drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "pno.h"
  36 #include "cfg80211.h"
  37 #include "feature.h"
  38 #include "fwil.h"
  39 #include "proto.h"
  40 #include "vendor.h"
  41 #include "bus.h"
  42 #include "common.h"
  43
  44 #define BRCMF_SCAN_IE_LEN_MAX           2048
  45
  46 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  47 #define WPA_OUI_TYPE                    1
  48 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  49 #define WME_OUI_TYPE                    2
  50 #define WPS_OUI_TYPE                    4
  51
  52 #define VS_IE_FIXED_HDR_LEN             6
  53 #define WPA_IE_VERSION_LEN              2
  54 #define WPA_IE_MIN_OUI_LEN              4
  55 #define WPA_IE_SUITE_COUNT_LEN          2
  56
  57 #define WPA_CIPHER_NONE                 0       /* None */
  58 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  59 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  60 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  61 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  62
  63 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  64 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  65 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  66 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  67 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  68 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  69 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  70 #define RSN_CAP_MFPR_MASK               BIT(6)
  71 #define RSN_CAP_MFPC_MASK               BIT(7)
  72 #define RSN_PMKID_COUNT_LEN             2
  73
  74 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  75                                                  * string :"add", "del" (+ NUL)
  76                                                  */
  77 #define VNDR_IE_COUNT_OFFSET            4
  78 #define VNDR_IE_PKTFLAG_OFFSET          8
  79 #define VNDR_IE_VSIE_OFFSET             12
  80 #define VNDR_IE_HDR_SIZE                12
  81 #define VNDR_IE_PARSE_LIMIT             5
  82
  83 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  84 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  85
  86 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  87 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  88 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  89
  90 #define BRCMF_SCAN_CHANNEL_TIME         40
  91 #define BRCMF_SCAN_UNASSOC_TIME         40
  92 #define BRCMF_SCAN_PASSIVE_TIME         120
  93
  94 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  95
  96 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  97         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  98
  99 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 100 {
 101         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 102                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 103                           vif->sme_state);
 104                 return false;
 105         }
 106         return true;
 107 }
 108
 109 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 110 #define RATETAB_ENT(_rateid, _flags) \
 111         {                                                               \
 112                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 113                 .hw_value       = (_rateid),                            \
 114                 .flags          = (_flags),                             \
 115         }
 116
 117 static struct ieee80211_rate __wl_rates[] = {
 118         RATETAB_ENT(BRCM_RATE_1M, 0),
 119         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 122         RATETAB_ENT(BRCM_RATE_6M, 0),
 123         RATETAB_ENT(BRCM_RATE_9M, 0),
 124         RATETAB_ENT(BRCM_RATE_12M, 0),
 125         RATETAB_ENT(BRCM_RATE_18M, 0),
 126         RATETAB_ENT(BRCM_RATE_24M, 0),
 127         RATETAB_ENT(BRCM_RATE_36M, 0),
 128         RATETAB_ENT(BRCM_RATE_48M, 0),
 129         RATETAB_ENT(BRCM_RATE_54M, 0),
 130 };
 131
 132 #define wl_g_rates              (__wl_rates + 0)
 133 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 134 #define wl_a_rates              (__wl_rates + 4)
 135 #define wl_a_rates_size         (wl_g_rates_size - 4)
 136
 137 #define CHAN2G(_channel, _freq) {                               \
 138         .band                   = NL80211_BAND_2GHZ,            \
 139         .center_freq            = (_freq),                      \
 140         .hw_value               = (_channel),                   \
 141         .max_antenna_gain       = 0,                            \
 142         .max_power              = 30,                           \
 143 }
 144
 145 #define CHAN5G(_channel) {                                      \
 146         .band                   = NL80211_BAND_5GHZ,            \
 147         .center_freq            = 5000 + (5 * (_channel)),      \
 148         .hw_value               = (_channel),                   \
 149         .max_antenna_gain       = 0,                            \
 150         .max_power              = 30,                           \
 151 }
 152
 153 static struct ieee80211_channel __wl_2ghz_channels[] = {
 154         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 155         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 156         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 157         CHAN2G(13, 2472), CHAN2G(14, 2484)
 158 };
 159
 160 static struct ieee80211_channel __wl_5ghz_channels[] = {
 161         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 162         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 163         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 164         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 165         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 166         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 167 };
 168
 169 /* Band templates duplicated per wiphy. The channel info
 170  * above is added to the band during setup.
 171  */
 172 static const struct ieee80211_supported_band __wl_band_2ghz = {
 173         .band = NL80211_BAND_2GHZ,
 174         .bitrates = wl_g_rates,
 175         .n_bitrates = wl_g_rates_size,
 176 };
 177
 178 static const struct ieee80211_supported_band __wl_band_5ghz = {
 179         .band = NL80211_BAND_5GHZ,
 180         .bitrates = wl_a_rates,
 181         .n_bitrates = wl_a_rates_size,
 182 };
 183
 184 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 185  * By default world regulatory domain defined in reg.c puts the flags
 186  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 187  * With respect to these flags, wpa_supplicant doesn't * start p2p
 188  * operations on 5GHz channels. All the changes in world regulatory
 189  * domain are to be done here.
