2557         if (err)
2558                 bphy_err(drvr, "error (%d)\n", err);
2559
2560         brcmf_dbg(TRACE, "Exit\n");
2561         return err;
2562 }
2563
2564 static s32
2565 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2566                             enum nl80211_tx_power_setting type, s32 mbm)
2567 {
2568         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2569         struct net_device *ndev = cfg_to_ndev(cfg);
2570         struct brcmf_if *ifp = netdev_priv(ndev);
2571         struct brcmf_pub *drvr = cfg->pub;
2572         s32 err;
2573         s32 disable;
2574         u32 qdbm = 127;
2575
2576         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2577         if (!check_vif_up(ifp->vif))
2578                 return -EIO;
2579
2580         switch (type) {
2581         case NL80211_TX_POWER_AUTOMATIC:
2582                 break;
2583         case NL80211_TX_POWER_LIMITED:
2584         case NL80211_TX_POWER_FIXED:
2585                 if (mbm < 0) {
2586                         bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2587                         err = -EINVAL;
2588                         goto done;
2589                 }
2590                 qdbm =  MBM_TO_DBM(4 * mbm);
2591                 if (qdbm > 127)
2592                         qdbm = 127;
2593                 qdbm |= WL_TXPWR_OVERRIDE;
2594                 break;
2595         default:
2596                 bphy_err(drvr, "Unsupported type %d\n", type);
2597                 err = -EINVAL;
2598                 goto done;
2599         }
2600         /* Make sure radio is off or on as far as software is concerned */
2601         disable = WL_RADIO_SW_DISABLE << 16;
2602         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2603         if (err)
2604                 bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2605
2606         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2607         if (err)
2608                 bphy_err(drvr, "qtxpower error (%d)\n", err);
2609
2610 done:
2611         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2612         return err;
2613 }
2614
2615 static s32
2616 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2617                             s32 *dbm)
2618 {
2619         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2620         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2621         struct brcmf_pub *drvr = cfg->pub;
2622         s32 qdbm = 0;
2623         s32 err;
2624
2625         brcmf_dbg(TRACE, "Enter\n");
2626         if (!check_vif_up(vif))
2627                 return -EIO;
2628
2629         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2630         if (err) {
2631                 bphy_err(drvr, "error (%d)\n", err);
2632                 goto done;
2633         }
2634         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2635
2636 done:
2637         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2638         return err;
2639 }
2640
2641 static s32
2642 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2643                                   int link_id, u8 key_idx, bool unicast,
2644                                   bool multicast)
2645 {
2646         struct brcmf_if *ifp = netdev_priv(ndev);
2647         struct brcmf_pub *drvr = ifp->drvr;
2648         u32 index;
2649         u32 wsec;
2650         s32 err = 0;
2651
2652         brcmf_dbg(TRACE, "Enter\n");
2653         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2654         if (!check_vif_up(ifp->vif))
2655                 return -EIO;
2656
2657         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2658         if (err) {
2659                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2660                 goto done;
2661         }
2662
2663         if (wsec & WEP_ENABLED) {
2664                 /* Just select a new current key */
2665                 index = key_idx;
2666                 err = brcmf_fil_cmd_int_set(ifp,
2667                                             BRCMF_C_SET_KEY_PRIMARY, index);
2668                 if (err)
2669                         bphy_err(drvr, "error (%d)\n", err);
2670         }
2671 done:
2672         brcmf_dbg(TRACE, "Exit\n");
2673         return err;
2674 }
2675
2676 static s32
2677 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2678                        int link_id, u8 key_idx, bool pairwise,
2679                        const u8 *mac_addr)
2680 {
2681         struct brcmf_if *ifp = netdev_priv(ndev);
2682         struct brcmf_wsec_key *key;
2683         s32 err;
2684
2685         brcmf_dbg(TRACE, "Enter\n");
2686         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2687
2688         if (!check_vif_up(ifp->vif))
2689                 return -EIO;
2690
2691         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2692                 /* we ignore this key index in this case */
2693                 return -EINVAL;
2694         }
2695
2696         key = &ifp->vif->profile.key[key_idx];
2697
2698         if (key->algo == CRYPTO_ALGO_OFF) {
2699                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2700                 return -EINVAL;
2701         }
2702
2703         memset(key, 0, sizeof(*key));
2704         key->index = (u32)key_idx;
2705         key->flags = BRCMF_PRIMARY_KEY;
2706
2707         /* Clear the key/index */
2708         err = send_key_to_dongle(ifp, key);
2709
2710         brcmf_dbg(TRACE, "Exit\n");
2711         return err;
2712 }
2713
2714 static s32
2715 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2716                        int link_id, u8 key_idx, bool pairwise,
2717                        const u8 *mac_addr, struct key_params *params)
2718 {
2719         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2720         struct brcmf_if *ifp = netdev_priv(ndev);
2721         struct brcmf_pub *drvr = cfg->pub;
2722         struct brcmf_wsec_key *key;
2723         s32 val;
2724         s32 wsec;
2725         s32 err;
2726         u8 keybuf[8];
2727         bool ext_key;
2728
2729         brcmf_dbg(TRACE, "Enter\n");
2730         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2731         if (!check_vif_up(ifp->vif))
2732                 return -EIO;
2733
2734         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2735                 /* we ignore this key index in this case */
2736                 bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2737                 return -EINVAL;
2738         }
2739
2740         if (params->key_len == 0)
2741                 return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2742                                               pairwise, mac_addr);
2743
2744         if (params->key_len > sizeof(key->data)) {
2745                 bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2746                 return -EINVAL;
2747         }
2748
2749         ext_key = false;
2750         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2751             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2752                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2753                 ext_key = true;
2754         }
2755
2756         key = &ifp->vif->profile.key[key_idx];
2757         memset(key, 0, sizeof(*key));
2758         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2759                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2760         key->len = params->key_len;
2761         key->index = key_idx;
2762         memcpy(key->data, params->key, key->len);
2763         if (!ext_key)
2764                 key->flags = BRCMF_PRIMARY_KEY;
2765
2766         if (params->seq && params->seq_len == 6) {
2767                 /* rx iv */
2768                 u8 *ivptr;
2769
2770                 ivptr = (u8 *)params->seq;
2771                 key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2772                         (ivptr[3] << 8) | ivptr[2];
2773                 key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2774                 key->iv_initialized = true;
2775         }
2776
2777         switch (params->cipher) {
2778         case WLAN_CIPHER_SUITE_WEP40:
2779                 key->algo = CRYPTO_ALGO_WEP1;
2780                 val = WEP_ENABLED;
2781                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2782                 break;
2783         case WLAN_CIPHER_SUITE_WEP104:
2784                 key->algo = CRYPTO_ALGO_WEP128;
2785                 val = WEP_ENABLED;
2786                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2787                 break;
2788         case WLAN_CIPHER_SUITE_TKIP:
2789                 if (!brcmf_is_apmode(ifp->vif)) {
2790                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2791                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2792                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2793                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2794                 }
2795                 key->algo = CRYPTO_ALGO_TKIP;
2796                 val = TKIP_ENABLED;
2797                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2798                 break;
2799         case WLAN_CIPHER_SUITE_AES_CMAC:
2800                 key->algo = CRYPTO_ALGO_AES_CCM;
2801                 val = AES_ENABLED;
2802                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2803                 break;
2804         case WLAN_CIPHER_SUITE_CCMP:
2805                 key->algo = CRYPTO_ALGO_AES_CCM;
2806                 val = AES_ENABLED;
2807                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2808                 break;
2809         default:
2810                 bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2811                 err = -EINVAL;
2812                 goto done;
2813         }
2814
2815         err = send_key_to_dongle(ifp, key);
2816         if (ext_key || err)
2817                 goto done;
2818
2819         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2820         if (err) {
2821                 bphy_err(drvr, "get wsec error (%d)\n", err);
2822                 goto done;
2823         }
2824         wsec |= val;
2825         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2826         if (err) {
2827                 bphy_err(drvr, "set wsec error (%d)\n", err);
2828                 goto done;
2829         }
2830
2831 done:
2832         brcmf_dbg(TRACE, "Exit\n");
2833         return err;
2834 }
2835
2836 static s32
2837 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2838                        int link_id, u8 key_idx, bool pairwise,
2839                        const u8 *mac_addr, void *cookie,
2840                        void (*callback)(void *cookie,
2841                                         struct key_params *params))
2842 {
2843         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2844         struct key_params params;
2845         struct brcmf_if *ifp = netdev_priv(ndev);
2846         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2847         struct brcmf_pub *drvr = cfg->pub;
2848         struct brcmf_cfg80211_security *sec;
2849         s32 wsec;
2850         s32 err = 0;
2851
2852         brcmf_dbg(TRACE, "Enter\n");
2853         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2854         if (!check_vif_up(ifp->vif))
2855                 return -EIO;
2856
2857         memset(&params, 0, sizeof(params));
2858
2859         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2860         if (err) {
2861                 bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2862                 /* Ignore this error, may happen during DISASSOC */
2863                 err = -EAGAIN;
2864                 goto done;
2865         }
2866         if (wsec & WEP_ENABLED) {
2867                 sec = &profile->sec;
2868                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2869                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2870                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2871                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2872                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2873                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2874                 }
2875         } else if (wsec & TKIP_ENABLED) {
2876                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2877                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2878         } else if (wsec & AES_ENABLED) {
2879                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2880                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2881         } else  {
2882                 bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2883                 err = -EINVAL;
2884                 goto done;
2885         }
2886         callback(cookie, &params);
2887
2888 done:
2889         brcmf_dbg(TRACE, "Exit\n");
2890         return err;
2891 }
2892
2893 static s32
2894 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2895                                        struct net_device *ndev, int link_id,
2896                                        u8 key_idx)
2897 {
2898         struct brcmf_if *ifp = netdev_priv(ndev);
2899
2900         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2901
2902         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2903                 return 0;
2904
2905         brcmf_dbg(INFO, "Not supported\n");
2906
2907         return -EOPNOTSUPP;
2908 }
2909
2910 static void
2911 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2912 {
2913         struct brcmf_pub *drvr = ifp->drvr;
2914         s32 err;
2915         u8 key_idx;
2916         struct brcmf_wsec_key *key;
2917         s32 wsec;
2918
2919         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2920                 key = &ifp->vif->profile.key[key_idx];
2921                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2922                     (key->algo == CRYPTO_ALGO_WEP128))
2923                         break;
2924         }
2925         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2926                 return;
2927
2928         err = send_key_to_dongle(ifp, key);
2929         if (err) {
2930                 bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
2931                 return;
2932         }
2933         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2934         if (err) {
2935                 bphy_err(drvr, "get wsec error (%d)\n", err);
2936                 return;
2937         }
2938         wsec |= WEP_ENABLED;
2939         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2940         if (err)
2941                 bphy_err(drvr, "set wsec error (%d)\n", err);
2942 }
2943
2944 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2945 {
2946         struct nl80211_sta_flag_update *sfu;
2947
2948         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2949         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
2950         sfu = &si->sta_flags;
2951         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2952                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2953                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2954                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2955         if (fw_sta_flags & BRCMF_STA_WME)
2956                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2957         if (fw_sta_flags & BRCMF_STA_AUTHE)
2958                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2959         if (fw_sta_flags & BRCMF_STA_ASSOC)
2960                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2961         if (fw_sta_flags & BRCMF_STA_AUTHO)
2962                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2963 }
2964
2965 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2966 {
2967         struct brcmf_pub *drvr = ifp->drvr;
2968         struct {
2969                 __le32 len;
2970                 struct brcmf_bss_info_le bss_le;
2971         } *buf;
2972         u16 capability;
2973         int err;
2974
2975         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2976         if (!buf)
2977                 return;
2978
2979         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2980         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2981                                      WL_BSS_INFO_MAX);
2982         if (err) {
2983                 bphy_err(drvr, "Failed to get bss info (%d)\n", err);
2984                 goto out_kfree;
2985         }
2986         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
2987         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2988         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2989         capability = le16_to_cpu(buf->bss_le.capability);
2990         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2991                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2992         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2993                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2994         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2995                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2996
2997 out_kfree:
2998         kfree(buf);
2999 }
3000
3001 static s32
3002 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3003                                 struct station_info *sinfo)
3004 {
3005         struct brcmf_pub *drvr = ifp->drvr;
3006         struct brcmf_scb_val_le scbval;
3007         struct brcmf_pktcnt_le pktcnt;
3008         s32 err;
3009         u32 rate;
3010         u32 rssi;
3011
3012         /* Get the current tx rate */
3013         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3014         if (err < 0) {
3015                 bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3016                 return err;
3017         }
3018         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3019         sinfo->txrate.legacy = rate * 5;
3020
3021         memset(&scbval, 0, sizeof(scbval));
3022         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3023                                      sizeof(scbval));
3024         if (err) {
3025                 bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3026                 return err;
3027         }
3028         rssi = le32_to_cpu(scbval.val);
3029         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3030         sinfo->signal = rssi;
3031
3032         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3033                                      sizeof(pktcnt));
3034         if (err) {
3035                 bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3036                 return err;
3037         }
3038         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3039                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3040                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3041                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3042         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3043         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3044         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3045         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3046
3047         return 0;
3048 }
3049
3050 static s32
3051 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3052                            const u8 *mac, struct station_info *sinfo)
3053 {
3054         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3055         struct brcmf_if *ifp = netdev_priv(ndev);
3056         struct brcmf_pub *drvr = cfg->pub;
3057         struct brcmf_scb_val_le scb_val;
3058         s32 err = 0;
3059         struct brcmf_sta_info_le sta_info_le;
3060         u32 sta_flags;
3061         u32 is_tdls_peer;
3062         s32 total_rssi_avg = 0;
3063         s32 total_rssi = 0;
3064         s32 count_rssi = 0;
3065         int rssi;
3066         u32 i;
3067
3068         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3069         if (!check_vif_up(ifp->vif))
3070                 return -EIO;
3071
3072         if (brcmf_is_ibssmode(ifp->vif))
3073                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3074
3075         memset(&sta_info_le, 0, sizeof(sta_info_le));
3076         memcpy(&sta_info_le, mac, ETH_ALEN);
3077         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3078                                        &sta_info_le,
3079                                        sizeof(sta_info_le));
3080         is_tdls_peer = !err;
3081         if (err) {
3082                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3083                                                &sta_info_le,
3084                                                sizeof(sta_info_le));
3085                 if (err < 0) {
3086                         bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3087                         goto done;
3088                 }
3089         }
3090         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3091         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3092         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3093         sta_flags = le32_to_cpu(sta_info_le.flags);
3094         brcmf_convert_sta_flags(sta_flags, sinfo);
3095         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3096         if (is_tdls_peer)
3097                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3098         else
3099                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3100         if (sta_flags & BRCMF_STA_ASSOC) {
3101                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3102                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3103                 brcmf_fill_bss_param(ifp, sinfo);
3104         }
3105         if (sta_flags & BRCMF_STA_SCBSTATS) {
3106                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3107                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3108                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3109                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3110                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3111                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3112                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3113                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3114                 if (sinfo->tx_packets) {
3115                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3116                         sinfo->txrate.legacy =
3117                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
3118                 }
3119                 if (sinfo->rx_packets) {
3120                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3121                         sinfo->rxrate.legacy =
3122                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
3123                 }
3124                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
3125                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3126                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3127                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3128                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3129                 }
3130                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
3131                         if (sta_info_le.rssi[i] == 0 ||
3132                             sta_info_le.rx_lastpkt_rssi[i] == 0)
3133                                 continue;
3134                         sinfo->chains |= BIT(count_rssi);
3135                         sinfo->chain_signal[count_rssi] =
3136                                 sta_info_le.rx_lastpkt_rssi[i];
3137                         sinfo->chain_signal_avg[count_rssi] =
3138                                 sta_info_le.rssi[i];
3139                         total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3140                         total_rssi_avg += sta_info_le.rssi[i];
3141                         count_rssi++;
3142                 }
3143                 if (count_rssi) {
3144                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3145                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3146                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3147                         sinfo->filled |=
3148                                 BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3149                         sinfo->signal = total_rssi / count_rssi;
3150                         sinfo->signal_avg = total_rssi_avg / count_rssi;
3151                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3152                         &ifp->vif->sme_state)) {
3153                         memset(&scb_val, 0, sizeof(scb_val));
3154                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3155                                                      &scb_val, sizeof(scb_val));
3156                         if (err) {
3157                                 bphy_err(drvr, "Could not get rssi (%d)\n",
3158                                          err);
3159                                 goto done;
3160                         } else {
3161                                 rssi = le32_to_cpu(scb_val.val);
3162                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3163                                 sinfo->signal = rssi;
3164                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3165                         }
3166                 }
3167         }
3168 done:
3169         brcmf_dbg(TRACE, "Exit\n");
3170         return err;
3171 }
3172
3173 static int
3174 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3175                             int idx, u8 *mac, struct station_info *sinfo)
3176 {
3177         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3178         struct brcmf_if *ifp = netdev_priv(ndev);
3179         struct brcmf_pub *drvr = cfg->pub;
3180         s32 err;
3181
3182         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3183
3184         if (idx == 0) {
3185                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3186                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3187                                              &cfg->assoclist,
3188                                              sizeof(cfg->assoclist));
3189                 if (err) {
3190                         /* GET_ASSOCLIST unsupported by firmware of older chips */
3191                         if (err == -EBADE)
3192                                 bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3193                         else
3194                                 bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3195                                          err);
3196
3197                         cfg->assoclist.count = 0;
3198                         return -EOPNOTSUPP;
3199                 }
3200         }
3201         if (idx < le32_to_cpu(cfg->assoclist.count)) {
3202                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3203                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3204         }
3205         return -ENOENT;
3206 }
3207
3208 static s32
3209 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3210                            bool enabled, s32 timeout)
3211 {
3212         s32 pm;
3213         s32 err = 0;
3214         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3215         struct brcmf_if *ifp = netdev_priv(ndev);
3216         struct brcmf_pub *drvr = cfg->pub;
3217
3218         brcmf_dbg(TRACE, "Enter\n");
3219
3220         /*
3221          * Powersave enable/disable request is coming from the
3222          * cfg80211 even before the interface is up. In that
3223          * scenario, driver will be storing the power save
3224          * preference in cfg struct to apply this to
3225          * FW later while initializing the dongle
3226          */
3227         cfg->pwr_save = enabled;
3228         if (!check_vif_up(ifp->vif)) {
3229
3230                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3231                 goto done;
3232         }
3233
3234         pm = enabled ? PM_FAST : PM_OFF;
3235         /* Do not enable the power save after assoc if it is a p2p interface */
3236         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3237                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3238                 pm = PM_OFF;
3239         }
3240         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
3241
3242         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3243         if (err) {
3244                 if (err == -ENODEV)
3245                         bphy_err(drvr, "net_device is not ready yet\n");
3246                 else
3247                         bphy_err(drvr, "error (%d)\n", err);
3248         }
3249
3250         err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3251                                 min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3252         if (err)
3253                 bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3254
3255 done:
3256         brcmf_dbg(TRACE, "Exit\n");
3257         return err;
3258 }
3259
3260 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3261                                    struct brcmf_bss_info_le *bi)
3262 {
3263         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3264         struct brcmf_pub *drvr = cfg->pub;
3265         struct cfg80211_bss *bss;
3266         enum nl80211_band band;
3267         struct brcmu_chan ch;
3268         u16 channel;
3269         u32 freq;
3270         u16 notify_capability;
3271         u16 notify_interval;
3272         u8 *notify_ie;
3273         size_t notify_ielen;
3274         struct cfg80211_inform_bss bss_data = {};
3275
3276         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3277                 bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3278                 return -EINVAL;
3279         }
3280
3281         if (!bi->ctl_ch) {
3282                 ch.chspec = le16_to_cpu(bi->chanspec);
3283                 cfg->d11inf.decchspec(&ch);
3284                 bi->ctl_ch = ch.control_ch_num;
3285         }
3286         channel = bi->ctl_ch;
3287
3288         if (channel <= CH_MAX_2G_CHANNEL)
3289                 band = NL80211_BAND_2GHZ;
3290         else
3291                 band = NL80211_BAND_5GHZ;
3292
3293         freq = ieee80211_channel_to_frequency(channel, band);
3294         bss_data.chan = ieee80211_get_channel(wiphy, freq);
3295         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3296         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3297
3298         notify_capability = le16_to_cpu(bi->capability);
