drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "pno.h"
  36 #include "cfg80211.h"
  37 #include "feature.h"
  38 #include "fwil.h"
  39 #include "proto.h"
  40 #include "vendor.h"
  41 #include "bus.h"
  42 #include "common.h"
  43
  44 #define BRCMF_SCAN_IE_LEN_MAX           2048
  45
  46 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  47 #define WPA_OUI_TYPE                    1
  48 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  49 #define WME_OUI_TYPE                    2
  50 #define WPS_OUI_TYPE                    4
  51
  52 #define VS_IE_FIXED_HDR_LEN             6
  53 #define WPA_IE_VERSION_LEN              2
  54 #define WPA_IE_MIN_OUI_LEN              4
  55 #define WPA_IE_SUITE_COUNT_LEN          2
  56
  57 #define WPA_CIPHER_NONE                 0       /* None */
  58 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  59 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  60 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  61 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  62
  63 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  64 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  65 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  66 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  67 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  68 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  69 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  70 #define RSN_CAP_MFPR_MASK               BIT(6)
  71 #define RSN_CAP_MFPC_MASK               BIT(7)
  72 #define RSN_PMKID_COUNT_LEN             2
  73
  74 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  75                                                  * string :"add", "del" (+ NUL)
  76                                                  */
  77 #define VNDR_IE_COUNT_OFFSET            4
  78 #define VNDR_IE_PKTFLAG_OFFSET          8
  79 #define VNDR_IE_VSIE_OFFSET             12
  80 #define VNDR_IE_HDR_SIZE                12
  81 #define VNDR_IE_PARSE_LIMIT             5
  82
  83 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  84 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  85
  86 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  87 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  88 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  89
  90 #define BRCMF_SCAN_CHANNEL_TIME         40
  91 #define BRCMF_SCAN_UNASSOC_TIME         40
  92 #define BRCMF_SCAN_PASSIVE_TIME         120
  93
  94 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  95
  96 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  97         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  98
  99 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 100 {
 101         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 102                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 103                           vif->sme_state);
 104                 return false;
 105         }
 106         return true;
 107 }
 108
 109 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 110 #define RATETAB_ENT(_rateid, _flags) \
 111         {                                                               \
 112                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 113                 .hw_value       = (_rateid),                            \
 114                 .flags          = (_flags),                             \
 115         }
 116
 117 static struct ieee80211_rate __wl_rates[] = {
 118         RATETAB_ENT(BRCM_RATE_1M, 0),
 119         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 122         RATETAB_ENT(BRCM_RATE_6M, 0),
 123         RATETAB_ENT(BRCM_RATE_9M, 0),
 124         RATETAB_ENT(BRCM_RATE_12M, 0),
 125         RATETAB_ENT(BRCM_RATE_18M, 0),
 126         RATETAB_ENT(BRCM_RATE_24M, 0),
 127         RATETAB_ENT(BRCM_RATE_36M, 0),
 128         RATETAB_ENT(BRCM_RATE_48M, 0),
 129         RATETAB_ENT(BRCM_RATE_54M, 0),
 130 };
 131
 132 #define wl_g_rates              (__wl_rates + 0)
 133 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 134 #define wl_a_rates              (__wl_rates + 4)
 135 #define wl_a_rates_size         (wl_g_rates_size - 4)
 136
 137 #define CHAN2G(_channel, _freq) {                               \
 138         .band                   = NL80211_BAND_2GHZ,            \
 139         .center_freq            = (_freq),                      \
 140         .hw_value               = (_channel),                   \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144
 145 #define CHAN5G(_channel) {                                      \
 146         .band                   = NL80211_BAND_5GHZ,            \
 147         .center_freq            = 5000 + (5 * (_channel)),      \
 148         .hw_value               = (_channel),                   \
 149         .max_antenna_gain       = 0,                            \
 150         .max_power              = 30,                           \
 151 }
 152
 153 static struct ieee80211_channel __wl_2ghz_channels[] = {
 154         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 155         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 156         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 157         CHAN2G(13, 2472), CHAN2G(14, 2484)
 158 };
 159
 160 static struct ieee80211_channel __wl_5ghz_channels[] = {
 161         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 162         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 163         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 164         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 165         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 166         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 167 };
 168
 169 /* Band templates duplicated per wiphy. The channel info
 170  * above is added to the band during setup.
 171  */
 172 static const struct ieee80211_supported_band __wl_band_2ghz = {
 173         .band = NL80211_BAND_2GHZ,
 174         .bitrates = wl_g_rates,
 175         .n_bitrates = wl_g_rates_size,
 176 };
 177
 178 static const struct ieee80211_supported_band __wl_band_5ghz = {
 179         .band = NL80211_BAND_5GHZ,
 180         .bitrates = wl_a_rates,
 181         .n_bitrates = wl_a_rates_size,
 182 };
 183
 184 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 185  * By default world regulatory domain defined in reg.c puts the flags
 186  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 187  * With respect to these flags, wpa_supplicant doesn't * start p2p
 188  * operations on 5GHz channels. All the changes in world regulatory
 189  * domain are to be done here.
 190  */
 191 static const struct ieee80211_regdomain brcmf_regdom = {
 192         .n_reg_rules = 4,
 193         .alpha2 =  "99",
 194         .reg_rules = {
 195                 /* IEEE 802.11b/g, channels 1..11 */
 196                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 197                 /* If any */
 198                 /* IEEE 802.11 channel 14 - Only JP enables
 199                  * this and for 802.11b only
 200                  */
 201                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 202                 /* IEEE 802.11a, channel 36..64 */
 203                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 204                 /* IEEE 802.11a, channel 100..165 */
 205                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 206 };
 207
 208 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 209  * are supported. A pointer to this array and the number of entries is passed
 210  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 211  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 212  * device does not support MFP then the number of suites will be decreased by 1
 213  */
 214 static const u32 brcmf_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         /* Keep as last entry: */
 220         WLAN_CIPHER_SUITE_AES_CMAC
 221 };
 222
 223 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 224 struct brcmf_vs_tlv {
 225         u8 id;
 226         u8 len;
 227         u8 oui[3];
 228         u8 oui_type;
 229 };
 230
 231 struct parsed_vndr_ie_info {
 232         u8 *ie_ptr;
 233         u32 ie_len;     /* total length including id & length field */
 234         struct brcmf_vs_tlv vndrie;
 235 };
 236
 237 struct parsed_vndr_ies {
 238         u32 count;
 239         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 240 };
 241
 242 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 243 {
 244         switch (band) {
 245         case NL80211_BAND_2GHZ:
 246                 return WLC_BAND_2G;
 247         case NL80211_BAND_5GHZ:
 248                 return WLC_BAND_5G;
 249         default:
 250                 WARN_ON(1);
 251                 break;
 252         }
 253         return 0;
 254 }
 255
 256 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 257                                struct cfg80211_chan_def *ch)
 258 {
 259         struct brcmu_chan ch_inf;
 260         s32 primary_offset;
 261
 262         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 263                   ch->chan->center_freq, ch->center_freq1, ch->width);
 264         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 265         primary_offset = ch->chan->center_freq - ch->center_freq1;
 266         switch (ch->width) {
 267         case NL80211_CHAN_WIDTH_20:
 268         case NL80211_CHAN_WIDTH_20_NOHT:
 269                 ch_inf.bw = BRCMU_CHAN_BW_20;
 270                 WARN_ON(primary_offset != 0);
 271                 break;
 272         case NL80211_CHAN_WIDTH_40:
 273                 ch_inf.bw = BRCMU_CHAN_BW_40;
 274                 if (primary_offset > 0)
 275                         ch_inf.sb = BRCMU_CHAN_SB_U;
 276                 else
 277                         ch_inf.sb = BRCMU_CHAN_SB_L;
 278                 break;
 279         case NL80211_CHAN_WIDTH_80:
 280                 ch_inf.bw = BRCMU_CHAN_BW_80;
 281                 if (primary_offset == -30)
 282                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 283                 else if (primary_offset == -10)
 284                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 285                 else if (primary_offset == 10)
 286                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80P80:
 291         case NL80211_CHAN_WIDTH_160:
 292         case NL80211_CHAN_WIDTH_5:
 293         case NL80211_CHAN_WIDTH_10:
 294         default:
 295                 WARN_ON_ONCE(1);
 296         }
 297         switch (ch->chan->band) {
 298         case NL80211_BAND_2GHZ:
 299                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 300                 break;
 301         case NL80211_BAND_5GHZ:
 302                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 303                 break;
 304         case NL80211_BAND_60GHZ:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         d11inf->encchspec(&ch_inf);
 309
 310         return ch_inf.chspec;
 311 }
 312
 313 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 314                         struct ieee80211_channel *ch)
 315 {
 316         struct brcmu_chan ch_inf;
 317
 318         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 319         ch_inf.bw = BRCMU_CHAN_BW_20;
 320         d11inf->encchspec(&ch_inf);
 321
 322         return ch_inf.chspec;
 323 }
 324
 325 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 326  * triples, returning a pointer to the substring whose first element
 327  * matches tag
 328  */
 329 static const struct brcmf_tlv *
 330 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 331 {
 332         const struct brcmf_tlv *elt = buf;
 333         int totlen = buflen;
 334
 335         /* find tagged parameter */
 336         while (totlen >= TLV_HDR_LEN) {
 337                 int len = elt->len;
 338
 339                 /* validate remaining totlen */
 340                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 341                         return elt;
 342
 343                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 344                 totlen -= (len + TLV_HDR_LEN);
 345         }
 346
 347         return NULL;
 348 }
 349
 350 /* Is any of the tlvs the expected entry? If
 351  * not update the tlvs buffer pointer/length.
 352  */
 353 static bool
 354 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 355                  const u8 *oui, u32 oui_len, u8 type)
 356 {
 357         /* If the contents match the OUI and the type */
 358         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 359             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 360             type == ie[TLV_BODY_OFF + oui_len]) {
 361                 return true;
 362         }
 363
 364         if (tlvs == NULL)
 365                 return false;
 366         /* point to the next ie */
 367         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 368         /* calculate the length of the rest of the buffer */
 369         *tlvs_len -= (int)(ie - *tlvs);
 370         /* update the pointer to the start of the buffer */
 371         *tlvs = ie;
 372
 373         return false;
 374 }
 375
 376 static struct brcmf_vs_tlv *
 377 brcmf_find_wpaie(const u8 *parse, u32 len)
 378 {
 379         const struct brcmf_tlv *ie;
 380
 381         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 382                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 383                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 384                         return (struct brcmf_vs_tlv *)ie;
 385         }
 386         return NULL;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpsie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 403                                      struct brcmf_cfg80211_vif *vif,
 404                                      enum nl80211_iftype new_type)
 405 {
 406         struct brcmf_cfg80211_vif *pos;
 407         bool check_combos = false;
 408         int ret = 0;
 409         struct iface_combination_params params = {
 410                 .num_different_channels = 1,
 411         };
 412
 413         list_for_each_entry(pos, &cfg->vif_list, list)
 414                 if (pos == vif) {
 415                         params.iftype_num[new_type]++;
 416                 } else {
 417                         /* concurrent interfaces so need check combinations */
 418                         check_combos = true;
 419                         params.iftype_num[pos->wdev.iftype]++;
 420                 }
 421
 422         if (check_combos)
 423                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 424
 425         return ret;
 426 }
 427
 428 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 429                                   enum nl80211_iftype new_type)
 430 {
 431         struct brcmf_cfg80211_vif *pos;
 432         struct iface_combination_params params = {
 433                 .num_different_channels = 1,
 434         };
 435
 436         list_for_each_entry(pos, &cfg->vif_list, list)
 437                 params.iftype_num[pos->wdev.iftype]++;
 438
 439         params.iftype_num[new_type]++;
 440         return cfg80211_check_combinations(cfg->wiphy, &params);
 441 }
 442
 443 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 444                                  struct brcmf_wsec_key_le *key_le)
 445 {
 446         key_le->index = cpu_to_le32(key->index);
 447         key_le->len = cpu_to_le32(key->len);
 448         key_le->algo = cpu_to_le32(key->algo);
 449         key_le->flags = cpu_to_le32(key->flags);
 450         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 451         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 452         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 453         memcpy(key_le->data, key->data, sizeof(key->data));
 454         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 455 }
 456
 457 static int
 458 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 459 {
 460         int err;
 461         struct brcmf_wsec_key_le key_le;
 462
 463         convert_key_from_CPU(key, &key_le);
 464
 465         brcmf_netdev_wait_pend8021x(ifp);
 466
 467         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 468                                         sizeof(key_le));
 469
 470         if (err)
 471                 brcmf_err("wsec_key error (%d)\n", err);
 472         return err;
 473 }
 474
 475 static void
 476 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 477 {
 478         struct brcmf_cfg80211_vif *vif;
 479         struct brcmf_if *ifp;
 480
 481         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 482         ifp = vif->ifp;
 483
 484         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 485             (wdev->iftype == NL80211_IFTYPE_AP) ||
 486             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 487                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 488                                                 ADDR_DIRECT);
 489         else
 490                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 491                                                 ADDR_INDIRECT);
 492 }
 493
 494 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 495 {
 496         int bsscfgidx;
 497
 498         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 499                 /* bsscfgidx 1 is reserved for legacy P2P */
 500                 if (bsscfgidx == 1)
 501                         continue;
 502                 if (!drvr->iflist[bsscfgidx])
 503                         return bsscfgidx;
 504         }
 505
 506         return -ENOMEM;
 507 }
 508
 509 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 510 {
 511         struct brcmf_mbss_ssid_le mbss_ssid_le;
 512         int bsscfgidx;
 513         int err;
 514
 515         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 516         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 517         if (bsscfgidx < 0)
 518                 return bsscfgidx;
 519
 520         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 521         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 522         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 523
 524         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 525                                         sizeof(mbss_ssid_le));
 526         if (err < 0)
 527                 brcmf_err("setting ssid failed %d\n", err);
 528
 529         return err;
 530 }
 531
 532 /**
 533  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 534  *
 535  * @wiphy: wiphy device of new interface.
 536  * @name: name of the new interface.
 537  * @params: contains mac address for AP device.
 538  */
 539 static
 540 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 541                                       struct vif_params *params)
 542 {
 543         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 544         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 545         struct brcmf_cfg80211_vif *vif;
 546         int err;
 547
 548         if (brcmf_cfg80211_vif_event_armed(cfg))
 549                 return ERR_PTR(-EBUSY);
 550
 551         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 552
 553         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 554         if (IS_ERR(vif))
 555                 return (struct wireless_dev *)vif;
 556
 557         brcmf_cfg80211_arm_vif_event(cfg, vif);
 558
 559         err = brcmf_cfg80211_request_ap_if(ifp);
 560         if (err) {
 561                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 562                 goto fail;
 563         }
 564
 565         /* wait for firmware event */
 566         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 567                                             BRCMF_VIF_EVENT_TIMEOUT);
 568         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 569         if (!err) {
 570                 brcmf_err("timeout occurred\n");
 571                 err = -EIO;
 572                 goto fail;
 573         }
 574
 575         /* interface created in firmware */
 576         ifp = vif->ifp;
 577         if (!ifp) {
 578                 brcmf_err("no if pointer provided\n");
 579                 err = -ENOENT;
 580                 goto fail;
 581         }
 582
 583         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 584         err = brcmf_net_attach(ifp, true);
 585         if (err) {
 586                 brcmf_err("Registering netdevice failed\n");
 587                 free_netdev(ifp->ndev);
 588                 goto fail;
 589         }
 590
 591         return &ifp->vif->wdev;
 592
 593 fail:
 594         brcmf_free_vif(vif);
 595         return ERR_PTR(err);
 596 }
 597
 598 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 599 {
 600         enum nl80211_iftype iftype;
 601
 602         iftype = vif->wdev.iftype;
 603         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 604 }
 605
 606 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 607 {
 608         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 609 }
 610
 611 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 612                                                      const char *name,
 613                                                      unsigned char name_assign_type,
 614                                                      enum nl80211_iftype type,
 615                                                      struct vif_params *params)
 616 {
 617         struct wireless_dev *wdev;
 618         int err;
 619
 620         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 621         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 622         if (err) {
 623                 brcmf_err("iface validation failed: err=%d\n", err);
 624                 return ERR_PTR(err);
 625         }
 626         switch (type) {
 627         case NL80211_IFTYPE_ADHOC:
 628         case NL80211_IFTYPE_STATION:
 629         case NL80211_IFTYPE_AP_VLAN:
 630         case NL80211_IFTYPE_WDS:
 631         case NL80211_IFTYPE_MONITOR:
 632         case NL80211_IFTYPE_MESH_POINT:
 633                 return ERR_PTR(-EOPNOTSUPP);
 634         case NL80211_IFTYPE_AP:
 635                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 636                 break;
 637         case NL80211_IFTYPE_P2P_CLIENT:
 638         case NL80211_IFTYPE_P2P_GO:
 639         case NL80211_IFTYPE_P2P_DEVICE:
 640                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 641                 break;
 642         case NL80211_IFTYPE_UNSPECIFIED:
 643         default:
 644                 return ERR_PTR(-EINVAL);
 645         }
 646
 647         if (IS_ERR(wdev))
 648                 brcmf_err("add iface %s type %d failed: err=%d\n",
 649                           name, type, (int)PTR_ERR(wdev));
 650         else
 651                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 652
 653         return wdev;
 654 }
 655
 656 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 657 {
 658         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 659                 brcmf_set_mpc(ifp, mpc);
 660 }
 661
 662 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 663 {
 664         s32 err = 0;
 665
 666         if (check_vif_up(ifp->vif)) {
 667                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 668                 if (err) {
 669                         brcmf_err("fail to set mpc\n");
 670                         return;
 671                 }
 672                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 673         }
 674 }
 675
 676 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 677                                 struct brcmf_if *ifp, bool aborted,
 678                                 bool fw_abort)
 679 {
 680         struct brcmf_scan_params_le params_le;
 681         struct cfg80211_scan_request *scan_request;
 682         u64 reqid;
 683         u32 bucket;
 684         s32 err = 0;
 685
 686         brcmf_dbg(SCAN, "Enter\n");
 687
 688         /* clear scan request, because the FW abort can cause a second call */
 689         /* to this functon and might cause a double cfg80211_scan_done      */
 690         scan_request = cfg->scan_request;
 691         cfg->scan_request = NULL;
 692
 693         if (timer_pending(&cfg->escan_timeout))
 694                 del_timer_sync(&cfg->escan_timeout);
 695
 696         if (fw_abort) {
 697                 /* Do a scan abort to stop the driver's scan engine */
 698                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 699                 memset(&params_le, 0, sizeof(params_le));
 700                 eth_broadcast_addr(params_le.bssid);
 701                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 702                 params_le.scan_type = 0;
 703                 params_le.channel_num = cpu_to_le32(1);
 704                 params_le.nprobes = cpu_to_le32(1);
 705                 params_le.active_time = cpu_to_le32(-1);
 706                 params_le.passive_time = cpu_to_le32(-1);
 707                 params_le.home_time = cpu_to_le32(-1);
 708                 /* Scan is aborted by setting channel_list[0] to -1 */
 709                 params_le.channel_list[0] = cpu_to_le16(-1);
 710                 /* E-Scan (or anyother type) can be aborted by SCAN */
 711                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 712                                              &params_le, sizeof(params_le));
 713                 if (err)
 714                         brcmf_err("Scan abort failed\n");
 715         }
 716
 717         brcmf_scan_config_mpc(ifp, 1);
 718
 719         /*
 720          * e-scan can be initiated internally
 721          * which takes precedence.
 722          */
 723         if (cfg->int_escan_map) {
 724                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 725                           cfg->int_escan_map);
 726                 while (cfg->int_escan_map) {
 727                         bucket = __ffs(cfg->int_escan_map);
 728                         cfg->int_escan_map &= ~BIT(bucket);
 729                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 730                                                                bucket);
 731                         if (!aborted) {
 732                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 733                                           reqid);
 734                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 735                                                             reqid);
 736                         }
 737                 }
 738         } else if (scan_request) {
 739                 struct cfg80211_scan_info info = {
 740                         .aborted = aborted,
 741                 };
 742
 743                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 744                           aborted ? "Aborted" : "Done");
 745                 cfg80211_scan_done(scan_request, &info);
 746         }
 747         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 748                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 749
 750         return err;
 751 }
 752
 753 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 754                                        struct wireless_dev *wdev)
 755 {
 756         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 757         struct net_device *ndev = wdev->netdev;
 758         struct brcmf_if *ifp = netdev_priv(ndev);
 759         int ret;
 760         int err;
 761
 762         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 763
 764         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 765         if (err) {
 766                 brcmf_err("interface_remove failed %d\n", err);
 767                 goto err_unarm;
 768         }
 769
 770         /* wait for firmware event */
 771         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 772                                             BRCMF_VIF_EVENT_TIMEOUT);
 773         if (!ret) {
 774                 brcmf_err("timeout occurred\n");
 775                 err = -EIO;
 776                 goto err_unarm;
 777         }
 778
 779         brcmf_remove_interface(ifp, true);
 780
 781 err_unarm:
 782         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 783         return err;
 784 }
 785
 786 static
 787 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 788 {
 789         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 790         struct net_device *ndev = wdev->netdev;
 791
 792         if (ndev && ndev == cfg_to_ndev(cfg))
 793                 return -ENOTSUPP;
 794
 795         /* vif event pending in firmware */
 796         if (brcmf_cfg80211_vif_event_armed(cfg))
 797                 return -EBUSY;
 798
 799         if (ndev) {
 800                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 801                     cfg->escan_info.ifp == netdev_priv(ndev))
 802                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 803                                                     true, true);
 804
 805                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 806         }
 807
 808         switch (wdev->iftype) {
 809         case NL80211_IFTYPE_ADHOC:
 810         case NL80211_IFTYPE_STATION:
 811         case NL80211_IFTYPE_AP_VLAN:
 812         case NL80211_IFTYPE_WDS:
 813         case NL80211_IFTYPE_MONITOR:
 814         case NL80211_IFTYPE_MESH_POINT:
 815                 return -EOPNOTSUPP;
 816         case NL80211_IFTYPE_AP:
 817                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 818         case NL80211_IFTYPE_P2P_CLIENT:
 819         case NL80211_IFTYPE_P2P_GO:
 820         case NL80211_IFTYPE_P2P_DEVICE:
 821                 return brcmf_p2p_del_vif(wiphy, wdev);
 822         case NL80211_IFTYPE_UNSPECIFIED:
 823         default:
 824                 return -EINVAL;
 825         }
 826         return -EOPNOTSUPP;
 827 }
 828
 829 static s32
 830 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 831                          enum nl80211_iftype type,
 832                          struct vif_params *params)
 833 {
 834         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 835         struct brcmf_if *ifp = netdev_priv(ndev);
 836         struct brcmf_cfg80211_vif *vif = ifp->vif;
 837         s32 infra = 0;
 838         s32 ap = 0;
 839         s32 err = 0;
 840
 841         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 842                   type);
 843
 844         /* WAR: There are a number of p2p interface related problems which
 845          * need to be handled initially (before doing the validate).
 846          * wpa_supplicant tends to do iface changes on p2p device/client/go
 847          * which are not always possible/allowed. However we need to return
 848          * OK otherwise the wpa_supplicant wont start. The situation differs
 849          * on configuration and setup (p2pon=1 module param). The first check
 850          * is to see if the request is a change to station for p2p iface.
 851          */
 852         if ((type == NL80211_IFTYPE_STATION) &&
 853             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 854              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 855              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 856                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 857                 /* Now depending on whether module param p2pon=1 was used the
 858                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 859                  * that if p2pon=1 is used, but a newer supplicant is used then
 860                  * we should return an error, as this combination wont work.
 861                  * In other situations 0 is returned and supplicant will start
 862                  * normally. It will give a trace in cfg80211, but it is the
 863                  * only way to get it working. Unfortunately this will result
 864                  * in situation where we wont support new supplicant in
 865                  * combination with module param p2pon=1, but that is the way
 866                  * it is. If the user tries this then unloading of driver might
 867                  * fail/lock.