 190  */
 191 static const struct ieee80211_regdomain brcmf_regdom = {
 192         .n_reg_rules = 4,
 193         .alpha2 =  "99",
 194         .reg_rules = {
 195                 /* IEEE 802.11b/g, channels 1..11 */
 196                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 197                 /* If any */
 198                 /* IEEE 802.11 channel 14 - Only JP enables
 199                  * this and for 802.11b only
 200                  */
 201                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 202                 /* IEEE 802.11a, channel 36..64 */
 203                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 204                 /* IEEE 802.11a, channel 100..165 */
 205                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 206 };
 207
 208 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 209  * are supported. A pointer to this array and the number of entries is passed
 210  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 211  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 212  * device does not support MFP then the number of suites will be decreased by 1
 213  */
 214 static const u32 brcmf_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         /* Keep as last entry: */
 220         WLAN_CIPHER_SUITE_AES_CMAC
 221 };
 222
 223 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 224 struct brcmf_vs_tlv {
 225         u8 id;
 226         u8 len;
 227         u8 oui[3];
 228         u8 oui_type;
 229 };
 230
 231 struct parsed_vndr_ie_info {
 232         u8 *ie_ptr;
 233         u32 ie_len;     /* total length including id & length field */
 234         struct brcmf_vs_tlv vndrie;
 235 };
 236
 237 struct parsed_vndr_ies {
 238         u32 count;
 239         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 240 };
 241
 242 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 243 {
 244         switch (band) {
 245         case NL80211_BAND_2GHZ:
 246                 return WLC_BAND_2G;
 247         case NL80211_BAND_5GHZ:
 248                 return WLC_BAND_5G;
 249         default:
 250                 WARN_ON(1);
 251                 break;
 252         }
 253         return 0;
 254 }
 255
 256 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 257                                struct cfg80211_chan_def *ch)
 258 {
 259         struct brcmu_chan ch_inf;
 260         s32 primary_offset;
 261
 262         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 263                   ch->chan->center_freq, ch->center_freq1, ch->width);
 264         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 265         primary_offset = ch->chan->center_freq - ch->center_freq1;
 266         switch (ch->width) {
 267         case NL80211_CHAN_WIDTH_20:
 268         case NL80211_CHAN_WIDTH_20_NOHT:
 269                 ch_inf.bw = BRCMU_CHAN_BW_20;
 270                 WARN_ON(primary_offset != 0);
 271                 break;
 272         case NL80211_CHAN_WIDTH_40:
 273                 ch_inf.bw = BRCMU_CHAN_BW_40;
 274                 if (primary_offset > 0)
 275                         ch_inf.sb = BRCMU_CHAN_SB_U;
 276                 else
 277                         ch_inf.sb = BRCMU_CHAN_SB_L;
 278                 break;
 279         case NL80211_CHAN_WIDTH_80:
 280                 ch_inf.bw = BRCMU_CHAN_BW_80;
 281                 if (primary_offset == -30)
 282                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 283                 else if (primary_offset == -10)
 284                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 285                 else if (primary_offset == 10)
 286                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80P80:
 291         case NL80211_CHAN_WIDTH_160:
 292         case NL80211_CHAN_WIDTH_5:
 293         case NL80211_CHAN_WIDTH_10:
 294         default:
 295                 WARN_ON_ONCE(1);
 296         }
 297         switch (ch->chan->band) {
 298         case NL80211_BAND_2GHZ:
 299                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 300                 break;
 301         case NL80211_BAND_5GHZ:
 302                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 303                 break;
 304         case NL80211_BAND_60GHZ:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         d11inf->encchspec(&ch_inf);
 309
 310         return ch_inf.chspec;
 311 }
 312
 313 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 314                         struct ieee80211_channel *ch)
 315 {
 316         struct brcmu_chan ch_inf;
 317
 318         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 319         ch_inf.bw = BRCMU_CHAN_BW_20;
 320         d11inf->encchspec(&ch_inf);
 321
 322         return ch_inf.chspec;
 323 }
 324
 325 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 326  * triples, returning a pointer to the substring whose first element
 327  * matches tag
 328  */
 329 static const struct brcmf_tlv *
 330 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 331 {
 332         const struct brcmf_tlv *elt = buf;
 333         int totlen = buflen;
 334
 335         /* find tagged parameter */
 336         while (totlen >= TLV_HDR_LEN) {
 337                 int len = elt->len;
 338
 339                 /* validate remaining totlen */
 340                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 341                         return elt;
 342
 343                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 344                 totlen -= (len + TLV_HDR_LEN);
 345         }
 346
 347         return NULL;
 348 }
 349
 350 /* Is any of the tlvs the expected entry? If
 351  * not update the tlvs buffer pointer/length.