3299         notify_interval = le16_to_cpu(bi->beacon_period);
3300         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3301         notify_ielen = le32_to_cpu(bi->ie_length);
3302         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3303
3304         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3305         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3306         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3307         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3308         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3309
3310         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3311                                        CFG80211_BSS_FTYPE_UNKNOWN,
3312                                        (const u8 *)bi->BSSID,
3313                                        0, notify_capability,
3314                                        notify_interval, notify_ie,
3315                                        notify_ielen, GFP_KERNEL);
3316
3317         if (!bss)
3318                 return -ENOMEM;
3319
3320         cfg80211_put_bss(wiphy, bss);
3321
3322         return 0;
3323 }
3324
3325 static struct brcmf_bss_info_le *
3326 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3327 {
3328         if (bss == NULL)
3329                 return list->bss_info_le;
3330         return (struct brcmf_bss_info_le *)((unsigned long)bss +
3331                                             le32_to_cpu(bss->length));
3332 }
3333
3334 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3335 {
3336         struct brcmf_pub *drvr = cfg->pub;
3337         struct brcmf_scan_results *bss_list;
3338         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
3339         s32 err = 0;
3340         int i;
3341
3342         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3343         if (bss_list->count != 0 &&
3344             bss_list->version != BRCMF_BSS_INFO_VERSION) {
3345                 bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3346                          bss_list->version);
3347                 return -EOPNOTSUPP;
3348         }
3349         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3350         for (i = 0; i < bss_list->count; i++) {
3351                 bi = next_bss_le(bss_list, bi);
3352                 err = brcmf_inform_single_bss(cfg, bi);
3353                 if (err)
3354                         break;
3355         }
3356         return err;
3357 }
3358
3359 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3360                              struct net_device *ndev, const u8 *bssid)
3361 {
3362         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3363         struct brcmf_pub *drvr = cfg->pub;
3364         struct ieee80211_channel *notify_channel;
3365         struct brcmf_bss_info_le *bi = NULL;
3366         struct ieee80211_supported_band *band;
3367         struct cfg80211_bss *bss;
3368         struct brcmu_chan ch;
3369         u8 *buf = NULL;
3370         s32 err = 0;
3371         u32 freq;
3372         u16 notify_capability;
3373         u16 notify_interval;
3374         u8 *notify_ie;
3375         size_t notify_ielen;
3376         s32 notify_signal;
3377
3378         brcmf_dbg(TRACE, "Enter\n");
3379
3380         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3381         if (buf == NULL) {
3382                 err = -ENOMEM;
3383                 goto CleanUp;
3384         }
3385
3386         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3387
3388         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3389                                      buf, WL_BSS_INFO_MAX);
3390         if (err) {
3391                 bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3392                 goto CleanUp;
3393         }
3394
3395         bi = (struct brcmf_bss_info_le *)(buf + 4);
3396
3397         ch.chspec = le16_to_cpu(bi->chanspec);
3398         cfg->d11inf.decchspec(&ch);
3399
3400         if (ch.band == BRCMU_CHAN_BAND_2G)
3401                 band = wiphy->bands[NL80211_BAND_2GHZ];
3402         else
3403                 band = wiphy->bands[NL80211_BAND_5GHZ];
3404
3405         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3406         cfg->channel = freq;
3407         notify_channel = ieee80211_get_channel(wiphy, freq);
3408
3409         notify_capability = le16_to_cpu(bi->capability);
3410         notify_interval = le16_to_cpu(bi->beacon_period);
3411         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3412         notify_ielen = le32_to_cpu(bi->ie_length);
3413         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3414
3415         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3416         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3417         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3418         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3419
3420         bss = cfg80211_inform_bss(wiphy, notify_channel,
3421                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3422                                   notify_capability, notify_interval,
3423                                   notify_ie, notify_ielen, notify_signal,
3424                                   GFP_KERNEL);
3425
3426         if (!bss) {
3427                 err = -ENOMEM;
3428                 goto CleanUp;
3429         }
3430
3431         cfg80211_put_bss(wiphy, bss);
3432
3433 CleanUp:
3434
3435         kfree(buf);
3436
3437         brcmf_dbg(TRACE, "Exit\n");
3438
3439         return err;
3440 }
3441
3442 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3443                                  struct brcmf_if *ifp)
3444 {
3445         struct brcmf_pub *drvr = cfg->pub;
3446         struct brcmf_bss_info_le *bi = NULL;
3447         s32 err = 0;
3448
3449         brcmf_dbg(TRACE, "Enter\n");
3450         if (brcmf_is_ibssmode(ifp->vif))
3451                 return err;
3452
3453         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3454         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3455                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
3456         if (err) {
3457                 bphy_err(drvr, "Could not get bss info %d\n", err);
3458                 goto update_bss_info_out;
3459         }
3460         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3461         err = brcmf_inform_single_bss(cfg, bi);
3462
3463 update_bss_info_out:
3464         brcmf_dbg(TRACE, "Exit");
3465         return err;
3466 }
3467
3468 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3469 {
3470         struct escan_info *escan = &cfg->escan_info;
3471
3472         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3473         if (cfg->int_escan_map || cfg->scan_request) {
3474                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3475                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3476         }
3477         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3478         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3479 }
3480
3481 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3482 {
3483         struct brcmf_cfg80211_info *cfg =
3484                         container_of(work, struct brcmf_cfg80211_info,
3485                                      escan_timeout_work);
3486
3487         brcmf_inform_bss(cfg);
3488         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3489 }
3490
3491 static void brcmf_escan_timeout(struct timer_list *t)
3492 {
3493         struct brcmf_cfg80211_info *cfg =
3494                         from_timer(cfg, t, escan_timeout);
3495         struct brcmf_pub *drvr = cfg->pub;
3496
3497         if (cfg->int_escan_map || cfg->scan_request) {
3498                 bphy_err(drvr, "timer expired\n");
3499                 schedule_work(&cfg->escan_timeout_work);
3500         }
3501 }
3502
3503 static s32
3504 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3505                               struct brcmf_bss_info_le *bss,
3506                               struct brcmf_bss_info_le *bss_info_le)
3507 {
3508         struct brcmu_chan ch_bss, ch_bss_info_le;
3509
3510         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3511         cfg->d11inf.decchspec(&ch_bss);
3512         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3513         cfg->d11inf.decchspec(&ch_bss_info_le);
3514
3515         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3516                 ch_bss.band == ch_bss_info_le.band &&
3517                 bss_info_le->SSID_len == bss->SSID_len &&
3518                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3519                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3520                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3521                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3522                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3523
3524                         /* preserve max RSSI if the measurements are
3525                         * both on-channel or both off-channel
3526                         */
3527                         if (bss_info_rssi > bss_rssi)
3528                                 bss->RSSI = bss_info_le->RSSI;
3529                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3530                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3531                         /* preserve the on-channel rssi measurement
3532                         * if the new measurement is off channel
3533                         */
3534                         bss->RSSI = bss_info_le->RSSI;
3535                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3536                 }
3537                 return 1;
3538         }
3539         return 0;
3540 }
3541
3542 static s32
3543 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3544                              const struct brcmf_event_msg *e, void *data)
3545 {
3546         struct brcmf_pub *drvr = ifp->drvr;
3547         struct brcmf_cfg80211_info *cfg = drvr->config;
3548         s32 status;
3549         struct brcmf_escan_result_le *escan_result_le;
3550         u32 escan_buflen;
3551         struct brcmf_bss_info_le *bss_info_le;
3552         struct brcmf_bss_info_le *bss = NULL;
3553         u32 bi_length;
3554         struct brcmf_scan_results *list;
3555         u32 i;
3556         bool aborted;
3557
3558         status = e->status;
3559
3560         if (status == BRCMF_E_STATUS_ABORT)
3561                 goto exit;
3562
3563         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3564                 bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3565                          ifp->bsscfgidx);
3566                 return -EPERM;
3567         }
3568
3569         if (status == BRCMF_E_STATUS_PARTIAL) {
3570                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3571                 if (e->datalen < sizeof(*escan_result_le)) {
3572                         bphy_err(drvr, "invalid event data length\n");
3573                         goto exit;
3574                 }
3575                 escan_result_le = (struct brcmf_escan_result_le *) data;
3576                 if (!escan_result_le) {
3577                         bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3578                         goto exit;
3579                 }
3580                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3581                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3582                     escan_buflen > e->datalen ||
3583                     escan_buflen < sizeof(*escan_result_le)) {
3584                         bphy_err(drvr, "Invalid escan buffer length: %d\n",
3585                                  escan_buflen);
3586                         goto exit;
3587                 }
3588                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3589                         bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3590                                  escan_result_le->bss_count);
3591                         goto exit;
3592                 }
3593                 bss_info_le = &escan_result_le->bss_info_le;
3594
3595                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3596                         goto exit;
3597
3598                 if (!cfg->int_escan_map && !cfg->scan_request) {
3599                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3600                         goto exit;
3601                 }
3602
3603                 bi_length = le32_to_cpu(bss_info_le->length);
3604                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3605                         bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3606                                  bi_length);
3607                         goto exit;
3608                 }
3609
3610                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3611                                         BIT(NL80211_IFTYPE_ADHOC))) {
3612                         if (le16_to_cpu(bss_info_le->capability) &
3613                                                 WLAN_CAPABILITY_IBSS) {
3614                                 bphy_err(drvr, "Ignoring IBSS result\n");
3615                                 goto exit;
3616                         }
3617                 }
3618
3619                 list = (struct brcmf_scan_results *)
3620                                 cfg->escan_info.escan_buf;
3621                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3622                         bphy_err(drvr, "Buffer is too small: ignoring\n");
3623                         goto exit;
3624                 }
3625
3626                 for (i = 0; i < list->count; i++) {
3627                         bss = bss ? (struct brcmf_bss_info_le *)
3628                                 ((unsigned char *)bss +
3629                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3630                         if (brcmf_compare_update_same_bss(cfg, bss,
3631                                                           bss_info_le))
3632                                 goto exit;
3633                 }
3634                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3635                        bi_length);
3636                 list->version = le32_to_cpu(bss_info_le->version);
3637                 list->buflen += bi_length;
3638                 list->count++;
3639         } else {
3640                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3641                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3642                         goto exit;
3643                 if (cfg->int_escan_map || cfg->scan_request) {
3644                         brcmf_inform_bss(cfg);
3645                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3646                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3647                 } else
3648                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3649                                   status);
3650         }
3651 exit:
3652         return 0;
3653 }
3654
3655 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3656 {
3657         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3658                             brcmf_cfg80211_escan_handler);
3659         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3660         /* Init scan_timeout timer */
3661         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3662         INIT_WORK(&cfg->escan_timeout_work,
3663                   brcmf_cfg80211_escan_timeout_worker);
3664 }
3665
3666 static struct cfg80211_scan_request *
3667 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3668         struct cfg80211_scan_request *req;
3669         size_t req_size;
3670
3671         req_size = sizeof(*req) +
3672                    n_netinfo * sizeof(req->channels[0]) +
3673                    n_netinfo * sizeof(*req->ssids);
3674
3675         req = kzalloc(req_size, GFP_KERNEL);
3676         if (req) {
3677                 req->wiphy = wiphy;
3678                 req->ssids = (void *)(&req->channels[0]) +
3679                              n_netinfo * sizeof(req->channels[0]);
3680         }
3681         return req;
3682 }
3683
3684 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3685                                          u8 *ssid, u8 ssid_len, u8 channel)
3686 {
3687         struct ieee80211_channel *chan;
3688         enum nl80211_band band;
3689         int freq, i;
3690
3691         if (channel <= CH_MAX_2G_CHANNEL)
3692                 band = NL80211_BAND_2GHZ;
3693         else
3694                 band = NL80211_BAND_5GHZ;
3695
3696         freq = ieee80211_channel_to_frequency(channel, band);
3697         if (!freq)
3698                 return -EINVAL;
3699
3700         chan = ieee80211_get_channel(req->wiphy, freq);
3701         if (!chan)
3702                 return -EINVAL;
3703
3704         for (i = 0; i < req->n_channels; i++) {
3705                 if (req->channels[i] == chan)
3706                         break;
3707         }
3708         if (i == req->n_channels)
3709                 req->channels[req->n_channels++] = chan;
3710
3711         for (i = 0; i < req->n_ssids; i++) {
3712                 if (req->ssids[i].ssid_len == ssid_len &&
3713                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3714                         break;
3715         }
3716         if (i == req->n_ssids) {
3717                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3718                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3719         }
3720         return 0;
3721 }
3722
3723 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3724                                       struct cfg80211_scan_request *request)
3725 {
3726         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3727         int err;
3728
3729         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3730                 if (cfg->int_escan_map)
3731                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3732                                   cfg->int_escan_map);
3733                 /* Abort any on-going scan */
3734                 brcmf_abort_scanning(cfg);
3735         }
3736
3737         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3738         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3739         cfg->escan_info.run = brcmf_run_escan;
3740         err = brcmf_do_escan(ifp, request);
3741         if (err) {
3742                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3743                 return err;
3744         }
3745         cfg->int_escan_map = fwmap;
3746         return 0;
3747 }
3748
3749 static struct brcmf_pno_net_info_le *
3750 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3751 {
3752         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3753         struct brcmf_pno_net_info_le *netinfo;
3754
3755         switch (pfn_v1->version) {
3756         default:
3757                 WARN_ON(1);
3758                 fallthrough;
3759         case cpu_to_le32(1):
3760                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3761                 break;
3762         case cpu_to_le32(2):
3763                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3764                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3765                 break;
3766         }
3767
3768         return netinfo;
3769 }
3770
3771 /* PFN result doesn't have all the info which are required by the supplicant
3772  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3773  * via wl_inform_single_bss in the required format. Escan does require the
3774  * scan request in the form of cfg80211_scan_request. For timebeing, create
3775  * cfg80211_scan_request one out of the received PNO event.
3776  */
3777 static s32
3778 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3779                                 const struct brcmf_event_msg *e, void *data)
3780 {
3781         struct brcmf_pub *drvr = ifp->drvr;
3782         struct brcmf_cfg80211_info *cfg = drvr->config;
3783         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3784         struct cfg80211_scan_request *request = NULL;
3785         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3786         int i, err = 0;
3787         struct brcmf_pno_scanresults_le *pfn_result;
3788         u32 bucket_map;
3789         u32 result_count;
3790         u32 status;
3791         u32 datalen;
3792
3793         brcmf_dbg(SCAN, "Enter\n");
3794
3795         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3796                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3797                 return 0;
3798         }
3799
3800         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3801                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3802                 return 0;
3803         }
3804
3805         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3806         result_count = le32_to_cpu(pfn_result->count);
3807         status = le32_to_cpu(pfn_result->status);
3808
3809         /* PFN event is limited to fit 512 bytes so we may get
3810          * multiple NET_FOUND events. For now place a warning here.
3811          */
3812         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3813         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3814         if (!result_count) {
3815                 bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3816                 goto out_err;
3817         }
3818
3819         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3820         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3821         if (datalen < result_count * sizeof(*netinfo)) {
3822                 bphy_err(drvr, "insufficient event data\n");
3823                 goto out_err;
3824         }
3825
3826         request = brcmf_alloc_internal_escan_request(wiphy,
3827                                                      result_count);
3828         if (!request) {
3829                 err = -ENOMEM;
3830                 goto out_err;
3831         }
3832
3833         bucket_map = 0;
3834         for (i = 0; i < result_count; i++) {
3835                 netinfo = &netinfo_start[i];
3836
3837                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3838                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3839                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3840                           netinfo->SSID, netinfo->channel);
3841                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3842                 err = brcmf_internal_escan_add_info(request,
3843                                                     netinfo->SSID,
3844                                                     netinfo->SSID_len,
3845                                                     netinfo->channel);
3846                 if (err)
3847                         goto out_err;
3848         }
3849
3850         if (!bucket_map)
3851                 goto free_req;
3852
3853         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3854         if (!err)
3855                 goto free_req;
3856
3857 out_err:
3858         cfg80211_sched_scan_stopped(wiphy, 0);
3859 free_req:
3860         kfree(request);
3861         return err;
3862 }
3863
3864 static int
3865 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3866                                 struct net_device *ndev,
3867                                 struct cfg80211_sched_scan_request *req)
3868 {
3869         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3870         struct brcmf_if *ifp = netdev_priv(ndev);
3871         struct brcmf_pub *drvr = cfg->pub;
3872
3873         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3874                   req->n_match_sets, req->n_ssids);
3875
3876         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3877                 bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3878                          cfg->scan_status);
3879                 return -EAGAIN;
3880         }
3881
3882         if (req->n_match_sets <= 0) {
3883                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3884                           req->n_match_sets);
3885                 return -EINVAL;
3886         }
3887
3888         return brcmf_pno_start_sched_scan(ifp, req);
3889 }
3890
3891 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3892                                           struct net_device *ndev, u64 reqid)
3893 {
3894         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3895         struct brcmf_if *ifp = netdev_priv(ndev);
3896
3897         brcmf_dbg(SCAN, "enter\n");
3898         brcmf_pno_stop_sched_scan(ifp, reqid);
3899         if (cfg->int_escan_map)
3900                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3901         return 0;
3902 }
3903
3904 static __always_inline void brcmf_delay(u32 ms)
3905 {
3906         if (ms < 1000 / HZ) {
3907                 cond_resched();
3908                 mdelay(ms);
3909         } else {
3910                 msleep(ms);
3911         }
3912 }
3913
3914 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3915                                      u8 *pattern, u32 patternsize, u8 *mask,
3916                                      u32 packet_offset)
3917 {
3918         struct brcmf_fil_wowl_pattern_le *filter;
3919         u32 masksize;
3920         u32 patternoffset;
3921         u8 *buf;
3922         u32 bufsize;
3923         s32 ret;
3924
3925         masksize = (patternsize + 7) / 8;
3926         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3927
3928         bufsize = sizeof(*filter) + patternsize + masksize;
3929         buf = kzalloc(bufsize, GFP_KERNEL);
3930         if (!buf)
3931                 return -ENOMEM;
3932         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3933
3934         memcpy(filter->cmd, cmd, 4);
3935         filter->masksize = cpu_to_le32(masksize);
3936         filter->offset = cpu_to_le32(packet_offset);
3937         filter->patternoffset = cpu_to_le32(patternoffset);
3938         filter->patternsize = cpu_to_le32(patternsize);
3939         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3940
3941         if ((mask) && (masksize))
3942                 memcpy(buf + sizeof(*filter), mask, masksize);
3943         if ((pattern) && (patternsize))
3944                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3945
3946         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3947
3948         kfree(buf);
3949         return ret;
3950 }
3951
3952 static s32
3953 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3954                       void *data)
3955 {
3956         struct brcmf_pub *drvr = ifp->drvr;
3957         struct brcmf_cfg80211_info *cfg = drvr->config;
3958         struct brcmf_pno_scanresults_le *pfn_result;
3959         struct brcmf_pno_net_info_le *netinfo;
3960
3961         brcmf_dbg(SCAN, "Enter\n");
3962
3963         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3964                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3965                 return 0;
3966         }
3967
3968         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3969
3970         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3971                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3972                 return 0;
3973         }
3974
3975         if (le32_to_cpu(pfn_result->count) < 1) {
3976                 bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
3977                          le32_to_cpu(pfn_result->count));
3978                 return -EINVAL;
3979         }
3980
3981         netinfo = brcmf_get_netinfo_array(pfn_result);
3982         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3983                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3984         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3985         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3986         cfg->wowl.nd->n_channels = 1;
3987         cfg->wowl.nd->channels[0] =
3988                 ieee80211_channel_to_frequency(netinfo->channel,
3989                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3990                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3991         cfg->wowl.nd_info->n_matches = 1;
3992         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3993
3994         /* Inform (the resume task) that the net detect information was recvd */
3995         cfg->wowl.nd_data_completed = true;
3996         wake_up(&cfg->wowl.nd_data_wait);
3997
3998         return 0;
3999 }
4000
4001 #ifdef CONFIG_PM
4002
4003 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4004 {
4005         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4006         struct brcmf_pub *drvr = cfg->pub;
4007         struct brcmf_wowl_wakeind_le wake_ind_le;
4008         struct cfg80211_wowlan_wakeup wakeup_data;
4009         struct cfg80211_wowlan_wakeup *wakeup;
4010         u32 wakeind;
4011         s32 err;
4012         int timeout;
4013
4014         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4015                                        sizeof(wake_ind_le));
4016         if (err) {
4017                 bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4018                 return;
4019         }
4020
4021         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4022         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4023                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4024                        BRCMF_WOWL_PFN_FOUND)) {
4025                 wakeup = &wakeup_data;
4026                 memset(&wakeup_data, 0, sizeof(wakeup_data));
4027                 wakeup_data.pattern_idx = -1;
4028
4029                 if (wakeind & BRCMF_WOWL_MAGIC) {
4030                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4031                         wakeup_data.magic_pkt = true;
4032                 }
4033                 if (wakeind & BRCMF_WOWL_DIS) {
4034                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4035                         wakeup_data.disconnect = true;
4036                 }
4037                 if (wakeind & BRCMF_WOWL_BCN) {
4038                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4039                         wakeup_data.disconnect = true;
4040                 }
4041                 if (wakeind & BRCMF_WOWL_RETR) {
4042                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4043                         wakeup_data.disconnect = true;
4044                 }
4045                 if (wakeind & BRCMF_WOWL_NET) {
4046                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4047                         /* For now always map to pattern 0, no API to get
4048                          * correct information available at the moment.