 868                  */
 869                 if (cfg->p2p.p2pdev_dynamically)
 870                         return -EOPNOTSUPP;
 871                 else
 872                         return 0;
 873         }
 874         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 875         if (err) {
 876                 brcmf_err("iface validation failed: err=%d\n", err);
 877                 return err;
 878         }
 879         switch (type) {
 880         case NL80211_IFTYPE_MONITOR:
 881         case NL80211_IFTYPE_WDS:
 882                 brcmf_err("type (%d) : currently we do not support this type\n",
 883                           type);
 884                 return -EOPNOTSUPP;
 885         case NL80211_IFTYPE_ADHOC:
 886                 infra = 0;
 887                 break;
 888         case NL80211_IFTYPE_STATION:
 889                 infra = 1;
 890                 break;
 891         case NL80211_IFTYPE_AP:
 892         case NL80211_IFTYPE_P2P_GO:
 893                 ap = 1;
 894                 break;
 895         default:
 896                 err = -EINVAL;
 897                 goto done;
 898         }
 899
 900         if (ap) {
 901                 if (type == NL80211_IFTYPE_P2P_GO) {
 902                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 903                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 904                 }
 905                 if (!err) {
 906                         brcmf_dbg(INFO, "IF Type = AP\n");
 907                 }
 908         } else {
 909                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 910                 if (err) {
 911                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 912                         err = -EAGAIN;
 913                         goto done;
 914                 }
 915                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 916                           "Adhoc" : "Infra");
 917         }
 918         ndev->ieee80211_ptr->iftype = type;
 919
 920         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 921
 922 done:
 923         brcmf_dbg(TRACE, "Exit\n");
 924
 925         return err;
 926 }
 927
 928 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 929                              struct brcmf_scan_params_le *params_le,
 930                              struct cfg80211_scan_request *request)
 931 {
 932         u32 n_ssids;
 933         u32 n_channels;
 934         s32 i;
 935         s32 offset;
 936         u16 chanspec;
 937         char *ptr;
 938         struct brcmf_ssid_le ssid_le;
 939
 940         eth_broadcast_addr(params_le->bssid);
 941         params_le->bss_type = DOT11_BSSTYPE_ANY;
 942         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
 943         params_le->channel_num = 0;
 944         params_le->nprobes = cpu_to_le32(-1);
 945         params_le->active_time = cpu_to_le32(-1);
 946         params_le->passive_time = cpu_to_le32(-1);
 947         params_le->home_time = cpu_to_le32(-1);
 948         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 949
 950         n_ssids = request->n_ssids;
 951         n_channels = request->n_channels;
 952
 953         /* Copy channel array if applicable */
 954         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 955                   n_channels);
 956         if (n_channels > 0) {
 957                 for (i = 0; i < n_channels; i++) {
 958                         chanspec = channel_to_chanspec(&cfg->d11inf,
 959                                                        request->channels[i]);
 960                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 961                                   request->channels[i]->hw_value, chanspec);
 962                         params_le->channel_list[i] = cpu_to_le16(chanspec);
 963                 }
 964         } else {
 965                 brcmf_dbg(SCAN, "Scanning all channels\n");
 966         }
 967         /* Copy ssid array if applicable */
 968         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
 969         if (n_ssids > 0) {
 970                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
 971                                 n_channels * sizeof(u16);
 972                 offset = roundup(offset, sizeof(u32));
 973                 ptr = (char *)params_le + offset;
 974                 for (i = 0; i < n_ssids; i++) {
 975                         memset(&ssid_le, 0, sizeof(ssid_le));
 976                         ssid_le.SSID_len =
 977                                         cpu_to_le32(request->ssids[i].ssid_len);
 978                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
 979                                request->ssids[i].ssid_len);
 980                         if (!ssid_le.SSID_len)
 981                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
 982                         else
 983                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
 984                                           i, ssid_le.SSID, ssid_le.SSID_len);
 985                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
 986                         ptr += sizeof(ssid_le);
 987                 }
 988         } else {
 989                 brcmf_dbg(SCAN, "Performing passive scan\n");
 990                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
 991         }
 992         /* Adding mask to channel numbers */
 993         params_le->channel_num =
 994                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
 995                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
 996 }
 997
 998 static s32
 999 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1000                 struct cfg80211_scan_request *request)
1001 {
1002         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1003                           offsetof(struct brcmf_escan_params_le, params_le);
1004         struct brcmf_escan_params_le *params;
1005         s32 err = 0;
1006
1007         brcmf_dbg(SCAN, "E-SCAN START\n");
1008
1009         if (request != NULL) {
1010                 /* Allocate space for populating ssids in struct */
1011                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1012
1013                 /* Allocate space for populating ssids in struct */
1014                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1015         }
1016
1017         params = kzalloc(params_size, GFP_KERNEL);
1018         if (!params) {
1019                 err = -ENOMEM;
1020                 goto exit;
1021         }
1022         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1023         brcmf_escan_prep(cfg, &params->params_le, request);
1024         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1025         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1026         params->sync_id = cpu_to_le16(0x1234);
1027
1028         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1029         if (err) {
1030                 if (err == -EBUSY)
1031                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1032                 else
1033                         brcmf_err("error (%d)\n", err);
1034         }
1035
1036         kfree(params);
1037 exit:
1038         return err;
1039 }
1040
1041 static s32
1042 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1043 {
1044         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1045         s32 err;
1046         struct brcmf_scan_results *results;
1047         struct escan_info *escan = &cfg->escan_info;
1048
1049         brcmf_dbg(SCAN, "Enter\n");
1050         escan->ifp = ifp;
1051         escan->wiphy = cfg->wiphy;
1052         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1053
1054         brcmf_scan_config_mpc(ifp, 0);
1055         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1056         results->version = 0;
1057         results->count = 0;
1058         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1059
1060         err = escan->run(cfg, ifp, request);
1061         if (err)
1062                 brcmf_scan_config_mpc(ifp, 1);
1063         return err;
1064 }
1065
1066 static s32
1067 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1068 {
1069         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1070         struct brcmf_cfg80211_vif *vif;
1071         s32 err = 0;
1072
1073         brcmf_dbg(TRACE, "Enter\n");
1074         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1075         if (!check_vif_up(vif))
1076                 return -EIO;
1077
1078         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1079                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1080                 return -EAGAIN;
1081         }
1082         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1083                 brcmf_err("Scanning being aborted: status (%lu)\n",
1084                           cfg->scan_status);
1085                 return -EAGAIN;
1086         }
1087         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1088                 brcmf_err("Scanning suppressed: status (%lu)\n",
1089                           cfg->scan_status);
1090                 return -EAGAIN;
1091         }
1092         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1093                 brcmf_err("Connecting: status (%lu)\n", vif->sme_state);
1094                 return -EAGAIN;
1095         }
1096
1097         /* If scan req comes for p2p0, send it over primary I/F */
1098         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1099                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1100
1101         brcmf_dbg(SCAN, "START ESCAN\n");
1102
1103         cfg->scan_request = request;
1104         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1105
1106         cfg->escan_info.run = brcmf_run_escan;
1107         err = brcmf_p2p_scan_prep(wiphy, request, vif);
1108         if (err)
1109                 goto scan_out;
1110
1111         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1112                                     request->ie, request->ie_len);
1113         if (err)
1114                 goto scan_out;
1115
1116         err = brcmf_do_escan(vif->ifp, request);
1117         if (err)
1118                 goto scan_out;
1119
1120         /* Arm scan timeout timer */
1121         mod_timer(&cfg->escan_timeout,
1122                   jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1123
1124         return 0;
1125
1126 scan_out:
1127         brcmf_err("scan error (%d)\n", err);
1128         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1129         cfg->scan_request = NULL;
1130         return err;
1131 }
1132
1133 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1134 {
1135         s32 err = 0;
1136
1137         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1138                                       rts_threshold);
1139         if (err)
1140                 brcmf_err("Error (%d)\n", err);
1141
1142         return err;
1143 }
1144
1145 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1146 {
1147         s32 err = 0;
1148
1149         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1150                                       frag_threshold);
1151         if (err)
1152                 brcmf_err("Error (%d)\n", err);
1153
1154         return err;
1155 }
1156
1157 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1158 {
1159         s32 err = 0;
1160         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1161
1162         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1163         if (err) {
1164                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1165                 return err;
1166         }
1167         return err;
1168 }
1169
1170 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1171 {
1172         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1173         struct net_device *ndev = cfg_to_ndev(cfg);
1174         struct brcmf_if *ifp = netdev_priv(ndev);
1175         s32 err = 0;
1176
1177         brcmf_dbg(TRACE, "Enter\n");
1178         if (!check_vif_up(ifp->vif))
1179                 return -EIO;
1180
1181         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1182             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1183                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1184                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1185                 if (!err)
1186                         goto done;
1187         }
1188         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1189             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1190                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1191                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1192                 if (!err)
1193                         goto done;
1194         }
1195         if (changed & WIPHY_PARAM_RETRY_LONG
1196             && (cfg->conf->retry_long != wiphy->retry_long)) {
1197                 cfg->conf->retry_long = wiphy->retry_long;
1198                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1199                 if (!err)
1200                         goto done;
1201         }
1202         if (changed & WIPHY_PARAM_RETRY_SHORT
1203             && (cfg->conf->retry_short != wiphy->retry_short)) {
1204                 cfg->conf->retry_short = wiphy->retry_short;
1205                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1206                 if (!err)
1207                         goto done;
1208         }
1209
1210 done:
1211         brcmf_dbg(TRACE, "Exit\n");
1212         return err;
1213 }
1214
1215 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1216 {
1217         memset(prof, 0, sizeof(*prof));
1218 }
1219
1220 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1221 {
1222         u16 reason;
1223
1224         switch (e->event_code) {
1225         case BRCMF_E_DEAUTH:
1226         case BRCMF_E_DEAUTH_IND:
1227         case BRCMF_E_DISASSOC_IND:
1228                 reason = e->reason;
1229                 break;
1230         case BRCMF_E_LINK:
1231         default:
1232                 reason = 0;
1233                 break;
1234         }
1235         return reason;
1236 }
1237
1238 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1239 {
1240         struct brcmf_wsec_pmk_le pmk;
1241         int i, err;
1242
1243         /* convert to firmware key format */
1244         pmk.key_len = cpu_to_le16(pmk_len << 1);
1245         pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1246         for (i = 0; i < pmk_len; i++)
1247                 snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1248
1249         /* store psk in firmware */
1250         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1251                                      &pmk, sizeof(pmk));
1252         if (err < 0)
1253                 brcmf_err("failed to change PSK in firmware (len=%u)\n",
1254                           pmk_len);
1255
1256         return err;
1257 }
1258
1259 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1260 {
1261         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1262         s32 err = 0;
1263
1264         brcmf_dbg(TRACE, "Enter\n");
1265
1266         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1267                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1268                 err = brcmf_fil_cmd_data_set(vif->ifp,
1269                                              BRCMF_C_DISASSOC, NULL, 0);
1270                 if (err) {
1271                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1272                 }
1273                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1274                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1275                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1276                                               true, GFP_KERNEL);
1277         }
1278         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1279         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1280         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1281         if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1282                 brcmf_set_pmk(vif->ifp, NULL, 0);
1283                 vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1284         }
1285         brcmf_dbg(TRACE, "Exit\n");
1286 }
1287
1288 static s32
1289 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1290                       struct cfg80211_ibss_params *params)
1291 {
1292         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1293         struct brcmf_if *ifp = netdev_priv(ndev);
1294         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1295         struct brcmf_join_params join_params;
1296         size_t join_params_size = 0;
1297         s32 err = 0;
1298         s32 wsec = 0;
1299         s32 bcnprd;
1300         u16 chanspec;
1301         u32 ssid_len;
1302
1303         brcmf_dbg(TRACE, "Enter\n");
1304         if (!check_vif_up(ifp->vif))
1305                 return -EIO;
1306
1307         if (params->ssid)
1308                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1309         else {
1310                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1311                 return -EOPNOTSUPP;
1312         }
1313
1314         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1315
1316         if (params->bssid)
1317                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1318         else
1319                 brcmf_dbg(CONN, "No BSSID specified\n");
1320
1321         if (params->chandef.chan)
1322                 brcmf_dbg(CONN, "channel: %d\n",
1323                           params->chandef.chan->center_freq);
1324         else
1325                 brcmf_dbg(CONN, "no channel specified\n");
1326
1327         if (params->channel_fixed)
1328                 brcmf_dbg(CONN, "fixed channel required\n");
1329         else
1330                 brcmf_dbg(CONN, "no fixed channel required\n");
1331
1332         if (params->ie && params->ie_len)
1333                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1334         else
1335                 brcmf_dbg(CONN, "no ie specified\n");
1336
1337         if (params->beacon_interval)
1338                 brcmf_dbg(CONN, "beacon interval: %d\n",
1339                           params->beacon_interval);
1340         else
1341                 brcmf_dbg(CONN, "no beacon interval specified\n");
1342
1343         if (params->basic_rates)
1344                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1345         else
1346                 brcmf_dbg(CONN, "no basic rates specified\n");
1347
1348         if (params->privacy)
1349                 brcmf_dbg(CONN, "privacy required\n");
1350         else
1351                 brcmf_dbg(CONN, "no privacy required\n");
1352
1353         /* Configure Privacy for starter */
1354         if (params->privacy)
1355                 wsec |= WEP_ENABLED;
1356
1357         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1358         if (err) {
1359                 brcmf_err("wsec failed (%d)\n", err);
1360                 goto done;
1361         }
1362
1363         /* Configure Beacon Interval for starter */
1364         if (params->beacon_interval)
1365                 bcnprd = params->beacon_interval;
1366         else
1367                 bcnprd = 100;
1368
1369         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1370         if (err) {
1371                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1372                 goto done;
1373         }
1374
1375         /* Configure required join parameter */
1376         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1377
1378         /* SSID */
1379         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1380         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1381         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1382         join_params_size = sizeof(join_params.ssid_le);
1383
1384         /* BSSID */
1385         if (params->bssid) {
1386                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1387                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1388                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1389         } else {
1390                 eth_broadcast_addr(join_params.params_le.bssid);
1391                 eth_zero_addr(profile->bssid);
1392         }
1393
1394         /* Channel */
1395         if (params->chandef.chan) {
1396                 u32 target_channel;
1397
1398                 cfg->channel =
1399                         ieee80211_frequency_to_channel(
1400                                 params->chandef.chan->center_freq);
1401                 if (params->channel_fixed) {
1402                         /* adding chanspec */
1403                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1404                                                        &params->chandef);
1405                         join_params.params_le.chanspec_list[0] =
1406                                 cpu_to_le16(chanspec);
1407                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1408                         join_params_size += sizeof(join_params.params_le);
1409                 }
1410
1411                 /* set channel for starter */
1412                 target_channel = cfg->channel;
1413                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1414                                             target_channel);
1415                 if (err) {
1416                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1417                         goto done;
1418                 }
1419         } else
1420                 cfg->channel = 0;
1421
1422         cfg->ibss_starter = false;
1423
1424
1425         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1426                                      &join_params, join_params_size);
1427         if (err) {
1428                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1429                 goto done;
1430         }
1431
1432 done:
1433         if (err)
1434                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1435         brcmf_dbg(TRACE, "Exit\n");
1436         return err;
1437 }
1438
1439 static s32
1440 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1441 {
1442         struct brcmf_if *ifp = netdev_priv(ndev);
1443
1444         brcmf_dbg(TRACE, "Enter\n");
1445         if (!check_vif_up(ifp->vif)) {
1446                 /* When driver is being unloaded, it can end up here. If an
1447                  * error is returned then later on a debug trace in the wireless
1448                  * core module will be printed. To avoid this 0 is returned.
1449                  */
1450                 return 0;
1451         }
1452
1453         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1454         brcmf_net_setcarrier(ifp, false);
1455
1456         brcmf_dbg(TRACE, "Exit\n");
1457
1458         return 0;
1459 }
1460
1461 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1462                                  struct cfg80211_connect_params *sme)
1463 {
1464         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1465         struct brcmf_cfg80211_security *sec;
1466         s32 val = 0;
1467         s32 err = 0;
1468
1469         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1470                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1471         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1472                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1473         else
1474                 val = WPA_AUTH_DISABLED;
1475         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1476         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1477         if (err) {
1478                 brcmf_err("set wpa_auth failed (%d)\n", err);
1479                 return err;
1480         }
1481         sec = &profile->sec;
1482         sec->wpa_versions = sme->crypto.wpa_versions;
1483         return err;
1484 }
1485
1486 static s32 brcmf_set_auth_type(struct net_device *ndev,
1487                                struct cfg80211_connect_params *sme)
1488 {
1489         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1490         struct brcmf_cfg80211_security *sec;
1491         s32 val = 0;
1492         s32 err = 0;
1493
1494         switch (sme->auth_type) {
1495         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1496                 val = 0;
1497                 brcmf_dbg(CONN, "open system\n");
1498                 break;
1499         case NL80211_AUTHTYPE_SHARED_KEY:
1500                 val = 1;
1501                 brcmf_dbg(CONN, "shared key\n");
1502                 break;
1503         default:
1504                 val = 2;
1505                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1506                 break;
1507         }
1508
1509         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1510         if (err) {
1511                 brcmf_err("set auth failed (%d)\n", err);
1512                 return err;
1513         }
1514         sec = &profile->sec;
1515         sec->auth_type = sme->auth_type;
1516         return err;
1517 }
1518
1519 static s32
1520 brcmf_set_wsec_mode(struct net_device *ndev,
1521                     struct cfg80211_connect_params *sme)
1522 {
1523         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1524         struct brcmf_cfg80211_security *sec;
1525         s32 pval = 0;
1526         s32 gval = 0;
1527         s32 wsec;
1528         s32 err = 0;
1529
1530         if (sme->crypto.n_ciphers_pairwise) {
1531                 switch (sme->crypto.ciphers_pairwise[0]) {
1532                 case WLAN_CIPHER_SUITE_WEP40:
1533                 case WLAN_CIPHER_SUITE_WEP104:
1534                         pval = WEP_ENABLED;
1535                         break;
1536                 case WLAN_CIPHER_SUITE_TKIP:
1537                         pval = TKIP_ENABLED;
1538                         break;
1539                 case WLAN_CIPHER_SUITE_CCMP:
1540                         pval = AES_ENABLED;
1541                         break;
1542                 case WLAN_CIPHER_SUITE_AES_CMAC:
1543                         pval = AES_ENABLED;
1544                         break;
1545                 default:
1546                         brcmf_err("invalid cipher pairwise (%d)\n",
1547                                   sme->crypto.ciphers_pairwise[0]);
1548                         return -EINVAL;
1549                 }
1550         }
1551         if (sme->crypto.cipher_group) {
1552                 switch (sme->crypto.cipher_group) {
1553                 case WLAN_CIPHER_SUITE_WEP40:
1554                 case WLAN_CIPHER_SUITE_WEP104:
1555                         gval = WEP_ENABLED;
1556                         break;
1557                 case WLAN_CIPHER_SUITE_TKIP:
1558                         gval = TKIP_ENABLED;
1559                         break;
1560                 case WLAN_CIPHER_SUITE_CCMP:
1561                         gval = AES_ENABLED;
1562                         break;
1563                 case WLAN_CIPHER_SUITE_AES_CMAC:
1564                         gval = AES_ENABLED;
1565                         break;
1566                 default:
1567                         brcmf_err("invalid cipher group (%d)\n",
1568                                   sme->crypto.cipher_group);
1569                         return -EINVAL;
1570                 }
1571         }
1572
1573         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1574         /* In case of privacy, but no security and WPS then simulate */
1575         /* setting AES. WPS-2.0 allows no security                   */
1576         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1577             sme->privacy)
1578                 pval = AES_ENABLED;
1579
1580         wsec = pval | gval;
1581         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1582         if (err) {
1583                 brcmf_err("error (%d)\n", err);
1584                 return err;
1585         }
1586
1587         sec = &profile->sec;
1588         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1589         sec->cipher_group = sme->crypto.cipher_group;
1590
1591         return err;
1592 }
1593
1594 static s32
1595 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1596 {
1597         struct brcmf_if *ifp = netdev_priv(ndev);
1598         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1599         s32 val;
1600         s32 err;
1601         const struct brcmf_tlv *rsn_ie;
1602         const u8 *ie;
1603         u32 ie_len;
1604         u32 offset;
1605         u16 rsn_cap;
1606         u32 mfp;
1607         u16 count;
1608
1609         profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1610
1611         if (!sme->crypto.n_akm_suites)
1612                 return 0;
1613
1614         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1615         if (err) {
1616                 brcmf_err("could not get wpa_auth (%d)\n", err);
1617                 return err;
1618         }
1619         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1620                 switch (sme->crypto.akm_suites[0]) {
1621                 case WLAN_AKM_SUITE_8021X:
1622                         val = WPA_AUTH_UNSPECIFIED;
1623                         if (sme->want_1x)
1624                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1625                         break;
1626                 case WLAN_AKM_SUITE_PSK:
1627                         val = WPA_AUTH_PSK;
1628                         break;
1629                 default:
1630                         brcmf_err("invalid cipher group (%d)\n",
1631                                   sme->crypto.cipher_group);
1632                         return -EINVAL;
1633                 }
1634         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1635                 switch (sme->crypto.akm_suites[0]) {
1636                 case WLAN_AKM_SUITE_8021X:
1637                         val = WPA2_AUTH_UNSPECIFIED;
1638                         if (sme->want_1x)
1639                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1640                         break;
1641                 case WLAN_AKM_SUITE_8021X_SHA256:
1642                         val = WPA2_AUTH_1X_SHA256;
1643                         if (sme->want_1x)
1644                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1645                         break;
1646                 case WLAN_AKM_SUITE_PSK_SHA256:
1647                         val = WPA2_AUTH_PSK_SHA256;
1648                         break;
1649                 case WLAN_AKM_SUITE_PSK:
1650                         val = WPA2_AUTH_PSK;
1651                         break;
1652                 case WLAN_AKM_SUITE_FT_8021X:
1653                         val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
1654                         if (sme->want_1x)
1655                                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
1656                         break;
1657                 case WLAN_AKM_SUITE_FT_PSK:
1658                         val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
1659                         break;
1660                 default:
1661                         brcmf_err("invalid cipher group (%d)\n",
1662                                   sme->crypto.cipher_group);
1663                         return -EINVAL;
1664                 }
1665         }
1666
1667         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
1668                 brcmf_dbg(INFO, "using 1X offload\n");
1669
1670         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1671                 goto skip_mfp_config;
1672         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1673          * IE will not be verified, just a quick search for MFP config
1674          */
1675         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1676                                   WLAN_EID_RSN);
1677         if (!rsn_ie)
1678                 goto skip_mfp_config;
1679         ie = (const u8 *)rsn_ie;
1680         ie_len = rsn_ie->len + TLV_HDR_LEN;
1681         /* Skip unicast suite */
1682         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1683         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1684                 goto skip_mfp_config;
1685         /* Skip multicast suite */
1686         count = ie[offset] + (ie[offset + 1] << 8);
1687         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1688         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1689                 goto skip_mfp_config;
1690         /* Skip auth key management suite(s) */
1691         count = ie[offset] + (ie[offset + 1] << 8);
1692         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1693         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1694                 goto skip_mfp_config;
1695         /* Ready to read capabilities */
1696         mfp = BRCMF_MFP_NONE;
1697         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1698         if (rsn_cap & RSN_CAP_MFPR_MASK)
1699                 mfp = BRCMF_MFP_REQUIRED;
1700         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1701                 mfp = BRCMF_MFP_CAPABLE;
1702         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1703
1704 skip_mfp_config:
1705         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1706         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1707         if (err) {
1708                 brcmf_err("could not set wpa_auth (%d)\n", err);
1709                 return err;
1710         }
1711
1712         return err;
1713 }
1714
1715 static s32
1716 brcmf_set_sharedkey(struct net_device *ndev,
1717                     struct cfg80211_connect_params *sme)
1718 {
1719         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1720         struct brcmf_cfg80211_security *sec;
1721         struct brcmf_wsec_key key;
1722         s32 val;
1723         s32 err = 0;
1724
1725         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1726
1727         if (sme->key_len == 0)
1728                 return 0;
1729
1730         sec = &profile->sec;
1731         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1732                   sec->wpa_versions, sec->cipher_pairwise);
1733
1734         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1735                 return 0;
1736
1737         if (!(sec->cipher_pairwise &
1738             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1739                 return 0;
1740
1741         memset(&key, 0, sizeof(key));
1742         key.len = (u32) sme->key_len;
1743         key.index = (u32) sme->key_idx;
1744         if (key.len > sizeof(key.data)) {
1745                 brcmf_err("Too long key length (%u)\n", key.len);
1746                 return -EINVAL;
1747         }
1748         memcpy(key.data, sme->key, key.len);
1749         key.flags = BRCMF_PRIMARY_KEY;
1750         switch (sec->cipher_pairwise) {
1751         case WLAN_CIPHER_SUITE_WEP40:
1752                 key.algo = CRYPTO_ALGO_WEP1;
1753                 break;
1754         case WLAN_CIPHER_SUITE_WEP104:
1755                 key.algo = CRYPTO_ALGO_WEP128;
1756                 break;
1757         default:
1758                 brcmf_err("Invalid algorithm (%d)\n",
1759                           sme->crypto.ciphers_pairwise[0]);
1760                 return -EINVAL;
1761         }
1762         /* Set the new key/index */
1763         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1764                   key.len, key.index, key.algo);
1765         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1766         err = send_key_to_dongle(netdev_priv(ndev), &key);
1767         if (err)
1768                 return err;
1769
1770         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1771                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1772                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1773                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1774                 if (err)
1775                         brcmf_err("set auth failed (%d)\n", err);
1776         }
1777         return err;
1778 }
1779
1780 static
1781 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1782                                            enum nl80211_auth_type type)
1783 {
1784         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1785             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1786                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1787                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1788         }
1789         return type;
1790 }
1791
1792 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1793                                 struct cfg80211_bss_selection *bss_select)
1794 {
1795         struct brcmf_join_pref_params join_pref_params[2];
1796         enum nl80211_band band;
1797         int err, i = 0;
1798
1799         join_pref_params[i].len = 2;
1800         join_pref_params[i].rssi_gain = 0;
1801
1802         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1803                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1804
1805         switch (bss_select->behaviour) {
1806         case __NL80211_BSS_SELECT_ATTR_INVALID:
1807                 brcmf_c_set_joinpref_default(ifp);
1808                 return;
1809         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1810                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1811                 band = bss_select->param.band_pref;
1812                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1813                 i++;
1814                 break;
1815         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1816                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1817                 band = bss_select->param.adjust.band;
1818                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1819                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1820                 i++;
1821                 break;
1822         case NL80211_BSS_SELECT_ATTR_RSSI:
1823         default:
1824                 break;
1825         }
1826         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1827         join_pref_params[i].len = 2;
1828         join_pref_params[i].rssi_gain = 0;
1829         join_pref_params[i].band = 0;
1830         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1831                                        sizeof(join_pref_params));
1832         if (err)
1833                 brcmf_err("Set join_pref error (%d)\n", err);
1834 }
1835
1836 static s32
1837 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1838                        struct cfg80211_connect_params *sme)
1839 {
1840         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1841         struct brcmf_if *ifp = netdev_priv(ndev);
1842         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1843         struct ieee80211_channel *chan = sme->channel;
1844         struct brcmf_join_params join_params;
1845         size_t join_params_size;
1846         const struct brcmf_tlv *rsn_ie;
1847         const struct brcmf_vs_tlv *wpa_ie;
1848         const void *ie;
1849         u32 ie_len;
1850         struct brcmf_ext_join_params_le *ext_join_params;
1851         u16 chanspec;
1852         s32 err = 0;
1853         u32 ssid_len;
1854
1855         brcmf_dbg(TRACE, "Enter\n");
1856         if (!check_vif_up(ifp->vif))
1857                 return -EIO;
1858
1859         if (!sme->ssid) {
1860                 brcmf_err("Invalid ssid\n");
1861                 return -EOPNOTSUPP;
1862         }
1863
1864         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1865                 /* A normal (non P2P) connection request setup. */
1866                 ie = NULL;
1867                 ie_len = 0;
1868                 /* find the WPA_IE */
1869                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1870                 if (wpa_ie) {
1871                         ie = wpa_ie;
1872                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1873                 } else {
1874                         /* find the RSN_IE */
1875                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1876                                                   sme->ie_len,
1877                                                   WLAN_EID_RSN);
1878                         if (rsn_ie) {
1879                                 ie = rsn_ie;
1880                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1881                         }
1882                 }
1883                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1884         }
1885
1886         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1887                                     sme->ie, sme->ie_len);
1888         if (err)
1889                 brcmf_err("Set Assoc REQ IE Failed\n");
1890         else
1891                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1892
1893         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1894
1895         if (chan) {
1896                 cfg->channel =
1897                         ieee80211_frequency_to_channel(chan->center_freq);
1898                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1899                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1900                           cfg->channel, chan->center_freq, chanspec);
1901         } else {
1902                 cfg->channel = 0;
1903                 chanspec = 0;
1904         }
1905
1906         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1907
1908         err = brcmf_set_wpa_version(ndev, sme);
1909         if (err) {
1910                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1911                 goto done;
1912         }
1913
1914         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1915         err = brcmf_set_auth_type(ndev, sme);
1916         if (err) {
1917                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1918                 goto done;
1919         }
1920
1921         err = brcmf_set_wsec_mode(ndev, sme);
1922         if (err) {
1923                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1924                 goto done;
1925         }
1926
1927         err = brcmf_set_key_mgmt(ndev, sme);
1928         if (err) {
1929                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1930                 goto done;
1931         }
1932
1933         err = brcmf_set_sharedkey(ndev, sme);
1934         if (err) {
1935                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1936                 goto done;
1937         }
1938
1939         if (sme->crypto.psk) {
1940                 if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
1941                         err = -EINVAL;
1942                         goto done;
1943                 }
1944                 brcmf_dbg(INFO, "using PSK offload\n");
1945                 profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
1946         }
1947
1948         if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1949                 /* enable firmware supplicant for this interface */
1950                 err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
1951                 if (err < 0) {
1952                         brcmf_err("failed to enable fw supplicant\n");
1953                         goto done;
1954                 }
1955         }
1956
1957         if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
1958                 err = brcmf_set_pmk(ifp, sme->crypto.psk,
1959                                     BRCMF_WSEC_MAX_PSK_LEN);
1960                 if (err)
1961                         goto done;
1962         }
1963
1964         /* Join with specific BSSID and cached SSID
1965          * If SSID is zero join based on BSSID only
1966          */
1967         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
1968                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
1969         if (cfg->channel)
1970                 join_params_size += sizeof(u16);
1971         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
1972         if (ext_join_params == NULL) {
1973                 err = -ENOMEM;
1974                 goto done;
1975         }
1976         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
1977         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
1978         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
1979         if (ssid_len < IEEE80211_MAX_SSID_LEN)
1980                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
1981                           ext_join_params->ssid_le.SSID, ssid_len);
1982
1983         /* Set up join scan parameters */
1984         ext_join_params->scan_le.scan_type = -1;
1985         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
1986
1987         if (sme->bssid)
1988                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
1989         else
1990                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
1991
1992         if (cfg->channel) {
1993                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
1994
1995                 ext_join_params->assoc_le.chanspec_list[0] =
1996                         cpu_to_le16(chanspec);
1997                 /* Increase dwell time to receive probe response or detect
1998                  * beacon from target AP at a noisy air only during connect
1999                  * command.