 352  */
 353 static bool
 354 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 355                  const u8 *oui, u32 oui_len, u8 type)
 356 {
 357         /* If the contents match the OUI and the type */
 358         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 359             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 360             type == ie[TLV_BODY_OFF + oui_len]) {
 361                 return true;
 362         }
 363
 364         if (tlvs == NULL)
 365                 return false;
 366         /* point to the next ie */
 367         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 368         /* calculate the length of the rest of the buffer */
 369         *tlvs_len -= (int)(ie - *tlvs);
 370         /* update the pointer to the start of the buffer */
 371         *tlvs = ie;
 372
 373         return false;
 374 }
 375
 376 static struct brcmf_vs_tlv *
 377 brcmf_find_wpaie(const u8 *parse, u32 len)
 378 {
 379         const struct brcmf_tlv *ie;
 380
 381         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 382                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 383                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 384                         return (struct brcmf_vs_tlv *)ie;
 385         }
 386         return NULL;
 387 }
 388
 389 static struct brcmf_vs_tlv *
 390 brcmf_find_wpsie(const u8 *parse, u32 len)
 391 {
 392         const struct brcmf_tlv *ie;
 393
 394         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 395                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 396                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 397                         return (struct brcmf_vs_tlv *)ie;
 398         }
 399         return NULL;
 400 }
 401
 402 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 403                                      struct brcmf_cfg80211_vif *vif,
 404                                      enum nl80211_iftype new_type)
 405 {
 406         struct brcmf_cfg80211_vif *pos;
 407         bool check_combos = false;
 408         int ret = 0;
 409         struct iface_combination_params params = {
 410                 .num_different_channels = 1,
 411         };
 412
 413         list_for_each_entry(pos, &cfg->vif_list, list)
 414                 if (pos == vif) {
 415                         params.iftype_num[new_type]++;
 416                 } else {
 417                         /* concurrent interfaces so need check combinations */
 418                         check_combos = true;
 419                         params.iftype_num[pos->wdev.iftype]++;
 420                 }
 421
 422         if (check_combos)
 423                 ret = cfg80211_check_combinations(cfg->wiphy, &params);
 424
 425         return ret;
 426 }
 427
 428 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 429                                   enum nl80211_iftype new_type)
 430 {
 431         struct brcmf_cfg80211_vif *pos;
 432         struct iface_combination_params params = {
 433                 .num_different_channels = 1,
 434         };
 435
 436         list_for_each_entry(pos, &cfg->vif_list, list)
 437                 params.iftype_num[pos->wdev.iftype]++;
 438
 439         params.iftype_num[new_type]++;
 440         return cfg80211_check_combinations(cfg->wiphy, &params);
 441 }
 442
 443 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 444                                  struct brcmf_wsec_key_le *key_le)
 445 {
 446         key_le->index = cpu_to_le32(key->index);
 447         key_le->len = cpu_to_le32(key->len);
 448         key_le->algo = cpu_to_le32(key->algo);
 449         key_le->flags = cpu_to_le32(key->flags);
 450         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 451         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 452         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 453         memcpy(key_le->data, key->data, sizeof(key->data));
 454         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 455 }
 456
 457 static int
 458 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 459 {
 460         int err;
 461         struct brcmf_wsec_key_le key_le;
 462
 463         convert_key_from_CPU(key, &key_le);
 464
 465         brcmf_netdev_wait_pend8021x(ifp);
 466
 467         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 468                                         sizeof(key_le));
 469
 470         if (err)
 471                 brcmf_err("wsec_key error (%d)\n", err);
 472         return err;
 473 }
 474
 475 static s32
 476 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 477 {
 478         s32 err;
 479         u32 mode;
 480
 481         if (enable)
 482                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 483         else
 484                 mode = 0;
 485
 486         /* Try to set and enable ARP offload feature, this may fail, then it  */
 487         /* is simply not supported and err 0 will be returned                 */
 488         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 489         if (err) {
 490                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 491                           mode, err);
 492                 err = 0;
 493         } else {
 494                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 495                 if (err) {
 496                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 497                                   enable, err);
 498                         err = 0;
 499                 } else
 500                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 501                                   enable, mode);
 502         }
 503
 504         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 505         if (err) {
 506                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 507                           enable, err);
 508                 err = 0;
 509         } else
 510                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 511                           enable, mode);
 512
 513         return err;
 514 }
 515
 516 static void
 517 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 518 {
 519         struct brcmf_cfg80211_vif *vif;
 520         struct brcmf_if *ifp;
 521
 522         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 523         ifp = vif->ifp;
 524
 525         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 526             (wdev->iftype == NL80211_IFTYPE_AP) ||
 527             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 528                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 529                                                 ADDR_DIRECT);
 530         else
 531                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 532                                                 ADDR_INDIRECT);
 533 }
 534
 535 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 536 {
 537         int bsscfgidx;
 538
 539         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 540                 /* bsscfgidx 1 is reserved for legacy P2P */
 541                 if (bsscfgidx == 1)
 542                         continue;
 543                 if (!drvr->iflist[bsscfgidx])
 544                         return bsscfgidx;
 545         }
 546
 547         return -ENOMEM;
 548 }
 549
 550 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 551 {
 552         struct brcmf_mbss_ssid_le mbss_ssid_le;
 553         int bsscfgidx;
 554         int err;
 555
 556         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 557         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 558         if (bsscfgidx < 0)
 559                 return bsscfgidx;
 560
 561         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 562         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 563         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 564
 565         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 566                                         sizeof(mbss_ssid_le));
 567         if (err < 0)
 568                 brcmf_err("setting ssid failed %d\n", err);
 569
 570         return err;
 571 }
 572
 573 /**
 574  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 575  *
 576  * @wiphy: wiphy device of new interface.
 577  * @name: name of the new interface.
 578  * @params: contains mac address for AP device.