4049                          */
4050                         wakeup_data.pattern_idx = 0;
4051                 }
4052                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4053                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4054                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4055                                 cfg->wowl.nd_data_completed,
4056                                 BRCMF_ND_INFO_TIMEOUT);
4057                         if (!timeout)
4058                                 bphy_err(drvr, "No result for wowl net detect\n");
4059                         else
4060                                 wakeup_data.net_detect = cfg->wowl.nd_info;
4061                 }
4062                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4063                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4064                         wakeup_data.gtk_rekey_failure = true;
4065                 }
4066         } else {
4067                 wakeup = NULL;
4068         }
4069         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4070 }
4071
4072 #else
4073
4074 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4075 {
4076 }
4077
4078 #endif /* CONFIG_PM */
4079
4080 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4081 {
4082         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4083         struct net_device *ndev = cfg_to_ndev(cfg);
4084         struct brcmf_if *ifp = netdev_priv(ndev);
4085
4086         brcmf_dbg(TRACE, "Enter\n");
4087
4088         if (cfg->wowl.active) {
4089                 brcmf_report_wowl_wakeind(wiphy, ifp);
4090                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4091                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4092                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4093                         brcmf_configure_arp_nd_offload(ifp, true);
4094                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4095                                       cfg->wowl.pre_pmmode);
4096                 cfg->wowl.active = false;
4097                 if (cfg->wowl.nd_enabled) {
4098                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4099                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4100                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4101                                             brcmf_notify_sched_scan_results);
4102                         cfg->wowl.nd_enabled = false;
4103                 }
4104         }
4105         return 0;
4106 }
4107
4108 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4109                                  struct brcmf_if *ifp,
4110                                  struct cfg80211_wowlan *wowl)
4111 {
4112         u32 wowl_config;
4113         struct brcmf_wowl_wakeind_le wowl_wakeind;
4114         u32 i;
4115
4116         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4117
4118         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4119                 brcmf_configure_arp_nd_offload(ifp, false);
4120         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4121         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4122
4123         wowl_config = 0;
4124         if (wowl->disconnect)
4125                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4126         if (wowl->magic_pkt)
4127                 wowl_config |= BRCMF_WOWL_MAGIC;
4128         if ((wowl->patterns) && (wowl->n_patterns)) {
4129                 wowl_config |= BRCMF_WOWL_NET;
4130                 for (i = 0; i < wowl->n_patterns; i++) {
4131                         brcmf_config_wowl_pattern(ifp, "add",
4132                                 (u8 *)wowl->patterns[i].pattern,
4133                                 wowl->patterns[i].pattern_len,
4134                                 (u8 *)wowl->patterns[i].mask,
4135                                 wowl->patterns[i].pkt_offset);
4136                 }
4137         }
4138         if (wowl->nd_config) {
4139                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4140                                                 wowl->nd_config);
4141                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
4142
4143                 cfg->wowl.nd_data_completed = false;
4144                 cfg->wowl.nd_enabled = true;
4145                 /* Now reroute the event for PFN to the wowl function. */
4146                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4147                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4148                                     brcmf_wowl_nd_results);
4149         }
4150         if (wowl->gtk_rekey_failure)
4151                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4152         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4153                 wowl_config |= BRCMF_WOWL_UNASSOC;
4154
4155         memcpy(&wowl_wakeind, "clear", 6);
4156         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4157                                  sizeof(wowl_wakeind));
4158         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4159         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4160         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4161         cfg->wowl.active = true;
4162 }
4163
4164 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4165 {
4166         struct brcmf_mkeep_alive_pkt_le kalive = {0};
4167         int ret = 0;
4168
4169         /* Configure Null function/data keepalive */
4170         kalive.version = cpu_to_le16(1);
4171         kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4172         kalive.len_bytes = cpu_to_le16(0);
4173         kalive.keep_alive_id = 0;
4174
4175         ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4176         if (ret)
4177                 brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4178
4179         return ret;
4180 }
4181
4182 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4183                                   struct cfg80211_wowlan *wowl)
4184 {
4185         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4186         struct net_device *ndev = cfg_to_ndev(cfg);
4187         struct brcmf_if *ifp = netdev_priv(ndev);
4188         struct brcmf_cfg80211_vif *vif;
4189
4190         brcmf_dbg(TRACE, "Enter\n");
4191
4192         /* if the primary net_device is not READY there is nothing
4193          * we can do but pray resume goes smoothly.
4194          */
4195         if (!check_vif_up(ifp->vif))
4196                 goto exit;
4197
4198         /* Stop scheduled scan */
4199         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4200                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4201
4202         /* end any scanning */
4203         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4204                 brcmf_abort_scanning(cfg);
4205
4206         if (wowl == NULL) {
4207                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4208                 list_for_each_entry(vif, &cfg->vif_list, list) {
4209                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4210                                 continue;
4211                         /* While going to suspend if associated with AP
4212                          * disassociate from AP to save power while system is
4213                          * in suspended state
4214                          */
4215                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4216                         /* Make sure WPA_Supplicant receives all the event
4217                          * generated due to DISASSOC call to the fw to keep
4218                          * the state fw and WPA_Supplicant state consistent
4219                          */
4220                         brcmf_delay(500);
4221                 }
4222                 /* Configure MPC */
4223                 brcmf_set_mpc(ifp, 1);
4224
4225         } else {
4226                 /* Configure WOWL paramaters */
4227                 brcmf_configure_wowl(cfg, ifp, wowl);
4228
4229                 /* Prevent disassociation due to inactivity with keep-alive */
4230                 brcmf_keepalive_start(ifp, 30);
4231         }
4232
4233 exit:
4234         brcmf_dbg(TRACE, "Exit\n");
4235         /* clear any scanning activity */
4236         cfg->scan_status = 0;
4237         return 0;
4238 }
4239
4240 static __used s32
4241 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4242 {
4243         struct brcmf_pmk_list_le *pmk_list;
4244         int i;
4245         u32 npmk;
4246
4247         pmk_list = &cfg->pmk_list;
4248         npmk = le32_to_cpu(pmk_list->npmk);
4249
4250         brcmf_dbg(CONN, "No of elements %d\n", npmk);
4251         for (i = 0; i < npmk; i++)
4252                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4253
4254         return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4255                         sizeof(*pmk_list));
4256 }
4257
4258 static s32
4259 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4260                          struct cfg80211_pmksa *pmksa)
4261 {
4262         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4263         struct brcmf_if *ifp = netdev_priv(ndev);
4264         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4265         struct brcmf_pub *drvr = cfg->pub;
4266         s32 err;
4267         u32 npmk, i;
4268
4269         brcmf_dbg(TRACE, "Enter\n");
4270         if (!check_vif_up(ifp->vif))
4271                 return -EIO;
4272
4273         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4274         for (i = 0; i < npmk; i++)
4275                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4276                         break;
4277         if (i < BRCMF_MAXPMKID) {
4278                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4279                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4280                 if (i == npmk) {
4281                         npmk++;
4282                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
4283                 }
4284         } else {
4285                 bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4286                 return -EINVAL;
4287         }
4288
4289         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
4290         brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmk[npmk].pmkid);
4291
4292         err = brcmf_update_pmklist(cfg, ifp);
4293
4294         brcmf_dbg(TRACE, "Exit\n");
4295         return err;
4296 }
4297
4298 static s32
4299 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4300                          struct cfg80211_pmksa *pmksa)
4301 {
4302         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4303         struct brcmf_if *ifp = netdev_priv(ndev);
4304         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4305         struct brcmf_pub *drvr = cfg->pub;
4306         s32 err;
4307         u32 npmk, i;
4308
4309         brcmf_dbg(TRACE, "Enter\n");
4310         if (!check_vif_up(ifp->vif))
4311                 return -EIO;
4312
4313         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4314
4315         npmk = le32_to_cpu(cfg->pmk_list.npmk);
4316         for (i = 0; i < npmk; i++)
4317                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4318                         break;
4319
4320         if ((npmk > 0) && (i < npmk)) {
4321                 for (; i < (npmk - 1); i++) {
4322                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4323                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4324                                WLAN_PMKID_LEN);
4325                 }
4326                 memset(&pmk[i], 0, sizeof(*pmk));
4327                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4328         } else {
4329                 bphy_err(drvr, "Cache entry not found\n");
4330                 return -EINVAL;
4331         }
4332
4333         err = brcmf_update_pmklist(cfg, ifp);
4334
4335         brcmf_dbg(TRACE, "Exit\n");
4336         return err;
4337
4338 }
4339
4340 static s32
4341 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4342 {
4343         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4344         struct brcmf_if *ifp = netdev_priv(ndev);
4345         s32 err;
4346
4347         brcmf_dbg(TRACE, "Enter\n");
4348         if (!check_vif_up(ifp->vif))
4349                 return -EIO;
4350
4351         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4352         err = brcmf_update_pmklist(cfg, ifp);
4353
4354         brcmf_dbg(TRACE, "Exit\n");
4355         return err;
4356
4357 }
4358
4359 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4360 {
4361         struct brcmf_pub *drvr = ifp->drvr;
4362         s32 err;
4363         s32 wpa_val;
4364
4365         /* set auth */
4366         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4367         if (err < 0) {
4368                 bphy_err(drvr, "auth error %d\n", err);
4369                 return err;
4370         }
4371         /* set wsec */
4372         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4373         if (err < 0) {
4374                 bphy_err(drvr, "wsec error %d\n", err);
4375                 return err;
4376         }
4377         /* set upper-layer auth */
4378         if (brcmf_is_ibssmode(ifp->vif))
4379                 wpa_val = WPA_AUTH_NONE;
4380         else
4381                 wpa_val = WPA_AUTH_DISABLED;
4382         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4383         if (err < 0) {
4384                 bphy_err(drvr, "wpa_auth error %d\n", err);
4385                 return err;
4386         }
4387
4388         return 0;
4389 }
4390
4391 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4392 {
4393         if (is_rsn_ie)
4394                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4395
4396         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4397 }
4398
4399 static s32
4400 brcmf_configure_wpaie(struct brcmf_if *ifp,
4401                       const struct brcmf_vs_tlv *wpa_ie,
4402                       bool is_rsn_ie)
4403 {
4404         struct brcmf_pub *drvr = ifp->drvr;
4405         u32 auth = 0; /* d11 open authentication */
4406         u16 count;
4407         s32 err = 0;
4408         s32 len;
4409         u32 i;
4410         u32 wsec;
4411         u32 pval = 0;
4412         u32 gval = 0;
4413         u32 wpa_auth = 0;
4414         u32 offset;
4415         u8 *data;
4416         u16 rsn_cap;
4417         u32 wme_bss_disable;
4418         u32 mfp;
4419
4420         brcmf_dbg(TRACE, "Enter\n");
4421         if (wpa_ie == NULL)
4422                 goto exit;
4423
4424         len = wpa_ie->len + TLV_HDR_LEN;
4425         data = (u8 *)wpa_ie;
4426         offset = TLV_HDR_LEN;
4427         if (!is_rsn_ie)
4428                 offset += VS_IE_FIXED_HDR_LEN;
4429         else
4430                 offset += WPA_IE_VERSION_LEN;
4431
4432         /* check for multicast cipher suite */
4433         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4434                 err = -EINVAL;
4435                 bphy_err(drvr, "no multicast cipher suite\n");
4436                 goto exit;
4437         }
4438
4439         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4440                 err = -EINVAL;
4441                 bphy_err(drvr, "ivalid OUI\n");
4442                 goto exit;
4443         }
4444         offset += TLV_OUI_LEN;
4445
4446         /* pick up multicast cipher */
4447         switch (data[offset]) {
4448         case WPA_CIPHER_NONE:
4449                 gval = 0;
4450                 break;
4451         case WPA_CIPHER_WEP_40:
4452         case WPA_CIPHER_WEP_104:
4453                 gval = WEP_ENABLED;
4454                 break;
4455         case WPA_CIPHER_TKIP:
4456                 gval = TKIP_ENABLED;
4457                 break;
4458         case WPA_CIPHER_AES_CCM:
4459                 gval = AES_ENABLED;
4460                 break;
4461         default:
4462                 err = -EINVAL;
4463                 bphy_err(drvr, "Invalid multi cast cipher info\n");
4464                 goto exit;
4465         }
4466
4467         offset++;
4468         /* walk thru unicast cipher list and pick up what we recognize */
4469         count = data[offset] + (data[offset + 1] << 8);
4470         offset += WPA_IE_SUITE_COUNT_LEN;
4471         /* Check for unicast suite(s) */
4472         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4473                 err = -EINVAL;
4474                 bphy_err(drvr, "no unicast cipher suite\n");
4475                 goto exit;
4476         }
4477         for (i = 0; i < count; i++) {
4478                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4479                         err = -EINVAL;
4480                         bphy_err(drvr, "ivalid OUI\n");
4481                         goto exit;
4482                 }
4483                 offset += TLV_OUI_LEN;
4484                 switch (data[offset]) {
4485                 case WPA_CIPHER_NONE:
4486                         break;
4487                 case WPA_CIPHER_WEP_40:
4488                 case WPA_CIPHER_WEP_104:
4489                         pval |= WEP_ENABLED;
4490                         break;
4491                 case WPA_CIPHER_TKIP:
4492                         pval |= TKIP_ENABLED;
4493                         break;
4494                 case WPA_CIPHER_AES_CCM:
4495                         pval |= AES_ENABLED;
4496                         break;
4497                 default:
4498                         bphy_err(drvr, "Invalid unicast security info\n");
4499                 }
4500                 offset++;
4501         }
4502         /* walk thru auth management suite list and pick up what we recognize */
4503         count = data[offset] + (data[offset + 1] << 8);
4504         offset += WPA_IE_SUITE_COUNT_LEN;
4505         /* Check for auth key management suite(s) */
4506         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4507                 err = -EINVAL;
4508                 bphy_err(drvr, "no auth key mgmt suite\n");
4509                 goto exit;
4510         }
4511         for (i = 0; i < count; i++) {
4512                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4513                         err = -EINVAL;
4514                         bphy_err(drvr, "ivalid OUI\n");
4515                         goto exit;
4516                 }
4517                 offset += TLV_OUI_LEN;
4518                 switch (data[offset]) {
4519                 case RSN_AKM_NONE:
4520                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4521                         wpa_auth |= WPA_AUTH_NONE;
4522                         break;
4523                 case RSN_AKM_UNSPECIFIED:
4524                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4525                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4526                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4527                         break;
4528                 case RSN_AKM_PSK:
4529                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4530                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4531                                     (wpa_auth |= WPA_AUTH_PSK);
4532                         break;
4533                 case RSN_AKM_SHA256_PSK:
4534                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4535                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4536                         break;
4537                 case RSN_AKM_SHA256_1X:
4538                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4539                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4540                         break;
4541                 case RSN_AKM_SAE:
4542                         brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4543                         wpa_auth |= WPA3_AUTH_SAE_PSK;
4544                         break;
4545                 default:
4546                         bphy_err(drvr, "Invalid key mgmt info\n");
4547                 }
4548                 offset++;
4549         }
4550
4551         mfp = BRCMF_MFP_NONE;
4552         if (is_rsn_ie) {
4553                 wme_bss_disable = 1;
4554                 if ((offset + RSN_CAP_LEN) <= len) {
4555                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4556                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4557                                 wme_bss_disable = 0;
4558                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4559                                 brcmf_dbg(TRACE, "MFP Required\n");
4560                                 mfp = BRCMF_MFP_REQUIRED;
4561                                 /* Firmware only supports mfp required in
4562                                  * combination with WPA2_AUTH_PSK_SHA256,
4563                                  * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4564                                  */
4565                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4566                                                   WPA2_AUTH_1X_SHA256 |
4567                                                   WPA3_AUTH_SAE_PSK))) {
4568                                         err = -EINVAL;
4569                                         goto exit;
4570                                 }
4571                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4572                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4573                                  * is to be included in the rsn ie.