2000                  */
2001                 ext_join_params->scan_le.active_time =
2002                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2003                 ext_join_params->scan_le.passive_time =
2004                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2005                 /* To sync with presence period of VSDB GO send probe request
2006                  * more frequently. Probe request will be stopped when it gets
2007                  * probe response from target AP/GO.
2008                  */
2009                 ext_join_params->scan_le.nprobes =
2010                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2011                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2012         } else {
2013                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2014                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2015                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2016         }
2017
2018         brcmf_set_join_pref(ifp, &sme->bss_select);
2019
2020         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2021                                          join_params_size);
2022         kfree(ext_join_params);
2023         if (!err)
2024                 /* This is it. join command worked, we are done */
2025                 goto done;
2026
2027         /* join command failed, fallback to set ssid */
2028         memset(&join_params, 0, sizeof(join_params));
2029         join_params_size = sizeof(join_params.ssid_le);
2030
2031         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2032         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2033
2034         if (sme->bssid)
2035                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2036         else
2037                 eth_broadcast_addr(join_params.params_le.bssid);
2038
2039         if (cfg->channel) {
2040                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2041                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2042                 join_params_size += sizeof(join_params.params_le);
2043         }
2044         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2045                                      &join_params, join_params_size);
2046         if (err)
2047                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2048
2049 done:
2050         if (err)
2051                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2052         brcmf_dbg(TRACE, "Exit\n");
2053         return err;
2054 }
2055
2056 static s32
2057 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2058                        u16 reason_code)
2059 {
2060         struct brcmf_if *ifp = netdev_priv(ndev);
2061         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2062         struct brcmf_scb_val_le scbval;
2063         s32 err = 0;
2064
2065         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2066         if (!check_vif_up(ifp->vif))
2067                 return -EIO;
2068
2069         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2070         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2071         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2072
2073         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2074         scbval.val = cpu_to_le32(reason_code);
2075         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2076                                      &scbval, sizeof(scbval));
2077         if (err)
2078                 brcmf_err("error (%d)\n", err);
2079
2080         brcmf_dbg(TRACE, "Exit\n");
2081         return err;
2082 }
2083
2084 static s32
2085 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2086                             enum nl80211_tx_power_setting type, s32 mbm)
2087 {
2088         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2089         struct net_device *ndev = cfg_to_ndev(cfg);
2090         struct brcmf_if *ifp = netdev_priv(ndev);
2091         s32 err;
2092         s32 disable;
2093         u32 qdbm = 127;
2094
2095         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2096         if (!check_vif_up(ifp->vif))
2097                 return -EIO;
2098
2099         switch (type) {
2100         case NL80211_TX_POWER_AUTOMATIC:
2101                 break;
2102         case NL80211_TX_POWER_LIMITED:
2103         case NL80211_TX_POWER_FIXED:
2104                 if (mbm < 0) {
2105                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2106                         err = -EINVAL;
2107                         goto done;
2108                 }
2109                 qdbm =  MBM_TO_DBM(4 * mbm);
2110                 if (qdbm > 127)
2111                         qdbm = 127;
2112                 qdbm |= WL_TXPWR_OVERRIDE;
2113                 break;
2114         default:
2115                 brcmf_err("Unsupported type %d\n", type);
2116                 err = -EINVAL;
2117                 goto done;
2118         }
2119         /* Make sure radio is off or on as far as software is concerned */
2120         disable = WL_RADIO_SW_DISABLE << 16;
2121         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2122         if (err)
2123                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2124
2125         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2126         if (err)
2127                 brcmf_err("qtxpower error (%d)\n", err);
2128
2129 done:
2130         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2131         return err;
2132 }
2133
2134 static s32
2135 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2136                             s32 *dbm)
2137 {
2138         struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2139         s32 qdbm = 0;
2140         s32 err;
2141
2142         brcmf_dbg(TRACE, "Enter\n");
2143         if (!check_vif_up(vif))
2144                 return -EIO;
2145
2146         err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2147         if (err) {
2148                 brcmf_err("error (%d)\n", err);
2149                 goto done;
2150         }
2151         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2152
2153 done:
2154         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2155         return err;
2156 }
2157
2158 static s32
2159 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2160                                   u8 key_idx, bool unicast, bool multicast)
2161 {
2162         struct brcmf_if *ifp = netdev_priv(ndev);
2163         u32 index;
2164         u32 wsec;
2165         s32 err = 0;
2166
2167         brcmf_dbg(TRACE, "Enter\n");
2168         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2169         if (!check_vif_up(ifp->vif))
2170                 return -EIO;
2171
2172         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2173         if (err) {
2174                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2175                 goto done;
2176         }
2177
2178         if (wsec & WEP_ENABLED) {
2179                 /* Just select a new current key */
2180                 index = key_idx;
2181                 err = brcmf_fil_cmd_int_set(ifp,
2182                                             BRCMF_C_SET_KEY_PRIMARY, index);
2183                 if (err)
2184                         brcmf_err("error (%d)\n", err);
2185         }
2186 done:
2187         brcmf_dbg(TRACE, "Exit\n");
2188         return err;
2189 }
2190
2191 static s32
2192 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2193                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2194 {
2195         struct brcmf_if *ifp = netdev_priv(ndev);
2196         struct brcmf_wsec_key *key;
2197         s32 err;
2198
2199         brcmf_dbg(TRACE, "Enter\n");
2200         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2201
2202         if (!check_vif_up(ifp->vif))
2203                 return -EIO;
2204
2205         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2206                 /* we ignore this key index in this case */
2207                 return -EINVAL;
2208         }
2209
2210         key = &ifp->vif->profile.key[key_idx];
2211
2212         if (key->algo == CRYPTO_ALGO_OFF) {
2213                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2214                 return -EINVAL;
2215         }
2216
2217         memset(key, 0, sizeof(*key));
2218         key->index = (u32)key_idx;
2219         key->flags = BRCMF_PRIMARY_KEY;
2220
2221         /* Clear the key/index */
2222         err = send_key_to_dongle(ifp, key);
2223
2224         brcmf_dbg(TRACE, "Exit\n");
2225         return err;
2226 }
2227
2228 static s32
2229 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2230                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2231                        struct key_params *params)
2232 {
2233         struct brcmf_if *ifp = netdev_priv(ndev);
2234         struct brcmf_wsec_key *key;
2235         s32 val;
2236         s32 wsec;
2237         s32 err;
2238         u8 keybuf[8];
2239         bool ext_key;
2240
2241         brcmf_dbg(TRACE, "Enter\n");
2242         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2243         if (!check_vif_up(ifp->vif))
2244                 return -EIO;
2245
2246         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2247                 /* we ignore this key index in this case */
2248                 brcmf_err("invalid key index (%d)\n", key_idx);
2249                 return -EINVAL;
2250         }
2251
2252         if (params->key_len == 0)
2253                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2254                                               mac_addr);
2255
2256         if (params->key_len > sizeof(key->data)) {
2257                 brcmf_err("Too long key length (%u)\n", params->key_len);
2258                 return -EINVAL;
2259         }
2260
2261         ext_key = false;
2262         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2263             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2264                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2265                 ext_key = true;
2266         }
2267
2268         key = &ifp->vif->profile.key[key_idx];
2269         memset(key, 0, sizeof(*key));
2270         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2271                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2272         key->len = params->key_len;
2273         key->index = key_idx;
2274         memcpy(key->data, params->key, key->len);
2275         if (!ext_key)
2276                 key->flags = BRCMF_PRIMARY_KEY;
2277
2278         switch (params->cipher) {
2279         case WLAN_CIPHER_SUITE_WEP40:
2280                 key->algo = CRYPTO_ALGO_WEP1;
2281                 val = WEP_ENABLED;
2282                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2283                 break;
2284         case WLAN_CIPHER_SUITE_WEP104:
2285                 key->algo = CRYPTO_ALGO_WEP128;
2286                 val = WEP_ENABLED;
2287                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2288                 break;
2289         case WLAN_CIPHER_SUITE_TKIP:
2290                 if (!brcmf_is_apmode(ifp->vif)) {
2291                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2292                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2293                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2294                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2295                 }
2296                 key->algo = CRYPTO_ALGO_TKIP;
2297                 val = TKIP_ENABLED;
2298                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2299                 break;
2300         case WLAN_CIPHER_SUITE_AES_CMAC:
2301                 key->algo = CRYPTO_ALGO_AES_CCM;
2302                 val = AES_ENABLED;
2303                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2304                 break;
2305         case WLAN_CIPHER_SUITE_CCMP:
2306                 key->algo = CRYPTO_ALGO_AES_CCM;
2307                 val = AES_ENABLED;
2308                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2309                 break;
2310         default:
2311                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2312                 err = -EINVAL;
2313                 goto done;
2314         }
2315
2316         err = send_key_to_dongle(ifp, key);
2317         if (ext_key || err)
2318                 goto done;
2319
2320         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2321         if (err) {
2322                 brcmf_err("get wsec error (%d)\n", err);
2323                 goto done;
2324         }
2325         wsec |= val;
2326         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2327         if (err) {
2328                 brcmf_err("set wsec error (%d)\n", err);
2329                 goto done;
2330         }
2331
2332 done:
2333         brcmf_dbg(TRACE, "Exit\n");
2334         return err;
2335 }
2336
2337 static s32
2338 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2339                        bool pairwise, const u8 *mac_addr, void *cookie,
2340                        void (*callback)(void *cookie,
2341                                         struct key_params *params))
2342 {
2343         struct key_params params;
2344         struct brcmf_if *ifp = netdev_priv(ndev);
2345         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2346         struct brcmf_cfg80211_security *sec;
2347         s32 wsec;
2348         s32 err = 0;
2349
2350         brcmf_dbg(TRACE, "Enter\n");
2351         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2352         if (!check_vif_up(ifp->vif))
2353                 return -EIO;
2354
2355         memset(&params, 0, sizeof(params));
2356
2357         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2358         if (err) {
2359                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2360                 /* Ignore this error, may happen during DISASSOC */
2361                 err = -EAGAIN;
2362                 goto done;
2363         }
2364         if (wsec & WEP_ENABLED) {
2365                 sec = &profile->sec;
2366                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2367                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2368                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2369                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2370                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2371                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2372                 }
2373         } else if (wsec & TKIP_ENABLED) {
2374                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2375                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2376         } else if (wsec & AES_ENABLED) {
2377                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2378                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2379         } else  {
2380                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2381                 err = -EINVAL;
2382                 goto done;
2383         }
2384         callback(cookie, &params);
2385
2386 done:
2387         brcmf_dbg(TRACE, "Exit\n");
2388         return err;
2389 }
2390
2391 static s32
2392 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2393                                        struct net_device *ndev, u8 key_idx)
2394 {
2395         struct brcmf_if *ifp = netdev_priv(ndev);
2396
2397         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2398
2399         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2400                 return 0;
2401
2402         brcmf_dbg(INFO, "Not supported\n");
2403
2404         return -EOPNOTSUPP;
2405 }
2406
2407 static void
2408 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2409 {
2410         s32 err;
2411         u8 key_idx;
2412         struct brcmf_wsec_key *key;
2413         s32 wsec;
2414
2415         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2416                 key = &ifp->vif->profile.key[key_idx];
2417                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2418                     (key->algo == CRYPTO_ALGO_WEP128))
2419                         break;
2420         }
2421         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2422                 return;
2423
2424         err = send_key_to_dongle(ifp, key);
2425         if (err) {
2426                 brcmf_err("Setting WEP key failed (%d)\n", err);
2427                 return;
2428         }
2429         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2430         if (err) {
2431                 brcmf_err("get wsec error (%d)\n", err);
2432                 return;
2433         }
2434         wsec |= WEP_ENABLED;
2435         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2436         if (err)
2437                 brcmf_err("set wsec error (%d)\n", err);
2438 }
2439
2440 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2441 {
2442         struct nl80211_sta_flag_update *sfu;
2443
2444         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2445         si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
2446         sfu = &si->sta_flags;
2447         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2448                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2449                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2450                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2451         if (fw_sta_flags & BRCMF_STA_WME)
2452                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2453         if (fw_sta_flags & BRCMF_STA_AUTHE)
2454                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2455         if (fw_sta_flags & BRCMF_STA_ASSOC)
2456                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2457         if (fw_sta_flags & BRCMF_STA_AUTHO)
2458                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2459 }
2460
2461 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2462 {
2463         struct {
2464                 __le32 len;
2465                 struct brcmf_bss_info_le bss_le;
2466         } *buf;
2467         u16 capability;
2468         int err;
2469
2470         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2471         if (!buf)
2472                 return;
2473
2474         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2475         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2476                                      WL_BSS_INFO_MAX);
2477         if (err) {
2478                 brcmf_err("Failed to get bss info (%d)\n", err);
2479                 goto out_kfree;
2480         }
2481         si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
2482         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2483         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2484         capability = le16_to_cpu(buf->bss_le.capability);
2485         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2486                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2487         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2488                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2489         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2490                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2491
2492 out_kfree:
2493         kfree(buf);
2494 }
2495
2496 static s32
2497 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2498                                 struct station_info *sinfo)
2499 {
2500         struct brcmf_scb_val_le scbval;
2501         struct brcmf_pktcnt_le pktcnt;
2502         s32 err;
2503         u32 rate;
2504         u32 rssi;
2505
2506         /* Get the current tx rate */
2507         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2508         if (err < 0) {
2509                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2510                 return err;
2511         }
2512         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2513         sinfo->txrate.legacy = rate * 5;
2514
2515         memset(&scbval, 0, sizeof(scbval));
2516         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2517                                      sizeof(scbval));
2518         if (err) {
2519                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2520                 return err;
2521         }
2522         rssi = le32_to_cpu(scbval.val);
2523         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2524         sinfo->signal = rssi;
2525
2526         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2527                                      sizeof(pktcnt));
2528         if (err) {
2529                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2530                 return err;
2531         }
2532         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
2533                          BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
2534                          BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
2535                          BIT_ULL(NL80211_STA_INFO_TX_FAILED);
2536         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2537         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2538         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2539         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2540
2541         return 0;
2542 }
2543
2544 static s32
2545 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2546                            const u8 *mac, struct station_info *sinfo)
2547 {
2548         struct brcmf_if *ifp = netdev_priv(ndev);
2549         struct brcmf_scb_val_le scb_val;
2550         s32 err = 0;
2551         struct brcmf_sta_info_le sta_info_le;
2552         u32 sta_flags;
2553         u32 is_tdls_peer;
2554         s32 total_rssi;
2555         s32 count_rssi;
2556         int rssi;
2557         u32 i;
2558
2559         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2560         if (!check_vif_up(ifp->vif))
2561                 return -EIO;
2562
2563         if (brcmf_is_ibssmode(ifp->vif))
2564                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2565
2566         memset(&sta_info_le, 0, sizeof(sta_info_le));
2567         memcpy(&sta_info_le, mac, ETH_ALEN);
2568         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2569                                        &sta_info_le,
2570                                        sizeof(sta_info_le));
2571         is_tdls_peer = !err;
2572         if (err) {
2573                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2574                                                &sta_info_le,
2575                                                sizeof(sta_info_le));
2576                 if (err < 0) {
2577                         brcmf_err("GET STA INFO failed, %d\n", err);
2578                         goto done;
2579                 }
2580         }
2581         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2582         sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
2583         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2584         sta_flags = le32_to_cpu(sta_info_le.flags);
2585         brcmf_convert_sta_flags(sta_flags, sinfo);
2586         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2587         if (is_tdls_peer)
2588                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2589         else
2590                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2591         if (sta_flags & BRCMF_STA_ASSOC) {
2592                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
2593                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2594                 brcmf_fill_bss_param(ifp, sinfo);
2595         }
2596         if (sta_flags & BRCMF_STA_SCBSTATS) {
2597                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
2598                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2599                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
2600                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2601                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2602                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
2603                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2604                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2605                 if (sinfo->tx_packets) {
2606                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2607                         sinfo->txrate.legacy =
2608                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2609                 }
2610                 if (sinfo->rx_packets) {
2611                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
2612                         sinfo->rxrate.legacy =
2613                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2614                 }
2615                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2616                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
2617                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2618                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
2619                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2620                 }
2621                 total_rssi = 0;
2622                 count_rssi = 0;
2623                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2624                         if (sta_info_le.rssi[i]) {
2625                                 sinfo->chain_signal_avg[count_rssi] =
2626                                         sta_info_le.rssi[i];
2627                                 sinfo->chain_signal[count_rssi] =
2628                                         sta_info_le.rssi[i];
2629                                 total_rssi += sta_info_le.rssi[i];
2630                                 count_rssi++;
2631                         }
2632                 }
2633                 if (count_rssi) {
2634                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
2635                         sinfo->chains = count_rssi;
2636
2637                         sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2638                         total_rssi /= count_rssi;
2639                         sinfo->signal = total_rssi;
2640                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2641                         &ifp->vif->sme_state)) {
2642                         memset(&scb_val, 0, sizeof(scb_val));
2643                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2644                                                      &scb_val, sizeof(scb_val));
2645                         if (err) {
2646                                 brcmf_err("Could not get rssi (%d)\n", err);
2647                                 goto done;
2648                         } else {
2649                                 rssi = le32_to_cpu(scb_val.val);
2650                                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2651                                 sinfo->signal = rssi;
2652                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2653                         }
2654                 }
2655         }
2656 done:
2657         brcmf_dbg(TRACE, "Exit\n");
2658         return err;
2659 }
2660
2661 static int
2662 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2663                             int idx, u8 *mac, struct station_info *sinfo)
2664 {
2665         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2666         struct brcmf_if *ifp = netdev_priv(ndev);
2667         s32 err;
2668
2669         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2670
2671         if (idx == 0) {
2672                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2673                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2674                                              &cfg->assoclist,
2675                                              sizeof(cfg->assoclist));
2676                 if (err) {
2677                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2678                                   err);
2679                         cfg->assoclist.count = 0;
2680                         return -EOPNOTSUPP;
2681                 }
2682         }
2683         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2684                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2685                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2686         }
2687         return -ENOENT;
2688 }
2689
2690 static s32
2691 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2692                            bool enabled, s32 timeout)
2693 {
2694         s32 pm;
2695         s32 err = 0;
2696         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2697         struct brcmf_if *ifp = netdev_priv(ndev);
2698
2699         brcmf_dbg(TRACE, "Enter\n");
2700
2701         /*
2702          * Powersave enable/disable request is coming from the
2703          * cfg80211 even before the interface is up. In that
2704          * scenario, driver will be storing the power save
2705          * preference in cfg struct to apply this to
2706          * FW later while initializing the dongle
2707          */
2708         cfg->pwr_save = enabled;
2709         if (!check_vif_up(ifp->vif)) {
2710
2711                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2712                 goto done;
2713         }
2714
2715         pm = enabled ? PM_FAST : PM_OFF;
2716         /* Do not enable the power save after assoc if it is a p2p interface */
2717         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2718                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2719                 pm = PM_OFF;
2720         }
2721         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2722
2723         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2724         if (err) {
2725                 if (err == -ENODEV)
2726                         brcmf_err("net_device is not ready yet\n");
2727                 else
2728                         brcmf_err("error (%d)\n", err);
2729         }
2730 done:
2731         brcmf_dbg(TRACE, "Exit\n");
2732         return err;
2733 }
2734
2735 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2736                                    struct brcmf_bss_info_le *bi)
2737 {
2738         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2739         struct cfg80211_bss *bss;
2740         enum nl80211_band band;
2741         struct brcmu_chan ch;
2742         u16 channel;
2743         u32 freq;
2744         u16 notify_capability;
2745         u16 notify_interval;
2746         u8 *notify_ie;
2747         size_t notify_ielen;
2748         struct cfg80211_inform_bss bss_data = {};
2749
2750         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2751                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2752                 return 0;
2753         }
2754
2755         if (!bi->ctl_ch) {
2756                 ch.chspec = le16_to_cpu(bi->chanspec);
2757                 cfg->d11inf.decchspec(&ch);
2758                 bi->ctl_ch = ch.control_ch_num;
2759         }
2760         channel = bi->ctl_ch;
2761
2762         if (channel <= CH_MAX_2G_CHANNEL)
2763                 band = NL80211_BAND_2GHZ;
2764         else
2765                 band = NL80211_BAND_5GHZ;
2766
2767         freq = ieee80211_channel_to_frequency(channel, band);
2768         bss_data.chan = ieee80211_get_channel(wiphy, freq);
2769         bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
2770         bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
2771
2772         notify_capability = le16_to_cpu(bi->capability);
2773         notify_interval = le16_to_cpu(bi->beacon_period);
2774         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2775         notify_ielen = le32_to_cpu(bi->ie_length);
2776         bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2777
2778         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2779         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2780         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2781         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2782         brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
2783
2784         bss = cfg80211_inform_bss_data(wiphy, &bss_data,
2785                                        CFG80211_BSS_FTYPE_UNKNOWN,
2786                                        (const u8 *)bi->BSSID,
2787                                        0, notify_capability,
2788                                        notify_interval, notify_ie,
2789                                        notify_ielen, GFP_KERNEL);
2790
2791         if (!bss)
2792                 return -ENOMEM;
2793
2794         cfg80211_put_bss(wiphy, bss);
2795
2796         return 0;
2797 }
2798
2799 static struct brcmf_bss_info_le *
2800 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2801 {
2802         if (bss == NULL)
2803                 return list->bss_info_le;
2804         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2805                                             le32_to_cpu(bss->length));
2806 }
2807
2808 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2809 {
2810         struct brcmf_scan_results *bss_list;
2811         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2812         s32 err = 0;
2813         int i;
2814
2815         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2816         if (bss_list->count != 0 &&
2817             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2818                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2819                           bss_list->version);
2820                 return -EOPNOTSUPP;
2821         }
2822         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2823         for (i = 0; i < bss_list->count; i++) {
2824                 bi = next_bss_le(bss_list, bi);
2825                 err = brcmf_inform_single_bss(cfg, bi);
2826                 if (err)
2827                         break;
2828         }
2829         return err;
2830 }
2831
2832 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2833                              struct net_device *ndev, const u8 *bssid)
2834 {
2835         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2836         struct ieee80211_channel *notify_channel;
2837         struct brcmf_bss_info_le *bi = NULL;
2838         struct ieee80211_supported_band *band;
2839         struct cfg80211_bss *bss;
2840         struct brcmu_chan ch;
2841         u8 *buf = NULL;
2842         s32 err = 0;
2843         u32 freq;
2844         u16 notify_capability;
2845         u16 notify_interval;
2846         u8 *notify_ie;
2847         size_t notify_ielen;
2848         s32 notify_signal;
2849
2850         brcmf_dbg(TRACE, "Enter\n");
2851
2852         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2853         if (buf == NULL) {
2854                 err = -ENOMEM;
2855                 goto CleanUp;
2856         }
2857
2858         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2859
2860         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2861                                      buf, WL_BSS_INFO_MAX);
2862         if (err) {
2863                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2864                 goto CleanUp;
2865         }
2866
2867         bi = (struct brcmf_bss_info_le *)(buf + 4);
2868
2869         ch.chspec = le16_to_cpu(bi->chanspec);
2870         cfg->d11inf.decchspec(&ch);
2871
2872         if (ch.band == BRCMU_CHAN_BAND_2G)
2873                 band = wiphy->bands[NL80211_BAND_2GHZ];
2874         else
2875                 band = wiphy->bands[NL80211_BAND_5GHZ];
2876
2877         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2878         cfg->channel = freq;
2879         notify_channel = ieee80211_get_channel(wiphy, freq);
2880
2881         notify_capability = le16_to_cpu(bi->capability);
2882         notify_interval = le16_to_cpu(bi->beacon_period);
2883         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2884         notify_ielen = le32_to_cpu(bi->ie_length);
2885         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2886
2887         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2888         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2889         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2890         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2891
2892         bss = cfg80211_inform_bss(wiphy, notify_channel,
2893                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2894                                   notify_capability, notify_interval,
2895                                   notify_ie, notify_ielen, notify_signal,
2896                                   GFP_KERNEL);
2897
2898         if (!bss) {
2899                 err = -ENOMEM;
2900                 goto CleanUp;
2901         }
2902
2903         cfg80211_put_bss(wiphy, bss);
2904
2905 CleanUp:
2906
2907         kfree(buf);
2908
2909         brcmf_dbg(TRACE, "Exit\n");
2910
2911         return err;
2912 }
2913
2914 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2915                                  struct brcmf_if *ifp)
2916 {
2917         struct brcmf_bss_info_le *bi;
2918         const struct brcmf_tlv *tim;
2919         u16 beacon_interval;
2920         u8 dtim_period;
2921         size_t ie_len;
2922         u8 *ie;
2923         s32 err = 0;
2924
2925         brcmf_dbg(TRACE, "Enter\n");
2926         if (brcmf_is_ibssmode(ifp->vif))
2927                 return err;
2928
2929         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2930         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2931                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2932         if (err) {
2933                 brcmf_err("Could not get bss info %d\n", err);
2934                 goto update_bss_info_out;
2935         }
2936
2937         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2938         err = brcmf_inform_single_bss(cfg, bi);
2939         if (err)
2940                 goto update_bss_info_out;
2941
2942         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2943         ie_len = le32_to_cpu(bi->ie_length);
2944         beacon_interval = le16_to_cpu(bi->beacon_period);
2945
2946         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2947         if (tim)
2948                 dtim_period = tim->data[1];
2949         else {
2950                 /*
2951                 * active scan was done so we could not get dtim
2952                 * information out of probe response.