 579  */
 580 static
 581 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 582                                       struct vif_params *params)
 583 {
 584         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 585         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 586         struct brcmf_cfg80211_vif *vif;
 587         int err;
 588
 589         if (brcmf_cfg80211_vif_event_armed(cfg))
 590                 return ERR_PTR(-EBUSY);
 591
 592         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 593
 594         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 595         if (IS_ERR(vif))
 596                 return (struct wireless_dev *)vif;
 597
 598         brcmf_cfg80211_arm_vif_event(cfg, vif);
 599
 600         err = brcmf_cfg80211_request_ap_if(ifp);
 601         if (err) {
 602                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 603                 goto fail;
 604         }
 605
 606         /* wait for firmware event */
 607         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 608                                             BRCMF_VIF_EVENT_TIMEOUT);
 609         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 610         if (!err) {
 611                 brcmf_err("timeout occurred\n");
 612                 err = -EIO;
 613                 goto fail;
 614         }
 615
 616         /* interface created in firmware */
 617         ifp = vif->ifp;
 618         if (!ifp) {
 619                 brcmf_err("no if pointer provided\n");
 620                 err = -ENOENT;
 621                 goto fail;
 622         }
 623
 624         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 625         err = brcmf_net_attach(ifp, true);
 626         if (err) {
 627                 brcmf_err("Registering netdevice failed\n");
 628                 goto fail;
 629         }
 630
 631         return &ifp->vif->wdev;
 632
 633 fail:
 634         brcmf_free_vif(vif);
 635         return ERR_PTR(err);
 636 }
 637
 638 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 639 {
 640         enum nl80211_iftype iftype;
 641
 642         iftype = vif->wdev.iftype;
 643         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 644 }
 645
 646 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 647 {
 648         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 649 }
 650
 651 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 652                                                      const char *name,
 653                                                      unsigned char name_assign_type,
 654                                                      enum nl80211_iftype type,
 655                                                      struct vif_params *params)
 656 {
 657         struct wireless_dev *wdev;
 658         int err;
 659
 660         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 661         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 662         if (err) {
 663                 brcmf_err("iface validation failed: err=%d\n", err);
 664                 return ERR_PTR(err);
 665         }
 666         switch (type) {
 667         case NL80211_IFTYPE_ADHOC:
 668         case NL80211_IFTYPE_STATION:
 669         case NL80211_IFTYPE_AP_VLAN:
 670         case NL80211_IFTYPE_WDS:
 671         case NL80211_IFTYPE_MONITOR:
 672         case NL80211_IFTYPE_MESH_POINT:
 673                 return ERR_PTR(-EOPNOTSUPP);
 674         case NL80211_IFTYPE_AP:
 675                 wdev = brcmf_ap_add_vif(wiphy, name, params);
 676                 break;
 677         case NL80211_IFTYPE_P2P_CLIENT:
 678         case NL80211_IFTYPE_P2P_GO:
 679         case NL80211_IFTYPE_P2P_DEVICE:
 680                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
 681                 break;
 682         case NL80211_IFTYPE_UNSPECIFIED:
 683         default:
 684                 return ERR_PTR(-EINVAL);
 685         }
 686
 687         if (IS_ERR(wdev))
 688                 brcmf_err("add iface %s type %d failed: err=%d\n",
 689                           name, type, (int)PTR_ERR(wdev));
 690         else
 691                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 692
 693         return wdev;
 694 }
 695
 696 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 697 {
 698         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 699                 brcmf_set_mpc(ifp, mpc);
 700 }
 701
 702 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 703 {
 704         s32 err = 0;
 705
 706         if (check_vif_up(ifp->vif)) {
 707                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 708                 if (err) {
 709                         brcmf_err("fail to set mpc\n");
 710                         return;
 711                 }
 712                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 713         }
 714 }
 715
 716 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 717                                 struct brcmf_if *ifp, bool aborted,
 718                                 bool fw_abort)
 719 {
 720         struct brcmf_scan_params_le params_le;
 721         struct cfg80211_scan_request *scan_request;
 722         u64 reqid;
 723         u32 bucket;
 724         s32 err = 0;
 725
 726         brcmf_dbg(SCAN, "Enter\n");
 727
 728         /* clear scan request, because the FW abort can cause a second call */
 729         /* to this functon and might cause a double cfg80211_scan_done      */
 730         scan_request = cfg->scan_request;
 731         cfg->scan_request = NULL;
 732
 733         if (timer_pending(&cfg->escan_timeout))
 734                 del_timer_sync(&cfg->escan_timeout);
 735
 736         if (fw_abort) {
 737                 /* Do a scan abort to stop the driver's scan engine */
 738                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 739                 memset(&params_le, 0, sizeof(params_le));
 740                 eth_broadcast_addr(params_le.bssid);
 741                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 742                 params_le.scan_type = 0;
 743                 params_le.channel_num = cpu_to_le32(1);
 744                 params_le.nprobes = cpu_to_le32(1);
 745                 params_le.active_time = cpu_to_le32(-1);
 746                 params_le.passive_time = cpu_to_le32(-1);
 747                 params_le.home_time = cpu_to_le32(-1);
 748                 /* Scan is aborted by setting channel_list[0] to -1 */
 749                 params_le.channel_list[0] = cpu_to_le16(-1);
 750                 /* E-Scan (or anyother type) can be aborted by SCAN */
 751                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 752                                              &params_le, sizeof(params_le));
 753                 if (err)
 754                         brcmf_err("Scan abort failed\n");
 755         }
 756
 757         brcmf_scan_config_mpc(ifp, 1);
 758
 759         /*
 760          * e-scan can be initiated internally
 761          * which takes precedence.