4574                                  */
4575                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4576                                         wpa_auth |= WPA2_AUTH_PSK;
4577                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4578                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4579                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4580                                 brcmf_dbg(TRACE, "MFP Capable\n");
4581                                 mfp = BRCMF_MFP_CAPABLE;
4582                         }
4583                 }
4584                 offset += RSN_CAP_LEN;
4585                 /* set wme_bss_disable to sync RSN Capabilities */
4586                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4587                                                wme_bss_disable);
4588                 if (err < 0) {
4589                         bphy_err(drvr, "wme_bss_disable error %d\n", err);
4590                         goto exit;
4591                 }
4592
4593                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4594                 offset += RSN_PMKID_COUNT_LEN;
4595
4596                 /* See if there is BIP wpa suite left for MFP */
4597                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4598                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4599                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4600                                                         &data[offset],
4601                                                         WPA_IE_MIN_OUI_LEN);
4602                         if (err < 0) {
4603                                 bphy_err(drvr, "bip error %d\n", err);
4604                                 goto exit;
4605                         }
4606                 }
4607         }
4608         /* FOR WPS , set SES_OW_ENABLED */
4609         wsec = (pval | gval | SES_OW_ENABLED);
4610
4611         /* set auth */
4612         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4613         if (err < 0) {
4614                 bphy_err(drvr, "auth error %d\n", err);
4615                 goto exit;
4616         }
4617         /* set wsec */
4618         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4619         if (err < 0) {
4620                 bphy_err(drvr, "wsec error %d\n", err);
4621                 goto exit;
4622         }
4623         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4624          * will overwrite the values set by MFP
4625          */
4626         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4627                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4628                 if (err < 0) {
4629                         bphy_err(drvr, "mfp error %d\n", err);
4630                         goto exit;
4631                 }
4632         }
4633         /* set upper-layer auth */
4634         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4635         if (err < 0) {
4636                 bphy_err(drvr, "wpa_auth error %d\n", err);
4637                 goto exit;
4638         }
4639
4640 exit:
4641         return err;
4642 }
4643
4644 static s32
4645 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4646                      struct parsed_vndr_ies *vndr_ies)
4647 {
4648         struct brcmf_vs_tlv *vndrie;
4649         struct brcmf_tlv *ie;
4650         struct parsed_vndr_ie_info *parsed_info;
4651         s32 remaining_len;
4652
4653         remaining_len = (s32)vndr_ie_len;
4654         memset(vndr_ies, 0, sizeof(*vndr_ies));
4655
4656         ie = (struct brcmf_tlv *)vndr_ie_buf;
4657         while (ie) {
4658                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4659                         goto next;
4660                 vndrie = (struct brcmf_vs_tlv *)ie;
4661                 /* len should be bigger than OUI length + one */
4662                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4663                         brcmf_err("invalid vndr ie. length is too small %d\n",
4664                                   vndrie->len);
4665                         goto next;
4666                 }
4667                 /* if wpa or wme ie, do not add ie */
4668                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4669                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4670                     (vndrie->oui_type == WME_OUI_TYPE))) {
4671                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4672                         goto next;
4673                 }
4674
4675                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4676
4677                 /* save vndr ie information */
4678                 parsed_info->ie_ptr = (char *)vndrie;
4679                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4680                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4681
4682                 vndr_ies->count++;
4683
4684                 brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4685                           parsed_info->vndrie.oui,
4686                           parsed_info->vndrie.oui_type);
4687
4688                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4689                         break;
4690 next:
4691                 remaining_len -= (ie->len + TLV_HDR_LEN);
4692                 if (remaining_len <= TLV_HDR_LEN)
4693                         ie = NULL;
4694                 else
4695                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4696                                 TLV_HDR_LEN);
4697         }
4698         return 0;
4699 }
4700
4701 static u32
4702 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4703 {
4704         strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4705
4706         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4707
4708         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4709
4710         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4711
4712         return ie_len + VNDR_IE_HDR_SIZE;
4713 }
4714
4715 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4716                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4717 {
4718         struct brcmf_pub *drvr;
4719         struct brcmf_if *ifp;
4720         struct vif_saved_ie *saved_ie;
4721         s32 err = 0;
4722         u8  *iovar_ie_buf;
4723         u8  *curr_ie_buf;
4724         u8  *mgmt_ie_buf = NULL;
4725         int mgmt_ie_buf_len;
4726         u32 *mgmt_ie_len;
4727         u32 del_add_ie_buf_len = 0;
4728         u32 total_ie_buf_len = 0;
4729         u32 parsed_ie_buf_len = 0;
4730         struct parsed_vndr_ies old_vndr_ies;
4731         struct parsed_vndr_ies new_vndr_ies;
4732         struct parsed_vndr_ie_info *vndrie_info;
4733         s32 i;
4734         u8 *ptr;
4735         int remained_buf_len;
4736
4737         if (!vif)
4738                 return -ENODEV;
4739         ifp = vif->ifp;
4740         drvr = ifp->drvr;
4741         saved_ie = &vif->saved_ie;
4742
4743         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4744                   pktflag);
4745         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4746         if (!iovar_ie_buf)
4747                 return -ENOMEM;
4748         curr_ie_buf = iovar_ie_buf;
4749         switch (pktflag) {
4750         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4751                 mgmt_ie_buf = saved_ie->probe_req_ie;
4752                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4753                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4754                 break;
4755         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4756                 mgmt_ie_buf = saved_ie->probe_res_ie;
4757                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4758                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4759                 break;
4760         case BRCMF_VNDR_IE_BEACON_FLAG:
4761                 mgmt_ie_buf = saved_ie->beacon_ie;
4762                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4763                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4764                 break;
4765         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4766                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4767                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4768                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4769                 break;
4770         case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4771                 mgmt_ie_buf = saved_ie->assoc_res_ie;
4772                 mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4773                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4774                 break;
4775         default:
4776                 err = -EPERM;
4777                 bphy_err(drvr, "not suitable type\n");
4778                 goto exit;
4779         }
4780
4781         if (vndr_ie_len > mgmt_ie_buf_len) {
4782                 err = -ENOMEM;
4783                 bphy_err(drvr, "extra IE size too big\n");
4784                 goto exit;
4785         }
4786
4787         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4788         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4789                 ptr = curr_ie_buf;
4790                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4791                 for (i = 0; i < new_vndr_ies.count; i++) {
4792                         vndrie_info = &new_vndr_ies.ie_info[i];
4793                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4794                                vndrie_info->ie_len);
4795                         parsed_ie_buf_len += vndrie_info->ie_len;
4796                 }
4797         }
4798
4799         if (mgmt_ie_buf && *mgmt_ie_len) {
4800                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4801                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4802                             parsed_ie_buf_len) == 0)) {
4803                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4804                         goto exit;
4805                 }
4806
4807                 /* parse old vndr_ie */
4808                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4809
4810                 /* make a command to delete old ie */
4811                 for (i = 0; i < old_vndr_ies.count; i++) {
4812                         vndrie_info = &old_vndr_ies.ie_info[i];
4813
4814                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4815                                   vndrie_info->vndrie.id,
4816                                   vndrie_info->vndrie.len,
4817                                   vndrie_info->vndrie.oui);
4818
4819                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4820                                                            vndrie_info->ie_ptr,
4821                                                            vndrie_info->ie_len,
4822                                                            "del");
4823                         curr_ie_buf += del_add_ie_buf_len;
4824                         total_ie_buf_len += del_add_ie_buf_len;
4825                 }
4826         }
4827
4828         *mgmt_ie_len = 0;
4829         /* Add if there is any extra IE */
4830         if (mgmt_ie_buf && parsed_ie_buf_len) {
4831                 ptr = mgmt_ie_buf;
4832
4833                 remained_buf_len = mgmt_ie_buf_len;
4834
4835                 /* make a command to add new ie */
4836                 for (i = 0; i < new_vndr_ies.count; i++) {
4837                         vndrie_info = &new_vndr_ies.ie_info[i];
4838
4839                         /* verify remained buf size before copy data */
4840                         if (remained_buf_len < (vndrie_info->vndrie.len +
4841                                                         VNDR_IE_VSIE_OFFSET)) {
4842                                 bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4843                                          remained_buf_len);
4844                                 break;
4845                         }
4846                         remained_buf_len -= (vndrie_info->ie_len +
4847                                              VNDR_IE_VSIE_OFFSET);
4848
4849                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4850                                   vndrie_info->vndrie.id,
4851                                   vndrie_info->vndrie.len,
4852                                   vndrie_info->vndrie.oui);
4853
4854                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4855                                                            vndrie_info->ie_ptr,
4856                                                            vndrie_info->ie_len,
4857                                                            "add");
4858
4859                         /* save the parsed IE in wl struct */
4860                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4861                                vndrie_info->ie_len);
4862                         *mgmt_ie_len += vndrie_info->ie_len;
4863
4864                         curr_ie_buf += del_add_ie_buf_len;
4865                         total_ie_buf_len += del_add_ie_buf_len;
4866                 }
4867         }
4868         if (total_ie_buf_len) {
4869                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4870                                                  total_ie_buf_len);
4871                 if (err)
4872                         bphy_err(drvr, "vndr ie set error : %d\n", err);
4873         }
4874
4875 exit:
4876         kfree(iovar_ie_buf);
4877         return err;
4878 }
4879
4880 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4881 {
4882         static const s32 pktflags[] = {
4883                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4884                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4885                 BRCMF_VNDR_IE_BEACON_FLAG
4886         };
4887         int i;
4888
4889         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4890                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4891
4892         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4893         return 0;
4894 }
4895
4896 static s32
4897 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4898                         struct cfg80211_beacon_data *beacon)
4899 {
4900         struct brcmf_pub *drvr = vif->ifp->drvr;
4901         s32 err;
4902
4903         /* Set Beacon IEs to FW */
4904         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4905                                     beacon->tail, beacon->tail_len);
4906         if (err) {
4907                 bphy_err(drvr, "Set Beacon IE Failed\n");
4908                 return err;
4909         }
4910         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4911
4912         /* Set Probe Response IEs to FW */
4913         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4914                                     beacon->proberesp_ies,
4915                                     beacon->proberesp_ies_len);
4916         if (err)
4917                 bphy_err(drvr, "Set Probe Resp IE Failed\n");
4918         else
4919                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4920
4921         /* Set Assoc Response IEs to FW */
4922         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
4923                                     beacon->assocresp_ies,
4924                                     beacon->assocresp_ies_len);
4925         if (err)
4926                 brcmf_err("Set Assoc Resp IE Failed\n");
4927         else
4928                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
4929
4930         return err;
4931 }
4932
4933 static s32
4934 brcmf_parse_configure_security(struct brcmf_if *ifp,
4935                                struct cfg80211_ap_settings *settings,
4936                                enum nl80211_iftype dev_role)
4937 {
4938         const struct brcmf_tlv *rsn_ie;
4939         const struct brcmf_vs_tlv *wpa_ie;
4940         s32 err = 0;
4941
4942         /* find the RSN_IE */
4943         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4944                                   settings->beacon.tail_len, WLAN_EID_RSN);
4945
4946         /* find the WPA_IE */
4947         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4948                                   settings->beacon.tail_len);
4949
4950         if (wpa_ie || rsn_ie) {
4951                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4952                 if (wpa_ie) {
4953                         /* WPA IE */
4954                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4955                         if (err < 0)
4956                                 return err;
4957                 } else {
4958                         struct brcmf_vs_tlv *tmp_ie;
4959
4960                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4961
4962                         /* RSN IE */
4963                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4964                         if (err < 0)
4965                                 return err;
4966                 }
4967         } else {
4968                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4969                 brcmf_configure_opensecurity(ifp);
4970         }
4971
4972         return err;
4973 }
4974
4975 static s32
4976 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4977                         struct cfg80211_ap_settings *settings)
4978 {
4979         s32 ie_offset;
4980         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4981         struct brcmf_if *ifp = netdev_priv(ndev);
4982         struct brcmf_pub *drvr = cfg->pub;
4983         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4984         struct cfg80211_crypto_settings *crypto = &settings->crypto;
4985         const struct brcmf_tlv *ssid_ie;
4986         const struct brcmf_tlv *country_ie;
4987         struct brcmf_ssid_le ssid_le;
4988         s32 err = -EPERM;
4989         struct brcmf_join_params join_params;
4990         enum nl80211_iftype dev_role;
4991         struct brcmf_fil_bss_enable_le bss_enable;
4992         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4993         bool mbss;
4994         int is_11d;
4995         bool supports_11d;
4996
4997         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4998                   settings->chandef.chan->hw_value,
4999                   settings->chandef.center_freq1, settings->chandef.width,
5000                   settings->beacon_interval, settings->dtim_period);
5001         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5002                   settings->ssid, settings->ssid_len, settings->auth_type,
5003                   settings->inactivity_timeout);
5004         dev_role = ifp->vif->wdev.iftype;
5005         mbss = ifp->vif->mbss;
5006
5007         /* store current 11d setting */
5008         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5009                                   &ifp->vif->is_11d)) {
5010                 is_11d = supports_11d = false;
5011         } else {
5012                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5013                                               settings->beacon.tail_len,
5014                                               WLAN_EID_COUNTRY);
5015                 is_11d = country_ie ? 1 : 0;
5016                 supports_11d = true;
5017         }
5018
5019         memset(&ssid_le, 0, sizeof(ssid_le));
5020         if (settings->ssid == NULL || settings->ssid_len == 0) {
5021                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5022                 ssid_ie = brcmf_parse_tlvs(
5023                                 (u8 *)&settings->beacon.head[ie_offset],
5024                                 settings->beacon.head_len - ie_offset,
5025                                 WLAN_EID_SSID);
5026                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5027                         return -EINVAL;
5028
5029                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5030                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5031                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5032         } else {
5033                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5034                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5035         }
5036
5037         if (!mbss) {
5038                 brcmf_set_mpc(ifp, 0);
5039                 brcmf_configure_arp_nd_offload(ifp, false);
5040         }
5041
5042         /* Parameters shared by all radio interfaces */
5043         if (!mbss) {
5044                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5045                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5046                                                     is_11d);
5047                         if (err < 0) {
5048                                 bphy_err(drvr, "Regulatory Set Error, %d\n",
5049                                          err);
5050                                 goto exit;
5051                         }
5052                 }
5053                 if (settings->beacon_interval) {
5054                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5055                                                     settings->beacon_interval);
5056                         if (err < 0) {
5057                                 bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5058                                          err);
5059                                 goto exit;
5060                         }
5061                 }
5062                 if (settings->dtim_period) {
5063                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5064                                                     settings->dtim_period);
5065                         if (err < 0) {
5066                                 bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5067                                          err);
5068                                 goto exit;
5069                         }
5070                 }
5071
5072                 if ((dev_role == NL80211_IFTYPE_AP) &&
5073                     ((ifp->ifidx == 0) ||
5074                      (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5075                       !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5076                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5077                         if (err < 0) {
5078                                 bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5079                                          err);
5080                                 goto exit;
5081                         }
5082                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5083                 }
5084
5085                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5086                 if (err < 0) {
5087                         bphy_err(drvr, "SET INFRA error %d\n", err);
5088                         goto exit;
5089                 }
5090         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5091                 /* Multiple-BSS should use same 11d configuration */
5092                 err = -EINVAL;
5093                 goto exit;
5094         }
5095
5096         /* Interface specific setup */
5097         if (dev_role == NL80211_IFTYPE_AP) {
5098                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5099                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5100
5101                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5102                 if (err < 0) {
5103                         bphy_err(drvr, "setting AP mode failed %d\n",
5104                                  err);
5105                         goto exit;
5106                 }
5107                 if (!mbss) {
5108                         /* Firmware 10.x requires setting channel after enabling
5109                          * AP and before bringing interface up.
5110                          */
5111                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5112                         if (err < 0) {
5113                                 bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5114                                          chanspec, err);
5115                                 goto exit;
5116                         }
5117                 }
5118                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5119                 if (err < 0) {
5120                         bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5121                         goto exit;
5122                 }
5123
5124                 if (crypto->psk) {
5125                         brcmf_dbg(INFO, "using PSK offload\n");
5126                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5127                         err = brcmf_set_pmk(ifp, crypto->psk,
5128                                             BRCMF_WSEC_MAX_PSK_LEN);
5129                         if (err < 0)
5130                                 goto exit;
5131                 }
5132                 if (crypto->sae_pwd) {
5133                         brcmf_dbg(INFO, "using SAE offload\n");
5134                         profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5135                         err = brcmf_set_sae_password(ifp, crypto->sae_pwd,
5136                                                      crypto->sae_pwd_len);
5137                         if (err < 0)
5138                                 goto exit;
5139                 }
5140                 if (profile->use_fwauth == 0)
5141                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5142
5143                 err = brcmf_parse_configure_security(ifp, settings,
5144                                                      NL80211_IFTYPE_AP);
5145                 if (err < 0) {
5146                         bphy_err(drvr, "brcmf_parse_configure_security error\n");
5147                         goto exit;
5148                 }
5149
5150                 /* On DOWN the firmware removes the WEP keys, reconfigure
5151                  * them if they were set.
5152                  */
5153                 brcmf_cfg80211_reconfigure_wep(ifp);
5154
5155                 memset(&join_params, 0, sizeof(join_params));
5156                 /* join parameters starts with ssid */
5157                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5158                 /* create softap */
5159                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5160                                              &join_params, sizeof(join_params));
5161                 if (err < 0) {
5162                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5163                         goto exit;
5164                 }
5165
5166                 err = brcmf_fil_iovar_int_set(ifp, "closednet",
5167                                               settings->hidden_ssid);
5168                 if (err) {
5169                         bphy_err(drvr, "%s closednet error (%d)\n",
5170                                  settings->hidden_ssid ?
5171                                  "enabled" : "disabled",
5172                                  err);
5173                         goto exit;
5174                 }
5175
5176                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
5177         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5178                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5179                 if (err < 0) {
5180                         bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5181                                  chanspec, err);
5182                         goto exit;
5183                 }
5184
5185                 err = brcmf_parse_configure_security(ifp, settings,
5186                                                      NL80211_IFTYPE_P2P_GO);
5187                 if (err < 0) {
5188                         brcmf_err("brcmf_parse_configure_security error\n");
5189                         goto exit;
5190                 }
5191
5192                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5193                                                 sizeof(ssid_le));
5194                 if (err < 0) {
5195                         bphy_err(drvr, "setting ssid failed %d\n", err);
5196                         goto exit;
5197                 }
5198                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5199                 bss_enable.enable = cpu_to_le32(1);
5200                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5201                                                sizeof(bss_enable));
5202                 if (err < 0) {
5203                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5204                         goto exit;
5205                 }
5206
5207                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
5208         } else {
5209                 WARN_ON(1);
5210         }
5211
5212         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5213         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5214         brcmf_net_setcarrier(ifp, true);
5215
5216 exit:
5217         if ((err) && (!mbss)) {
5218                 brcmf_set_mpc(ifp, 1);
5219                 brcmf_configure_arp_nd_offload(ifp, true);
5220         }
5221         return err;
5222 }
5223
5224 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5225                                   unsigned int link_id)
5226 {
5227         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5228         struct brcmf_if *ifp = netdev_priv(ndev);
5229         struct brcmf_pub *drvr = cfg->pub;
5230         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5231         s32 err;
5232         struct brcmf_fil_bss_enable_le bss_enable;
5233         struct brcmf_join_params join_params;
5234
5235         brcmf_dbg(TRACE, "Enter\n");
5236
5237         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5238                 /* Due to most likely deauths outstanding we sleep */
5239                 /* first to make sure they get processed by fw. */
5240                 msleep(400);
5241
5242                 if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5243                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5244                                 brcmf_set_pmk(ifp, NULL, 0);
5245                         if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5246                                 brcmf_set_sae_password(ifp, NULL, 0);
5247                         profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5248                 }
5249
5250                 if (ifp->vif->mbss) {
5251                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5252                         return err;
5253                 }
5254
5255                 /* First BSS doesn't get a full reset */
5256                 if (ifp->bsscfgidx == 0)
5257                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5258
5259                 memset(&join_params, 0, sizeof(join_params));
5260                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5261                                              &join_params, sizeof(join_params));
5262                 if (err < 0)
5263                         bphy_err(drvr, "SET SSID error (%d)\n", err);
5264                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5265                 if (err < 0)
5266                         bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5267                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5268                 if (err < 0)
5269                         bphy_err(drvr, "setting AP mode failed %d\n", err);
5270                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5271                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5272                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5273                                       ifp->vif->is_11d);
5274                 /* Bring device back up so it can be used again */
5275                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5276                 if (err < 0)
5277                         bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5278
5279                 brcmf_vif_clear_mgmt_ies(ifp->vif);
5280         } else {
5281                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5282                 bss_enable.enable = cpu_to_le32(0);
5283                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5284                                                sizeof(bss_enable));
5285                 if (err < 0)
5286                         bphy_err(drvr, "bss_enable config failed %d\n", err);
5287         }
5288         brcmf_set_mpc(ifp, 1);
5289         brcmf_configure_arp_nd_offload(ifp, true);
5290         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5291         brcmf_net_setcarrier(ifp, false);
5292
5293         return err;
5294 }
5295
5296 static s32
5297 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5298                              struct cfg80211_beacon_data *info)
5299 {
5300         struct brcmf_if *ifp = netdev_priv(ndev);
5301
5302         brcmf_dbg(TRACE, "Enter\n");
5303
5304         return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5305 }
5306
5307 static int
5308 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5309                            struct station_del_parameters *params)
5310 {
5311         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5312         struct brcmf_pub *drvr = cfg->pub;
5313         struct brcmf_scb_val_le scbval;
5314         struct brcmf_if *ifp = netdev_priv(ndev);
5315         s32 err;
5316
5317         if (!params->mac)
5318                 return -EFAULT;
5319
5320         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5321
5322         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5323                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5324         if (!check_vif_up(ifp->vif))
5325                 return -EIO;
5326
5327         memcpy(&scbval.ea, params->mac, ETH_ALEN);
5328         scbval.val = cpu_to_le32(params->reason_code);
5329         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5330                                      &scbval, sizeof(scbval));
5331         if (err)
5332                 bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5333                          err);
5334
5335         brcmf_dbg(TRACE, "Exit\n");
5336         return err;
5337 }
5338
5339 static int
5340 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5341                               const u8 *mac, struct station_parameters *params)
5342 {
5343         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5344         struct brcmf_pub *drvr = cfg->pub;
5345         struct brcmf_if *ifp = netdev_priv(ndev);
5346         s32 err;
5347
5348         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5349                   params->sta_flags_mask, params->sta_flags_set);
5350
5351         /* Ignore all 00 MAC */
5352         if (is_zero_ether_addr(mac))
5353                 return 0;
5354
5355         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5356                 return 0;
5357
5358         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5359                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5360                                              (void *)mac, ETH_ALEN);
5361         else
5362                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5363                                              (void *)mac, ETH_ALEN);
5364         if (err < 0)
5365                 bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5366
5367         return err;
5368 }
5369
5370 static void
5371 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5372                                                struct wireless_dev *wdev,
5373                                                struct mgmt_frame_regs *upd)
5374 {
5375         struct brcmf_cfg80211_vif *vif;
5376
5377         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5378
5379         vif->mgmt_rx_reg = upd->interface_stypes;
5380 }
5381
5382
5383 static int
5384 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5385                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5386 {
5387         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5388         struct ieee80211_channel *chan = params->chan;
5389         struct brcmf_pub *drvr = cfg->pub;
5390         const u8 *buf = params->buf;
5391         size_t len = params->len;
5392         const struct ieee80211_mgmt *mgmt;
5393         struct brcmf_cfg80211_vif *vif;
5394         s32 err = 0;
5395         s32 ie_offset;
5396         s32 ie_len;
5397         struct brcmf_fil_action_frame_le *action_frame;
5398         struct brcmf_fil_af_params_le *af_params;
5399         bool ack;
5400         s32 chan_nr;
5401         u32 freq;
5402
5403         brcmf_dbg(TRACE, "Enter\n");
5404
5405         *cookie = 0;
5406
5407         mgmt = (const struct ieee80211_mgmt *)buf;
5408
5409         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5410                 bphy_err(drvr, "Driver only allows MGMT packet type\n");
5411                 return -EPERM;
5412         }
5413
5414         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5415
5416         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5417                 /* Right now the only reason to get a probe response */
5418                 /* is for p2p listen response or for p2p GO from     */
5419                 /* wpa_supplicant. Unfortunately the probe is send   */
5420                 /* on primary ndev, while dongle wants it on the p2p */
5421                 /* vif. Since this is only reason for a probe        */
5422                 /* response to be sent, the vif is taken from cfg.   */
5423                 /* If ever desired to send proberesp for non p2p     */
5424                 /* response then data should be checked for          */
5425                 /* "DIRECT-". Note in future supplicant will take    */
5426                 /* dedicated p2p wdev to do this and then this 'hack'*/
5427                 /* is not needed anymore.                            */
5428                 ie_offset =  DOT11_MGMT_HDR_LEN +
5429                              DOT11_BCN_PRB_FIXED_LEN;
5430                 ie_len = len - ie_offset;
5431                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5432                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5433                 err = brcmf_vif_set_mgmt_ie(vif,
5434                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
5435                                             &buf[ie_offset],
5436                                             ie_len);
5437                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5438                                         GFP_KERNEL);
5439         } else if (ieee80211_is_action(mgmt->frame_control)) {
5440                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5441                         bphy_err(drvr, "invalid action frame length\n");
5442                         err = -EINVAL;
5443                         goto exit;
5444                 }
5445                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5446                 if (af_params == NULL) {
5447                         bphy_err(drvr, "unable to allocate frame\n");
5448                         err = -ENOMEM;
5449                         goto exit;
5450                 }
5451                 action_frame = &af_params->action_frame;
5452                 /* Add the packet Id */
5453                 action_frame->packet_id = cpu_to_le32(*cookie);
5454                 /* Add BSSID */
5455                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5456                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5457                 /* Add the length exepted for 802.11 header  */
5458                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5459                 /* Add the channel. Use the one specified as parameter if any or
5460                  * the current one (got from the firmware) otherwise
5461                  */
5462                 if (chan)
5463                         freq = chan->center_freq;
5464                 else
5465                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5466                                               &freq);
5467                 chan_nr = ieee80211_frequency_to_channel(freq);
5468                 af_params->channel = cpu_to_le32(chan_nr);
5469                 af_params->dwell_time = cpu_to_le32(params->wait);
5470                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5471                        le16_to_cpu(action_frame->len));
5472
5473                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5474                           *cookie, le16_to_cpu(action_frame->len), freq);
5475
5476                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5477                                                   af_params);
5478
5479                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5480                                         GFP_KERNEL);
5481                 kfree(af_params);
5482         } else {
5483                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5484                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5485         }
5486
5487 exit:
5488         return err;
5489 }
5490
5491 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5492                                                     struct net_device *ndev,
5493                                                     s32 rssi_low, s32 rssi_high)
5494 {
5495         struct brcmf_cfg80211_vif *vif;
5496         struct brcmf_if *ifp;
5497         int err = 0;
5498
5499         brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5500
5501         ifp = netdev_priv(ndev);
5502         vif = ifp->vif;
5503
5504         if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5505                 /* The firmware will send an event when the RSSI is less than or
5506                  * equal to a configured level and the previous RSSI event was
5507                  * less than or equal to a different level. Set a third level
5508                  * so that we also detect the transition from rssi <= rssi_high
5509                  * to rssi > rssi_high.