2953                 * so we speficially query dtim information to dongle.
2954                 */
2955                 u32 var;
2956                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2957                 if (err) {
2958                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2959                         goto update_bss_info_out;
2960                 }
2961                 dtim_period = (u8)var;
2962         }
2963
2964 update_bss_info_out:
2965         brcmf_dbg(TRACE, "Exit");
2966         return err;
2967 }
2968
2969 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
2970 {
2971         struct escan_info *escan = &cfg->escan_info;
2972
2973         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2974         if (cfg->int_escan_map || cfg->scan_request) {
2975                 escan->escan_state = WL_ESCAN_STATE_IDLE;
2976                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
2977         }
2978         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
2979         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2980 }
2981
2982 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
2983 {
2984         struct brcmf_cfg80211_info *cfg =
2985                         container_of(work, struct brcmf_cfg80211_info,
2986                                      escan_timeout_work);
2987
2988         brcmf_inform_bss(cfg);
2989         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
2990 }
2991
2992 static void brcmf_escan_timeout(struct timer_list *t)
2993 {
2994         struct brcmf_cfg80211_info *cfg =
2995                         from_timer(cfg, t, escan_timeout);
2996
2997         if (cfg->int_escan_map || cfg->scan_request) {
2998                 brcmf_err("timer expired\n");
2999                 schedule_work(&cfg->escan_timeout_work);
3000         }
3001 }
3002
3003 static s32
3004 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3005                               struct brcmf_bss_info_le *bss,
3006                               struct brcmf_bss_info_le *bss_info_le)
3007 {
3008         struct brcmu_chan ch_bss, ch_bss_info_le;
3009
3010         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3011         cfg->d11inf.decchspec(&ch_bss);
3012         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3013         cfg->d11inf.decchspec(&ch_bss_info_le);
3014
3015         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3016                 ch_bss.band == ch_bss_info_le.band &&
3017                 bss_info_le->SSID_len == bss->SSID_len &&
3018                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3019                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3020                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3021                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3022                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3023
3024                         /* preserve max RSSI if the measurements are
3025                         * both on-channel or both off-channel
3026                         */
3027                         if (bss_info_rssi > bss_rssi)
3028                                 bss->RSSI = bss_info_le->RSSI;
3029                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3030                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3031                         /* preserve the on-channel rssi measurement
3032                         * if the new measurement is off channel
3033                         */
3034                         bss->RSSI = bss_info_le->RSSI;
3035                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3036                 }
3037                 return 1;
3038         }
3039         return 0;
3040 }
3041
3042 static s32
3043 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3044                              const struct brcmf_event_msg *e, void *data)
3045 {
3046         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3047         s32 status;
3048         struct brcmf_escan_result_le *escan_result_le;
3049         u32 escan_buflen;
3050         struct brcmf_bss_info_le *bss_info_le;
3051         struct brcmf_bss_info_le *bss = NULL;
3052         u32 bi_length;
3053         struct brcmf_scan_results *list;
3054         u32 i;
3055         bool aborted;
3056
3057         status = e->status;
3058
3059         if (status == BRCMF_E_STATUS_ABORT)
3060                 goto exit;
3061
3062         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3063                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3064                 return -EPERM;
3065         }
3066
3067         if (status == BRCMF_E_STATUS_PARTIAL) {
3068                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3069                 if (e->datalen < sizeof(*escan_result_le)) {
3070                         brcmf_err("invalid event data length\n");
3071                         goto exit;
3072                 }
3073                 escan_result_le = (struct brcmf_escan_result_le *) data;
3074                 if (!escan_result_le) {
3075                         brcmf_err("Invalid escan result (NULL pointer)\n");
3076                         goto exit;
3077                 }
3078                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3079                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3080                     escan_buflen > e->datalen ||
3081                     escan_buflen < sizeof(*escan_result_le)) {
3082                         brcmf_err("Invalid escan buffer length: %d\n",
3083                                   escan_buflen);
3084                         goto exit;
3085                 }
3086                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3087                         brcmf_err("Invalid bss_count %d: ignoring\n",
3088                                   escan_result_le->bss_count);
3089                         goto exit;
3090                 }
3091                 bss_info_le = &escan_result_le->bss_info_le;
3092
3093                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3094                         goto exit;
3095
3096                 if (!cfg->int_escan_map && !cfg->scan_request) {
3097                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3098                         goto exit;
3099                 }
3100
3101                 bi_length = le32_to_cpu(bss_info_le->length);
3102                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3103                         brcmf_err("Ignoring invalid bss_info length: %d\n",
3104                                   bi_length);
3105                         goto exit;
3106                 }
3107
3108                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3109                                         BIT(NL80211_IFTYPE_ADHOC))) {
3110                         if (le16_to_cpu(bss_info_le->capability) &
3111                                                 WLAN_CAPABILITY_IBSS) {
3112                                 brcmf_err("Ignoring IBSS result\n");
3113                                 goto exit;
3114                         }
3115                 }
3116
3117                 list = (struct brcmf_scan_results *)
3118                                 cfg->escan_info.escan_buf;
3119                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3120                         brcmf_err("Buffer is too small: ignoring\n");
3121                         goto exit;
3122                 }
3123
3124                 for (i = 0; i < list->count; i++) {
3125                         bss = bss ? (struct brcmf_bss_info_le *)
3126                                 ((unsigned char *)bss +
3127                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3128                         if (brcmf_compare_update_same_bss(cfg, bss,
3129                                                           bss_info_le))
3130                                 goto exit;
3131                 }
3132                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3133                        bi_length);
3134                 list->version = le32_to_cpu(bss_info_le->version);
3135                 list->buflen += bi_length;
3136                 list->count++;
3137         } else {
3138                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3139                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3140                         goto exit;
3141                 if (cfg->int_escan_map || cfg->scan_request) {
3142                         brcmf_inform_bss(cfg);
3143                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3144                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3145                 } else
3146                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3147                                   status);
3148         }
3149 exit:
3150         return 0;
3151 }
3152
3153 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3154 {
3155         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3156                             brcmf_cfg80211_escan_handler);
3157         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3158         /* Init scan_timeout timer */
3159         timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3160         INIT_WORK(&cfg->escan_timeout_work,
3161                   brcmf_cfg80211_escan_timeout_worker);
3162 }
3163
3164 static struct cfg80211_scan_request *
3165 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3166         struct cfg80211_scan_request *req;
3167         size_t req_size;
3168
3169         req_size = sizeof(*req) +
3170                    n_netinfo * sizeof(req->channels[0]) +
3171                    n_netinfo * sizeof(*req->ssids);
3172
3173         req = kzalloc(req_size, GFP_KERNEL);
3174         if (req) {
3175                 req->wiphy = wiphy;
3176                 req->ssids = (void *)(&req->channels[0]) +
3177                              n_netinfo * sizeof(req->channels[0]);
3178         }
3179         return req;
3180 }
3181
3182 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3183                                          u8 *ssid, u8 ssid_len, u8 channel)
3184 {
3185         struct ieee80211_channel *chan;
3186         enum nl80211_band band;
3187         int freq, i;
3188
3189         if (channel <= CH_MAX_2G_CHANNEL)
3190                 band = NL80211_BAND_2GHZ;
3191         else
3192                 band = NL80211_BAND_5GHZ;
3193
3194         freq = ieee80211_channel_to_frequency(channel, band);
3195         if (!freq)
3196                 return -EINVAL;
3197
3198         chan = ieee80211_get_channel(req->wiphy, freq);
3199         if (!chan)
3200                 return -EINVAL;
3201
3202         for (i = 0; i < req->n_channels; i++) {
3203                 if (req->channels[i] == chan)
3204                         break;
3205         }
3206         if (i == req->n_channels)
3207                 req->channels[req->n_channels++] = chan;
3208
3209         for (i = 0; i < req->n_ssids; i++) {
3210                 if (req->ssids[i].ssid_len == ssid_len &&
3211                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3212                         break;
3213         }
3214         if (i == req->n_ssids) {
3215                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3216                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3217         }
3218         return 0;
3219 }
3220
3221 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3222                                       struct cfg80211_scan_request *request)
3223 {
3224         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3225         int err;
3226
3227         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3228                 if (cfg->int_escan_map)
3229                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3230                                   cfg->int_escan_map);
3231                 /* Abort any on-going scan */
3232                 brcmf_abort_scanning(cfg);
3233         }
3234
3235         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3236         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3237         cfg->escan_info.run = brcmf_run_escan;
3238         err = brcmf_do_escan(ifp, request);
3239         if (err) {
3240                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3241                 return err;
3242         }
3243         cfg->int_escan_map = fwmap;
3244         return 0;
3245 }
3246
3247 static struct brcmf_pno_net_info_le *
3248 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3249 {
3250         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3251         struct brcmf_pno_net_info_le *netinfo;
3252
3253         switch (pfn_v1->version) {
3254         default:
3255                 WARN_ON(1);
3256                 /* fall-thru */
3257         case cpu_to_le32(1):
3258                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3259                 break;
3260         case cpu_to_le32(2):
3261                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3262                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3263                 break;
3264         }
3265
3266         return netinfo;
3267 }
3268
3269 /* PFN result doesn't have all the info which are required by the supplicant
3270  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3271  * via wl_inform_single_bss in the required format. Escan does require the
3272  * scan request in the form of cfg80211_scan_request. For timebeing, create
3273  * cfg80211_scan_request one out of the received PNO event.
3274  */
3275 static s32
3276 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3277                                 const struct brcmf_event_msg *e, void *data)
3278 {
3279         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3280         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3281         struct cfg80211_scan_request *request = NULL;
3282         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3283         int i, err = 0;
3284         struct brcmf_pno_scanresults_le *pfn_result;
3285         u32 bucket_map;
3286         u32 result_count;
3287         u32 status;
3288         u32 datalen;
3289
3290         brcmf_dbg(SCAN, "Enter\n");
3291
3292         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3293                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3294                 return 0;
3295         }
3296
3297         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3298                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3299                 return 0;
3300         }
3301
3302         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3303         result_count = le32_to_cpu(pfn_result->count);
3304         status = le32_to_cpu(pfn_result->status);
3305
3306         /* PFN event is limited to fit 512 bytes so we may get
3307          * multiple NET_FOUND events. For now place a warning here.
3308          */
3309         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3310         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3311         if (!result_count) {
3312                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3313                 goto out_err;
3314         }
3315
3316         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3317         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3318         if (datalen < result_count * sizeof(*netinfo)) {
3319                 brcmf_err("insufficient event data\n");
3320                 goto out_err;
3321         }
3322
3323         request = brcmf_alloc_internal_escan_request(wiphy,
3324                                                      result_count);
3325         if (!request) {
3326                 err = -ENOMEM;
3327                 goto out_err;
3328         }
3329
3330         bucket_map = 0;
3331         for (i = 0; i < result_count; i++) {
3332                 netinfo = &netinfo_start[i];
3333
3334                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3335                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3336                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3337                           netinfo->SSID, netinfo->channel);
3338                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3339                 err = brcmf_internal_escan_add_info(request,
3340                                                     netinfo->SSID,
3341                                                     netinfo->SSID_len,
3342                                                     netinfo->channel);
3343                 if (err)
3344                         goto out_err;
3345         }
3346
3347         if (!bucket_map)
3348                 goto free_req;
3349
3350         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3351         if (!err)
3352                 goto free_req;
3353
3354 out_err:
3355         cfg80211_sched_scan_stopped(wiphy, 0);
3356 free_req:
3357         kfree(request);
3358         return err;
3359 }
3360
3361 static int
3362 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3363                                 struct net_device *ndev,
3364                                 struct cfg80211_sched_scan_request *req)
3365 {
3366         struct brcmf_if *ifp = netdev_priv(ndev);
3367         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3368
3369         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3370                   req->n_match_sets, req->n_ssids);
3371
3372         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3373                 brcmf_err("Scanning suppressed: status=%lu\n",
3374                           cfg->scan_status);
3375                 return -EAGAIN;
3376         }
3377
3378         if (req->n_match_sets <= 0) {
3379                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3380                           req->n_match_sets);
3381                 return -EINVAL;
3382         }
3383
3384         return brcmf_pno_start_sched_scan(ifp, req);
3385 }
3386
3387 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3388                                           struct net_device *ndev, u64 reqid)
3389 {
3390         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3391         struct brcmf_if *ifp = netdev_priv(ndev);
3392
3393         brcmf_dbg(SCAN, "enter\n");
3394         brcmf_pno_stop_sched_scan(ifp, reqid);
3395         if (cfg->int_escan_map)
3396                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3397         return 0;
3398 }
3399
3400 static __always_inline void brcmf_delay(u32 ms)
3401 {
3402         if (ms < 1000 / HZ) {
3403                 cond_resched();
3404                 mdelay(ms);
3405         } else {
3406                 msleep(ms);
3407         }
3408 }
3409
3410 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3411                                      u8 *pattern, u32 patternsize, u8 *mask,
3412                                      u32 packet_offset)
3413 {
3414         struct brcmf_fil_wowl_pattern_le *filter;
3415         u32 masksize;
3416         u32 patternoffset;
3417         u8 *buf;
3418         u32 bufsize;
3419         s32 ret;
3420
3421         masksize = (patternsize + 7) / 8;
3422         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3423
3424         bufsize = sizeof(*filter) + patternsize + masksize;
3425         buf = kzalloc(bufsize, GFP_KERNEL);
3426         if (!buf)
3427                 return -ENOMEM;
3428         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3429
3430         memcpy(filter->cmd, cmd, 4);
3431         filter->masksize = cpu_to_le32(masksize);
3432         filter->offset = cpu_to_le32(packet_offset);
3433         filter->patternoffset = cpu_to_le32(patternoffset);
3434         filter->patternsize = cpu_to_le32(patternsize);
3435         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3436
3437         if ((mask) && (masksize))
3438                 memcpy(buf + sizeof(*filter), mask, masksize);
3439         if ((pattern) && (patternsize))
3440                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3441
3442         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3443
3444         kfree(buf);
3445         return ret;
3446 }
3447
3448 static s32
3449 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3450                       void *data)
3451 {
3452         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3453         struct brcmf_pno_scanresults_le *pfn_result;
3454         struct brcmf_pno_net_info_le *netinfo;
3455
3456         brcmf_dbg(SCAN, "Enter\n");
3457
3458         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3459                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3460                 return 0;
3461         }
3462
3463         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3464
3465         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3466                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3467                 return 0;
3468         }
3469
3470         if (le32_to_cpu(pfn_result->count) < 1) {
3471                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3472                           le32_to_cpu(pfn_result->count));
3473                 return -EINVAL;
3474         }
3475
3476         netinfo = brcmf_get_netinfo_array(pfn_result);
3477         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3478         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3479         cfg->wowl.nd->n_channels = 1;
3480         cfg->wowl.nd->channels[0] =
3481                 ieee80211_channel_to_frequency(netinfo->channel,
3482                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3483                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3484         cfg->wowl.nd_info->n_matches = 1;
3485         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3486
3487         /* Inform (the resume task) that the net detect information was recvd */
3488         cfg->wowl.nd_data_completed = true;
3489         wake_up(&cfg->wowl.nd_data_wait);
3490
3491         return 0;
3492 }
3493
3494 #ifdef CONFIG_PM
3495
3496 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3497 {
3498         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3499         struct brcmf_wowl_wakeind_le wake_ind_le;
3500         struct cfg80211_wowlan_wakeup wakeup_data;
3501         struct cfg80211_wowlan_wakeup *wakeup;
3502         u32 wakeind;
3503         s32 err;
3504         int timeout;
3505
3506         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3507                                        sizeof(wake_ind_le));
3508         if (err) {
3509                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3510                 return;
3511         }
3512
3513         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3514         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3515                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3516                        BRCMF_WOWL_PFN_FOUND)) {
3517                 wakeup = &wakeup_data;
3518                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3519                 wakeup_data.pattern_idx = -1;
3520
3521                 if (wakeind & BRCMF_WOWL_MAGIC) {
3522                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3523                         wakeup_data.magic_pkt = true;
3524                 }
3525                 if (wakeind & BRCMF_WOWL_DIS) {
3526                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3527                         wakeup_data.disconnect = true;
3528                 }
3529                 if (wakeind & BRCMF_WOWL_BCN) {
3530                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3531                         wakeup_data.disconnect = true;
3532                 }
3533                 if (wakeind & BRCMF_WOWL_RETR) {
3534                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3535                         wakeup_data.disconnect = true;
3536                 }
3537                 if (wakeind & BRCMF_WOWL_NET) {
3538                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3539                         /* For now always map to pattern 0, no API to get
3540                          * correct information available at the moment.