 762          */
 763         if (cfg->int_escan_map) {
 764                 brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
 765                           cfg->int_escan_map);
 766                 while (cfg->int_escan_map) {
 767                         bucket = __ffs(cfg->int_escan_map);
 768                         cfg->int_escan_map &= ~BIT(bucket);
 769                         reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
 770                                                                bucket);
 771                         if (!aborted) {
 772                                 brcmf_dbg(SCAN, "report results: reqid=%llu\n",
 773                                           reqid);
 774                                 cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
 775                                                             reqid);
 776                         }
 777                 }
 778         } else if (scan_request) {
 779                 struct cfg80211_scan_info info = {
 780                         .aborted = aborted,
 781                 };
 782
 783                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 784                           aborted ? "Aborted" : "Done");
 785                 cfg80211_scan_done(scan_request, &info);
 786         }
 787         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 788                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 789
 790         return err;
 791 }
 792
 793 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 794                                        struct wireless_dev *wdev)
 795 {
 796         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 797         struct net_device *ndev = wdev->netdev;
 798         struct brcmf_if *ifp = netdev_priv(ndev);
 799         int ret;
 800         int err;
 801
 802         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 803
 804         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 805         if (err) {
 806                 brcmf_err("interface_remove failed %d\n", err);
 807                 goto err_unarm;
 808         }
 809
 810         /* wait for firmware event */
 811         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 812                                             BRCMF_VIF_EVENT_TIMEOUT);
 813         if (!ret) {
 814                 brcmf_err("timeout occurred\n");
 815                 err = -EIO;
 816                 goto err_unarm;
 817         }
 818
 819         brcmf_remove_interface(ifp, true);
 820
 821 err_unarm:
 822         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 823         return err;
 824 }
 825
 826 static
 827 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 828 {
 829         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 830         struct net_device *ndev = wdev->netdev;
 831
 832         if (ndev && ndev == cfg_to_ndev(cfg))
 833                 return -ENOTSUPP;
 834
 835         /* vif event pending in firmware */
 836         if (brcmf_cfg80211_vif_event_armed(cfg))
 837                 return -EBUSY;
 838
 839         if (ndev) {
 840                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 841                     cfg->escan_info.ifp == netdev_priv(ndev))
 842                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 843                                                     true, true);
 844
 845                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 846         }
 847
 848         switch (wdev->iftype) {
 849         case NL80211_IFTYPE_ADHOC:
 850         case NL80211_IFTYPE_STATION:
 851         case NL80211_IFTYPE_AP_VLAN:
 852         case NL80211_IFTYPE_WDS:
 853         case NL80211_IFTYPE_MONITOR:
 854         case NL80211_IFTYPE_MESH_POINT:
 855                 return -EOPNOTSUPP;
 856         case NL80211_IFTYPE_AP:
 857                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 858         case NL80211_IFTYPE_P2P_CLIENT:
 859         case NL80211_IFTYPE_P2P_GO:
 860         case NL80211_IFTYPE_P2P_DEVICE:
 861                 return brcmf_p2p_del_vif(wiphy, wdev);
 862         case NL80211_IFTYPE_UNSPECIFIED:
 863         default:
 864                 return -EINVAL;
 865         }
 866         return -EOPNOTSUPP;
 867 }
 868
 869 static s32
 870 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 871                          enum nl80211_iftype type,
 872                          struct vif_params *params)
 873 {
 874         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 875         struct brcmf_if *ifp = netdev_priv(ndev);
 876         struct brcmf_cfg80211_vif *vif = ifp->vif;
 877         s32 infra = 0;
 878         s32 ap = 0;
 879         s32 err = 0;
 880
 881         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 882                   type);
 883
 884         /* WAR: There are a number of p2p interface related problems which
 885          * need to be handled initially (before doing the validate).
 886          * wpa_supplicant tends to do iface changes on p2p device/client/go
 887          * which are not always possible/allowed. However we need to return
 888          * OK otherwise the wpa_supplicant wont start. The situation differs
 889          * on configuration and setup (p2pon=1 module param). The first check
 890          * is to see if the request is a change to station for p2p iface.
 891          */
 892         if ((type == NL80211_IFTYPE_STATION) &&
 893             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 894              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 895              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 896                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 897                 /* Now depending on whether module param p2pon=1 was used the
 898                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 899                  * that if p2pon=1 is used, but a newer supplicant is used then
 900                  * we should return an error, as this combination wont work.
 901                  * In other situations 0 is returned and supplicant will start
 902                  * normally. It will give a trace in cfg80211, but it is the
 903                  * only way to get it working. Unfortunately this will result
 904                  * in situation where we wont support new supplicant in
 905                  * combination with module param p2pon=1, but that is the way
 906                  * it is. If the user tries this then unloading of driver might
 907                  * fail/lock.
 908                  */
 909                 if (cfg->p2p.p2pdev_dynamically)
 910                         return -EOPNOTSUPP;
 911                 else
 912                         return 0;
 913         }
 914         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 915         if (err) {
 916                 brcmf_err("iface validation failed: err=%d\n", err);
 917                 return err;
 918         }
 919         switch (type) {
 920         case NL80211_IFTYPE_MONITOR:
 921         case NL80211_IFTYPE_WDS:
 922                 brcmf_err("type (%d) : currently we do not support this type\n",
 923                           type);
 924                 return -EOPNOTSUPP;
 925         case NL80211_IFTYPE_ADHOC:
 926                 infra = 0;
 927                 break;
 928         case NL80211_IFTYPE_STATION:
 929                 infra = 1;
 930                 break;
 931         case NL80211_IFTYPE_AP:
 932         case NL80211_IFTYPE_P2P_GO:
 933                 ap = 1;
 934                 break;
 935         default:
 936                 err = -EINVAL;
 937                 goto done;
 938         }
 939
 940         if (ap) {
 941                 if (type == NL80211_IFTYPE_P2P_GO) {
 942                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 943                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 944                 }
 945                 if (!err) {
 946                         brcmf_dbg(INFO, "IF Type = AP\n");
 947                 }
 948         } else {
 949                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 950                 if (err) {
 951                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 952                         err = -EAGAIN;
 953                         goto done;
 954                 }
 955                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 956                           "Adhoc" : "Infra");
 957         }
 958         ndev->ieee80211_ptr->iftype = type;