5510                  */
5511                 struct brcmf_rssi_event_le config = {
5512                         .rate_limit_msec = cpu_to_le32(0),
5513                         .rssi_level_num = 3,
5514                         .rssi_levels = {
5515                                 clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5516                                 clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5517                                 S8_MAX,
5518                         },
5519                 };
5520
5521                 err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5522                                                sizeof(config));
5523                 if (err) {
5524                         err = -EINVAL;
5525                 } else {
5526                         vif->cqm_rssi_low = rssi_low;
5527                         vif->cqm_rssi_high = rssi_high;
5528                 }
5529         }
5530
5531         return err;
5532 }
5533
5534 static int
5535 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5536                                         struct wireless_dev *wdev,
5537                                         u64 cookie)
5538 {
5539         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5540         struct brcmf_pub *drvr = cfg->pub;
5541         struct brcmf_cfg80211_vif *vif;
5542         int err = 0;
5543
5544         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5545
5546         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5547         if (vif == NULL) {
5548                 bphy_err(drvr, "No p2p device available for probe response\n");
5549                 err = -ENODEV;
5550                 goto exit;
5551         }
5552         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5553 exit:
5554         return err;
5555 }
5556
5557 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5558                                       struct wireless_dev *wdev,
5559                                       unsigned int link_id,
5560                                       struct cfg80211_chan_def *chandef)
5561 {
5562         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5563         struct net_device *ndev = wdev->netdev;
5564         struct brcmf_pub *drvr = cfg->pub;
5565         struct brcmu_chan ch;
5566         enum nl80211_band band = 0;
5567         enum nl80211_chan_width width = 0;
5568         u32 chanspec;
5569         int freq, err;
5570
5571         if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5572                 return -ENODEV;
5573
5574         err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5575         if (err) {
5576                 bphy_err(drvr, "chanspec failed (%d)\n", err);
5577                 return err;
5578         }
5579
5580         ch.chspec = chanspec;
5581         cfg->d11inf.decchspec(&ch);
5582
5583         switch (ch.band) {
5584         case BRCMU_CHAN_BAND_2G:
5585                 band = NL80211_BAND_2GHZ;
5586                 break;
5587         case BRCMU_CHAN_BAND_5G:
5588                 band = NL80211_BAND_5GHZ;
5589                 break;
5590         }
5591
5592         switch (ch.bw) {
5593         case BRCMU_CHAN_BW_80:
5594                 width = NL80211_CHAN_WIDTH_80;
5595                 break;
5596         case BRCMU_CHAN_BW_40:
5597                 width = NL80211_CHAN_WIDTH_40;
5598                 break;
5599         case BRCMU_CHAN_BW_20:
5600                 width = NL80211_CHAN_WIDTH_20;
5601                 break;
5602         case BRCMU_CHAN_BW_80P80:
5603                 width = NL80211_CHAN_WIDTH_80P80;
5604                 break;
5605         case BRCMU_CHAN_BW_160:
5606                 width = NL80211_CHAN_WIDTH_160;
5607                 break;
5608         }
5609
5610         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5611         chandef->chan = ieee80211_get_channel(wiphy, freq);
5612         chandef->width = width;
5613         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5614         chandef->center_freq2 = 0;
5615
5616         return 0;
5617 }
5618
5619 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5620                                            struct wireless_dev *wdev,
5621                                            enum nl80211_crit_proto_id proto,
5622                                            u16 duration)
5623 {
5624         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5625         struct brcmf_cfg80211_vif *vif;
5626
5627         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5628
5629         /* only DHCP support for now */
5630         if (proto != NL80211_CRIT_PROTO_DHCP)
5631                 return -EINVAL;
5632
5633         /* suppress and abort scanning */
5634         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5635         brcmf_abort_scanning(cfg);
5636
5637         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5638 }
5639
5640 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5641                                            struct wireless_dev *wdev)
5642 {
5643         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5644         struct brcmf_cfg80211_vif *vif;
5645
5646         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5647
5648         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5649         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5650 }
5651
5652 static s32
5653 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5654                              const struct brcmf_event_msg *e, void *data)
5655 {
5656         switch (e->reason) {
5657         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5658                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5659                 break;
5660         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5661                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5662                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5663                 break;
5664         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5665                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5666                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5667                 break;
5668         }
5669
5670         return 0;
5671 }
5672
5673 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5674 {
5675         int ret;
5676
5677         switch (oper) {
5678         case NL80211_TDLS_DISCOVERY_REQ:
5679                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5680                 break;
5681         case NL80211_TDLS_SETUP:
5682                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5683                 break;
5684         case NL80211_TDLS_TEARDOWN:
5685                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5686                 break;
5687         default:
5688                 brcmf_err("unsupported operation: %d\n", oper);
5689                 ret = -EOPNOTSUPP;
5690         }
5691         return ret;
5692 }
5693
5694 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5695                                     struct net_device *ndev, const u8 *peer,
5696                                     enum nl80211_tdls_operation oper)
5697 {
5698         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5699         struct brcmf_pub *drvr = cfg->pub;
5700         struct brcmf_if *ifp;
5701         struct brcmf_tdls_iovar_le info;
5702         int ret = 0;
5703
5704         ret = brcmf_convert_nl80211_tdls_oper(oper);
5705         if (ret < 0)
5706                 return ret;
5707
5708         ifp = netdev_priv(ndev);
5709         memset(&info, 0, sizeof(info));
5710         info.mode = (u8)ret;
5711         if (peer)
5712                 memcpy(info.ea, peer, ETH_ALEN);
5713
5714         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5715                                        &info, sizeof(info));
5716         if (ret < 0)
5717                 bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5718
5719         return ret;
5720 }
5721
5722 static int
5723 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5724                                   struct net_device *ndev,
5725                                   struct cfg80211_connect_params *sme,
5726                                   u32 changed)
5727 {
5728         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5729         struct brcmf_pub *drvr = cfg->pub;
5730         struct brcmf_if *ifp;
5731         int err;
5732
5733         if (!(changed & UPDATE_ASSOC_IES))
5734                 return 0;
5735
5736         ifp = netdev_priv(ndev);
5737         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5738                                     sme->ie, sme->ie_len);
5739         if (err)
5740                 bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5741         else
5742                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5743
5744         return err;
5745 }
5746
5747 #ifdef CONFIG_PM
5748 static int
5749 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5750                               struct cfg80211_gtk_rekey_data *gtk)
5751 {
5752         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5753         struct brcmf_pub *drvr = cfg->pub;
5754         struct brcmf_if *ifp = netdev_priv(ndev);
5755         struct brcmf_gtk_keyinfo_le gtk_le;
5756         int ret;
5757
5758         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5759
5760         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5761         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5762         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5763                sizeof(gtk_le.replay_counter));
5764
5765         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5766                                        sizeof(gtk_le));
5767         if (ret < 0)
5768                 bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5769
5770         return ret;
5771 }
5772 #endif
5773
5774 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5775                                   const struct cfg80211_pmk_conf *conf)
5776 {
5777         struct brcmf_if *ifp;
5778
5779         brcmf_dbg(TRACE, "enter\n");
5780
5781         /* expect using firmware supplicant for 1X */
5782         ifp = netdev_priv(dev);
5783         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5784                 return -EINVAL;
5785
5786         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5787                 return -ERANGE;
5788
5789         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5790 }
5791
5792 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5793                                   const u8 *aa)
5794 {
5795         struct brcmf_if *ifp;
5796
5797         brcmf_dbg(TRACE, "enter\n");
5798         ifp = netdev_priv(dev);
5799         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5800                 return -EINVAL;
5801
5802         return brcmf_set_pmk(ifp, NULL, 0);
5803 }
5804
5805 static struct cfg80211_ops brcmf_cfg80211_ops = {
5806         .add_virtual_intf = brcmf_cfg80211_add_iface,
5807         .del_virtual_intf = brcmf_cfg80211_del_iface,
5808         .change_virtual_intf = brcmf_cfg80211_change_iface,
5809         .scan = brcmf_cfg80211_scan,
5810         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5811         .join_ibss = brcmf_cfg80211_join_ibss,
5812         .leave_ibss = brcmf_cfg80211_leave_ibss,
5813         .get_station = brcmf_cfg80211_get_station,
5814         .dump_station = brcmf_cfg80211_dump_station,
5815         .set_tx_power = brcmf_cfg80211_set_tx_power,
5816         .get_tx_power = brcmf_cfg80211_get_tx_power,
5817         .add_key = brcmf_cfg80211_add_key,
5818         .del_key = brcmf_cfg80211_del_key,
5819         .get_key = brcmf_cfg80211_get_key,
5820         .set_default_key = brcmf_cfg80211_config_default_key,
5821         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5822         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5823         .connect = brcmf_cfg80211_connect,
5824         .disconnect = brcmf_cfg80211_disconnect,
5825         .suspend = brcmf_cfg80211_suspend,
5826         .resume = brcmf_cfg80211_resume,
5827         .set_pmksa = brcmf_cfg80211_set_pmksa,
5828         .del_pmksa = brcmf_cfg80211_del_pmksa,
5829         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5830         .start_ap = brcmf_cfg80211_start_ap,
5831         .stop_ap = brcmf_cfg80211_stop_ap,
5832         .change_beacon = brcmf_cfg80211_change_beacon,
5833         .del_station = brcmf_cfg80211_del_station,
5834         .change_station = brcmf_cfg80211_change_station,
5835         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5836         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5837         .update_mgmt_frame_registrations =
5838                 brcmf_cfg80211_update_mgmt_frame_registrations,
5839         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5840         .set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5841         .remain_on_channel = brcmf_p2p_remain_on_channel,
5842         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5843         .get_channel = brcmf_cfg80211_get_channel,
5844         .start_p2p_device = brcmf_p2p_start_device,
5845         .stop_p2p_device = brcmf_p2p_stop_device,
5846         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5847         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5848         .tdls_oper = brcmf_cfg80211_tdls_oper,
5849         .update_connect_params = brcmf_cfg80211_update_conn_params,
5850         .set_pmk = brcmf_cfg80211_set_pmk,
5851         .del_pmk = brcmf_cfg80211_del_pmk,
5852 };
5853
5854 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5855 {
5856         struct cfg80211_ops *ops;
5857
5858         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5859                        GFP_KERNEL);
5860
5861         if (ops && settings->roamoff)
5862                 ops->update_connect_params = NULL;
5863
5864         return ops;
5865 }
5866
5867 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5868                                            enum nl80211_iftype type)
5869 {
5870         struct brcmf_cfg80211_vif *vif_walk;
5871         struct brcmf_cfg80211_vif *vif;
5872         bool mbss;
5873         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5874
5875         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5876                   sizeof(*vif));
5877         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5878         if (!vif)
5879                 return ERR_PTR(-ENOMEM);
5880
5881         vif->wdev.wiphy = cfg->wiphy;
5882         vif->wdev.iftype = type;
5883
5884         brcmf_init_prof(&vif->profile);
5885
5886         if (type == NL80211_IFTYPE_AP &&
5887             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
5888                 mbss = false;
5889                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5890                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5891                                 mbss = true;
5892                                 break;
5893                         }
5894                 }
5895                 vif->mbss = mbss;
5896         }
5897
5898         list_add_tail(&vif->list, &cfg->vif_list);
5899         return vif;
5900 }
5901
5902 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5903 {
5904         list_del(&vif->list);
5905         kfree(vif);
5906 }
5907
5908 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5909 {
5910         struct brcmf_cfg80211_vif *vif;
5911         struct brcmf_if *ifp;
5912
5913         ifp = netdev_priv(ndev);
5914         vif = ifp->vif;
5915
5916         if (vif)
5917                 brcmf_free_vif(vif);
5918 }
5919
5920 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5921                             const struct brcmf_event_msg *e)
5922 {
5923         u32 event = e->event_code;
5924         u32 status = e->status;
5925
5926         if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
5927              vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
5928             event == BRCMF_E_PSK_SUP &&
5929             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5930                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5931         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5932                 brcmf_dbg(CONN, "Processing set ssid\n");
5933                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5934                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
5935                     vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
5936                         return true;
5937
5938                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5939         }
5940
5941         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5942             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5943                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5944                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5945                 return true;
5946         }
5947         return false;
5948 }
5949
5950 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
5951                             const struct brcmf_event_msg *e)
5952 {
5953         u32 event = e->event_code;
5954         u16 flags = e->flags;
5955
5956         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5957             (event == BRCMF_E_DISASSOC_IND) ||
5958             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5959                 brcmf_dbg(CONN, "Processing link down\n");
5960                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5961                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5962                 return true;
5963         }
5964         return false;
5965 }
5966
5967 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5968                                const struct brcmf_event_msg *e)
5969 {
5970         u32 event = e->event_code;
5971         u32 status = e->status;
5972
5973         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5974                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5975                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5976                 return true;
5977         }
5978
5979         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5980                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5981                 return true;
5982         }
5983
5984         if (event == BRCMF_E_PSK_SUP &&
5985             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5986                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5987                           status);
5988                 return true;
5989         }
5990
5991         return false;
5992 }
5993
5994 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5995 {
5996         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5997
5998         kfree(conn_info->req_ie);
5999         conn_info->req_ie = NULL;
6000         conn_info->req_ie_len = 0;
6001         kfree(conn_info->resp_ie);
6002         conn_info->resp_ie = NULL;
6003         conn_info->resp_ie_len = 0;
6004 }
6005
6006 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6007 {
6008         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6009
6010         if (!cfg)
6011                 return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6012                        (prio ^ 2) : prio;
6013
6014         /* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6015          * to an 8-level precedence which is the same as BE's
6016          */
6017         if (prio > PRIO_8021D_EE &&
6018             cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6019                 return cfg->ac_priority[prio] * 2;
6020
6021         /* Conversion of 4-level priority to 8-level precedence */
6022         if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6023             prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6024                 return cfg->ac_priority[prio] * 2;
6025         else
6026                 return cfg->ac_priority[prio] * 2 + 1;
6027 }
6028
6029 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6030 {
6031         /* Prio here refers to the 802.1d priority in range of 0 to 7.
6032          * ACI here refers to the WLAN AC Index in range of 0 to 3.
6033          * This function will return ACI corresponding to input prio.
6034          */
6035         struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6036
6037         if (cfg)
6038                 return cfg->ac_priority[prio];
6039
6040         return prio;
6041 }
6042
6043 static void brcmf_init_wmm_prio(u8 *priority)
6044 {
6045         /* Initialize AC priority array to default
6046          * 802.1d priority as per following table:
6047          * 802.1d prio 0,3 maps to BE
6048          * 802.1d prio 1,2 maps to BK
6049          * 802.1d prio 4,5 maps to VI
6050          * 802.1d prio 6,7 maps to VO
6051          */
6052         priority[0] = BRCMF_FWS_FIFO_AC_BE;
6053         priority[3] = BRCMF_FWS_FIFO_AC_BE;
6054         priority[1] = BRCMF_FWS_FIFO_AC_BK;
6055         priority[2] = BRCMF_FWS_FIFO_AC_BK;
6056         priority[4] = BRCMF_FWS_FIFO_AC_VI;
6057         priority[5] = BRCMF_FWS_FIFO_AC_VI;
6058         priority[6] = BRCMF_FWS_FIFO_AC_VO;
6059         priority[7] = BRCMF_FWS_FIFO_AC_VO;
6060 }
6061
6062 static void brcmf_wifi_prioritize_acparams(const
6063         struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6064 {
6065         u8 aci;
6066         u8 aifsn;
6067         u8 ecwmin;
6068         u8 ecwmax;
6069         u8 acm;
6070         u8 ranking_basis[EDCF_AC_COUNT];
6071         u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6072         u8 index;
6073
6074         for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6075                 aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6076                 acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6077                 ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6078                 ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6079                 brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6080                           aci, aifsn, acm, ecwmin, ecwmax);
6081                 /* Default AC_VO will be the lowest ranking value */
6082                 ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6083                 /* Initialise priority starting at 0 (AC_BE) */
6084                 aci_prio[aci] = 0;
6085
6086                 /* If ACM is set, STA can't use this AC as per 802.11.
6087                  * Change the ranking to BE
6088                  */
6089                 if (aci != AC_BE && aci != AC_BK && acm == 1)
6090                         ranking_basis[aci] = ranking_basis[AC_BE];
6091         }
6092
6093         /* Ranking method which works for AC priority
6094          * swapping when values for cwmin, cwmax and aifsn are varied
6095          * Compare each aci_prio against each other aci_prio
6096          */
6097         for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6098                 for (index = 0; index < EDCF_AC_COUNT; index++) {
6099                         if (index != aci) {
6100                                 /* Smaller ranking value has higher priority,
6101                                  * so increment priority for each ACI which has
6102                                  * a higher ranking value
6103                                  */
6104                                 if (ranking_basis[aci] < ranking_basis[index])
6105                                         aci_prio[aci]++;
6106                         }
6107                 }
6108         }
6109
6110         /* By now, aci_prio[] will be in range of 0 to 3.
6111          * Use ACI prio to get the new priority value for
6112          * each 802.1d traffic type, in this range.