3541                          */
3542                         wakeup_data.pattern_idx = 0;
3543                 }
3544                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3545                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3546                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3547                                 cfg->wowl.nd_data_completed,
3548                                 BRCMF_ND_INFO_TIMEOUT);
3549                         if (!timeout)
3550                                 brcmf_err("No result for wowl net detect\n");
3551                         else
3552                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3553                 }
3554                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3555                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3556                         wakeup_data.gtk_rekey_failure = true;
3557                 }
3558         } else {
3559                 wakeup = NULL;
3560         }
3561         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3562 }
3563
3564 #else
3565
3566 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3567 {
3568 }
3569
3570 #endif /* CONFIG_PM */
3571
3572 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3573 {
3574         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3575         struct net_device *ndev = cfg_to_ndev(cfg);
3576         struct brcmf_if *ifp = netdev_priv(ndev);
3577
3578         brcmf_dbg(TRACE, "Enter\n");
3579
3580         if (cfg->wowl.active) {
3581                 brcmf_report_wowl_wakeind(wiphy, ifp);
3582                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3583                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3584                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3585                         brcmf_configure_arp_nd_offload(ifp, true);
3586                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3587                                       cfg->wowl.pre_pmmode);
3588                 cfg->wowl.active = false;
3589                 if (cfg->wowl.nd_enabled) {
3590                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3591                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3592                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3593                                             brcmf_notify_sched_scan_results);
3594                         cfg->wowl.nd_enabled = false;
3595                 }
3596         }
3597         return 0;
3598 }
3599
3600 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3601                                  struct brcmf_if *ifp,
3602                                  struct cfg80211_wowlan *wowl)
3603 {
3604         u32 wowl_config;
3605         struct brcmf_wowl_wakeind_le wowl_wakeind;
3606         u32 i;
3607
3608         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3609
3610         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3611                 brcmf_configure_arp_nd_offload(ifp, false);
3612         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3613         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3614
3615         wowl_config = 0;
3616         if (wowl->disconnect)
3617                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3618         if (wowl->magic_pkt)
3619                 wowl_config |= BRCMF_WOWL_MAGIC;
3620         if ((wowl->patterns) && (wowl->n_patterns)) {
3621                 wowl_config |= BRCMF_WOWL_NET;
3622                 for (i = 0; i < wowl->n_patterns; i++) {
3623                         brcmf_config_wowl_pattern(ifp, "add",
3624                                 (u8 *)wowl->patterns[i].pattern,
3625                                 wowl->patterns[i].pattern_len,
3626                                 (u8 *)wowl->patterns[i].mask,
3627                                 wowl->patterns[i].pkt_offset);
3628                 }
3629         }
3630         if (wowl->nd_config) {
3631                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3632                                                 wowl->nd_config);
3633                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3634
3635                 cfg->wowl.nd_data_completed = false;
3636                 cfg->wowl.nd_enabled = true;
3637                 /* Now reroute the event for PFN to the wowl function. */
3638                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3639                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3640                                     brcmf_wowl_nd_results);
3641         }
3642         if (wowl->gtk_rekey_failure)
3643                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3644         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3645                 wowl_config |= BRCMF_WOWL_UNASSOC;
3646
3647         memcpy(&wowl_wakeind, "clear", 6);
3648         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3649                                  sizeof(wowl_wakeind));
3650         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3651         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3652         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3653         cfg->wowl.active = true;
3654 }
3655
3656 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3657                                   struct cfg80211_wowlan *wowl)
3658 {
3659         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3660         struct net_device *ndev = cfg_to_ndev(cfg);
3661         struct brcmf_if *ifp = netdev_priv(ndev);
3662         struct brcmf_cfg80211_vif *vif;
3663
3664         brcmf_dbg(TRACE, "Enter\n");
3665
3666         /* if the primary net_device is not READY there is nothing
3667          * we can do but pray resume goes smoothly.
3668          */
3669         if (!check_vif_up(ifp->vif))
3670                 goto exit;
3671
3672         /* Stop scheduled scan */
3673         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3674                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3675
3676         /* end any scanning */
3677         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3678                 brcmf_abort_scanning(cfg);
3679
3680         if (wowl == NULL) {
3681                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3682                 list_for_each_entry(vif, &cfg->vif_list, list) {
3683                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3684                                 continue;
3685                         /* While going to suspend if associated with AP
3686                          * disassociate from AP to save power while system is
3687                          * in suspended state
3688                          */
3689                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3690                         /* Make sure WPA_Supplicant receives all the event
3691                          * generated due to DISASSOC call to the fw to keep
3692                          * the state fw and WPA_Supplicant state consistent
3693                          */
3694                         brcmf_delay(500);
3695                 }
3696                 /* Configure MPC */
3697                 brcmf_set_mpc(ifp, 1);
3698
3699         } else {
3700                 /* Configure WOWL paramaters */
3701                 brcmf_configure_wowl(cfg, ifp, wowl);
3702         }
3703
3704 exit:
3705         brcmf_dbg(TRACE, "Exit\n");
3706         /* clear any scanning activity */
3707         cfg->scan_status = 0;
3708         return 0;
3709 }
3710
3711 static __used s32
3712 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3713 {
3714         struct brcmf_pmk_list_le *pmk_list;
3715         int i;
3716         u32 npmk;
3717         s32 err;
3718
3719         pmk_list = &cfg->pmk_list;
3720         npmk = le32_to_cpu(pmk_list->npmk);
3721
3722         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3723         for (i = 0; i < npmk; i++)
3724                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3725
3726         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3727                                        sizeof(*pmk_list));
3728
3729         return err;
3730 }
3731
3732 static s32
3733 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3734                          struct cfg80211_pmksa *pmksa)
3735 {
3736         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3737         struct brcmf_if *ifp = netdev_priv(ndev);
3738         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3739         s32 err;
3740         u32 npmk, i;
3741
3742         brcmf_dbg(TRACE, "Enter\n");
3743         if (!check_vif_up(ifp->vif))
3744                 return -EIO;
3745
3746         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3747         for (i = 0; i < npmk; i++)
3748                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3749                         break;
3750         if (i < BRCMF_MAXPMKID) {
3751                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3752                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3753                 if (i == npmk) {
3754                         npmk++;
3755                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3756                 }
3757         } else {
3758                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3759                 return -EINVAL;
3760         }
3761
3762         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3763         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3764                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3765                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3766                           pmk[npmk].pmkid[i + 3]);
3767
3768         err = brcmf_update_pmklist(cfg, ifp);
3769
3770         brcmf_dbg(TRACE, "Exit\n");
3771         return err;
3772 }
3773
3774 static s32
3775 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3776                          struct cfg80211_pmksa *pmksa)
3777 {
3778         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3779         struct brcmf_if *ifp = netdev_priv(ndev);
3780         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3781         s32 err;
3782         u32 npmk, i;
3783
3784         brcmf_dbg(TRACE, "Enter\n");
3785         if (!check_vif_up(ifp->vif))
3786                 return -EIO;
3787
3788         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3789
3790         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3791         for (i = 0; i < npmk; i++)
3792                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3793                         break;
3794
3795         if ((npmk > 0) && (i < npmk)) {
3796                 for (; i < (npmk - 1); i++) {
3797                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3798                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3799                                WLAN_PMKID_LEN);
3800                 }
3801                 memset(&pmk[i], 0, sizeof(*pmk));
3802                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3803         } else {
3804                 brcmf_err("Cache entry not found\n");
3805                 return -EINVAL;
3806         }
3807
3808         err = brcmf_update_pmklist(cfg, ifp);
3809
3810         brcmf_dbg(TRACE, "Exit\n");
3811         return err;
3812
3813 }
3814
3815 static s32
3816 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3817 {
3818         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3819         struct brcmf_if *ifp = netdev_priv(ndev);
3820         s32 err;
3821
3822         brcmf_dbg(TRACE, "Enter\n");
3823         if (!check_vif_up(ifp->vif))
3824                 return -EIO;
3825
3826         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3827         err = brcmf_update_pmklist(cfg, ifp);
3828
3829         brcmf_dbg(TRACE, "Exit\n");
3830         return err;
3831
3832 }
3833
3834 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3835 {
3836         s32 err;
3837         s32 wpa_val;
3838
3839         /* set auth */
3840         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3841         if (err < 0) {
3842                 brcmf_err("auth error %d\n", err);
3843                 return err;
3844         }
3845         /* set wsec */
3846         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3847         if (err < 0) {
3848                 brcmf_err("wsec error %d\n", err);
3849                 return err;
3850         }
3851         /* set upper-layer auth */
3852         if (brcmf_is_ibssmode(ifp->vif))
3853                 wpa_val = WPA_AUTH_NONE;
3854         else
3855                 wpa_val = WPA_AUTH_DISABLED;
3856         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
3857         if (err < 0) {
3858                 brcmf_err("wpa_auth error %d\n", err);
3859                 return err;
3860         }
3861
3862         return 0;
3863 }
3864
3865 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3866 {
3867         if (is_rsn_ie)
3868                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3869
3870         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3871 }
3872
3873 static s32
3874 brcmf_configure_wpaie(struct brcmf_if *ifp,
3875                       const struct brcmf_vs_tlv *wpa_ie,
3876                       bool is_rsn_ie)
3877 {
3878         u32 auth = 0; /* d11 open authentication */
3879         u16 count;
3880         s32 err = 0;
3881         s32 len;
3882         u32 i;
3883         u32 wsec;
3884         u32 pval = 0;
3885         u32 gval = 0;
3886         u32 wpa_auth = 0;
3887         u32 offset;
3888         u8 *data;
3889         u16 rsn_cap;
3890         u32 wme_bss_disable;
3891         u32 mfp;
3892
3893         brcmf_dbg(TRACE, "Enter\n");
3894         if (wpa_ie == NULL)
3895                 goto exit;
3896
3897         len = wpa_ie->len + TLV_HDR_LEN;
3898         data = (u8 *)wpa_ie;
3899         offset = TLV_HDR_LEN;
3900         if (!is_rsn_ie)
3901                 offset += VS_IE_FIXED_HDR_LEN;
3902         else
3903                 offset += WPA_IE_VERSION_LEN;
3904
3905         /* check for multicast cipher suite */
3906         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3907                 err = -EINVAL;
3908                 brcmf_err("no multicast cipher suite\n");
3909                 goto exit;
3910         }
3911
3912         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3913                 err = -EINVAL;
3914                 brcmf_err("ivalid OUI\n");
3915                 goto exit;
3916         }
3917         offset += TLV_OUI_LEN;
3918
3919         /* pick up multicast cipher */
3920         switch (data[offset]) {
3921         case WPA_CIPHER_NONE:
3922                 gval = 0;
3923                 break;
3924         case WPA_CIPHER_WEP_40:
3925         case WPA_CIPHER_WEP_104:
3926                 gval = WEP_ENABLED;
3927                 break;
3928         case WPA_CIPHER_TKIP:
3929                 gval = TKIP_ENABLED;
3930                 break;
3931         case WPA_CIPHER_AES_CCM:
3932                 gval = AES_ENABLED;
3933                 break;
3934         default:
3935                 err = -EINVAL;
3936                 brcmf_err("Invalid multi cast cipher info\n");
3937                 goto exit;
3938         }
3939
3940         offset++;
3941         /* walk thru unicast cipher list and pick up what we recognize */
3942         count = data[offset] + (data[offset + 1] << 8);
3943         offset += WPA_IE_SUITE_COUNT_LEN;
3944         /* Check for unicast suite(s) */
3945         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3946                 err = -EINVAL;
3947                 brcmf_err("no unicast cipher suite\n");
3948                 goto exit;
3949         }
3950         for (i = 0; i < count; i++) {
3951                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3952                         err = -EINVAL;
3953                         brcmf_err("ivalid OUI\n");
3954                         goto exit;
3955                 }
3956                 offset += TLV_OUI_LEN;
3957                 switch (data[offset]) {
3958                 case WPA_CIPHER_NONE:
3959                         break;
3960                 case WPA_CIPHER_WEP_40:
3961                 case WPA_CIPHER_WEP_104:
3962                         pval |= WEP_ENABLED;
3963                         break;
3964                 case WPA_CIPHER_TKIP:
3965                         pval |= TKIP_ENABLED;
3966                         break;
3967                 case WPA_CIPHER_AES_CCM:
3968                         pval |= AES_ENABLED;
3969                         break;
3970                 default:
3971                         brcmf_err("Invalid unicast security info\n");
3972                 }
3973                 offset++;
3974         }
3975         /* walk thru auth management suite list and pick up what we recognize */
3976         count = data[offset] + (data[offset + 1] << 8);
3977         offset += WPA_IE_SUITE_COUNT_LEN;
3978         /* Check for auth key management suite(s) */
3979         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3980                 err = -EINVAL;
3981                 brcmf_err("no auth key mgmt suite\n");
3982                 goto exit;
3983         }
3984         for (i = 0; i < count; i++) {
3985                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3986                         err = -EINVAL;
3987                         brcmf_err("ivalid OUI\n");
3988                         goto exit;
3989                 }
3990                 offset += TLV_OUI_LEN;
3991                 switch (data[offset]) {
3992                 case RSN_AKM_NONE:
3993                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
3994                         wpa_auth |= WPA_AUTH_NONE;
3995                         break;
3996                 case RSN_AKM_UNSPECIFIED:
3997                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
3998                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
3999                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4000                         break;
4001                 case RSN_AKM_PSK:
4002                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4003                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4004                                     (wpa_auth |= WPA_AUTH_PSK);
4005                         break;
4006                 case RSN_AKM_SHA256_PSK:
4007                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4008                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4009                         break;
4010                 case RSN_AKM_SHA256_1X:
4011                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4012                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4013                         break;
4014                 default:
4015                         brcmf_err("Invalid key mgmt info\n");
4016                 }
4017                 offset++;
4018         }
4019
4020         mfp = BRCMF_MFP_NONE;
4021         if (is_rsn_ie) {
4022                 wme_bss_disable = 1;
4023                 if ((offset + RSN_CAP_LEN) <= len) {
4024                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4025                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4026                                 wme_bss_disable = 0;
4027                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4028                                 brcmf_dbg(TRACE, "MFP Required\n");
4029                                 mfp = BRCMF_MFP_REQUIRED;
4030                                 /* Firmware only supports mfp required in
4031                                  * combination with WPA2_AUTH_PSK_SHA256 or
4032                                  * WPA2_AUTH_1X_SHA256.
4033                                  */
4034                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4035                                                   WPA2_AUTH_1X_SHA256))) {
4036                                         err = -EINVAL;
4037                                         goto exit;
4038                                 }
4039                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4040                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4041                                  * is to be included in the rsn ie.
4042                                  */
4043                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4044                                         wpa_auth |= WPA2_AUTH_PSK;
4045                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4046                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4047                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4048                                 brcmf_dbg(TRACE, "MFP Capable\n");
4049                                 mfp = BRCMF_MFP_CAPABLE;
4050                         }
4051                 }
4052                 offset += RSN_CAP_LEN;
4053                 /* set wme_bss_disable to sync RSN Capabilities */
4054                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4055                                                wme_bss_disable);
4056                 if (err < 0) {
4057                         brcmf_err("wme_bss_disable error %d\n", err);
4058                         goto exit;
4059                 }
4060
4061                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4062                 offset += RSN_PMKID_COUNT_LEN;
4063
4064                 /* See if there is BIP wpa suite left for MFP */
4065                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4066                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4067                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4068                                                         &data[offset],
4069                                                         WPA_IE_MIN_OUI_LEN);
4070                         if (err < 0) {
4071                                 brcmf_err("bip error %d\n", err);
4072                                 goto exit;
4073                         }
4074                 }
4075         }
4076         /* FOR WPS , set SES_OW_ENABLED */
4077         wsec = (pval | gval | SES_OW_ENABLED);
4078
4079         /* set auth */
4080         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4081         if (err < 0) {
4082                 brcmf_err("auth error %d\n", err);
4083                 goto exit;
4084         }
4085         /* set wsec */
4086         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4087         if (err < 0) {
4088                 brcmf_err("wsec error %d\n", err);
4089                 goto exit;
4090         }
4091         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4092          * will overwrite the values set by MFP
4093          */
4094         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4095                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4096                 if (err < 0) {
4097                         brcmf_err("mfp error %d\n", err);
4098                         goto exit;
4099                 }
4100         }
4101         /* set upper-layer auth */
4102         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4103         if (err < 0) {
4104                 brcmf_err("wpa_auth error %d\n", err);
4105                 goto exit;
4106         }
4107
4108 exit:
4109         return err;
4110 }
4111
4112 static s32
4113 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4114                      struct parsed_vndr_ies *vndr_ies)
4115 {
4116         struct brcmf_vs_tlv *vndrie;
4117         struct brcmf_tlv *ie;
4118         struct parsed_vndr_ie_info *parsed_info;
4119         s32 remaining_len;
4120
4121         remaining_len = (s32)vndr_ie_len;
4122         memset(vndr_ies, 0, sizeof(*vndr_ies));
4123
4124         ie = (struct brcmf_tlv *)vndr_ie_buf;
4125         while (ie) {
4126                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4127                         goto next;
4128                 vndrie = (struct brcmf_vs_tlv *)ie;
4129                 /* len should be bigger than OUI length + one */
4130                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4131                         brcmf_err("invalid vndr ie. length is too small %d\n",
4132                                   vndrie->len);
4133                         goto next;
4134                 }
4135                 /* if wpa or wme ie, do not add ie */
4136                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4137                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4138                     (vndrie->oui_type == WME_OUI_TYPE))) {
4139                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4140                         goto next;
4141                 }
4142
4143                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4144
4145                 /* save vndr ie information */
4146                 parsed_info->ie_ptr = (char *)vndrie;
4147                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4148                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4149
4150                 vndr_ies->count++;
4151
4152                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4153                           parsed_info->vndrie.oui[0],
4154                           parsed_info->vndrie.oui[1],
4155                           parsed_info->vndrie.oui[2],
4156                           parsed_info->vndrie.oui_type);
4157
4158                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4159                         break;
4160 next:
4161                 remaining_len -= (ie->len + TLV_HDR_LEN);
4162                 if (remaining_len <= TLV_HDR_LEN)
4163                         ie = NULL;
4164                 else
4165                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4166                                 TLV_HDR_LEN);
4167         }
4168         return 0;
4169 }
4170
4171 static u32
4172 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4173 {
4174
4175         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4176         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4177
4178         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4179
4180         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4181
4182         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4183
4184         return ie_len + VNDR_IE_HDR_SIZE;
4185 }
4186
4187 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4188                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4189 {
4190         struct brcmf_if *ifp;
4191         struct vif_saved_ie *saved_ie;
4192         s32 err = 0;
4193         u8  *iovar_ie_buf;
4194         u8  *curr_ie_buf;
4195         u8  *mgmt_ie_buf = NULL;
4196         int mgmt_ie_buf_len;
4197         u32 *mgmt_ie_len;
4198         u32 del_add_ie_buf_len = 0;
4199         u32 total_ie_buf_len = 0;
4200         u32 parsed_ie_buf_len = 0;
4201         struct parsed_vndr_ies old_vndr_ies;
4202         struct parsed_vndr_ies new_vndr_ies;
4203         struct parsed_vndr_ie_info *vndrie_info;
4204         s32 i;
4205         u8 *ptr;
4206         int remained_buf_len;
4207
4208         if (!vif)
4209                 return -ENODEV;
4210         ifp = vif->ifp;
4211         saved_ie = &vif->saved_ie;
4212
4213         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4214                   pktflag);
4215         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4216         if (!iovar_ie_buf)
4217                 return -ENOMEM;
4218         curr_ie_buf = iovar_ie_buf;
4219         switch (pktflag) {
4220         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4221                 mgmt_ie_buf = saved_ie->probe_req_ie;
4222                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4223                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4224                 break;
4225         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4226                 mgmt_ie_buf = saved_ie->probe_res_ie;
4227                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4228                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4229                 break;
4230         case BRCMF_VNDR_IE_BEACON_FLAG:
4231                 mgmt_ie_buf = saved_ie->beacon_ie;
4232                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4233                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4234                 break;
4235         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4236                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4237                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4238                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4239                 break;
4240         default:
4241                 err = -EPERM;
4242                 brcmf_err("not suitable type\n");
4243                 goto exit;
4244         }
4245
4246         if (vndr_ie_len > mgmt_ie_buf_len) {
4247                 err = -ENOMEM;
4248                 brcmf_err("extra IE size too big\n");
4249                 goto exit;
4250         }
4251
4252         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4253         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4254                 ptr = curr_ie_buf;
4255                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4256                 for (i = 0; i < new_vndr_ies.count; i++) {
4257                         vndrie_info = &new_vndr_ies.ie_info[i];
4258                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4259                                vndrie_info->ie_len);
4260                         parsed_ie_buf_len += vndrie_info->ie_len;
4261                 }
4262         }
4263
4264         if (mgmt_ie_buf && *mgmt_ie_len) {
4265                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4266                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4267                             parsed_ie_buf_len) == 0)) {
4268                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4269                         goto exit;
4270                 }
4271
4272                 /* parse old vndr_ie */
4273                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4274
4275                 /* make a command to delete old ie */
4276                 for (i = 0; i < old_vndr_ies.count; i++) {
4277                         vndrie_info = &old_vndr_ies.ie_info[i];
4278
4279                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4280                                   vndrie_info->vndrie.id,
4281                                   vndrie_info->vndrie.len,
4282                                   vndrie_info->vndrie.oui[0],
4283                                   vndrie_info->vndrie.oui[1],
4284                                   vndrie_info->vndrie.oui[2]);
4285
4286                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4287                                                            vndrie_info->ie_ptr,
4288                                                            vndrie_info->ie_len,
4289                                                            "del");
4290                         curr_ie_buf += del_add_ie_buf_len;
4291                         total_ie_buf_len += del_add_ie_buf_len;
4292                 }
4293         }
4294
4295         *mgmt_ie_len = 0;
4296         /* Add if there is any extra IE */
4297         if (mgmt_ie_buf && parsed_ie_buf_len) {
4298                 ptr = mgmt_ie_buf;
4299
4300                 remained_buf_len = mgmt_ie_buf_len;
4301
4302                 /* make a command to add new ie */
4303                 for (i = 0; i < new_vndr_ies.count; i++) {
4304                         vndrie_info = &new_vndr_ies.ie_info[i];
4305
4306                         /* verify remained buf size before copy data */
4307                         if (remained_buf_len < (vndrie_info->vndrie.len +
4308                                                         VNDR_IE_VSIE_OFFSET)) {
4309                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4310                                           remained_buf_len);
4311                                 break;
4312                         }
4313                         remained_buf_len -= (vndrie_info->ie_len +
4314                                              VNDR_IE_VSIE_OFFSET);
4315
4316                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4317                                   vndrie_info->vndrie.id,
4318                                   vndrie_info->vndrie.len,
4319                                   vndrie_info->vndrie.oui[0],
4320                                   vndrie_info->vndrie.oui[1],
4321                                   vndrie_info->vndrie.oui[2]);
4322
4323                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4324                                                            vndrie_info->ie_ptr,
4325                                                            vndrie_info->ie_len,
4326                                                            "add");
4327
4328                         /* save the parsed IE in wl struct */
4329                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4330                                vndrie_info->ie_len);
4331                         *mgmt_ie_len += vndrie_info->ie_len;
4332
4333                         curr_ie_buf += del_add_ie_buf_len;
4334                         total_ie_buf_len += del_add_ie_buf_len;
4335                 }
4336         }
4337         if (total_ie_buf_len) {
4338                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4339                                                  total_ie_buf_len);
4340                 if (err)
4341                         brcmf_err("vndr ie set error : %d\n", err);
4342         }
4343
4344 exit:
4345         kfree(iovar_ie_buf);
4346         return err;
4347 }
4348
4349 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4350 {
4351         s32 pktflags[] = {
4352                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4353                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4354                 BRCMF_VNDR_IE_BEACON_FLAG
4355         };
4356         int i;
4357
4358         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4359                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4360
4361         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4362         return 0;
4363 }
4364
4365 static s32
4366 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4367                         struct cfg80211_beacon_data *beacon)
4368 {
4369         s32 err;
4370
4371         /* Set Beacon IEs to FW */
4372         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4373                                     beacon->tail, beacon->tail_len);
4374         if (err) {
4375                 brcmf_err("Set Beacon IE Failed\n");
4376                 return err;
4377         }
4378         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4379
4380         /* Set Probe Response IEs to FW */
4381         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4382                                     beacon->proberesp_ies,
4383                                     beacon->proberesp_ies_len);
4384         if (err)
4385                 brcmf_err("Set Probe Resp IE Failed\n");
4386         else
4387                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4388
4389         return err;
4390 }
4391
4392 static s32
4393 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4394                         struct cfg80211_ap_settings *settings)
4395 {
4396         s32 ie_offset;
4397         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4398         struct brcmf_if *ifp = netdev_priv(ndev);
4399         const struct brcmf_tlv *ssid_ie;
4400         const struct brcmf_tlv *country_ie;
4401         struct brcmf_ssid_le ssid_le;
4402         s32 err = -EPERM;
4403         const struct brcmf_tlv *rsn_ie;
4404         const struct brcmf_vs_tlv *wpa_ie;
4405         struct brcmf_join_params join_params;
4406         enum nl80211_iftype dev_role;
4407         struct brcmf_fil_bss_enable_le bss_enable;
4408         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4409         bool mbss;
4410         int is_11d;
4411         bool supports_11d;
4412
4413         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4414                   settings->chandef.chan->hw_value,
4415                   settings->chandef.center_freq1, settings->chandef.width,
4416                   settings->beacon_interval, settings->dtim_period);
4417         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4418                   settings->ssid, settings->ssid_len, settings->auth_type,
4419                   settings->inactivity_timeout);
4420         dev_role = ifp->vif->wdev.iftype;
4421         mbss = ifp->vif->mbss;
4422
4423         /* store current 11d setting */
4424         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4425                                   &ifp->vif->is_11d)) {
4426                 is_11d = supports_11d = false;
4427         } else {
4428                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4429                                               settings->beacon.tail_len,
4430                                               WLAN_EID_COUNTRY);
4431                 is_11d = country_ie ? 1 : 0;
4432                 supports_11d = true;
4433         }
4434
4435         memset(&ssid_le, 0, sizeof(ssid_le));
4436         if (settings->ssid == NULL || settings->ssid_len == 0) {
4437                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4438                 ssid_ie = brcmf_parse_tlvs(
4439                                 (u8 *)&settings->beacon.head[ie_offset],
4440                                 settings->beacon.head_len - ie_offset,
4441                                 WLAN_EID_SSID);
4442                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4443                         return -EINVAL;
4444
4445                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4446                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4447                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4448         } else {
4449                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4450                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4451         }
4452
4453         if (!mbss) {
4454                 brcmf_set_mpc(ifp, 0);
4455                 brcmf_configure_arp_nd_offload(ifp, false);
4456         }
4457
4458         /* find the RSN_IE */
4459         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4460                                   settings->beacon.tail_len, WLAN_EID_RSN);
4461
4462         /* find the WPA_IE */
4463         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4464                                   settings->beacon.tail_len);
4465
4466         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4467                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4468                 if (wpa_ie != NULL) {
4469                         /* WPA IE */
4470                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4471                         if (err < 0)
4472                                 goto exit;
4473                 } else {
4474                         struct brcmf_vs_tlv *tmp_ie;
4475
4476                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4477
4478                         /* RSN IE */
4479                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4480                         if (err < 0)
4481                                 goto exit;
4482                 }
4483         } else {
4484                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4485                 brcmf_configure_opensecurity(ifp);
4486         }
4487
4488         /* Parameters shared by all radio interfaces */
4489         if (!mbss) {
4490                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4491                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4492                                                     is_11d);
4493                         if (err < 0) {
4494                                 brcmf_err("Regulatory Set Error, %d\n", err);
4495                                 goto exit;
4496                         }
4497                 }
4498                 if (settings->beacon_interval) {
4499                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4500                                                     settings->beacon_interval);
4501                         if (err < 0) {
4502                                 brcmf_err("Beacon Interval Set Error, %d\n",
4503                                           err);
4504                                 goto exit;
4505                         }
4506                 }
4507                 if (settings->dtim_period) {
4508                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4509                                                     settings->dtim_period);
4510                         if (err < 0) {
4511                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4512                                 goto exit;
4513                         }
4514                 }
4515
4516                 if ((dev_role == NL80211_IFTYPE_AP) &&
4517                     ((ifp->ifidx == 0) ||
4518                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4519                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4520                         if (err < 0) {
4521                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4522                                 goto exit;
4523                         }
4524                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4525                 }
4526
4527                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4528                 if (err < 0) {
4529                         brcmf_err("SET INFRA error %d\n", err);
4530                         goto exit;
4531                 }
4532         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4533                 /* Multiple-BSS should use same 11d configuration */
4534                 err = -EINVAL;
4535                 goto exit;
4536         }
4537
4538         /* Interface specific setup */
4539         if (dev_role == NL80211_IFTYPE_AP) {
4540                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4541                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4542
4543                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4544                 if (err < 0) {
4545                         brcmf_err("setting AP mode failed %d\n", err);
4546                         goto exit;
4547                 }
4548                 if (!mbss) {
4549                         /* Firmware 10.x requires setting channel after enabling
4550                          * AP and before bringing interface up.