 959
 960         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 961
 962 done:
 963         brcmf_dbg(TRACE, "Exit\n");
 964
 965         return err;
 966 }
 967
 968 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 969                              struct brcmf_scan_params_le *params_le,
 970                              struct cfg80211_scan_request *request)
 971 {
 972         u32 n_ssids;
 973         u32 n_channels;
 974         s32 i;
 975         s32 offset;
 976         u16 chanspec;
 977         char *ptr;
 978         struct brcmf_ssid_le ssid_le;
 979
 980         eth_broadcast_addr(params_le->bssid);
 981         params_le->bss_type = DOT11_BSSTYPE_ANY;
 982         params_le->scan_type = 0;
 983         params_le->channel_num = 0;
 984         params_le->nprobes = cpu_to_le32(-1);
 985         params_le->active_time = cpu_to_le32(-1);
 986         params_le->passive_time = cpu_to_le32(-1);
 987         params_le->home_time = cpu_to_le32(-1);
 988         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 989
 990         /* if request is null exit so it will be all channel broadcast scan */
 991         if (!request)
 992                 return;
 993
 994         n_ssids = request->n_ssids;
 995         n_channels = request->n_channels;
 996         /* Copy channel array if applicable */
 997         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 998                   n_channels);
 999         if (n_channels > 0) {
1000                 for (i = 0; i < n_channels; i++) {
1001                         chanspec = channel_to_chanspec(&cfg->d11inf,
1002                                                        request->channels[i]);
1003                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1004                                   request->channels[i]->hw_value, chanspec);
1005                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1006                 }
1007         } else {
1008                 brcmf_dbg(SCAN, "Scanning all channels\n");
1009         }
1010         /* Copy ssid array if applicable */
1011         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1012         if (n_ssids > 0) {
1013                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1014                                 n_channels * sizeof(u16);
1015                 offset = roundup(offset, sizeof(u32));
1016                 ptr = (char *)params_le + offset;
1017                 for (i = 0; i < n_ssids; i++) {
1018                         memset(&ssid_le, 0, sizeof(ssid_le));
1019                         ssid_le.SSID_len =
1020                                         cpu_to_le32(request->ssids[i].ssid_len);
1021                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1022                                request->ssids[i].ssid_len);
1023                         if (!ssid_le.SSID_len)
1024                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1025                         else
1026                                 brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1027                                           i, ssid_le.SSID, ssid_le.SSID_len);
1028                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1029                         ptr += sizeof(ssid_le);
1030                 }
1031         } else {
1032                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
1033                 if ((request->ssids) && request->ssids->ssid_len) {
1034                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
1035                                   params_le->ssid_le.SSID,
1036                                   request->ssids->ssid_len);
1037                         params_le->ssid_le.SSID_len =
1038                                 cpu_to_le32(request->ssids->ssid_len);
1039                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
1040                                 request->ssids->ssid_len);
1041                 }
1042         }
1043         /* Adding mask to channel numbers */
1044         params_le->channel_num =
1045                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1046                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1047 }
1048
1049 static s32
1050 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1051                 struct cfg80211_scan_request *request)
1052 {
1053         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1054                           offsetof(struct brcmf_escan_params_le, params_le);
1055         struct brcmf_escan_params_le *params;
1056         s32 err = 0;
1057
1058         brcmf_dbg(SCAN, "E-SCAN START\n");
1059
1060         if (request != NULL) {
1061                 /* Allocate space for populating ssids in struct */
1062                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1063
1064                 /* Allocate space for populating ssids in struct */
1065                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1066         }
1067
1068         params = kzalloc(params_size, GFP_KERNEL);
1069         if (!params) {
1070                 err = -ENOMEM;
1071                 goto exit;
1072         }
1073         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1074         brcmf_escan_prep(cfg, &params->params_le, request);
1075         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1076         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1077         params->sync_id = cpu_to_le16(0x1234);
1078
1079         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1080         if (err) {
1081                 if (err == -EBUSY)
1082                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1083                 else
1084                         brcmf_err("error (%d)\n", err);
1085         }
1086
1087         kfree(params);
1088 exit:
1089         return err;
1090 }
1091
1092 static s32
1093 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1094 {
1095         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1096         s32 err;
1097         u32 passive_scan;
1098         struct brcmf_scan_results *results;
1099         struct escan_info *escan = &cfg->escan_info;
1100
1101         brcmf_dbg(SCAN, "Enter\n");
1102         escan->ifp = ifp;
1103         escan->wiphy = cfg->wiphy;
1104         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1105         passive_scan = cfg->active_scan ? 0 : 1;
1106         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1107                                     passive_scan);
1108         if (err) {
1109                 brcmf_err("error (%d)\n", err);
1110                 return err;
1111         }
1112         brcmf_scan_config_mpc(ifp, 0);
1113         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1114         results->version = 0;
1115         results->count = 0;
1116         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1117
1118         err = escan->run(cfg, ifp, request);
1119         if (err)
1120                 brcmf_scan_config_mpc(ifp, 1);
1121         return err;
1122 }
1123
1124 static s32
1125 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1126                      struct cfg80211_scan_request *request,
1127                      struct cfg80211_ssid *this_ssid)
1128 {
1129         struct brcmf_if *ifp = vif->ifp;
1130         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1131         struct cfg80211_ssid *ssids;
1132         u32 passive_scan;
1133         bool escan_req;
1134         bool spec_scan;
1135         s32 err;
1136         struct brcmf_ssid_le ssid_le;
1137         u32 SSID_len;
1138
1139         brcmf_dbg(SCAN, "START ESCAN\n");
1140
1141         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1142                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1143                 return -EAGAIN;
1144         }
1145         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1146                 brcmf_err("Scanning being aborted: status (%lu)\n",
1147                           cfg->scan_status);
1148                 return -EAGAIN;
1149         }
1150         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1151                 brcmf_err("Scanning suppressed: status (%lu)\n",
1152                           cfg->scan_status);
1153                 return -EAGAIN;
1154         }
1155         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1156                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1157                 return -EAGAIN;
1158         }
1159