6113          */
6114         if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6115               aci_prio[AC_BK] == aci_prio[AC_VI] &&
6116               aci_prio[AC_VI] == aci_prio[AC_VO])) {
6117                 /* 802.1d 0,3 maps to BE */
6118                 priority[0] = aci_prio[AC_BE];
6119                 priority[3] = aci_prio[AC_BE];
6120
6121                 /* 802.1d 1,2 maps to BK */
6122                 priority[1] = aci_prio[AC_BK];
6123                 priority[2] = aci_prio[AC_BK];
6124
6125                 /* 802.1d 4,5 maps to VO */
6126                 priority[4] = aci_prio[AC_VI];
6127                 priority[5] = aci_prio[AC_VI];
6128
6129                 /* 802.1d 6,7 maps to VO */
6130                 priority[6] = aci_prio[AC_VO];
6131                 priority[7] = aci_prio[AC_VO];
6132         } else {
6133                 /* Initialize to default priority */
6134                 brcmf_init_wmm_prio(priority);
6135         }
6136
6137         brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6138                   priority[0], priority[1], priority[2], priority[3]);
6139
6140         brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6141                   priority[4], priority[5], priority[6], priority[7]);
6142 }
6143
6144 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6145                                struct brcmf_if *ifp)
6146 {
6147         struct brcmf_pub *drvr = cfg->pub;
6148         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6149         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6150         struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6151         u32 req_len;
6152         u32 resp_len;
6153         s32 err = 0;
6154
6155         brcmf_clear_assoc_ies(cfg);
6156
6157         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6158                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
6159         if (err) {
6160                 bphy_err(drvr, "could not get assoc info (%d)\n", err);
6161                 return err;
6162         }
6163         assoc_info =
6164                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6165         req_len = le32_to_cpu(assoc_info->req_len);
6166         resp_len = le32_to_cpu(assoc_info->resp_len);
6167         if (req_len) {
6168                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6169                                                cfg->extra_buf,
6170                                                WL_ASSOC_INFO_MAX);
6171                 if (err) {
6172                         bphy_err(drvr, "could not get assoc req (%d)\n", err);
6173                         return err;
6174                 }
6175                 conn_info->req_ie_len = req_len;
6176                 conn_info->req_ie =
6177                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6178                             GFP_KERNEL);
6179                 if (!conn_info->req_ie)
6180                         conn_info->req_ie_len = 0;
6181         } else {
6182                 conn_info->req_ie_len = 0;
6183                 conn_info->req_ie = NULL;
6184         }
6185         if (resp_len) {
6186                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6187                                                cfg->extra_buf,
6188                                                WL_ASSOC_INFO_MAX);
6189                 if (err) {
6190                         bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6191                         return err;
6192                 }
6193                 conn_info->resp_ie_len = resp_len;
6194                 conn_info->resp_ie =
6195                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6196                             GFP_KERNEL);
6197                 if (!conn_info->resp_ie)
6198                         conn_info->resp_ie_len = 0;
6199
6200                 err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6201                                                edcf_acparam_info,
6202                                                sizeof(edcf_acparam_info));
6203                 if (err) {
6204                         brcmf_err("could not get wme_ac_sta (%d)\n", err);
6205                         return err;
6206                 }
6207
6208                 brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6209                                                cfg->ac_priority);
6210         } else {
6211                 conn_info->resp_ie_len = 0;
6212                 conn_info->resp_ie = NULL;
6213         }
6214         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6215                   conn_info->req_ie_len, conn_info->resp_ie_len);
6216
6217         return err;
6218 }
6219
6220 static s32
6221 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6222                        struct net_device *ndev,
6223                        const struct brcmf_event_msg *e)
6224 {
6225         struct brcmf_if *ifp = netdev_priv(ndev);
6226         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6227         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6228         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6229         struct ieee80211_channel *notify_channel = NULL;
6230         struct ieee80211_supported_band *band;
6231         struct brcmf_bss_info_le *bi;
6232         struct brcmu_chan ch;
6233         struct cfg80211_roam_info roam_info = {};
6234         u32 freq;
6235         s32 err = 0;
6236         u8 *buf;
6237
6238         brcmf_dbg(TRACE, "Enter\n");
6239
6240         brcmf_get_assoc_ies(cfg, ifp);
6241         memcpy(profile->bssid, e->addr, ETH_ALEN);
6242         brcmf_update_bss_info(cfg, ifp);
6243
6244         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6245         if (buf == NULL) {
6246                 err = -ENOMEM;
6247                 goto done;
6248         }
6249
6250         /* data sent to dongle has to be little endian */
6251         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6252         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6253                                      buf, WL_BSS_INFO_MAX);
6254
6255         if (err)
6256                 goto done;
6257
6258         bi = (struct brcmf_bss_info_le *)(buf + 4);
6259         ch.chspec = le16_to_cpu(bi->chanspec);
6260         cfg->d11inf.decchspec(&ch);
6261
6262         if (ch.band == BRCMU_CHAN_BAND_2G)
6263                 band = wiphy->bands[NL80211_BAND_2GHZ];
6264         else
6265                 band = wiphy->bands[NL80211_BAND_5GHZ];
6266
6267         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6268         notify_channel = ieee80211_get_channel(wiphy, freq);
6269
6270 done:
6271         kfree(buf);
6272
6273         roam_info.links[0].channel = notify_channel;
6274         roam_info.links[0].bssid = profile->bssid;
6275         roam_info.req_ie = conn_info->req_ie;
6276         roam_info.req_ie_len = conn_info->req_ie_len;
6277         roam_info.resp_ie = conn_info->resp_ie;
6278         roam_info.resp_ie_len = conn_info->resp_ie_len;
6279
6280         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6281         brcmf_dbg(CONN, "Report roaming result\n");
6282
6283         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6284                 cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6285                 brcmf_dbg(CONN, "Report port authorized\n");
6286         }
6287
6288         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6289         brcmf_dbg(TRACE, "Exit\n");
6290         return err;
6291 }
6292
6293 static s32
6294 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6295                        struct net_device *ndev, const struct brcmf_event_msg *e,
6296                        bool completed)
6297 {
6298         struct brcmf_if *ifp = netdev_priv(ndev);
6299         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6300         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6301         struct cfg80211_connect_resp_params conn_params;
6302
6303         brcmf_dbg(TRACE, "Enter\n");
6304
6305         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6306                                &ifp->vif->sme_state)) {
6307                 memset(&conn_params, 0, sizeof(conn_params));
6308                 if (completed) {
6309                         brcmf_get_assoc_ies(cfg, ifp);
6310                         brcmf_update_bss_info(cfg, ifp);
6311                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6312                                 &ifp->vif->sme_state);
6313                         conn_params.status = WLAN_STATUS_SUCCESS;
6314                 } else {
6315                         clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6316                                   &ifp->vif->sme_state);
6317                         clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6318                                   &ifp->vif->sme_state);
6319                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6320                 }
6321                 conn_params.links[0].bssid = profile->bssid;
6322                 conn_params.req_ie = conn_info->req_ie;
6323                 conn_params.req_ie_len = conn_info->req_ie_len;
6324                 conn_params.resp_ie = conn_info->resp_ie;
6325                 conn_params.resp_ie_len = conn_info->resp_ie_len;
6326                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6327                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
6328                           completed ? "succeeded" : "failed");
6329         }
6330         brcmf_dbg(TRACE, "Exit\n");
6331         return 0;
6332 }
6333
6334 static s32
6335 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6336                                struct net_device *ndev,
6337                                const struct brcmf_event_msg *e, void *data)
6338 {
6339         struct brcmf_pub *drvr = cfg->pub;
6340         static int generation;
6341         u32 event = e->event_code;
6342         u32 reason = e->reason;
6343         struct station_info *sinfo;
6344
6345         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6346                   brcmf_fweh_event_name(event), event, reason);
6347         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6348             ndev != cfg_to_ndev(cfg)) {
6349                 brcmf_dbg(CONN, "AP mode link down\n");
6350                 complete(&cfg->vif_disabled);
6351                 return 0;
6352         }
6353
6354         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6355             (reason == BRCMF_E_STATUS_SUCCESS)) {
6356                 if (!data) {
6357                         bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6358                         return -EINVAL;
6359                 }
6360
6361                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6362                 if (!sinfo)
6363                         return -ENOMEM;
6364
6365                 sinfo->assoc_req_ies = data;
6366                 sinfo->assoc_req_ies_len = e->datalen;
6367                 generation++;
6368                 sinfo->generation = generation;
6369                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6370
6371                 kfree(sinfo);
6372         } else if ((event == BRCMF_E_DISASSOC_IND) ||
6373                    (event == BRCMF_E_DEAUTH_IND) ||
6374                    (event == BRCMF_E_DEAUTH)) {
6375                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6376         }
6377         return 0;
6378 }
6379
6380 static s32
6381 brcmf_notify_connect_status(struct brcmf_if *ifp,
6382                             const struct brcmf_event_msg *e, void *data)
6383 {
6384         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6385         struct net_device *ndev = ifp->ndev;
6386         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6387         struct ieee80211_channel *chan;
6388         s32 err = 0;
6389
6390         if ((e->event_code == BRCMF_E_DEAUTH) ||
6391             (e->event_code == BRCMF_E_DEAUTH_IND) ||
6392             (e->event_code == BRCMF_E_DISASSOC_IND) ||
6393             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6394                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6395         }
6396
6397         if (brcmf_is_apmode(ifp->vif)) {
6398                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6399         } else if (brcmf_is_linkup(ifp->vif, e)) {
6400                 brcmf_dbg(CONN, "Linkup\n");
6401                 if (brcmf_is_ibssmode(ifp->vif)) {
6402                         brcmf_inform_ibss(cfg, ndev, e->addr);
6403                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6404                         memcpy(profile->bssid, e->addr, ETH_ALEN);
6405                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6406                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6407                                   &ifp->vif->sme_state);
6408                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
6409                                 &ifp->vif->sme_state);
6410                 } else
6411                         brcmf_bss_connect_done(cfg, ndev, e, true);
6412                 brcmf_net_setcarrier(ifp, true);
6413         } else if (brcmf_is_linkdown(ifp->vif, e)) {
6414                 brcmf_dbg(CONN, "Linkdown\n");
6415                 if (!brcmf_is_ibssmode(ifp->vif) &&
6416                     (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6417                               &ifp->vif->sme_state) ||
6418                      test_bit(BRCMF_VIF_STATUS_CONNECTING,
6419                               &ifp->vif->sme_state))) {
6420                         if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6421                                      &ifp->vif->sme_state) &&
6422                             memcmp(profile->bssid, e->addr, ETH_ALEN))
6423                                 return err;
6424
6425                         brcmf_bss_connect_done(cfg, ndev, e, false);
6426                         brcmf_link_down(ifp->vif,
6427                                         brcmf_map_fw_linkdown_reason(e),
6428                                         e->event_code &
6429                                         (BRCMF_E_DEAUTH_IND |
6430                                         BRCMF_E_DISASSOC_IND)
6431                                         ? false : true);
6432                         brcmf_init_prof(ndev_to_prof(ndev));
6433                         if (ndev != cfg_to_ndev(cfg))
6434                                 complete(&cfg->vif_disabled);
6435                         brcmf_net_setcarrier(ifp, false);
6436                 }
6437         } else if (brcmf_is_nonetwork(cfg, e)) {
6438                 if (brcmf_is_ibssmode(ifp->vif))
6439                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6440                                   &ifp->vif->sme_state);
6441                 else
6442                         brcmf_bss_connect_done(cfg, ndev, e, false);
6443         }
6444
6445         return err;
6446 }
6447
6448 static s32
6449 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6450                             const struct brcmf_event_msg *e, void *data)
6451 {
6452         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6453         u32 event = e->event_code;
6454         u32 status = e->status;
6455
6456         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6457                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6458                              &ifp->vif->sme_state)) {
6459                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6460                 } else {
6461                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6462                         brcmf_net_setcarrier(ifp, true);
6463                 }
6464         }
6465
6466         return 0;
6467 }
6468
6469 static s32
6470 brcmf_notify_mic_status(struct brcmf_if *ifp,
6471                         const struct brcmf_event_msg *e, void *data)
6472 {
6473         u16 flags = e->flags;
6474         enum nl80211_key_type key_type;
6475
6476         if (flags & BRCMF_EVENT_MSG_GROUP)
6477                 key_type = NL80211_KEYTYPE_GROUP;
6478         else
6479                 key_type = NL80211_KEYTYPE_PAIRWISE;
6480
6481         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6482                                      NULL, GFP_KERNEL);
6483
6484         return 0;
6485 }
6486
6487 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6488                              const struct brcmf_event_msg *e, void *data)
6489 {
6490         struct brcmf_cfg80211_vif *vif = ifp->vif;
6491         struct brcmf_rssi_be *info = data;
6492         s32 rssi, snr, noise;
6493         s32 low, high, last;
6494
6495         if (e->datalen < sizeof(*info)) {
6496                 brcmf_err("insufficient RSSI event data\n");
6497                 return 0;
6498         }
6499
6500         rssi = be32_to_cpu(info->rssi);
6501         snr = be32_to_cpu(info->snr);
6502         noise = be32_to_cpu(info->noise);
6503
6504         low = vif->cqm_rssi_low;
6505         high = vif->cqm_rssi_high;
6506         last = vif->cqm_rssi_last;
6507
6508         brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6509                   rssi, snr, noise, low, high, last);
6510
6511         vif->cqm_rssi_last = rssi;
6512
6513         if (rssi <= low || rssi == 0) {
6514                 brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6515                 cfg80211_cqm_rssi_notify(ifp->ndev,
6516                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6517                                          rssi, GFP_KERNEL);
6518         } else if (rssi > high) {
6519                 brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6520                 cfg80211_cqm_rssi_notify(ifp->ndev,
6521                                          NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6522                                          rssi, GFP_KERNEL);
6523         }
6524
6525         return 0;
6526 }
6527
6528 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6529                                   const struct brcmf_event_msg *e, void *data)
6530 {
6531         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6532         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6533         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6534         struct brcmf_cfg80211_vif *vif;
6535
6536         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6537                   ifevent->action, ifevent->flags, ifevent->ifidx,
6538                   ifevent->bsscfgidx);
6539
6540         spin_lock(&event->vif_event_lock);
6541         event->action = ifevent->action;
6542         vif = event->vif;
6543
6544         switch (ifevent->action) {
6545         case BRCMF_E_IF_ADD:
6546                 /* waiting process may have timed out */
6547                 if (!cfg->vif_event.vif) {
6548                         spin_unlock(&event->vif_event_lock);
6549                         return -EBADF;
6550                 }
6551
6552                 ifp->vif = vif;
6553                 vif->ifp = ifp;
6554                 if (ifp->ndev) {
6555                         vif->wdev.netdev = ifp->ndev;
6556                         ifp->ndev->ieee80211_ptr = &vif->wdev;
6557                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6558                 }
6559                 spin_unlock(&event->vif_event_lock);
6560                 wake_up(&event->vif_wq);
6561                 return 0;
6562
6563         case BRCMF_E_IF_DEL:
6564                 spin_unlock(&event->vif_event_lock);
6565                 /* event may not be upon user request */
6566                 if (brcmf_cfg80211_vif_event_armed(cfg))
6567                         wake_up(&event->vif_wq);
6568                 return 0;
6569
6570         case BRCMF_E_IF_CHANGE:
6571                 spin_unlock(&event->vif_event_lock);
6572                 wake_up(&event->vif_wq);
6573                 return 0;
6574
6575         default:
6576                 spin_unlock(&event->vif_event_lock);
6577                 break;
6578         }
6579         return -EINVAL;
6580 }
6581
6582 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6583 {
6584         conf->frag_threshold = (u32)-1;
6585         conf->rts_threshold = (u32)-1;
6586         conf->retry_short = (u32)-1;
6587         conf->retry_long = (u32)-1;
6588 }
6589
6590 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6591 {
6592         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6593                             brcmf_notify_connect_status);
6594         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6595                             brcmf_notify_connect_status);
6596         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6597                             brcmf_notify_connect_status);
6598         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6599                             brcmf_notify_connect_status);
6600         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6601                             brcmf_notify_connect_status);
6602         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6603                             brcmf_notify_connect_status);
6604         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6605                             brcmf_notify_roaming_status);
6606         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6607                             brcmf_notify_mic_status);
6608         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6609                             brcmf_notify_connect_status);
6610         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6611                             brcmf_notify_sched_scan_results);
6612         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6613                             brcmf_notify_vif_event);
6614         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6615                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6616         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6617                             brcmf_p2p_notify_listen_complete);
6618         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6619                             brcmf_p2p_notify_action_frame_rx);
6620         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6621                             brcmf_p2p_notify_action_tx_complete);
6622         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6623                             brcmf_p2p_notify_action_tx_complete);
6624         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6625                             brcmf_notify_connect_status);
6626         brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6627 }
6628
6629 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6630 {
6631         kfree(cfg->conf);
6632         cfg->conf = NULL;
6633         kfree(cfg->extra_buf);
6634         cfg->extra_buf = NULL;
6635         kfree(cfg->wowl.nd);
6636         cfg->wowl.nd = NULL;
6637         kfree(cfg->wowl.nd_info);
6638         cfg->wowl.nd_info = NULL;
6639         kfree(cfg->escan_info.escan_buf);
6640         cfg->escan_info.escan_buf = NULL;
6641 }
6642
6643 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6644 {
6645         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6646         if (!cfg->conf)
6647                 goto init_priv_mem_out;
6648         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6649         if (!cfg->extra_buf)
6650                 goto init_priv_mem_out;
6651         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6652         if (!cfg->wowl.nd)
6653                 goto init_priv_mem_out;
6654         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6655                                     sizeof(struct cfg80211_wowlan_nd_match *),
6656                                     GFP_KERNEL);
6657         if (!cfg->wowl.nd_info)
6658                 goto init_priv_mem_out;
6659         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6660         if (!cfg->escan_info.escan_buf)
6661                 goto init_priv_mem_out;
6662
6663         return 0;
6664
6665 init_priv_mem_out:
6666         brcmf_deinit_priv_mem(cfg);
6667
6668         return -ENOMEM;
6669 }
6670
6671 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6672 {
6673         s32 err = 0;
6674
6675         cfg->scan_request = NULL;
6676         cfg->pwr_save = true;
6677         cfg->dongle_up = false;         /* dongle is not up yet */
6678         err = brcmf_init_priv_mem(cfg);
6679         if (err)
6680                 return err;
6681         brcmf_register_event_handlers(cfg);
6682         mutex_init(&cfg->usr_sync);
6683         brcmf_init_escan(cfg);
6684         brcmf_init_conf(cfg->conf);
6685         brcmf_init_wmm_prio(cfg->ac_priority);
6686         init_completion(&cfg->vif_disabled);
6687         return err;
6688 }
6689
6690 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6691 {
6692         cfg->dongle_up = false; /* dongle down */
6693         brcmf_abort_scanning(cfg);
6694         brcmf_deinit_priv_mem(cfg);
6695         brcmf_clear_assoc_ies(cfg);
6696 }
6697
6698 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6699 {
6700         init_waitqueue_head(&event->vif_wq);
6701         spin_lock_init(&event->vif_event_lock);
6702 }
6703
6704 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6705 {
6706         struct brcmf_pub *drvr = ifp->drvr;
6707         s32 err;
6708         u32 bcn_timeout;
6709         __le32 roamtrigger[2];
6710         __le32 roam_delta[2];
6711
6712         /* Configure beacon timeout value based upon roaming setting */
6713         if (ifp->drvr->settings->roamoff)
6714                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6715         else
6716                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6717         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6718         if (err) {
6719                 bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6720                 goto roam_setup_done;
6721         }
6722
6723         /* Enable/Disable built-in roaming to allow supplicant to take care of
6724          * roaming.
6725          */
6726         brcmf_dbg(INFO, "Internal Roaming = %s\n",
6727                   ifp->drvr->settings->roamoff ? "Off" : "On");
6728         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6729                                       ifp->drvr->settings->roamoff);
6730         if (err) {
6731                 bphy_err(drvr, "roam_off error (%d)\n", err);
6732                 goto roam_setup_done;
6733         }
6734
6735         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6736         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6737         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6738                                      (void *)roamtrigger, sizeof(roamtrigger));
6739         if (err)
6740                 bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6741
6742         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6743         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6744         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6745                                      (void *)roam_delta, sizeof(roam_delta));
6746         if (err)
6747                 bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6748
6749         return 0;
6750
6751 roam_setup_done:
6752         return err;
6753 }
6754
6755 static s32
6756 brcmf_dongle_scantime(struct brcmf_if *ifp)
6757 {
6758         struct brcmf_pub *drvr = ifp->drvr;
6759         s32 err = 0;
6760
6761         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6762                                     BRCMF_SCAN_CHANNEL_TIME);
6763         if (err) {
6764                 bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6765                 goto dongle_scantime_out;
6766         }
6767         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6768                                     BRCMF_SCAN_UNASSOC_TIME);
6769         if (err) {
6770                 bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6771                 goto dongle_scantime_out;
6772         }
6773
6774         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6775                                     BRCMF_SCAN_PASSIVE_TIME);
6776         if (err) {
6777                 bphy_err(drvr, "Scan passive time error (%d)\n", err);
6778                 goto dongle_scantime_out;
6779         }
6780
6781 dongle_scantime_out:
6782         return err;
6783 }
6784
6785 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6786                                            struct brcmu_chan *ch)
6787 {
6788         u32 ht40_flag;
6789
6790         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6791         if (ch->sb == BRCMU_CHAN_SB_U) {
6792                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6793                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6794                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6795         } else {
6796                 /* It should be one of
6797                  * IEEE80211_CHAN_NO_HT40 or
6798                  * IEEE80211_CHAN_NO_HT40PLUS
6799                  */
6800                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6801                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6802                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6803         }
6804 }
6805
6806 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6807                                     u32 bw_cap[])
6808 {
6809         struct wiphy *wiphy = cfg_to_wiphy(cfg);
6810         struct brcmf_pub *drvr = cfg->pub;
6811         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6812         struct ieee80211_supported_band *band;
6813         struct ieee80211_channel *channel;
6814         struct brcmf_chanspec_list *list;
6815         struct brcmu_chan ch;
6816         int err;
6817         u8 *pbuf;
6818         u32 i, j;
6819         u32 total;
6820         u32 chaninfo;
6821
6822         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6823
6824         if (pbuf == NULL)
6825                 return -ENOMEM;
6826
6827         list = (struct brcmf_chanspec_list *)pbuf;
6828
6829         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6830                                        BRCMF_DCMD_MEDLEN);
6831         if (err) {
6832                 bphy_err(drvr, "get chanspecs error (%d)\n", err);
6833                 goto fail_pbuf;
6834         }
6835
6836         band = wiphy->bands[NL80211_BAND_2GHZ];
6837         if (band)
6838                 for (i = 0; i < band->n_channels; i++)
6839                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6840         band = wiphy->bands[NL80211_BAND_5GHZ];
6841         if (band)
6842                 for (i = 0; i < band->n_channels; i++)
6843                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6844
6845         total = le32_to_cpu(list->count);
6846         if (total > BRCMF_MAX_CHANSPEC_LIST) {
6847                 bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6848                          total);
6849                 err = -EINVAL;
6850                 goto fail_pbuf;
6851         }
6852
6853         for (i = 0; i < total; i++) {
6854                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
6855                 cfg->d11inf.decchspec(&ch);
6856
6857                 if (ch.band == BRCMU_CHAN_BAND_2G) {
6858                         band = wiphy->bands[NL80211_BAND_2GHZ];
6859                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
6860                         band = wiphy->bands[NL80211_BAND_5GHZ];
6861                 } else {
6862                         bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
6863                                  ch.chspec);
6864                         continue;
6865                 }
6866                 if (!band)
6867                         continue;
6868                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6869                     ch.bw == BRCMU_CHAN_BW_40)
6870                         continue;
6871                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6872                     ch.bw == BRCMU_CHAN_BW_80)
6873                         continue;
6874
6875                 channel = NULL;
6876                 for (j = 0; j < band->n_channels; j++) {
6877                         if (band->channels[j].hw_value == ch.control_ch_num) {
6878                                 channel = &band->channels[j];
6879                                 break;
6880                         }
6881                 }
6882                 if (!channel) {
6883                         /* It seems firmware supports some channel we never
6884                          * considered. Something new in IEEE standard?