4551                          */
4552                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4553                         if (err < 0) {
4554                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4555                                           chanspec, err);
4556                                 goto exit;
4557                         }
4558                 }
4559                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4560                 if (err < 0) {
4561                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4562                         goto exit;
4563                 }
4564                 /* On DOWN the firmware removes the WEP keys, reconfigure
4565                  * them if they were set.
4566                  */
4567                 brcmf_cfg80211_reconfigure_wep(ifp);
4568
4569                 memset(&join_params, 0, sizeof(join_params));
4570                 /* join parameters starts with ssid */
4571                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4572                 /* create softap */
4573                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4574                                              &join_params, sizeof(join_params));
4575                 if (err < 0) {
4576                         brcmf_err("SET SSID error (%d)\n", err);
4577                         goto exit;
4578                 }
4579
4580                 if (settings->hidden_ssid) {
4581                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4582                         if (err) {
4583                                 brcmf_err("closednet error (%d)\n", err);
4584                                 goto exit;
4585                         }
4586                 }
4587
4588                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4589         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4590                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4591                 if (err < 0) {
4592                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4593                                   chanspec, err);
4594                         goto exit;
4595                 }
4596                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4597                                                 sizeof(ssid_le));
4598                 if (err < 0) {
4599                         brcmf_err("setting ssid failed %d\n", err);
4600                         goto exit;
4601                 }
4602                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4603                 bss_enable.enable = cpu_to_le32(1);
4604                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4605                                                sizeof(bss_enable));
4606                 if (err < 0) {
4607                         brcmf_err("bss_enable config failed %d\n", err);
4608                         goto exit;
4609                 }
4610
4611                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4612         } else {
4613                 WARN_ON(1);
4614         }
4615
4616         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4617         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4618         brcmf_net_setcarrier(ifp, true);
4619
4620 exit:
4621         if ((err) && (!mbss)) {
4622                 brcmf_set_mpc(ifp, 1);
4623                 brcmf_configure_arp_nd_offload(ifp, true);
4624         }
4625         return err;
4626 }
4627
4628 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4629 {
4630         struct brcmf_if *ifp = netdev_priv(ndev);
4631         s32 err;
4632         struct brcmf_fil_bss_enable_le bss_enable;
4633         struct brcmf_join_params join_params;
4634
4635         brcmf_dbg(TRACE, "Enter\n");
4636
4637         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4638                 /* Due to most likely deauths outstanding we sleep */
4639                 /* first to make sure they get processed by fw. */
4640                 msleep(400);
4641
4642                 if (ifp->vif->mbss) {
4643                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4644                         return err;
4645                 }
4646
4647                 /* First BSS doesn't get a full reset */
4648                 if (ifp->bsscfgidx == 0)
4649                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4650
4651                 memset(&join_params, 0, sizeof(join_params));
4652                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4653                                              &join_params, sizeof(join_params));
4654                 if (err < 0)
4655                         brcmf_err("SET SSID error (%d)\n", err);
4656                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4657                 if (err < 0)
4658                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4659                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4660                 if (err < 0)
4661                         brcmf_err("setting AP mode failed %d\n", err);
4662                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4663                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4664                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4665                                       ifp->vif->is_11d);
4666                 /* Bring device back up so it can be used again */
4667                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4668                 if (err < 0)
4669                         brcmf_err("BRCMF_C_UP error %d\n", err);
4670
4671                 brcmf_vif_clear_mgmt_ies(ifp->vif);
4672         } else {
4673                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4674                 bss_enable.enable = cpu_to_le32(0);
4675                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4676                                                sizeof(bss_enable));
4677                 if (err < 0)
4678                         brcmf_err("bss_enable config failed %d\n", err);
4679         }
4680         brcmf_set_mpc(ifp, 1);
4681         brcmf_configure_arp_nd_offload(ifp, true);
4682         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4683         brcmf_net_setcarrier(ifp, false);
4684
4685         return err;
4686 }
4687
4688 static s32
4689 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4690                              struct cfg80211_beacon_data *info)
4691 {
4692         struct brcmf_if *ifp = netdev_priv(ndev);
4693         s32 err;
4694
4695         brcmf_dbg(TRACE, "Enter\n");
4696
4697         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4698
4699         return err;
4700 }
4701
4702 static int
4703 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4704                            struct station_del_parameters *params)
4705 {
4706         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4707         struct brcmf_scb_val_le scbval;
4708         struct brcmf_if *ifp = netdev_priv(ndev);
4709         s32 err;
4710
4711         if (!params->mac)
4712                 return -EFAULT;
4713
4714         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4715
4716         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4717                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4718         if (!check_vif_up(ifp->vif))
4719                 return -EIO;
4720
4721         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4722         scbval.val = cpu_to_le32(params->reason_code);
4723         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4724                                      &scbval, sizeof(scbval));
4725         if (err)
4726                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4727
4728         brcmf_dbg(TRACE, "Exit\n");
4729         return err;
4730 }
4731
4732 static int
4733 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4734                               const u8 *mac, struct station_parameters *params)
4735 {
4736         struct brcmf_if *ifp = netdev_priv(ndev);
4737         s32 err;
4738
4739         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4740                   params->sta_flags_mask, params->sta_flags_set);
4741
4742         /* Ignore all 00 MAC */
4743         if (is_zero_ether_addr(mac))
4744                 return 0;
4745
4746         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4747                 return 0;
4748
4749         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4750                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4751                                              (void *)mac, ETH_ALEN);
4752         else
4753                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4754                                              (void *)mac, ETH_ALEN);
4755         if (err < 0)
4756                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4757
4758         return err;
4759 }
4760
4761 static void
4762 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4763                                    struct wireless_dev *wdev,
4764                                    u16 frame_type, bool reg)
4765 {
4766         struct brcmf_cfg80211_vif *vif;
4767         u16 mgmt_type;
4768
4769         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4770
4771         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4772         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4773         if (reg)
4774                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4775         else
4776                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4777 }
4778
4779
4780 static int
4781 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4782                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4783 {
4784         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4785         struct ieee80211_channel *chan = params->chan;
4786         const u8 *buf = params->buf;
4787         size_t len = params->len;
4788         const struct ieee80211_mgmt *mgmt;
4789         struct brcmf_cfg80211_vif *vif;
4790         s32 err = 0;
4791         s32 ie_offset;
4792         s32 ie_len;
4793         struct brcmf_fil_action_frame_le *action_frame;
4794         struct brcmf_fil_af_params_le *af_params;
4795         bool ack;
4796         s32 chan_nr;
4797         u32 freq;
4798
4799         brcmf_dbg(TRACE, "Enter\n");
4800
4801         *cookie = 0;
4802
4803         mgmt = (const struct ieee80211_mgmt *)buf;
4804
4805         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4806                 brcmf_err("Driver only allows MGMT packet type\n");
4807                 return -EPERM;
4808         }
4809
4810         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4811
4812         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4813                 /* Right now the only reason to get a probe response */
4814                 /* is for p2p listen response or for p2p GO from     */
4815                 /* wpa_supplicant. Unfortunately the probe is send   */
4816                 /* on primary ndev, while dongle wants it on the p2p */
4817                 /* vif. Since this is only reason for a probe        */
4818                 /* response to be sent, the vif is taken from cfg.   */
4819                 /* If ever desired to send proberesp for non p2p     */
4820                 /* response then data should be checked for          */
4821                 /* "DIRECT-". Note in future supplicant will take    */
4822                 /* dedicated p2p wdev to do this and then this 'hack'*/
4823                 /* is not needed anymore.                            */
4824                 ie_offset =  DOT11_MGMT_HDR_LEN +
4825                              DOT11_BCN_PRB_FIXED_LEN;
4826                 ie_len = len - ie_offset;
4827                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4828                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4829                 err = brcmf_vif_set_mgmt_ie(vif,
4830                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4831                                             &buf[ie_offset],
4832                                             ie_len);
4833                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4834                                         GFP_KERNEL);
4835         } else if (ieee80211_is_action(mgmt->frame_control)) {
4836                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
4837                         brcmf_err("invalid action frame length\n");
4838                         err = -EINVAL;
4839                         goto exit;
4840                 }
4841                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4842                 if (af_params == NULL) {
4843                         brcmf_err("unable to allocate frame\n");
4844                         err = -ENOMEM;
4845                         goto exit;
4846                 }
4847                 action_frame = &af_params->action_frame;
4848                 /* Add the packet Id */
4849                 action_frame->packet_id = cpu_to_le32(*cookie);
4850                 /* Add BSSID */
4851                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4852                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4853                 /* Add the length exepted for 802.11 header  */
4854                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4855                 /* Add the channel. Use the one specified as parameter if any or
4856                  * the current one (got from the firmware) otherwise
4857                  */
4858                 if (chan)
4859                         freq = chan->center_freq;
4860                 else
4861                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4862                                               &freq);
4863                 chan_nr = ieee80211_frequency_to_channel(freq);
4864                 af_params->channel = cpu_to_le32(chan_nr);
4865
4866                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4867                        le16_to_cpu(action_frame->len));
4868
4869                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4870                           *cookie, le16_to_cpu(action_frame->len), freq);
4871
4872                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4873                                                   af_params);
4874
4875                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4876                                         GFP_KERNEL);
4877                 kfree(af_params);
4878         } else {
4879                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4880                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
4881         }
4882
4883 exit:
4884         return err;
4885 }
4886
4887
4888 static int
4889 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4890                                         struct wireless_dev *wdev,
4891                                         u64 cookie)
4892 {
4893         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4894         struct brcmf_cfg80211_vif *vif;
4895         int err = 0;
4896
4897         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4898
4899         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4900         if (vif == NULL) {
4901                 brcmf_err("No p2p device available for probe response\n");
4902                 err = -ENODEV;
4903                 goto exit;
4904         }
4905         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4906 exit:
4907         return err;
4908 }
4909
4910 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
4911                                       struct wireless_dev *wdev,
4912                                       struct cfg80211_chan_def *chandef)
4913 {
4914         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4915         struct net_device *ndev = wdev->netdev;
4916         struct brcmf_if *ifp;
4917         struct brcmu_chan ch;
4918         enum nl80211_band band = 0;
4919         enum nl80211_chan_width width = 0;
4920         u32 chanspec;
4921         int freq, err;
4922
4923         if (!ndev)
4924                 return -ENODEV;
4925         ifp = netdev_priv(ndev);
4926
4927         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
4928         if (err) {
4929                 brcmf_err("chanspec failed (%d)\n", err);
4930                 return err;
4931         }
4932
4933         ch.chspec = chanspec;
4934         cfg->d11inf.decchspec(&ch);
4935
4936         switch (ch.band) {
4937         case BRCMU_CHAN_BAND_2G:
4938                 band = NL80211_BAND_2GHZ;
4939                 break;
4940         case BRCMU_CHAN_BAND_5G:
4941                 band = NL80211_BAND_5GHZ;
4942                 break;
4943         }
4944
4945         switch (ch.bw) {
4946         case BRCMU_CHAN_BW_80:
4947                 width = NL80211_CHAN_WIDTH_80;
4948                 break;
4949         case BRCMU_CHAN_BW_40:
4950                 width = NL80211_CHAN_WIDTH_40;
4951                 break;
4952         case BRCMU_CHAN_BW_20:
4953                 width = NL80211_CHAN_WIDTH_20;
4954                 break;
4955         case BRCMU_CHAN_BW_80P80:
4956                 width = NL80211_CHAN_WIDTH_80P80;
4957                 break;
4958         case BRCMU_CHAN_BW_160:
4959                 width = NL80211_CHAN_WIDTH_160;
4960                 break;
4961         }
4962
4963         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
4964         chandef->chan = ieee80211_get_channel(wiphy, freq);
4965         chandef->width = width;
4966         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
4967         chandef->center_freq2 = 0;
4968
4969         return 0;
4970 }
4971
4972 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
4973                                            struct wireless_dev *wdev,
4974                                            enum nl80211_crit_proto_id proto,
4975                                            u16 duration)
4976 {
4977         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4978         struct brcmf_cfg80211_vif *vif;
4979
4980         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4981
4982         /* only DHCP support for now */
4983         if (proto != NL80211_CRIT_PROTO_DHCP)
4984                 return -EINVAL;
4985
4986         /* suppress and abort scanning */
4987         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4988         brcmf_abort_scanning(cfg);
4989
4990         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
4991 }
4992
4993 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
4994                                            struct wireless_dev *wdev)
4995 {
4996         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4997         struct brcmf_cfg80211_vif *vif;
4998
4999         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5000
5001         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5002         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5003 }
5004
5005 static s32
5006 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5007                              const struct brcmf_event_msg *e, void *data)
5008 {
5009         switch (e->reason) {
5010         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5011                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5012                 break;
5013         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5014                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5015                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5016                 break;
5017         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5018                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5019                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5020                 break;
5021         }
5022
5023         return 0;
5024 }
5025
5026 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5027 {
5028         int ret;
5029
5030         switch (oper) {
5031         case NL80211_TDLS_DISCOVERY_REQ:
5032                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5033                 break;
5034         case NL80211_TDLS_SETUP:
5035                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5036                 break;
5037         case NL80211_TDLS_TEARDOWN:
5038                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5039                 break;
5040         default:
5041                 brcmf_err("unsupported operation: %d\n", oper);
5042                 ret = -EOPNOTSUPP;
5043         }
5044         return ret;
5045 }
5046
5047 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5048                                     struct net_device *ndev, const u8 *peer,
5049                                     enum nl80211_tdls_operation oper)
5050 {
5051         struct brcmf_if *ifp;
5052         struct brcmf_tdls_iovar_le info;
5053         int ret = 0;
5054
5055         ret = brcmf_convert_nl80211_tdls_oper(oper);
5056         if (ret < 0)
5057                 return ret;
5058
5059         ifp = netdev_priv(ndev);
5060         memset(&info, 0, sizeof(info));
5061         info.mode = (u8)ret;
5062         if (peer)
5063                 memcpy(info.ea, peer, ETH_ALEN);
5064
5065         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5066                                        &info, sizeof(info));
5067         if (ret < 0)
5068                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5069
5070         return ret;
5071 }
5072
5073 static int
5074 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5075                                   struct net_device *ndev,
5076                                   struct cfg80211_connect_params *sme,
5077                                   u32 changed)
5078 {
5079         struct brcmf_if *ifp;
5080         int err;
5081
5082         if (!(changed & UPDATE_ASSOC_IES))
5083                 return 0;
5084
5085         ifp = netdev_priv(ndev);
5086         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5087                                     sme->ie, sme->ie_len);
5088         if (err)
5089                 brcmf_err("Set Assoc REQ IE Failed\n");
5090         else
5091                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5092
5093         return err;
5094 }
5095
5096 #ifdef CONFIG_PM
5097 static int
5098 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5099                               struct cfg80211_gtk_rekey_data *gtk)
5100 {
5101         struct brcmf_if *ifp = netdev_priv(ndev);
5102         struct brcmf_gtk_keyinfo_le gtk_le;
5103         int ret;
5104
5105         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5106
5107         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5108         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5109         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5110                sizeof(gtk_le.replay_counter));
5111
5112         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5113                                        sizeof(gtk_le));
5114         if (ret < 0)
5115                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5116
5117         return ret;
5118 }
5119 #endif
5120
5121 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5122                                   const struct cfg80211_pmk_conf *conf)
5123 {
5124         struct brcmf_if *ifp;
5125
5126         brcmf_dbg(TRACE, "enter\n");
5127
5128         /* expect using firmware supplicant for 1X */
5129         ifp = netdev_priv(dev);
5130         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5131                 return -EINVAL;
5132
5133         if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5134                 return -ERANGE;
5135
5136         return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5137 }
5138
5139 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5140                                   const u8 *aa)
5141 {
5142         struct brcmf_if *ifp;
5143
5144         brcmf_dbg(TRACE, "enter\n");
5145         ifp = netdev_priv(dev);
5146         if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5147                 return -EINVAL;
5148
5149         return brcmf_set_pmk(ifp, NULL, 0);
5150 }
5151
5152 static struct cfg80211_ops brcmf_cfg80211_ops = {
5153         .add_virtual_intf = brcmf_cfg80211_add_iface,
5154         .del_virtual_intf = brcmf_cfg80211_del_iface,
5155         .change_virtual_intf = brcmf_cfg80211_change_iface,
5156         .scan = brcmf_cfg80211_scan,
5157         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5158         .join_ibss = brcmf_cfg80211_join_ibss,
5159         .leave_ibss = brcmf_cfg80211_leave_ibss,
5160         .get_station = brcmf_cfg80211_get_station,
5161         .dump_station = brcmf_cfg80211_dump_station,
5162         .set_tx_power = brcmf_cfg80211_set_tx_power,
5163         .get_tx_power = brcmf_cfg80211_get_tx_power,
5164         .add_key = brcmf_cfg80211_add_key,
5165         .del_key = brcmf_cfg80211_del_key,
5166         .get_key = brcmf_cfg80211_get_key,
5167         .set_default_key = brcmf_cfg80211_config_default_key,
5168         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5169         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5170         .connect = brcmf_cfg80211_connect,
5171         .disconnect = brcmf_cfg80211_disconnect,
5172         .suspend = brcmf_cfg80211_suspend,
5173         .resume = brcmf_cfg80211_resume,
5174         .set_pmksa = brcmf_cfg80211_set_pmksa,
5175         .del_pmksa = brcmf_cfg80211_del_pmksa,
5176         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5177         .start_ap = brcmf_cfg80211_start_ap,
5178         .stop_ap = brcmf_cfg80211_stop_ap,
5179         .change_beacon = brcmf_cfg80211_change_beacon,
5180         .del_station = brcmf_cfg80211_del_station,
5181         .change_station = brcmf_cfg80211_change_station,
5182         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5183         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5184         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5185         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5186         .remain_on_channel = brcmf_p2p_remain_on_channel,
5187         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5188         .get_channel = brcmf_cfg80211_get_channel,
5189         .start_p2p_device = brcmf_p2p_start_device,
5190         .stop_p2p_device = brcmf_p2p_stop_device,
5191         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5192         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5193         .tdls_oper = brcmf_cfg80211_tdls_oper,
5194         .update_connect_params = brcmf_cfg80211_update_conn_params,
5195         .set_pmk = brcmf_cfg80211_set_pmk,
5196         .del_pmk = brcmf_cfg80211_del_pmk,
5197 };
5198
5199 struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
5200 {
5201         return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5202                        GFP_KERNEL);
5203 }
5204
5205 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5206                                            enum nl80211_iftype type)
5207 {
5208         struct brcmf_cfg80211_vif *vif_walk;
5209         struct brcmf_cfg80211_vif *vif;
5210         bool mbss;
5211
5212         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5213                   sizeof(*vif));
5214         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5215         if (!vif)
5216                 return ERR_PTR(-ENOMEM);
5217
5218         vif->wdev.wiphy = cfg->wiphy;
5219         vif->wdev.iftype = type;
5220
5221         brcmf_init_prof(&vif->profile);
5222
5223         if (type == NL80211_IFTYPE_AP) {
5224                 mbss = false;
5225                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5226                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5227                                 mbss = true;
5228                                 break;
5229                         }
5230                 }
5231                 vif->mbss = mbss;
5232         }
5233
5234         list_add_tail(&vif->list, &cfg->vif_list);
5235         return vif;
5236 }
5237
5238 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5239 {
5240         list_del(&vif->list);
5241         kfree(vif);
5242 }
5243
5244 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5245 {
5246         struct brcmf_cfg80211_vif *vif;
5247         struct brcmf_if *ifp;
5248
5249         ifp = netdev_priv(ndev);
5250         vif = ifp->vif;
5251
5252         if (vif)
5253                 brcmf_free_vif(vif);
5254 }
5255
5256 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
5257                             const struct brcmf_event_msg *e)
5258 {
5259         u32 event = e->event_code;
5260         u32 status = e->status;
5261
5262         if (vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK &&
5263             event == BRCMF_E_PSK_SUP &&
5264             status == BRCMF_E_STATUS_FWSUP_COMPLETED)
5265                 set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5266         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5267                 brcmf_dbg(CONN, "Processing set ssid\n");
5268                 memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
5269                 if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK)
5270                         return true;
5271
5272                 set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5273         }
5274
5275         if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
5276             test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
5277                 clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
5278                 clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
5279                 return true;
5280         }
5281         return false;
5282 }
5283
5284 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5285 {
5286         u32 event = e->event_code;