1160         /* If scan req comes for p2p0, send it over primary I/F */
1161         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1162                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1163
1164         escan_req = false;
1165         if (request) {
1166                 /* scan bss */
1167                 ssids = request->ssids;
1168                 escan_req = true;
1169         } else {
1170                 /* scan in ibss */
1171                 /* we don't do escan in ibss */
1172                 ssids = this_ssid;
1173         }
1174
1175         cfg->scan_request = request;
1176         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1177         if (escan_req) {
1178                 cfg->escan_info.run = brcmf_run_escan;
1179                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1180                 if (err)
1181                         goto scan_out;
1182
1183                 err = brcmf_do_escan(vif->ifp, request);
1184                 if (err)
1185                         goto scan_out;
1186         } else {
1187                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1188                           ssids->ssid, ssids->ssid_len);
1189                 memset(&ssid_le, 0, sizeof(ssid_le));
1190                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1191                 ssid_le.SSID_len = cpu_to_le32(0);
1192                 spec_scan = false;
1193                 if (SSID_len) {
1194                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1195                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1196                         spec_scan = true;
1197                 } else
1198                         brcmf_dbg(SCAN, "Broadcast scan\n");
1199
1200                 passive_scan = cfg->active_scan ? 0 : 1;
1201                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1202                                             passive_scan);
1203                 if (err) {
1204                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1205                         goto scan_out;
1206                 }
1207                 brcmf_scan_config_mpc(ifp, 0);
1208                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1209                                              sizeof(ssid_le));
1210                 if (err) {
1211                         if (err == -EBUSY)
1212                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1213                                           ssid_le.SSID);
1214                         else
1215                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1216
1217                         brcmf_scan_config_mpc(ifp, 1);
1218                         goto scan_out;
1219                 }
1220         }
1221
1222         /* Arm scan timeout timer */
1223         mod_timer(&cfg->escan_timeout, jiffies +
1224                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1225
1226         return 0;
1227
1228 scan_out:
1229         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1230         cfg->scan_request = NULL;
1231         return err;
1232 }
1233
1234 static s32
1235 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1236 {
1237         struct brcmf_cfg80211_vif *vif;
1238         s32 err = 0;
1239
1240         brcmf_dbg(TRACE, "Enter\n");
1241         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1242         if (!check_vif_up(vif))
1243                 return -EIO;
1244
1245         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1246
1247         if (err)
1248                 brcmf_err("scan error (%d)\n", err);
1249
1250         brcmf_dbg(TRACE, "Exit\n");
1251         return err;
1252 }
1253
1254 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1255 {
1256         s32 err = 0;
1257
1258         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1259                                       rts_threshold);
1260         if (err)
1261                 brcmf_err("Error (%d)\n", err);
1262
1263         return err;
1264 }
1265
1266 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1267 {
1268         s32 err = 0;
1269
1270         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1271                                       frag_threshold);
1272         if (err)
1273                 brcmf_err("Error (%d)\n", err);
1274
1275         return err;
1276 }
1277
1278 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1279 {
1280         s32 err = 0;
1281         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1282
1283         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1284         if (err) {
1285                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1286                 return err;
1287         }
1288         return err;
1289 }
1290
1291 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1292 {
1293         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1294         struct net_device *ndev = cfg_to_ndev(cfg);
1295         struct brcmf_if *ifp = netdev_priv(ndev);
1296         s32 err = 0;
1297
1298         brcmf_dbg(TRACE, "Enter\n");
1299         if (!check_vif_up(ifp->vif))
1300                 return -EIO;
1301
1302         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1303             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1304                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1305                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1306                 if (!err)
1307                         goto done;
1308         }
1309         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1310             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1311                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1312                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1313                 if (!err)
1314                         goto done;
1315         }
1316         if (changed & WIPHY_PARAM_RETRY_LONG
1317             && (cfg->conf->retry_long != wiphy->retry_long)) {
1318                 cfg->conf->retry_long = wiphy->retry_long;
1319                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1320                 if (!err)
1321                         goto done;
1322         }
1323         if (changed & WIPHY_PARAM_RETRY_SHORT
1324             && (cfg->conf->retry_short != wiphy->retry_short)) {
1325                 cfg->conf->retry_short = wiphy->retry_short;
1326                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1327                 if (!err)
1328                         goto done;
1329         }
1330
1331 done:
1332         brcmf_dbg(TRACE, "Exit\n");
1333         return err;
1334 }
1335
1336 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1337 {
1338         memset(prof, 0, sizeof(*prof));
1339 }
1340
1341 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1342 {
1343         u16 reason;
1344
1345         switch (e->event_code) {
1346         case BRCMF_E_DEAUTH:
1347         case BRCMF_E_DEAUTH_IND:
1348         case BRCMF_E_DISASSOC_IND:
1349                 reason = e->reason;
1350                 break;
1351         case BRCMF_E_LINK:
1352         default:
1353                 reason = 0;
1354                 break;
1355         }
1356         return reason;
1357 }
1358
1359 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1360 {
1361         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1362         s32 err = 0;
1363
1364         brcmf_dbg(TRACE, "Enter\n");
1365
1366         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1367                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1368                 err = brcmf_fil_cmd_data_set(vif->ifp,
1369                                              BRCMF_C_DISASSOC, NULL, 0);
1370                 if (err) {
1371                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1372                 }
1373                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1374                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1375                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1376                                               true, GFP_KERNEL);
1377         }
1378         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1379         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1380         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1381         brcmf_dbg(TRACE, "Exit\n");
1382 }
1383
1384 static s32
1385 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1386                       struct cfg80211_ibss_params *params)