6885                          */
6886                         bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
6887                                  ch.control_ch_num);
6888                         continue;
6889                 }
6890
6891                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
6892                         continue;
6893
6894                 /* assuming the chanspecs order is HT20,
6895                  * HT40 upper, HT40 lower, and VHT80.
6896                  */
6897                 switch (ch.bw) {
6898                 case BRCMU_CHAN_BW_160:
6899                         channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
6900                         break;
6901                 case BRCMU_CHAN_BW_80:
6902                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6903                         break;
6904                 case BRCMU_CHAN_BW_40:
6905                         brcmf_update_bw40_channel_flag(channel, &ch);
6906                         break;
6907                 default:
6908                         wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
6909                                    ch.bw);
6910                         fallthrough;
6911                 case BRCMU_CHAN_BW_20:
6912                         /* enable the channel and disable other bandwidths
6913                          * for now as mentioned order assure they are enabled
6914                          * for subsequent chanspecs.
6915                          */
6916                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6917                                          IEEE80211_CHAN_NO_80MHZ |
6918                                          IEEE80211_CHAN_NO_160MHZ;
6919                         ch.bw = BRCMU_CHAN_BW_20;
6920                         cfg->d11inf.encchspec(&ch);
6921                         chaninfo = ch.chspec;
6922                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6923                                                        &chaninfo);
6924                         if (!err) {
6925                                 if (chaninfo & WL_CHAN_RADAR)
6926                                         channel->flags |=
6927                                                 (IEEE80211_CHAN_RADAR |
6928                                                  IEEE80211_CHAN_NO_IR);
6929                                 if (chaninfo & WL_CHAN_PASSIVE)
6930                                         channel->flags |=
6931                                                 IEEE80211_CHAN_NO_IR;
6932                         }
6933                 }
6934         }
6935
6936 fail_pbuf:
6937         kfree(pbuf);
6938         return err;
6939 }
6940
6941 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6942 {
6943         struct brcmf_pub *drvr = cfg->pub;
6944         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6945         struct ieee80211_supported_band *band;
6946         struct brcmf_fil_bwcap_le band_bwcap;
6947         struct brcmf_chanspec_list *list;
6948         u8 *pbuf;
6949         u32 val;
6950         int err;
6951         struct brcmu_chan ch;
6952         u32 num_chan;
6953         int i, j;
6954
6955         /* verify support for bw_cap command */
6956         val = WLC_BAND_5G;
6957         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6958
6959         if (!err) {
6960                 /* only set 2G bandwidth using bw_cap command */
6961                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6962                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6963                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6964                                                sizeof(band_bwcap));
6965         } else {
6966                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6967                 val = WLC_N_BW_40ALL;
6968                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6969         }
6970
6971         if (!err) {
6972                 /* update channel info in 2G band */
6973                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6974
6975                 if (pbuf == NULL)
6976                         return -ENOMEM;
6977
6978                 ch.band = BRCMU_CHAN_BAND_2G;
6979                 ch.bw = BRCMU_CHAN_BW_40;
6980                 ch.sb = BRCMU_CHAN_SB_NONE;
6981                 ch.chnum = 0;
6982                 cfg->d11inf.encchspec(&ch);
6983
6984                 /* pass encoded chanspec in query */
6985                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6986
6987                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6988                                                BRCMF_DCMD_MEDLEN);
6989                 if (err) {
6990                         bphy_err(drvr, "get chanspecs error (%d)\n", err);
6991                         kfree(pbuf);
6992                         return err;
6993                 }
6994
6995                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6996                 list = (struct brcmf_chanspec_list *)pbuf;
6997                 num_chan = le32_to_cpu(list->count);
6998                 if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
6999                         bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7000                                  num_chan);
7001                         kfree(pbuf);
7002                         return -EINVAL;
7003                 }
7004
7005                 for (i = 0; i < num_chan; i++) {
7006                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
7007                         cfg->d11inf.decchspec(&ch);
7008                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7009                                 continue;
7010                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7011                                 continue;
7012                         for (j = 0; j < band->n_channels; j++) {
7013                                 if (band->channels[j].hw_value == ch.control_ch_num)
7014                                         break;
7015                         }
7016                         if (WARN_ON(j == band->n_channels))
7017                                 continue;
7018
7019                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7020                 }
7021                 kfree(pbuf);
7022         }
7023         return err;
7024 }
7025
7026 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7027 {
7028         struct brcmf_pub *drvr = ifp->drvr;
7029         u32 band, mimo_bwcap;
7030         int err;
7031
7032         band = WLC_BAND_2G;
7033         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7034         if (!err) {
7035                 bw_cap[NL80211_BAND_2GHZ] = band;
7036                 band = WLC_BAND_5G;
7037                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7038                 if (!err) {
7039                         bw_cap[NL80211_BAND_5GHZ] = band;
7040                         return;
7041                 }
7042                 WARN_ON(1);
7043                 return;
7044         }
7045         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7046         mimo_bwcap = 0;
7047         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7048         if (err)
7049                 /* assume 20MHz if firmware does not give a clue */
7050                 mimo_bwcap = WLC_N_BW_20ALL;
7051
7052         switch (mimo_bwcap) {
7053         case WLC_N_BW_40ALL:
7054                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7055                 fallthrough;
7056         case WLC_N_BW_20IN2G_40IN5G:
7057                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7058                 fallthrough;
7059         case WLC_N_BW_20ALL:
7060                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7061                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7062                 break;
7063         default:
7064                 bphy_err(drvr, "invalid mimo_bw_cap value\n");
7065         }
7066 }
7067
7068 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7069                                 u32 bw_cap[2], u32 nchain)
7070 {
7071         band->ht_cap.ht_supported = true;
7072         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7073                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7074                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7075         }
7076         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7077         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7078         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7079         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7080         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7081         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7082 }
7083
7084 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7085 {
7086         u16 mcs_map;
7087         int i;
7088
7089         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7090                 mcs_map = (mcs_map << 2) | supp;
7091
7092         return cpu_to_le16(mcs_map);
7093 }
7094
7095 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7096                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
7097                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7098 {
7099         __le16 mcs_map;
7100
7101         /* not allowed in 2.4G band */
7102         if (band->band == NL80211_BAND_2GHZ)
7103                 return;
7104
7105         band->vht_cap.vht_supported = true;
7106         /* 80MHz is mandatory */
7107         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7108         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7109                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7110                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7111         }
7112         /* all support 256-QAM */
7113         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7114         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7115         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7116
7117         /* Beamforming support information */
7118         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7119                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7120         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7121                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7122         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7123                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7124         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7125                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7126
7127         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7128                 band->vht_cap.cap |=
7129                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7130                 band->vht_cap.cap |= ((txstreams - 1) <<
7131                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7132                 band->vht_cap.cap |=
7133                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7134         }
7135 }
7136
7137 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7138 {
7139         struct brcmf_pub *drvr = cfg->pub;
7140         struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7141         struct wiphy *wiphy = cfg_to_wiphy(cfg);
7142         u32 nmode = 0;
7143         u32 vhtmode = 0;
7144         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7145         u32 rxchain;
7146         u32 nchain;
7147         int err;
7148         s32 i;
7149         struct ieee80211_supported_band *band;
7150         u32 txstreams = 0;
7151         u32 txbf_bfe_cap = 0;
7152         u32 txbf_bfr_cap = 0;
7153
7154         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7155         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7156         if (err) {
7157                 bphy_err(drvr, "nmode error (%d)\n", err);
7158         } else {
7159                 brcmf_get_bwcap(ifp, bw_cap);
7160         }
7161         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7162                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7163                   bw_cap[NL80211_BAND_5GHZ]);
7164
7165         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7166         if (err) {
7167                 /* rxchain unsupported by firmware of older chips */
7168                 if (err == -EBADE)
7169                         bphy_info_once(drvr, "rxchain unsupported\n");
7170                 else
7171                         bphy_err(drvr, "rxchain error (%d)\n", err);
7172
7173                 nchain = 1;
7174         } else {
7175                 for (nchain = 0; rxchain; nchain++)
7176                         rxchain = rxchain & (rxchain - 1);
7177         }
7178         brcmf_dbg(INFO, "nchain=%d\n", nchain);
7179
7180         err = brcmf_construct_chaninfo(cfg, bw_cap);
7181         if (err) {
7182                 bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7183                 return err;
7184         }
7185
7186         if (vhtmode) {
7187                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7188                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7189                                               &txbf_bfe_cap);
7190                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7191                                               &txbf_bfr_cap);
7192         }
7193
7194         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7195                 band = wiphy->bands[i];
7196                 if (band == NULL)
7197                         continue;
7198
7199                 if (nmode)
7200                         brcmf_update_ht_cap(band, bw_cap, nchain);
7201                 if (vhtmode)
7202                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7203                                              txbf_bfe_cap, txbf_bfr_cap);
7204         }
7205
7206         return 0;
7207 }
7208
7209 static const struct ieee80211_txrx_stypes
7210 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7211         [NL80211_IFTYPE_STATION] = {
7212                 .tx = 0xffff,
7213                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7214                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7215         },
7216         [NL80211_IFTYPE_P2P_CLIENT] = {
7217                 .tx = 0xffff,
7218                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7219                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7220         },
7221         [NL80211_IFTYPE_P2P_GO] = {
7222                 .tx = 0xffff,
7223                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7224                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7225                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7226                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7227                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7228                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7229                       BIT(IEEE80211_STYPE_ACTION >> 4)
7230         },
7231         [NL80211_IFTYPE_P2P_DEVICE] = {
7232                 .tx = 0xffff,
7233                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7234                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7235         },
7236         [NL80211_IFTYPE_AP] = {
7237                 .tx = 0xffff,
7238                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7239                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7240                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7241                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7242                       BIT(IEEE80211_STYPE_AUTH >> 4) |
7243                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7244                       BIT(IEEE80211_STYPE_ACTION >> 4)
7245         }
7246 };
7247
7248 /**
7249  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7250  *
7251  * @wiphy: wiphy object.
7252  * @ifp: interface object needed for feat module api.
7253  *
7254  * The interface modes and combinations are determined dynamically here
7255  * based on firmware functionality.
7256  *
7257  * no p2p and no mbss:
7258  *
7259  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7260  *
7261  * no p2p and mbss:
7262  *
7263  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
7264  *      #AP <= 4, matching BI, channels = 1, 4 total
7265  *
7266  * no p2p and rsdb:
7267  *      #STA <= 1, #AP <= 2, channels = 2, 4 total
7268  *
7269  * p2p, no mchan, and mbss:
7270  *
7271  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7272  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7273  *      #AP <= 4, matching BI, channels = 1, 4 total
7274  *
7275  * p2p, mchan, and mbss:
7276  *
7277  *      #STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7278  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7279  *      #AP <= 4, matching BI, channels = 1, 4 total
7280  *
7281  * p2p, rsdb, and no mbss:
7282  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7283  *       channels = 2, 4 total
7284  */
7285 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7286 {
7287         struct ieee80211_iface_combination *combo = NULL;
7288         struct ieee80211_iface_limit *c0_limits = NULL;
7289         struct ieee80211_iface_limit *p2p_limits = NULL;
7290         struct ieee80211_iface_limit *mbss_limits = NULL;
7291         bool mon_flag, mbss, p2p, rsdb, mchan;
7292         int i, c, n_combos, n_limits;
7293
7294         mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7295         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7296         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7297         rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7298         mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7299
7300         n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7301         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7302         if (!combo)
7303                 goto err;
7304
7305         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7306                                  BIT(NL80211_IFTYPE_ADHOC) |
7307                                  BIT(NL80211_IFTYPE_AP);
7308         if (mon_flag)
7309                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7310         if (p2p)
7311                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7312                                           BIT(NL80211_IFTYPE_P2P_GO) |
7313                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
7314
7315         c = 0;
7316         i = 0;
7317         n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7318         c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7319         if (!c0_limits)
7320                 goto err;
7321
7322         combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7323         c0_limits[i].max = 1 + (p2p && mchan);
7324         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7325         if (mon_flag) {
7326                 c0_limits[i].max = 1;
7327                 c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7328         }
7329         if (p2p) {
7330                 c0_limits[i].max = 1;
7331                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7332                 c0_limits[i].max = 1 + rsdb;
7333                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7334                                        BIT(NL80211_IFTYPE_P2P_GO);
7335         }
7336         if (p2p && rsdb) {
7337                 c0_limits[i].max = 2;
7338                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7339                 combo[c].max_interfaces = 4;
7340         } else if (p2p) {
7341                 combo[c].max_interfaces = i;
7342         } else if (rsdb) {
7343                 c0_limits[i].max = 2;
7344                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7345                 combo[c].max_interfaces = 3;
7346         } else {
7347                 c0_limits[i].max = 1;
7348                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7349                 combo[c].max_interfaces = i;
7350         }
7351         combo[c].n_limits = i;
7352         combo[c].limits = c0_limits;
7353
7354         if (p2p && !rsdb) {
7355                 c++;
7356                 i = 0;
7357                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7358                 if (!p2p_limits)
7359                         goto err;
7360                 p2p_limits[i].max = 1;
7361                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7362                 p2p_limits[i].max = 1;
7363                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7364                 p2p_limits[i].max = 1;
7365                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7366                 p2p_limits[i].max = 1;
7367                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7368                 combo[c].num_different_channels = 1;
7369                 combo[c].max_interfaces = i;
7370                 combo[c].n_limits = i;
7371                 combo[c].limits = p2p_limits;
7372         }
7373
7374         if (mbss) {
7375                 c++;
7376                 i = 0;
7377                 n_limits = 1 + mon_flag;
7378                 mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7379                                       GFP_KERNEL);
7380                 if (!mbss_limits)
7381                         goto err;
7382                 mbss_limits[i].max = 4;
7383                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7384                 if (mon_flag) {
7385                         mbss_limits[i].max = 1;
7386                         mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7387                 }
7388                 combo[c].beacon_int_infra_match = true;
7389                 combo[c].num_different_channels = 1;
7390                 combo[c].max_interfaces = 4 + mon_flag;
7391                 combo[c].n_limits = i;
7392                 combo[c].limits = mbss_limits;
7393         }
7394
7395         wiphy->n_iface_combinations = n_combos;
7396         wiphy->iface_combinations = combo;
7397         return 0;
7398
7399 err:
7400         kfree(c0_limits);
7401         kfree(p2p_limits);
7402         kfree(mbss_limits);
7403         kfree(combo);
7404         return -ENOMEM;
7405 }
7406
7407 #ifdef CONFIG_PM
7408 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7409         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7410         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
7411         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7412         .pattern_min_len = 1,
7413         .max_pkt_offset = 1500,
7414 };
7415 #endif
7416
7417 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7418 {
7419 #ifdef CONFIG_PM
7420         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7421         struct brcmf_pub *drvr = cfg->pub;
7422         struct wiphy_wowlan_support *wowl;
7423
7424         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7425                        GFP_KERNEL);
7426         if (!wowl) {
7427                 bphy_err(drvr, "only support basic wowlan features\n");
7428                 wiphy->wowlan = &brcmf_wowlan_support;
7429                 return;
7430         }
7431
7432         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7433                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7434                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7435                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7436                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
7437                 }
7438         }
7439         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7440                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7441                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7442         }
7443
7444         wiphy->wowlan = wowl;
7445 #endif
7446 }
7447
7448 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7449 {
7450         struct brcmf_pub *drvr = ifp->drvr;
7451         const struct ieee80211_iface_combination *combo;
7452         struct ieee80211_supported_band *band;
7453         u16 max_interfaces = 0;
7454         bool gscan;
7455         __le32 bandlist[3];
7456         u32 n_bands;
7457         int err, i;
7458
7459         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7460         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7461         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7462
7463         err = brcmf_setup_ifmodes(wiphy, ifp);
7464         if (err)
7465                 return err;
7466
7467         for (i = 0, combo = wiphy->iface_combinations;
7468              i < wiphy->n_iface_combinations; i++, combo++) {
7469                 max_interfaces = max(max_interfaces, combo->max_interfaces);
7470         }
7471
7472         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7473              i++) {
7474                 u8 *addr = drvr->addresses[i].addr;
7475
7476                 memcpy(addr, drvr->mac, ETH_ALEN);
7477                 if (i) {
7478                         addr[0] |= BIT(1);
7479                         addr[ETH_ALEN - 1] ^= i;
7480                 }
7481         }
7482         wiphy->addresses = drvr->addresses;
7483         wiphy->n_addresses = i;
7484
7485         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7486         wiphy->cipher_suites = brcmf_cipher_suites;
7487         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7488         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7489                 wiphy->n_cipher_suites--;
7490         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7491                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7492                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7493
7494         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7495                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
7496                         WIPHY_FLAG_HAVE_AP_SME |
7497                         WIPHY_FLAG_OFFCHAN_TX |
7498                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7499         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7500                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7501         if (!ifp->drvr->settings->roamoff)
7502                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7503         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7504                 wiphy_ext_feature_set(wiphy,
7505                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7506                 wiphy_ext_feature_set(wiphy,
7507                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7508                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7509                         wiphy_ext_feature_set(wiphy,
7510                                               NL80211_EXT_FEATURE_SAE_OFFLOAD);
7511         }
7512         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7513                 wiphy_ext_feature_set(wiphy,
7514                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7515                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7516                         wiphy_ext_feature_set(wiphy,
7517                                               NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7518         }
7519         wiphy->mgmt_stypes = brcmf_txrx_stypes;
7520         wiphy->max_remain_on_channel_duration = 5000;
7521         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7522                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7523                 brcmf_pno_wiphy_params(wiphy, gscan);
7524         }
7525         /* vendor commands/events support */
7526         wiphy->vendor_commands = brcmf_vendor_cmds;
7527         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7528
7529         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7530                 brcmf_wiphy_wowl_params(wiphy, ifp);
7531         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7532                                      sizeof(bandlist));
7533         if (err) {
7534                 bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7535                 return err;
7536         }
7537         /* first entry in bandlist is number of bands */
7538         n_bands = le32_to_cpu(bandlist[0]);
7539         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7540                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7541                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7542                                        GFP_KERNEL);