5287         u16 flags = e->flags;
5288
5289         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5290             (event == BRCMF_E_DISASSOC_IND) ||
5291             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5292                 brcmf_dbg(CONN, "Processing link down\n");
5293                 return true;
5294         }
5295         return false;
5296 }
5297
5298 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5299                                const struct brcmf_event_msg *e)
5300 {
5301         u32 event = e->event_code;
5302         u32 status = e->status;
5303
5304         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5305                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5306                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5307                 return true;
5308         }
5309
5310         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5311                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5312                 return true;
5313         }
5314
5315         if (event == BRCMF_E_PSK_SUP &&
5316             status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
5317                 brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
5318                           status);
5319                 return true;
5320         }
5321
5322         return false;
5323 }
5324
5325 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5326 {
5327         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5328
5329         kfree(conn_info->req_ie);
5330         conn_info->req_ie = NULL;
5331         conn_info->req_ie_len = 0;
5332         kfree(conn_info->resp_ie);
5333         conn_info->resp_ie = NULL;
5334         conn_info->resp_ie_len = 0;
5335 }
5336
5337 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5338                                struct brcmf_if *ifp)
5339 {
5340         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5341         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5342         u32 req_len;
5343         u32 resp_len;
5344         s32 err = 0;
5345
5346         brcmf_clear_assoc_ies(cfg);
5347
5348         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5349                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5350         if (err) {
5351                 brcmf_err("could not get assoc info (%d)\n", err);
5352                 return err;
5353         }
5354         assoc_info =
5355                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5356         req_len = le32_to_cpu(assoc_info->req_len);
5357         resp_len = le32_to_cpu(assoc_info->resp_len);
5358         if (req_len) {
5359                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5360                                                cfg->extra_buf,
5361                                                WL_ASSOC_INFO_MAX);
5362                 if (err) {
5363                         brcmf_err("could not get assoc req (%d)\n", err);
5364                         return err;
5365                 }
5366                 conn_info->req_ie_len = req_len;
5367                 conn_info->req_ie =
5368                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5369                             GFP_KERNEL);
5370         } else {
5371                 conn_info->req_ie_len = 0;
5372                 conn_info->req_ie = NULL;
5373         }
5374         if (resp_len) {
5375                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5376                                                cfg->extra_buf,
5377                                                WL_ASSOC_INFO_MAX);
5378                 if (err) {
5379                         brcmf_err("could not get assoc resp (%d)\n", err);
5380                         return err;
5381                 }
5382                 conn_info->resp_ie_len = resp_len;
5383                 conn_info->resp_ie =
5384                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5385                             GFP_KERNEL);
5386         } else {
5387                 conn_info->resp_ie_len = 0;
5388                 conn_info->resp_ie = NULL;
5389         }
5390         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5391                   conn_info->req_ie_len, conn_info->resp_ie_len);
5392
5393         return err;
5394 }
5395
5396 static s32
5397 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5398                        struct net_device *ndev,
5399                        const struct brcmf_event_msg *e)
5400 {
5401         struct brcmf_if *ifp = netdev_priv(ndev);
5402         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5403         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5404         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5405         struct ieee80211_channel *notify_channel = NULL;
5406         struct ieee80211_supported_band *band;
5407         struct brcmf_bss_info_le *bi;
5408         struct brcmu_chan ch;
5409         struct cfg80211_roam_info roam_info = {};
5410         u32 freq;
5411         s32 err = 0;
5412         u8 *buf;
5413
5414         brcmf_dbg(TRACE, "Enter\n");
5415
5416         brcmf_get_assoc_ies(cfg, ifp);
5417         memcpy(profile->bssid, e->addr, ETH_ALEN);
5418         brcmf_update_bss_info(cfg, ifp);
5419
5420         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5421         if (buf == NULL) {
5422                 err = -ENOMEM;
5423                 goto done;
5424         }
5425
5426         /* data sent to dongle has to be little endian */
5427         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5428         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5429                                      buf, WL_BSS_INFO_MAX);
5430
5431         if (err)
5432                 goto done;
5433
5434         bi = (struct brcmf_bss_info_le *)(buf + 4);
5435         ch.chspec = le16_to_cpu(bi->chanspec);
5436         cfg->d11inf.decchspec(&ch);
5437
5438         if (ch.band == BRCMU_CHAN_BAND_2G)
5439                 band = wiphy->bands[NL80211_BAND_2GHZ];
5440         else
5441                 band = wiphy->bands[NL80211_BAND_5GHZ];
5442
5443         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5444         notify_channel = ieee80211_get_channel(wiphy, freq);
5445
5446 done:
5447         kfree(buf);
5448
5449         roam_info.channel = notify_channel;
5450         roam_info.bssid = profile->bssid;
5451         roam_info.req_ie = conn_info->req_ie;
5452         roam_info.req_ie_len = conn_info->req_ie_len;
5453         roam_info.resp_ie = conn_info->resp_ie;
5454         roam_info.resp_ie_len = conn_info->resp_ie_len;
5455
5456         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
5457         brcmf_dbg(CONN, "Report roaming result\n");
5458
5459         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5460         brcmf_dbg(TRACE, "Exit\n");
5461         return err;
5462 }
5463
5464 static s32
5465 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5466                        struct net_device *ndev, const struct brcmf_event_msg *e,
5467                        bool completed)
5468 {
5469         struct brcmf_if *ifp = netdev_priv(ndev);
5470         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5471         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5472         struct cfg80211_connect_resp_params conn_params;
5473
5474         brcmf_dbg(TRACE, "Enter\n");
5475
5476         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5477                                &ifp->vif->sme_state)) {
5478                 memset(&conn_params, 0, sizeof(conn_params));
5479                 if (completed) {
5480                         brcmf_get_assoc_ies(cfg, ifp);
5481                         brcmf_update_bss_info(cfg, ifp);
5482                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5483                                 &ifp->vif->sme_state);
5484                         conn_params.status = WLAN_STATUS_SUCCESS;
5485                 } else {
5486                         conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
5487                 }
5488                 conn_params.bssid = profile->bssid;
5489                 conn_params.req_ie = conn_info->req_ie;
5490                 conn_params.req_ie_len = conn_info->req_ie_len;
5491                 conn_params.resp_ie = conn_info->resp_ie;
5492                 conn_params.resp_ie_len = conn_info->resp_ie_len;
5493                 cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
5494                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5495                           completed ? "succeeded" : "failed");
5496         }
5497         brcmf_dbg(TRACE, "Exit\n");
5498         return 0;
5499 }
5500
5501 static s32
5502 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5503                                struct net_device *ndev,
5504                                const struct brcmf_event_msg *e, void *data)
5505 {
5506         static int generation;
5507         u32 event = e->event_code;
5508         u32 reason = e->reason;
5509         struct station_info *sinfo;
5510
5511         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
5512                   brcmf_fweh_event_name(event), event, reason);
5513         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5514             ndev != cfg_to_ndev(cfg)) {
5515                 brcmf_dbg(CONN, "AP mode link down\n");
5516                 complete(&cfg->vif_disabled);
5517                 return 0;
5518         }
5519
5520         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5521             (reason == BRCMF_E_STATUS_SUCCESS)) {
5522                 if (!data) {
5523                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5524                         return -EINVAL;
5525                 }
5526
5527                 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
5528                 if (!sinfo)
5529                         return -ENOMEM;
5530
5531                 sinfo->assoc_req_ies = data;
5532                 sinfo->assoc_req_ies_len = e->datalen;
5533                 generation++;
5534                 sinfo->generation = generation;
5535                 cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
5536
5537                 kfree(sinfo);
5538         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5539                    (event == BRCMF_E_DEAUTH_IND) ||
5540                    (event == BRCMF_E_DEAUTH)) {
5541                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5542         }
5543         return 0;
5544 }
5545
5546 static s32
5547 brcmf_notify_connect_status(struct brcmf_if *ifp,
5548                             const struct brcmf_event_msg *e, void *data)
5549 {
5550         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5551         struct net_device *ndev = ifp->ndev;
5552         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5553         struct ieee80211_channel *chan;
5554         s32 err = 0;
5555
5556         if ((e->event_code == BRCMF_E_DEAUTH) ||
5557             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5558             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5559             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5560                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5561         }
5562
5563         if (brcmf_is_apmode(ifp->vif)) {
5564                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5565         } else if (brcmf_is_linkup(ifp->vif, e)) {
5566                 brcmf_dbg(CONN, "Linkup\n");
5567                 if (brcmf_is_ibssmode(ifp->vif)) {
5568                         brcmf_inform_ibss(cfg, ndev, e->addr);
5569                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5570                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5571                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5572                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5573                                   &ifp->vif->sme_state);
5574                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5575                                 &ifp->vif->sme_state);
5576                 } else
5577                         brcmf_bss_connect_done(cfg, ndev, e, true);
5578                 brcmf_net_setcarrier(ifp, true);
5579         } else if (brcmf_is_linkdown(e)) {
5580                 brcmf_dbg(CONN, "Linkdown\n");
5581                 if (!brcmf_is_ibssmode(ifp->vif)) {
5582                         brcmf_bss_connect_done(cfg, ndev, e, false);
5583                         brcmf_link_down(ifp->vif,
5584                                         brcmf_map_fw_linkdown_reason(e));
5585                         brcmf_init_prof(ndev_to_prof(ndev));
5586                         if (ndev != cfg_to_ndev(cfg))
5587                                 complete(&cfg->vif_disabled);
5588                         brcmf_net_setcarrier(ifp, false);
5589                 }
5590         } else if (brcmf_is_nonetwork(cfg, e)) {
5591                 if (brcmf_is_ibssmode(ifp->vif))
5592                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5593                                   &ifp->vif->sme_state);
5594                 else
5595                         brcmf_bss_connect_done(cfg, ndev, e, false);
5596         }
5597
5598         return err;
5599 }
5600
5601 static s32
5602 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5603                             const struct brcmf_event_msg *e, void *data)
5604 {
5605         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5606         u32 event = e->event_code;
5607         u32 status = e->status;
5608
5609         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5610                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
5611                              &ifp->vif->sme_state)) {
5612                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5613                 } else {
5614                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5615                         brcmf_net_setcarrier(ifp, true);
5616                 }
5617         }
5618
5619         return 0;
5620 }
5621
5622 static s32
5623 brcmf_notify_mic_status(struct brcmf_if *ifp,
5624                         const struct brcmf_event_msg *e, void *data)
5625 {
5626         u16 flags = e->flags;
5627         enum nl80211_key_type key_type;
5628
5629         if (flags & BRCMF_EVENT_MSG_GROUP)
5630                 key_type = NL80211_KEYTYPE_GROUP;
5631         else
5632                 key_type = NL80211_KEYTYPE_PAIRWISE;
5633
5634         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5635                                      NULL, GFP_KERNEL);
5636
5637         return 0;
5638 }
5639
5640 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5641                                   const struct brcmf_event_msg *e, void *data)
5642 {
5643         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5644         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5645         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5646         struct brcmf_cfg80211_vif *vif;
5647
5648         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5649                   ifevent->action, ifevent->flags, ifevent->ifidx,
5650                   ifevent->bsscfgidx);
5651
5652         spin_lock(&event->vif_event_lock);
5653         event->action = ifevent->action;
5654         vif = event->vif;
5655
5656         switch (ifevent->action) {
5657         case BRCMF_E_IF_ADD:
5658                 /* waiting process may have timed out */
5659                 if (!cfg->vif_event.vif) {
5660                         spin_unlock(&event->vif_event_lock);
5661                         return -EBADF;
5662                 }
5663
5664                 ifp->vif = vif;
5665                 vif->ifp = ifp;
5666                 if (ifp->ndev) {
5667                         vif->wdev.netdev = ifp->ndev;
5668                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5669                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5670                 }
5671                 spin_unlock(&event->vif_event_lock);
5672                 wake_up(&event->vif_wq);
5673                 return 0;
5674
5675         case BRCMF_E_IF_DEL:
5676                 spin_unlock(&event->vif_event_lock);
5677                 /* event may not be upon user request */
5678                 if (brcmf_cfg80211_vif_event_armed(cfg))
5679                         wake_up(&event->vif_wq);
5680                 return 0;
5681
5682         case BRCMF_E_IF_CHANGE:
5683                 spin_unlock(&event->vif_event_lock);
5684                 wake_up(&event->vif_wq);
5685                 return 0;
5686
5687         default:
5688                 spin_unlock(&event->vif_event_lock);
5689                 break;
5690         }
5691         return -EINVAL;
5692 }
5693
5694 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5695 {
5696         conf->frag_threshold = (u32)-1;
5697         conf->rts_threshold = (u32)-1;
5698         conf->retry_short = (u32)-1;
5699         conf->retry_long = (u32)-1;
5700 }
5701
5702 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5703 {
5704         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5705                             brcmf_notify_connect_status);
5706         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5707                             brcmf_notify_connect_status);
5708         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5709                             brcmf_notify_connect_status);
5710         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5711                             brcmf_notify_connect_status);
5712         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5713                             brcmf_notify_connect_status);
5714         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5715                             brcmf_notify_connect_status);
5716         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5717                             brcmf_notify_roaming_status);
5718         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5719                             brcmf_notify_mic_status);
5720         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5721                             brcmf_notify_connect_status);
5722         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5723                             brcmf_notify_sched_scan_results);
5724         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5725                             brcmf_notify_vif_event);
5726         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5727                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5728         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5729                             brcmf_p2p_notify_listen_complete);
5730         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5731                             brcmf_p2p_notify_action_frame_rx);
5732         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5733                             brcmf_p2p_notify_action_tx_complete);
5734         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5735                             brcmf_p2p_notify_action_tx_complete);
5736         brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
5737                             brcmf_notify_connect_status);
5738 }
5739
5740 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5741 {
5742         kfree(cfg->conf);
5743         cfg->conf = NULL;
5744         kfree(cfg->extra_buf);
5745         cfg->extra_buf = NULL;
5746         kfree(cfg->wowl.nd);
5747         cfg->wowl.nd = NULL;
5748         kfree(cfg->wowl.nd_info);
5749         cfg->wowl.nd_info = NULL;
5750         kfree(cfg->escan_info.escan_buf);
5751         cfg->escan_info.escan_buf = NULL;
5752 }
5753
5754 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5755 {
5756         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5757         if (!cfg->conf)
5758                 goto init_priv_mem_out;
5759         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5760         if (!cfg->extra_buf)
5761                 goto init_priv_mem_out;
5762         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5763         if (!cfg->wowl.nd)
5764                 goto init_priv_mem_out;
5765         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5766                                     sizeof(struct cfg80211_wowlan_nd_match *),
5767                                     GFP_KERNEL);
5768         if (!cfg->wowl.nd_info)
5769                 goto init_priv_mem_out;
5770         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5771         if (!cfg->escan_info.escan_buf)
5772                 goto init_priv_mem_out;
5773
5774         return 0;
5775
5776 init_priv_mem_out:
5777         brcmf_deinit_priv_mem(cfg);
5778
5779         return -ENOMEM;
5780 }
5781
5782 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5783 {
5784         s32 err = 0;
5785
5786         cfg->scan_request = NULL;
5787         cfg->pwr_save = true;
5788         cfg->dongle_up = false;         /* dongle is not up yet */
5789         err = brcmf_init_priv_mem(cfg);
5790         if (err)
5791                 return err;
5792         brcmf_register_event_handlers(cfg);
5793         mutex_init(&cfg->usr_sync);
5794         brcmf_init_escan(cfg);
5795         brcmf_init_conf(cfg->conf);
5796         init_completion(&cfg->vif_disabled);
5797         return err;
5798 }
5799
5800 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5801 {
5802         cfg->dongle_up = false; /* dongle down */
5803         brcmf_abort_scanning(cfg);
5804         brcmf_deinit_priv_mem(cfg);
5805 }
5806
5807 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5808 {
5809         init_waitqueue_head(&event->vif_wq);
5810         spin_lock_init(&event->vif_event_lock);
5811 }
5812
5813 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5814 {
5815         s32 err;
5816         u32 bcn_timeout;
5817         __le32 roamtrigger[2];
5818         __le32 roam_delta[2];
5819
5820         /* Configure beacon timeout value based upon roaming setting */
5821         if (ifp->drvr->settings->roamoff)
5822                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5823         else
5824                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5825         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5826         if (err) {
5827                 brcmf_err("bcn_timeout error (%d)\n", err);
5828                 goto roam_setup_done;
5829         }
5830
5831         /* Enable/Disable built-in roaming to allow supplicant to take care of
5832          * roaming.
5833          */
5834         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5835                   ifp->drvr->settings->roamoff ? "Off" : "On");
5836         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5837                                       ifp->drvr->settings->roamoff);
5838         if (err) {
5839                 brcmf_err("roam_off error (%d)\n", err);
5840                 goto roam_setup_done;
5841         }
5842
5843         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5844         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5845         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5846                                      (void *)roamtrigger, sizeof(roamtrigger));
5847         if (err) {
5848                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5849                 goto roam_setup_done;
5850         }
5851
5852         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5853         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5854         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5855                                      (void *)roam_delta, sizeof(roam_delta));
5856         if (err) {
5857                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5858                 goto roam_setup_done;
5859         }
5860
5861 roam_setup_done:
5862         return err;
5863 }
5864
5865 static s32
5866 brcmf_dongle_scantime(struct brcmf_if *ifp)
5867 {
5868         s32 err = 0;
5869
5870         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5871                                     BRCMF_SCAN_CHANNEL_TIME);
5872         if (err) {
5873                 brcmf_err("Scan assoc time error (%d)\n", err);
5874                 goto dongle_scantime_out;
5875         }
5876         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5877                                     BRCMF_SCAN_UNASSOC_TIME);
5878         if (err) {
5879                 brcmf_err("Scan unassoc time error (%d)\n", err);
5880                 goto dongle_scantime_out;
5881         }
5882
5883         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5884                                     BRCMF_SCAN_PASSIVE_TIME);
5885         if (err) {
5886                 brcmf_err("Scan passive time error (%d)\n", err);
5887                 goto dongle_scantime_out;
5888         }
5889
5890 dongle_scantime_out:
5891         return err;
5892 }
5893
5894 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5895                                            struct brcmu_chan *ch)
5896 {
5897         u32 ht40_flag;
5898
5899         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5900         if (ch->sb == BRCMU_CHAN_SB_U) {
5901                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5902                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5903                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5904         } else {
5905                 /* It should be one of
5906                  * IEEE80211_CHAN_NO_HT40 or
5907                  * IEEE80211_CHAN_NO_HT40PLUS
5908                  */
5909                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5910                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5911                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5912         }
5913 }
5914
5915 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5916                                     u32 bw_cap[])
5917 {
5918         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5919         struct ieee80211_supported_band *band;
5920         struct ieee80211_channel *channel;
5921         struct wiphy *wiphy;
5922         struct brcmf_chanspec_list *list;
5923         struct brcmu_chan ch;
5924         int err;
5925         u8 *pbuf;
5926         u32 i, j;
5927         u32 total;
5928         u32 chaninfo;
5929
5930         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5931
5932         if (pbuf == NULL)
5933                 return -ENOMEM;
5934
5935         list = (struct brcmf_chanspec_list *)pbuf;
5936
5937         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5938                                        BRCMF_DCMD_MEDLEN);
5939         if (err) {
5940                 brcmf_err("get chanspecs error (%d)\n", err);
5941                 goto fail_pbuf;
5942         }
5943
5944         wiphy = cfg_to_wiphy(cfg);
5945         band = wiphy->bands[NL80211_BAND_2GHZ];
5946         if (band)
5947                 for (i = 0; i < band->n_channels; i++)
5948                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5949         band = wiphy->bands[NL80211_BAND_5GHZ];
5950         if (band)
5951                 for (i = 0; i < band->n_channels; i++)
5952                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5953
5954         total = le32_to_cpu(list->count);
5955         for (i = 0; i < total; i++) {
5956                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5957                 cfg->d11inf.decchspec(&ch);
5958
5959                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5960                         band = wiphy->bands[NL80211_BAND_2GHZ];
5961                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5962                         band = wiphy->bands[NL80211_BAND_5GHZ];
5963                 } else {
5964                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5965                         continue;
5966                 }
5967                 if (!band)
5968                         continue;
5969                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5970                     ch.bw == BRCMU_CHAN_BW_40)
5971                         continue;
5972                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5973                     ch.bw == BRCMU_CHAN_BW_80)
5974                         continue;
5975
5976                 channel = NULL;
5977                 for (j = 0; j < band->n_channels; j++) {
5978                         if (band->channels[j].hw_value == ch.control_ch_num) {
5979                                 channel = &band->channels[j];
5980                                 break;
5981                         }
5982                 }
5983                 if (!channel) {
5984                         /* It seems firmware supports some channel we never
5985                          * considered. Something new in IEEE standard?
5986                          */
5987                         brcmf_err("Ignoring unexpected firmware channel %d\n",
5988                                   ch.control_ch_num);
5989                         continue;
5990                 }
5991
5992                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
5993                         continue;
5994
5995                 /* assuming the chanspecs order is HT20,
5996                  * HT40 upper, HT40 lower, and VHT80.
5997                  */
5998                 if (ch.bw == BRCMU_CHAN_BW_80) {
5999                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
6000                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
6001                         brcmf_update_bw40_channel_flag(channel, &ch);
6002                 } else {
6003                         /* enable the channel and disable other bandwidths
6004                          * for now as mentioned order assure they are enabled
6005                          * for subsequent chanspecs.
6006                          */
6007                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6008                                          IEEE80211_CHAN_NO_80MHZ;
6009                         ch.bw = BRCMU_CHAN_BW_20;
6010                         cfg->d11inf.encchspec(&ch);
6011                         chaninfo = ch.chspec;
6012                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6013                                                        &chaninfo);
6014                         if (!err) {
6015                                 if (chaninfo & WL_CHAN_RADAR)
6016                                         channel->flags |=
6017                                                 (IEEE80211_CHAN_RADAR |
6018                                                  IEEE80211_CHAN_NO_IR);
6019                                 if (chaninfo & WL_CHAN_PASSIVE)
6020                                         channel->flags |=
6021                                                 IEEE80211_CHAN_NO_IR;
6022                         }
6023                 }
6024         }
6025
6026 fail_pbuf:
6027         kfree(pbuf);
6028         return err;
6029 }
6030
6031 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6032 {
6033         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
6034         struct ieee80211_supported_band *band;
6035         struct brcmf_fil_bwcap_le band_bwcap;
6036         struct brcmf_chanspec_list *list;
6037         u8 *pbuf;
6038         u32 val;
6039         int err;
6040         struct brcmu_chan ch;
6041         u32 num_chan;
6042         int i, j;
6043
6044         /* verify support for bw_cap command */
6045         val = WLC_BAND_5G;
6046         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6047
6048         if (!err) {
6049                 /* only set 2G bandwidth using bw_cap command */
6050                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6051                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6052                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6053                                                sizeof(band_bwcap));
6054         } else {
6055                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6056                 val = WLC_N_BW_40ALL;
6057                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6058         }
6059
6060         if (!err) {
6061                 /* update channel info in 2G band */
6062                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6063
6064                 if (pbuf == NULL)
6065                         return -ENOMEM;
6066
6067                 ch.band = BRCMU_CHAN_BAND_2G;
6068                 ch.bw = BRCMU_CHAN_BW_40;
6069                 ch.sb = BRCMU_CHAN_SB_NONE;
6070                 ch.chnum = 0;
6071                 cfg->d11inf.encchspec(&ch);
6072
6073                 /* pass encoded chanspec in query */
6074                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6075
6076                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6077                                                BRCMF_DCMD_MEDLEN);
6078                 if (err) {
6079                         brcmf_err("get chanspecs error (%d)\n", err);
6080                         kfree(pbuf);
6081                         return err;
6082                 }
6083
6084                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6085                 list = (struct brcmf_chanspec_list *)pbuf;
6086                 num_chan = le32_to_cpu(list->count);
6087                 for (i = 0; i < num_chan; i++) {
6088                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6089                         cfg->d11inf.decchspec(&ch);
6090                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6091                                 continue;
6092                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6093                                 continue;
6094                         for (j = 0; j < band->n_channels; j++) {
6095                                 if (band->channels[j].hw_value == ch.control_ch_num)
6096                                         break;
6097                         }
6098                         if (WARN_ON(j == band->n_channels))
6099                                 continue;
6100
6101                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6102                 }
6103                 kfree(pbuf);
6104         }
6105         return err;
6106 }
6107
6108 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6109 {
6110         u32 band, mimo_bwcap;
6111         int err;
6112
6113         band = WLC_BAND_2G;
6114         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6115         if (!err) {
6116                 bw_cap[NL80211_BAND_2GHZ] = band;
6117                 band = WLC_BAND_5G;
6118                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6119                 if (!err) {
6120                         bw_cap[NL80211_BAND_5GHZ] = band;
6121                         return;
6122                 }
6123                 WARN_ON(1);
6124                 return;
6125         }
6126         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6127         mimo_bwcap = 0;
6128         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6129         if (err)
6130                 /* assume 20MHz if firmware does not give a clue */
6131                 mimo_bwcap = WLC_N_BW_20ALL;
6132
6133         switch (mimo_bwcap) {
6134         case WLC_N_BW_40ALL:
6135                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6136                 /* fall-thru */
6137         case WLC_N_BW_20IN2G_40IN5G:
6138                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6139                 /* fall-thru */
6140         case WLC_N_BW_20ALL:
6141                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6142                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6143                 break;
6144         default:
6145                 brcmf_err("invalid mimo_bw_cap value\n");
6146         }
6147 }
6148
6149 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6150                                 u32 bw_cap[2], u32 nchain)
6151 {
6152         band->ht_cap.ht_supported = true;
6153         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6154                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6155                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6156         }
6157         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6158         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6159         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6160         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6161         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6162         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6163 }
6164
6165 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6166 {
6167         u16 mcs_map;
6168         int i;
6169
6170         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6171                 mcs_map = (mcs_map << 2) | supp;
6172
6173         return cpu_to_le16(mcs_map);
6174 }
6175
6176 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6177                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6178                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6179 {
6180         __le16 mcs_map;
6181
6182         /* not allowed in 2.4G band */
6183         if (band->band == NL80211_BAND_2GHZ)
6184                 return;
6185
6186         band->vht_cap.vht_supported = true;
6187         /* 80MHz is mandatory */
6188         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6189         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6190                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6191                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6192         }
6193         /* all support 256-QAM */
6194         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6195         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6196         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6197
6198         /* Beamforming support information */
6199         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6200                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6201         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6202                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6203         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6204                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6205         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6206                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6207
6208         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6209                 band->vht_cap.cap |=
6210                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6211                 band->vht_cap.cap |= ((txstreams - 1) <<
6212                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6213                 band->vht_cap.cap |=
6214                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6215         }
6216 }
6217
6218 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
6219 {
6220         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
6221         struct wiphy *wiphy;
6222         u32 nmode = 0;
6223         u32 vhtmode = 0;
6224         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6225         u32 rxchain;
6226         u32 nchain;
6227         int err;
6228         s32 i;
6229         struct ieee80211_supported_band *band;
6230         u32 txstreams = 0;
6231         u32 txbf_bfe_cap = 0;
6232         u32 txbf_bfr_cap = 0;
6233
6234         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6235         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6236         if (err) {
6237                 brcmf_err("nmode error (%d)\n", err);
6238         } else {
6239                 brcmf_get_bwcap(ifp, bw_cap);
6240         }
6241         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6242                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6243                   bw_cap[NL80211_BAND_5GHZ]);
6244
6245         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6246         if (err) {
6247                 brcmf_err("rxchain error (%d)\n", err);
6248                 nchain = 1;
6249         } else {
6250                 for (nchain = 0; rxchain; nchain++)
6251                         rxchain = rxchain & (rxchain - 1);
6252         }
6253         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6254
6255         err = brcmf_construct_chaninfo(cfg, bw_cap);
6256         if (err) {
6257                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6258                 return err;
6259         }
6260
6261         if (vhtmode) {
6262                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6263                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6264                                               &txbf_bfe_cap);
6265                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6266                                               &txbf_bfr_cap);
6267         }
6268
6269         wiphy = cfg_to_wiphy(cfg);
6270         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6271                 band = wiphy->bands[i];
6272                 if (band == NULL)
6273                         continue;
6274
6275                 if (nmode)
6276                         brcmf_update_ht_cap(band, bw_cap, nchain);
6277                 if (vhtmode)
6278                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6279                                              txbf_bfe_cap, txbf_bfr_cap);
6280         }
6281
6282         return 0;
6283 }
6284
6285 static const struct ieee80211_txrx_stypes
6286 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6287         [NL80211_IFTYPE_STATION] = {
6288                 .tx = 0xffff,
6289                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6290                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6291         },
6292         [NL80211_IFTYPE_P2P_CLIENT] = {
6293                 .tx = 0xffff,
6294                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6295                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6296         },
6297         [NL80211_IFTYPE_P2P_GO] = {
6298                 .tx = 0xffff,
6299                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6300                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6301                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6302                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6303                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6304                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6305                       BIT(IEEE80211_STYPE_ACTION >> 4)
6306         },
6307         [NL80211_IFTYPE_P2P_DEVICE] = {
6308                 .tx = 0xffff,
6309                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6310                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6311         }
6312 };
6313
6314 /**
6315  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6316  *
6317  * @wiphy: wiphy object.
6318  * @ifp: interface object needed for feat module api.
6319  *
6320  * The interface modes and combinations are determined dynamically here
6321  * based on firmware functionality.
6322  *
6323  * no p2p and no mbss:
6324  *
6325  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6326  *
6327  * no p2p and mbss:
6328  *
6329  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6330  *      #AP <= 4, matching BI, channels = 1, 4 total
6331  *
6332  * p2p, no mchan, and mbss:
6333  *
6334  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6335  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6336  *      #AP <= 4, matching BI, channels = 1, 4 total
6337  *
6338  * p2p, mchan, and mbss:
6339  *
6340  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6341  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6342  *      #AP <= 4, matching BI, channels = 1, 4 total
6343  */
6344 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6345 {
6346         struct ieee80211_iface_combination *combo = NULL;
6347         struct ieee80211_iface_limit *c0_limits = NULL;
6348         struct ieee80211_iface_limit *p2p_limits = NULL;
6349         struct ieee80211_iface_limit *mbss_limits = NULL;
6350         bool mbss, p2p;
6351         int i, c, n_combos;
6352
6353         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6354         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6355
6356         n_combos = 1 + !!p2p + !!mbss;
6357         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6358         if (!combo)
6359                 goto err;
6360
6361         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6362                                  BIT(NL80211_IFTYPE_ADHOC) |
6363                                  BIT(NL80211_IFTYPE_AP);
6364
6365         c = 0;
6366         i = 0;
6367         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6368         if (!c0_limits)
6369                 goto err;
6370         c0_limits[i].max = 1;
6371         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6372         if (p2p) {
6373                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6374                         combo[c].num_different_channels = 2;
6375                 else
6376                         combo[c].num_different_channels = 1;
6377                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6378                                           BIT(NL80211_IFTYPE_P2P_GO) |
6379                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6380                 c0_limits[i].max = 1;
6381                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6382                 c0_limits[i].max = 1;
6383                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6384                                        BIT(NL80211_IFTYPE_P2P_GO);
6385         } else {
6386                 combo[c].num_different_channels = 1;
6387                 c0_limits[i].max = 1;
6388                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6389         }
6390         combo[c].max_interfaces = i;
6391         combo[c].n_limits = i;
6392         combo[c].limits = c0_limits;
6393
6394         if (p2p) {
6395                 c++;
6396                 i = 0;
6397                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6398                 if (!p2p_limits)
6399                         goto err;
6400                 p2p_limits[i].max = 1;
6401                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6402                 p2p_limits[i].max = 1;
6403                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6404                 p2p_limits[i].max = 1;
6405                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6406                 p2p_limits[i].max = 1;
6407                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6408                 combo[c].num_different_channels = 1;
6409                 combo[c].max_interfaces = i;
6410                 combo[c].n_limits = i;
6411                 combo[c].limits = p2p_limits;
6412         }
6413
6414         if (mbss) {
6415                 c++;
6416                 i = 0;
6417                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6418                 if (!mbss_limits)
6419                         goto err;
6420                 mbss_limits[i].max = 4;
6421                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6422                 combo[c].beacon_int_infra_match = true;
6423                 combo[c].num_different_channels = 1;
6424                 combo[c].max_interfaces = 4;
6425                 combo[c].n_limits = i;
6426                 combo[c].limits = mbss_limits;
6427         }
6428
6429         wiphy->n_iface_combinations = n_combos;
6430         wiphy->iface_combinations = combo;
6431         return 0;
6432
6433 err:
6434         kfree(c0_limits);
6435         kfree(p2p_limits);
6436         kfree(mbss_limits);
6437         kfree(combo);
6438         return -ENOMEM;
6439 }
6440
6441 #ifdef CONFIG_PM
6442 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
6443         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6444         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6445         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6446         .pattern_min_len = 1,
6447         .max_pkt_offset = 1500,
6448 };
6449 #endif
6450
6451 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6452 {
6453 #ifdef CONFIG_PM
6454         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6455         struct wiphy_wowlan_support *wowl;
6456
6457         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
6458                        GFP_KERNEL);
6459         if (!wowl) {
6460                 brcmf_err("only support basic wowlan features\n");
6461                 wiphy->wowlan = &brcmf_wowlan_support;
6462                 return;
6463         }
6464
6465         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6466                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6467                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
6468                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6469                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6470                 }
6471         }
6472         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6473                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6474                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6475         }
6476
6477         wiphy->wowlan = wowl;
6478 #endif
6479 }
6480
6481 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6482 {
6483         struct brcmf_pub *drvr = ifp->drvr;
6484         const struct ieee80211_iface_combination *combo;
6485         struct ieee80211_supported_band *band;
6486         u16 max_interfaces = 0;
6487         bool gscan;
6488         __le32 bandlist[3];
6489         u32 n_bands;
6490         int err, i;
6491
6492         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6493         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6494         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6495
6496         err = brcmf_setup_ifmodes(wiphy, ifp);
6497         if (err)
6498                 return err;
6499
6500         for (i = 0, combo = wiphy->iface_combinations;
6501              i < wiphy->n_iface_combinations; i++, combo++) {
6502                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6503         }
6504
6505         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6506              i++) {
6507                 u8 *addr = drvr->addresses[i].addr;
6508
6509                 memcpy(addr, drvr->mac, ETH_ALEN);
6510                 if (i) {
6511                         addr[0] |= BIT(1);
6512                         addr[ETH_ALEN - 1] ^= i;
6513                 }
6514         }
6515         wiphy->addresses = drvr->addresses;
6516         wiphy->n_addresses = i;
6517
6518         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6519         wiphy->cipher_suites = brcmf_cipher_suites;
6520         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6521         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6522                 wiphy->n_cipher_suites--;
6523         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6524                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6525                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6526
6527         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
6528                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
6529                         WIPHY_FLAG_HAVE_AP_SME |
6530                         WIPHY_FLAG_OFFCHAN_TX |
6531                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6532         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6533                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6534         if (!ifp->drvr->settings->roamoff)
6535                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6536         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
6537                 wiphy_ext_feature_set(wiphy,
6538                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
6539                 wiphy_ext_feature_set(wiphy,
6540                                       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
6541         }
6542         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6543         wiphy->max_remain_on_channel_duration = 5000;
6544         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6545                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
6546                 brcmf_pno_wiphy_params(wiphy, gscan);
6547         }
6548         /* vendor commands/events support */
6549         wiphy->vendor_commands = brcmf_vendor_cmds;
6550         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6551
6552         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6553                 brcmf_wiphy_wowl_params(wiphy, ifp);
6554         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6555                                      sizeof(bandlist));
6556         if (err) {
6557                 brcmf_err("could not obtain band info: err=%d\n", err);
6558                 return err;
6559         }
6560         /* first entry in bandlist is number of bands */
6561         n_bands = le32_to_cpu(bandlist[0]);
6562         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6563                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6564                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6565                                        GFP_KERNEL);
6566                         if (!band)
6567                                 return -ENOMEM;
6568
6569                         band->channels = kmemdup(&__wl_2ghz_channels,
6570                                                  sizeof(__wl_2ghz_channels),
6571                                                  GFP_KERNEL);
6572                         if (!band->channels) {
6573                                 kfree(band);
6574                                 return -ENOMEM;
6575                         }
6576
6577                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6578                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6579                 }
6580                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6581                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6582                                        GFP_KERNEL);
6583                         if (!band)
6584                                 return -ENOMEM;
6585
6586                         band->channels = kmemdup(&__wl_5ghz_channels,
6587                                                  sizeof(__wl_5ghz_channels),
6588                                                  GFP_KERNEL);
6589                         if (!band->channels) {
6590                                 kfree(band);
6591                                 return -ENOMEM;
6592                         }
6593
6594                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6595                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6596                 }
6597         }
6598
6599         wiphy_read_of_freq_limits(wiphy);
6600
6601         return 0;
6602 }
6603
6604 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6605 {
6606         struct net_device *ndev;
6607         struct wireless_dev *wdev;
6608         struct brcmf_if *ifp;
6609         s32 power_mode;
6610         s32 err = 0;
6611
6612         if (cfg->dongle_up)
6613                 return err;
6614
6615         ndev = cfg_to_ndev(cfg);
6616         wdev = ndev->ieee80211_ptr;
6617         ifp = netdev_priv(ndev);
6618
6619         /* make sure RF is ready for work */
6620         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6621
6622         brcmf_dongle_scantime(ifp);
6623
6624         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6625         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6626         if (err)
6627                 goto default_conf_out;
6628         brcmf_dbg(INFO, "power save set to %s\n",
6629                   (power_mode ? "enabled" : "disabled"));
6630
6631         err = brcmf_dongle_roam(ifp);
6632         if (err)
6633                 goto default_conf_out;
6634         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6635                                           NULL);
6636         if (err)
6637                 goto default_conf_out;
6638
6639         brcmf_configure_arp_nd_offload(ifp, true);
6640
6641         cfg->dongle_up = true;
6642 default_conf_out:
6643
6644         return err;
6645
6646 }
6647
6648 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6649 {
6650         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6651
6652         return brcmf_config_dongle(ifp->drvr->config);
6653 }
6654
6655 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6656 {
6657         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6658
6659         /*
6660          * While going down, if associated with AP disassociate
6661          * from AP to save power
6662          */
6663         if (check_vif_up(ifp->vif)) {
6664                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6665
6666                 /* Make sure WPA_Supplicant receives all the event
6667                    generated due to DISASSOC call to the fw to keep
6668                    the state fw and WPA_Supplicant state consistent
6669                  */
6670                 brcmf_delay(500);
6671         }
6672
6673         brcmf_abort_scanning(cfg);
6674         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6675
6676         return 0;
6677 }
6678
6679 s32 brcmf_cfg80211_up(struct net_device *ndev)
6680 {
6681         struct brcmf_if *ifp = netdev_priv(ndev);
6682         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6683         s32 err = 0;
6684
6685         mutex_lock(&cfg->usr_sync);
6686         err = __brcmf_cfg80211_up(ifp);
6687         mutex_unlock(&cfg->usr_sync);
6688
6689         return err;
6690 }
6691
6692 s32 brcmf_cfg80211_down(struct net_device *ndev)
6693 {
6694         struct brcmf_if *ifp = netdev_priv(ndev);
6695         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6696         s32 err = 0;
6697
6698         mutex_lock(&cfg->usr_sync);
6699         err = __brcmf_cfg80211_down(ifp);
6700         mutex_unlock(&cfg->usr_sync);
6701
6702         return err;
6703 }
6704
6705 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6706 {
6707         struct wireless_dev *wdev = &ifp->vif->wdev;
6708
6709         return wdev->iftype;
6710 }
6711
6712 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6713                              unsigned long state)
6714 {
6715         struct brcmf_cfg80211_vif *vif;
6716
6717         list_for_each_entry(vif, &cfg->vif_list, list) {
6718                 if (test_bit(state, &vif->sme_state))
6719                         return true;
6720         }
6721         return false;
6722 }
6723
6724 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6725                                     u8 action)
6726 {
6727         u8 evt_action;
6728
6729         spin_lock(&event->vif_event_lock);
6730         evt_action = event->action;
6731         spin_unlock(&event->vif_event_lock);
6732         return evt_action == action;
6733 }
6734
6735 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6736                                   struct brcmf_cfg80211_vif *vif)
6737 {
6738         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6739
6740         spin_lock(&event->vif_event_lock);
6741         event->vif = vif;
6742         event->action = 0;
6743         spin_unlock(&event->vif_event_lock);
6744 }
6745
6746 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6747 {
6748         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6749         bool armed;
6750
6751         spin_lock(&event->vif_event_lock);
6752         armed = event->vif != NULL;
6753         spin_unlock(&event->vif_event_lock);
6754
6755         return armed;
6756 }
6757
6758 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6759                                   u8 action, ulong timeout)
6760 {
6761         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6762
6763         return wait_event_timeout(event->vif_wq,
6764                                   vif_event_equals(event, action), timeout);
6765 }
6766
6767 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6768                                         struct brcmf_fil_country_le *ccreq)
6769 {
6770         struct brcmfmac_pd_cc *country_codes;
6771         struct brcmfmac_pd_cc_entry *cc;
6772         s32 found_index;
6773         int i;
6774
6775         country_codes = drvr->settings->country_codes;
6776         if (!country_codes) {
6777                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6778                 return -EINVAL;
6779         }
6780
6781         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6782             (alpha2[1] == ccreq->country_abbrev[1])) {
6783                 brcmf_dbg(TRACE, "Country code already set\n");
6784                 return -EAGAIN;
6785         }
6786
6787         found_index = -1;
6788         for (i = 0; i < country_codes->table_size; i++) {
6789                 cc = &country_codes->table[i];
6790                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6791                         found_index = i;
6792                 if ((cc->iso3166[0] == alpha2[0]) &&
6793                     (cc->iso3166[1] == alpha2[1])) {
6794                         found_index = i;
6795                         break;
6796                 }
6797         }
6798         if (found_index == -1) {
6799                 brcmf_dbg(TRACE, "No country code match found\n");
6800                 return -EINVAL;
6801         }
6802         memset(ccreq, 0, sizeof(*ccreq));
6803         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6804         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6805                BRCMF_COUNTRY_BUF_SZ);
6806         ccreq->country_abbrev[0] = alpha2[0];
6807         ccreq->country_abbrev[1] = alpha2[1];
6808         ccreq->country_abbrev[2] = 0;
6809
6810         return 0;
6811 }
6812
6813 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6814                                         struct regulatory_request *req)
6815 {
6816         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6817         struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
6818         struct brcmf_fil_country_le ccreq;
6819         s32 err;
6820         int i;
6821
6822         /* The country code gets set to "00" by default at boot, ignore */
6823         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
6824                 return;
6825
6826         /* ignore non-ISO3166 country codes */
6827         for (i = 0; i < 2; i++)
6828                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6829                         brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
6830                                   req->alpha2[0], req->alpha2[1]);
6831                         return;
6832                 }
6833
6834         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6835                   req->alpha2[0], req->alpha2[1]);
6836
6837         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6838         if (err) {
6839                 brcmf_err("Country code iovar returned err = %d\n", err);
6840                 return;
6841         }
6842
6843         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6844         if (err)
6845                 return;
6846
6847         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6848         if (err) {
6849                 brcmf_err("Firmware rejected country setting\n");
6850                 return;
6851         }
6852         brcmf_setup_wiphybands(cfg);
6853 }
6854
6855 static void brcmf_free_wiphy(struct wiphy *wiphy)
6856 {
6857         int i;
6858
6859         if (!wiphy)
6860                 return;
6861
6862         if (wiphy->iface_combinations) {
6863                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6864                         kfree(wiphy->iface_combinations[i].limits);
6865         }
6866         kfree(wiphy->iface_combinations);
6867         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6868                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6869                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6870         }
6871         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6872                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6873                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6874         }
6875 #if IS_ENABLED(CONFIG_PM)
6876         if (wiphy->wowlan != &brcmf_wowlan_support)
6877                 kfree(wiphy->wowlan);
6878 #endif
6879 }
6880
6881 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6882                                                   struct cfg80211_ops *ops,
6883                                                   bool p2pdev_forced)
6884 {
6885         struct wiphy *wiphy = drvr->wiphy;
6886         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6887         struct brcmf_cfg80211_info *cfg;
6888         struct brcmf_cfg80211_vif *vif;
6889         struct brcmf_if *ifp;
6890         s32 err = 0;
6891         s32 io_type;
6892         u16 *cap = NULL;
6893
6894         if (!ndev) {
6895                 brcmf_err("ndev is invalid\n");
6896                 return NULL;
6897         }
6898
6899         cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
6900         if (!cfg) {
6901                 brcmf_err("Could not allocate wiphy device\n");
6902                 return NULL;
6903         }
6904
6905         cfg->wiphy = wiphy;
6906         cfg->pub = drvr;
6907         init_vif_event(&cfg->vif_event);
6908         INIT_LIST_HEAD(&cfg->vif_list);
6909
6910         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
6911         if (IS_ERR(vif))
6912                 goto wiphy_out;
6913
6914         ifp = netdev_priv(ndev);
6915         vif->ifp = ifp;
6916         vif->wdev.netdev = ndev;
6917         ndev->ieee80211_ptr = &vif->wdev;
6918         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6919
6920         err = wl_init_priv(cfg);
6921         if (err) {
6922                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6923                 brcmf_free_vif(vif);
6924                 goto wiphy_out;
6925         }
6926         ifp->vif = vif;
6927
6928         /* determine d11 io type before wiphy setup */
6929         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6930         if (err) {
6931                 brcmf_err("Failed to get D11 version (%d)\n", err);
6932                 goto priv_out;
6933         }
6934         cfg->d11inf.io_type = (u8)io_type;
6935         brcmu_d11_attach(&cfg->d11inf);
6936
6937         /* regulatory notifer below needs access to cfg so
6938          * assign it now.
6939          */
6940         drvr->config = cfg;
6941
6942         err = brcmf_setup_wiphy(wiphy, ifp);
6943         if (err < 0)
6944                 goto priv_out;
6945
6946         brcmf_dbg(INFO, "Registering custom regulatory\n");
6947         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6948         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6949         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6950
6951         /* firmware defaults to 40MHz disabled in 2G band. We signal
6952          * cfg80211 here that we do and have it decide we can enable
6953          * it. But first check if device does support 2G operation.
6954          */
6955         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6956                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6957                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6958         }
6959 #ifdef CONFIG_PM
6960         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6961                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6962 #endif
6963         err = wiphy_register(wiphy);
6964         if (err < 0) {
6965                 brcmf_err("Could not register wiphy device (%d)\n", err);
6966                 goto priv_out;
6967         }
6968
6969         err = brcmf_setup_wiphybands(cfg);
6970         if (err) {
6971                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
6972                 goto wiphy_unreg_out;
6973         }
6974
6975         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6976          * setup 40MHz in 2GHz band and enable OBSS scanning.
6977          */
6978         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6979                 err = brcmf_enable_bw40_2g(cfg);
6980                 if (!err)
6981                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6982                                                       BRCMF_OBSS_COEX_AUTO);
6983                 else
6984                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6985         }
6986
6987         err = brcmf_fweh_activate_events(ifp);
6988         if (err) {
6989                 brcmf_err("FWEH activation failed (%d)\n", err);
6990                 goto wiphy_unreg_out;
6991         }
6992
6993         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6994         if (err) {
6995                 brcmf_err("P2P initialisation failed (%d)\n", err);
6996                 goto wiphy_unreg_out;
6997         }
6998         err = brcmf_btcoex_attach(cfg);
6999         if (err) {
7000                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
7001                 brcmf_p2p_detach(&cfg->p2p);
7002                 goto wiphy_unreg_out;
7003         }
7004         err = brcmf_pno_attach(cfg);
7005         if (err) {
7006                 brcmf_err("PNO initialisation failed (%d)\n", err);
7007                 brcmf_btcoex_detach(cfg);
7008                 brcmf_p2p_detach(&cfg->p2p);
7009                 goto wiphy_unreg_out;
7010         }
7011
7012         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
7013                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
7014                 if (err) {
7015                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
7016                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
7017                 } else {
7018                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
7019                                             brcmf_notify_tdls_peer_event);
7020                 }
7021         }
7022
7023         /* (re-) activate FWEH event handling */
7024         err = brcmf_fweh_activate_events(ifp);
7025         if (err) {
7026                 brcmf_err("FWEH activation failed (%d)\n", err);
7027                 goto detach;
7028         }
7029
7030         /* Fill in some of the advertised nl80211 supported features */
7031         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7032                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7033 #ifdef CONFIG_PM
7034                 if (wiphy->wowlan &&
7035                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7036                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7037 #endif
7038         }
7039
7040         return cfg;
7041
7042 detach:
7043         brcmf_pno_detach(cfg);
7044         brcmf_btcoex_detach(cfg);
7045         brcmf_p2p_detach(&cfg->p2p);
7046 wiphy_unreg_out:
7047         wiphy_unregister(cfg->wiphy);
7048 priv_out:
7049         wl_deinit_priv(cfg);
7050         brcmf_free_vif(vif);
7051         ifp->vif = NULL;
7052 wiphy_out:
7053         brcmf_free_wiphy(wiphy);
7054         kfree(cfg);
7055         return NULL;
7056 }
7057
7058 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7059 {
7060         if (!cfg)
7061                 return;
7062
7063         brcmf_pno_detach(cfg);
7064         brcmf_btcoex_detach(cfg);
7065         wiphy_unregister(cfg->wiphy);
7066         kfree(cfg->ops);
7067         wl_deinit_priv(cfg);
7068         brcmf_free_wiphy(cfg->wiphy);
7069         kfree(cfg);
7070 }