7543                         if (!band)
7544                                 return -ENOMEM;
7545
7546                         band->channels = kmemdup(&__wl_2ghz_channels,
7547                                                  sizeof(__wl_2ghz_channels),
7548                                                  GFP_KERNEL);
7549                         if (!band->channels) {
7550                                 kfree(band);
7551                                 return -ENOMEM;
7552                         }
7553
7554                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7555                         wiphy->bands[NL80211_BAND_2GHZ] = band;
7556                 }
7557                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7558                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7559                                        GFP_KERNEL);
7560                         if (!band)
7561                                 return -ENOMEM;
7562
7563                         band->channels = kmemdup(&__wl_5ghz_channels,
7564                                                  sizeof(__wl_5ghz_channels),
7565                                                  GFP_KERNEL);
7566                         if (!band->channels) {
7567                                 kfree(band);
7568                                 return -ENOMEM;
7569                         }
7570
7571                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7572                         wiphy->bands[NL80211_BAND_5GHZ] = band;
7573                 }
7574         }
7575
7576         if (wiphy->bands[NL80211_BAND_5GHZ] &&
7577             brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7578                 wiphy_ext_feature_set(wiphy,
7579                                       NL80211_EXT_FEATURE_DFS_OFFLOAD);
7580
7581         wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7582
7583         wiphy_read_of_freq_limits(wiphy);
7584
7585         return 0;
7586 }
7587
7588 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7589 {
7590         struct brcmf_pub *drvr = cfg->pub;
7591         struct net_device *ndev;
7592         struct wireless_dev *wdev;
7593         struct brcmf_if *ifp;
7594         s32 power_mode;
7595         s32 err = 0;
7596
7597         if (cfg->dongle_up)
7598                 return err;
7599
7600         ndev = cfg_to_ndev(cfg);
7601         wdev = ndev->ieee80211_ptr;
7602         ifp = netdev_priv(ndev);
7603
7604         /* make sure RF is ready for work */
7605         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7606
7607         brcmf_dongle_scantime(ifp);
7608
7609         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7610         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7611         if (err)
7612                 goto default_conf_out;
7613         brcmf_dbg(INFO, "power save set to %s\n",
7614                   (power_mode ? "enabled" : "disabled"));
7615
7616         err = brcmf_dongle_roam(ifp);
7617         if (err)
7618                 goto default_conf_out;
7619         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7620                                           NULL);
7621         if (err)
7622                 goto default_conf_out;
7623
7624         brcmf_configure_arp_nd_offload(ifp, true);
7625
7626         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7627         if (err) {
7628                 bphy_err(drvr, "failed to set frameburst mode\n");
7629                 goto default_conf_out;
7630         }
7631
7632         cfg->dongle_up = true;
7633 default_conf_out:
7634
7635         return err;
7636
7637 }
7638
7639 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7640 {
7641         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7642
7643         return brcmf_config_dongle(ifp->drvr->config);
7644 }
7645
7646 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7647 {
7648         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7649
7650         /*
7651          * While going down, if associated with AP disassociate
7652          * from AP to save power
7653          */
7654         if (check_vif_up(ifp->vif)) {
7655                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7656
7657                 /* Make sure WPA_Supplicant receives all the event
7658                    generated due to DISASSOC call to the fw to keep
7659                    the state fw and WPA_Supplicant state consistent
7660                  */
7661                 brcmf_delay(500);
7662         }
7663
7664         brcmf_abort_scanning(cfg);
7665         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7666
7667         return 0;
7668 }
7669
7670 s32 brcmf_cfg80211_up(struct net_device *ndev)
7671 {
7672         struct brcmf_if *ifp = netdev_priv(ndev);
7673         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7674         s32 err = 0;
7675
7676         mutex_lock(&cfg->usr_sync);
7677         err = __brcmf_cfg80211_up(ifp);
7678         mutex_unlock(&cfg->usr_sync);
7679
7680         return err;
7681 }
7682
7683 s32 brcmf_cfg80211_down(struct net_device *ndev)
7684 {
7685         struct brcmf_if *ifp = netdev_priv(ndev);
7686         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7687         s32 err = 0;
7688
7689         mutex_lock(&cfg->usr_sync);
7690         err = __brcmf_cfg80211_down(ifp);
7691         mutex_unlock(&cfg->usr_sync);
7692
7693         return err;
7694 }
7695
7696 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7697 {
7698         struct wireless_dev *wdev = &ifp->vif->wdev;
7699
7700         return wdev->iftype;
7701 }
7702
7703 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7704                              unsigned long state)
7705 {
7706         struct brcmf_cfg80211_vif *vif;
7707
7708         list_for_each_entry(vif, &cfg->vif_list, list) {
7709                 if (test_bit(state, &vif->sme_state))
7710                         return true;
7711         }
7712         return false;
7713 }
7714
7715 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7716                                     u8 action)
7717 {
7718         u8 evt_action;
7719
7720         spin_lock(&event->vif_event_lock);
7721         evt_action = event->action;
7722         spin_unlock(&event->vif_event_lock);
7723         return evt_action == action;
7724 }
7725
7726 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7727                                   struct brcmf_cfg80211_vif *vif)
7728 {
7729         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7730
7731         spin_lock(&event->vif_event_lock);
7732         event->vif = vif;
7733         event->action = 0;
7734         spin_unlock(&event->vif_event_lock);
7735 }
7736
7737 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7738 {
7739         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7740         bool armed;
7741
7742         spin_lock(&event->vif_event_lock);
7743         armed = event->vif != NULL;
7744         spin_unlock(&event->vif_event_lock);
7745
7746         return armed;
7747 }
7748
7749 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7750                                   u8 action, ulong timeout)
7751 {
7752         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7753
7754         return wait_event_timeout(event->vif_wq,
7755                                   vif_event_equals(event, action), timeout);
7756 }
7757
7758 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
7759 {
7760         if (drvr->settings->trivial_ccode_map)
7761                 return true;
7762
7763         switch (drvr->bus_if->chip) {
7764         case BRCM_CC_43430_CHIP_ID:
7765         case BRCM_CC_4345_CHIP_ID:
7766         case BRCM_CC_43602_CHIP_ID:
7767                 return true;
7768         default:
7769                 return false;
7770         }
7771 }
7772
7773 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7774                                         struct brcmf_fil_country_le *ccreq)
7775 {
7776         struct brcmfmac_pd_cc *country_codes;
7777         struct brcmfmac_pd_cc_entry *cc;
7778         s32 found_index;
7779         int i;
7780
7781         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7782             (alpha2[1] == ccreq->country_abbrev[1])) {
7783                 brcmf_dbg(TRACE, "Country code already set\n");
7784                 return -EAGAIN;
7785         }
7786
7787         country_codes = drvr->settings->country_codes;
7788         if (!country_codes) {
7789                 if (brmcf_use_iso3166_ccode_fallback(drvr)) {
7790                         brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
7791                         memset(ccreq, 0, sizeof(*ccreq));
7792                         ccreq->country_abbrev[0] = alpha2[0];
7793                         ccreq->country_abbrev[1] = alpha2[1];
7794                         ccreq->ccode[0] = alpha2[0];
7795                         ccreq->ccode[1] = alpha2[1];
7796                         return 0;
7797                 }
7798
7799                 brcmf_dbg(TRACE, "No country codes configured for device\n");
7800                 return -EINVAL;
7801         }
7802
7803         found_index = -1;
7804         for (i = 0; i < country_codes->table_size; i++) {
7805                 cc = &country_codes->table[i];
7806                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
7807                         found_index = i;
7808                 if ((cc->iso3166[0] == alpha2[0]) &&
7809                     (cc->iso3166[1] == alpha2[1])) {
7810                         found_index = i;
7811                         break;
7812                 }
7813         }
7814         if (found_index == -1) {
7815                 brcmf_dbg(TRACE, "No country code match found\n");
7816                 return -EINVAL;
7817         }
7818         memset(ccreq, 0, sizeof(*ccreq));
7819         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7820         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7821                BRCMF_COUNTRY_BUF_SZ);
7822         ccreq->country_abbrev[0] = alpha2[0];
7823         ccreq->country_abbrev[1] = alpha2[1];
7824         ccreq->country_abbrev[2] = 0;
7825
7826         return 0;
7827 }
7828
7829 static int
7830 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
7831 {
7832         int i;
7833         char *token;
7834         char delim[] = "\n ";
7835         unsigned long val;
7836         int err = 0;
7837
7838         token = strsep(&buf, delim);
7839         while (token) {
7840                 if (!strcmp(token, "OBSS")) {
7841                         for (i = 0; i < OBSS_TOKEN_IDX; i++)
7842                                 token = strsep(&buf, delim);
7843                         err = kstrtoul(token, 10, &val);
7844                         if (err)
7845                                 break;
7846                         survey->obss = val;
7847                 }
7848
7849                 if (!strcmp(token, "IBSS")) {
7850                         for (i = 0; i < IBSS_TOKEN_IDX; i++)
7851                                 token = strsep(&buf, delim);
7852                         err = kstrtoul(token, 10, &val);
7853                         if (err)
7854                                 break;
7855                         survey->ibss = val;
7856                 }
7857
7858                 if (!strcmp(token, "TXDur")) {
7859                         for (i = 0; i < TX_TOKEN_IDX; i++)
7860                                 token = strsep(&buf, delim);
7861                         err = kstrtoul(token, 10, &val);
7862                         if (err)
7863                                 break;
7864                         survey->tx = val;
7865                 }
7866
7867                 if (!strcmp(token, "Category")) {
7868                         for (i = 0; i < CTG_TOKEN_IDX; i++)
7869                                 token = strsep(&buf, delim);
7870                         err = kstrtoul(token, 10, &val);
7871                         if (err)
7872                                 break;
7873                         survey->no_ctg = val;
7874                 }
7875
7876                 if (!strcmp(token, "Packet")) {
7877                         for (i = 0; i < PKT_TOKEN_IDX; i++)
7878                                 token = strsep(&buf, delim);
7879                         err = kstrtoul(token, 10, &val);
7880                         if (err)
7881                                 break;
7882                         survey->no_pckt = val;
7883                 }
7884
7885                 if (!strcmp(token, "Opp(time):")) {
7886                         for (i = 0; i < IDLE_TOKEN_IDX; i++)
7887                                 token = strsep(&buf, delim);
7888                         err = kstrtoul(token, 10, &val);
7889                         if (err)
7890                                 break;
7891                         survey->idle = val;
7892                 }
7893
7894                 token = strsep(&buf, delim);
7895         }
7896
7897         return err;
7898 }
7899
7900 static int
7901 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
7902                 struct brcmf_dump_survey *survey)
7903 {
7904         struct cca_stats_n_flags *results;
7905         char *buf;
7906         int err;
7907
7908         buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7909         if (!buf)
7910                 return -ENOMEM;
7911
7912         memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
7913         err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
7914                                        buf, BRCMF_DCMD_MEDLEN);
7915         if (err) {
7916                 brcmf_err("dump_obss error (%d)\n", err);
7917                 err = -EINVAL;
7918                 goto exit;
7919         }
7920         results = (struct cca_stats_n_flags *)(buf);
7921
7922         if (req.msrmnt_query)
7923                 brcmf_parse_dump_obss(results->buf, survey);
7924
7925 exit:
7926         kfree(buf);
7927         return err;
7928 }
7929
7930 static s32
7931 cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
7932                      struct ieee80211_channel *chan,
7933                      enum nl80211_channel_type channel_type)
7934 {
7935         u16 chspec = 0;
7936         int err = 0;
7937         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7938         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
7939
7940         /* set_channel */
7941         chspec = channel_to_chanspec(&cfg->d11inf, chan);
7942         if (chspec != INVCHANSPEC) {
7943                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
7944                 if (err) {
7945                         brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
7946                         err = -EINVAL;
7947                 }
7948         } else {
7949                 brcmf_err("failed to convert host chanspec to fw chanspec\n");
7950                 err = -EINVAL;
7951         }
7952
7953         return err;
7954 }
7955
7956 static int
7957 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
7958                            int idx, struct survey_info *info)
7959 {
7960         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7961         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
7962         struct brcmf_dump_survey survey = {};
7963         struct ieee80211_supported_band *band;
7964         struct ieee80211_channel *chan;
7965         struct cca_msrmnt_query req;
7966         u32 noise;
7967         int err;
7968
7969         brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
7970
7971         /* Do not run survey when VIF in CONNECTING / CONNECTED states */
7972         if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
7973             (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
7974                 return -EBUSY;
7975         }
7976
7977         band = wiphy->bands[NL80211_BAND_2GHZ];
7978         if (band && idx >= band->n_channels) {
7979                 idx -= band->n_channels;
7980                 band = NULL;
7981         }
7982
7983         if (!band || idx >= band->n_channels) {
7984                 band = wiphy->bands[NL80211_BAND_5GHZ];
7985                 if (idx >= band->n_channels)
7986                         return -ENOENT;
7987         }
7988
7989         /* Setting current channel to the requested channel */
7990         chan = &band->channels[idx];
7991         err = cfg80211_set_channel(wiphy, ndev, chan, NL80211_CHAN_HT20);
7992         if (err) {
7993                 info->channel = chan;
7994                 info->filled = 0;
7995                 return 0;
7996         }
7997
7998         /* Disable mpc */
7999         brcmf_set_mpc(ifp, 0);
8000
8001         /* Set interface up, explicitly. */
8002         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8003         if (err) {
8004                 brcmf_err("set interface up failed, err = %d\n", err);
8005                 goto exit;
8006         }
8007
8008         /* Get noise value */
8009         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8010         if (err) {
8011                 brcmf_err("Get Phy Noise failed, use dummy value\n");
8012                 noise = CHAN_NOISE_DUMMY;
8013         }
8014
8015         /* Start Measurement for obss stats on current channel */
8016         req.msrmnt_query = 0;
8017         req.time_req = ACS_MSRMNT_DELAY;
8018         err = brcmf_dump_obss(ifp, req, &survey);
8019         if (err)
8020                 goto exit;
8021
8022         /* Add 10 ms for IOVAR completion */
8023         msleep(ACS_MSRMNT_DELAY + 10);
8024
8025         /* Issue IOVAR to collect measurement results */
8026         req.msrmnt_query = 1;
8027         err = brcmf_dump_obss(ifp, req, &survey);
8028         if (err)
8029                 goto exit;
8030
8031         info->channel = chan;
8032         info->noise = noise;
8033         info->time = ACS_MSRMNT_DELAY;
8034         info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8035         info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8036                 survey.no_pckt;
8037         info->time_tx = survey.tx;
8038         info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8039                 SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8040                 SURVEY_INFO_TIME_TX;
8041
8042         brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8043                   ieee80211_frequency_to_channel(chan->center_freq),
8044                   ACS_MSRMNT_DELAY);
8045         brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8046                   info->noise, info->time_busy, info->time_rx, info->time_tx);
8047
8048 exit:
8049         if (!brcmf_is_apmode(ifp->vif))
8050                 brcmf_set_mpc(ifp, 1);
8051         return err;
8052 }
8053
8054 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8055                                         struct regulatory_request *req)
8056 {
8057         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8058         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8059         struct brcmf_pub *drvr = cfg->pub;
8060         struct brcmf_fil_country_le ccreq;
8061         s32 err;
8062         int i;
8063
8064         /* The country code gets set to "00" by default at boot, ignore */
8065         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
8066                 return;
8067
8068         /* ignore non-ISO3166 country codes */
8069         for (i = 0; i < 2; i++)
8070                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
8071                         bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8072                                  req->alpha2[0], req->alpha2[1]);
8073                         return;
8074                 }
8075
8076         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8077                   req->alpha2[0], req->alpha2[1]);
8078
8079         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8080         if (err) {
8081                 bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8082                 return;
8083         }
8084
8085         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
8086         if (err)
8087                 return;
8088
8089         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8090         if (err) {
8091                 bphy_err(drvr, "Firmware rejected country setting\n");
8092                 return;
8093         }
8094         brcmf_setup_wiphybands(cfg);
8095 }
8096
8097 static void brcmf_free_wiphy(struct wiphy *wiphy)
8098 {
8099         int i;
8100
8101         if (!wiphy)
8102                 return;
8103
8104         if (wiphy->iface_combinations) {
8105                 for (i = 0; i < wiphy->n_iface_combinations; i++)
8106                         kfree(wiphy->iface_combinations[i].limits);
8107         }
8108         kfree(wiphy->iface_combinations);
8109         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8110                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8111                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8112         }
8113         if (wiphy->bands[NL80211_BAND_5GHZ]) {
8114                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8115                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8116         }
8117 #if IS_ENABLED(CONFIG_PM)
8118         if (wiphy->wowlan != &brcmf_wowlan_support)
8119                 kfree(wiphy->wowlan);
8120 #endif
8121 }
8122
8123 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8124                                                   struct cfg80211_ops *ops,
8125                                                   bool p2pdev_forced)
8126 {
8127         struct wiphy *wiphy = drvr->wiphy;
8128         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8129         struct brcmf_cfg80211_info *cfg;
8130         struct brcmf_cfg80211_vif *vif;
8131         struct brcmf_if *ifp;
8132         s32 err = 0;
8133         s32 io_type;
8134         u16 *cap = NULL;
8135
8136         if (!ndev) {
8137                 bphy_err(drvr, "ndev is invalid\n");
8138                 return NULL;
8139         }
8140
8141         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8142         if (!cfg) {
8143                 bphy_err(drvr, "Could not allocate wiphy device\n");
8144                 return NULL;
8145         }
8146
8147         cfg->wiphy = wiphy;
8148         cfg->pub = drvr;
8149         init_vif_event(&cfg->vif_event);
8150         INIT_LIST_HEAD(&cfg->vif_list);
8151
8152         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8153         if (IS_ERR(vif))
8154                 goto wiphy_out;
8155
8156         ifp = netdev_priv(ndev);
8157         vif->ifp = ifp;
8158         vif->wdev.netdev = ndev;
8159         ndev->ieee80211_ptr = &vif->wdev;
8160         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8161
8162         err = wl_init_priv(cfg);
8163         if (err) {
8164                 bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8165                 brcmf_free_vif(vif);
8166                 goto wiphy_out;
8167         }
8168         ifp->vif = vif;
8169
8170         /* determine d11 io type before wiphy setup */
8171         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8172         if (err) {
8173                 bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8174                 goto priv_out;
8175         }
8176         cfg->d11inf.io_type = (u8)io_type;
8177         brcmu_d11_attach(&cfg->d11inf);
8178
8179         /* regulatory notifer below needs access to cfg so
8180          * assign it now.
8181          */
8182         drvr->config = cfg;
8183
8184         err = brcmf_setup_wiphy(wiphy, ifp);
8185         if (err < 0)
8186                 goto priv_out;
8187
8188         brcmf_dbg(INFO, "Registering custom regulatory\n");
8189         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8190         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8191         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8192
8193         /* firmware defaults to 40MHz disabled in 2G band. We signal
8194          * cfg80211 here that we do and have it decide we can enable
8195          * it. But first check if device does support 2G operation.
8196          */
8197         if (wiphy->bands[NL80211_BAND_2GHZ]) {
8198                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8199                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8200         }
8201 #ifdef CONFIG_PM
8202         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8203                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8204 #endif
8205         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8206                 ops->dump_survey = brcmf_cfg80211_dump_survey;
8207
8208         err = wiphy_register(wiphy);
8209         if (err < 0) {
8210                 bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8211                 goto priv_out;
8212         }
8213
8214         err = brcmf_setup_wiphybands(cfg);
8215         if (err) {
8216                 bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8217                 goto wiphy_unreg_out;
8218         }
8219
8220         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8221          * setup 40MHz in 2GHz band and enable OBSS scanning.
8222          */
8223         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8224                 err = brcmf_enable_bw40_2g(cfg);
8225                 if (!err)
8226                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8227                                                       BRCMF_OBSS_COEX_AUTO);
8228                 else
8229                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8230         }
8231
8232         err = brcmf_fweh_activate_events(ifp);
8233         if (err) {
8234                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8235                 goto wiphy_unreg_out;
8236         }
8237
8238         err = brcmf_p2p_attach(cfg, p2pdev_forced);
8239         if (err) {
8240                 bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8241                 goto wiphy_unreg_out;
8242         }
8243         err = brcmf_btcoex_attach(cfg);
8244         if (err) {
8245                 bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8246                 brcmf_p2p_detach(&cfg->p2p);
8247                 goto wiphy_unreg_out;
8248         }
8249         err = brcmf_pno_attach(cfg);
8250         if (err) {
8251                 bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8252                 brcmf_btcoex_detach(cfg);
8253                 brcmf_p2p_detach(&cfg->p2p);
8254                 goto wiphy_unreg_out;
8255         }
8256
8257         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8258                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8259                 if (err) {
8260                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8261                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8262                 } else {
8263                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8264                                             brcmf_notify_tdls_peer_event);
8265                 }
8266         }
8267
8268         /* (re-) activate FWEH event handling */
8269         err = brcmf_fweh_activate_events(ifp);
8270         if (err) {
8271                 bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8272                 goto detach;
8273         }
8274
8275         /* Fill in some of the advertised nl80211 supported features */
8276         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8277                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8278 #ifdef CONFIG_PM
8279                 if (wiphy->wowlan &&
8280                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8281                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8282 #endif
8283         }
8284
8285         return cfg;
8286
8287 detach:
8288         brcmf_pno_detach(cfg);
8289         brcmf_btcoex_detach(cfg);
8290         brcmf_p2p_detach(&cfg->p2p);
8291 wiphy_unreg_out:
8292         wiphy_unregister(cfg->wiphy);
8293 priv_out:
8294         wl_deinit_priv(cfg);
8295         brcmf_free_vif(vif);
8296         ifp->vif = NULL;
8297 wiphy_out:
8298         brcmf_free_wiphy(wiphy);
8299         kfree(cfg);
8300         return NULL;
8301 }
8302
8303 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8304 {
8305         if (!cfg)
8306                 return;
8307
8308         brcmf_pno_detach(cfg);
8309         brcmf_btcoex_detach(cfg);
8310         wiphy_unregister(cfg->wiphy);
8311         wl_deinit_priv(cfg);
8312         brcmf_free_wiphy(cfg->wiphy);
8313         kfree(cfg);
8314 }