1387 {
1388         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1389         struct brcmf_if *ifp = netdev_priv(ndev);
1390         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1391         struct brcmf_join_params join_params;
1392         size_t join_params_size = 0;
1393         s32 err = 0;
1394         s32 wsec = 0;
1395         s32 bcnprd;
1396         u16 chanspec;
1397         u32 ssid_len;
1398
1399         brcmf_dbg(TRACE, "Enter\n");
1400         if (!check_vif_up(ifp->vif))
1401                 return -EIO;
1402
1403         if (params->ssid)
1404                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1405         else {
1406                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1407                 return -EOPNOTSUPP;
1408         }
1409
1410         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1411
1412         if (params->bssid)
1413                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1414         else
1415                 brcmf_dbg(CONN, "No BSSID specified\n");
1416
1417         if (params->chandef.chan)
1418                 brcmf_dbg(CONN, "channel: %d\n",
1419                           params->chandef.chan->center_freq);
1420         else
1421                 brcmf_dbg(CONN, "no channel specified\n");
1422
1423         if (params->channel_fixed)
1424                 brcmf_dbg(CONN, "fixed channel required\n");
1425         else
1426                 brcmf_dbg(CONN, "no fixed channel required\n");
1427
1428         if (params->ie && params->ie_len)
1429                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1430         else
1431                 brcmf_dbg(CONN, "no ie specified\n");
1432
1433         if (params->beacon_interval)
1434                 brcmf_dbg(CONN, "beacon interval: %d\n",
1435                           params->beacon_interval);
1436         else
1437                 brcmf_dbg(CONN, "no beacon interval specified\n");
1438
1439         if (params->basic_rates)
1440                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1441         else
1442                 brcmf_dbg(CONN, "no basic rates specified\n");
1443
1444         if (params->privacy)
1445                 brcmf_dbg(CONN, "privacy required\n");
1446         else
1447                 brcmf_dbg(CONN, "no privacy required\n");
1448
1449         /* Configure Privacy for starter */
1450         if (params->privacy)
1451                 wsec |= WEP_ENABLED;
1452
1453         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1454         if (err) {
1455                 brcmf_err("wsec failed (%d)\n", err);
1456                 goto done;
1457         }
1458
1459         /* Configure Beacon Interval for starter */
1460         if (params->beacon_interval)
1461                 bcnprd = params->beacon_interval;
1462         else
1463                 bcnprd = 100;
1464
1465         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1466         if (err) {
1467                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1468                 goto done;
1469         }
1470
1471         /* Configure required join parameter */
1472         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1473
1474         /* SSID */
1475         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1476         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1477         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1478         join_params_size = sizeof(join_params.ssid_le);
1479
1480         /* BSSID */
1481         if (params->bssid) {
1482                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1483                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1484                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1485         } else {
1486                 eth_broadcast_addr(join_params.params_le.bssid);
1487                 eth_zero_addr(profile->bssid);
1488         }
1489
1490         /* Channel */
1491         if (params->chandef.chan) {
1492                 u32 target_channel;
1493
1494                 cfg->channel =
1495                         ieee80211_frequency_to_channel(
1496                                 params->chandef.chan->center_freq);
1497                 if (params->channel_fixed) {
1498                         /* adding chanspec */
1499                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1500                                                        &params->chandef);
1501                         join_params.params_le.chanspec_list[0] =
1502                                 cpu_to_le16(chanspec);
1503                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1504                         join_params_size += sizeof(join_params.params_le);
1505                 }
1506
1507                 /* set channel for starter */
1508                 target_channel = cfg->channel;
1509                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1510                                             target_channel);
1511                 if (err) {
1512                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1513                         goto done;
1514                 }
1515         } else
1516                 cfg->channel = 0;
1517
1518         cfg->ibss_starter = false;
1519
1520
1521         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1522                                      &join_params, join_params_size);
1523         if (err) {
1524                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1525                 goto done;
1526         }
1527
1528 done:
1529         if (err)
1530                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1531         brcmf_dbg(TRACE, "Exit\n");
1532         return err;
1533 }
1534
1535 static s32
1536 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1537 {
1538         struct brcmf_if *ifp = netdev_priv(ndev);
1539
1540         brcmf_dbg(TRACE, "Enter\n");
1541         if (!check_vif_up(ifp->vif)) {
1542                 /* When driver is being unloaded, it can end up here. If an
1543                  * error is returned then later on a debug trace in the wireless
1544                  * core module will be printed. To avoid this 0 is returned.
1545                  */
1546                 return 0;
1547         }
1548
1549         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1550         brcmf_net_setcarrier(ifp, false);
1551
1552         brcmf_dbg(TRACE, "Exit\n");
1553
1554         return 0;
1555 }
1556
1557 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1558                                  struct cfg80211_connect_params *sme)
1559 {
1560         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1561         struct brcmf_cfg80211_security *sec;
1562         s32 val = 0;
1563         s32 err = 0;
1564
1565         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1566                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1567         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1568                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1569         else
1570                 val = WPA_AUTH_DISABLED;
1571         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1572         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1573         if (err) {
1574                 brcmf_err("set wpa_auth failed (%d)\n", err);
1575                 return err;
1576         }
1577         sec = &profile->sec;
1578         sec->wpa_versions = sme->crypto.wpa_versions;
1579         return err;
1580 }
1581
1582 static s32 brcmf_set_auth_type(struct net_device *ndev,
1583                                struct cfg80211_connect_params *sme)
1584 {
1585         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1586         struct brcmf_cfg80211_security *sec;
1587         s32 val = 0;
1588         s32 err = 0;
1589
1590         switch (sme->auth_type) {
1591         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1592                 val = 0;
1593                 brcmf_dbg(CONN, "open system\n");
1594                 break;
1595         case NL80211_AUTHTYPE_SHARED_KEY:
1596                 val = 1;
1597                 brcmf_dbg(CONN, "shared key\n");
1598                 break;
1599         default:
1600                 val = 2;
1601                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1602                 break;
1603         }
1604
1605         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1606         if (err) {
1607                 brcmf_err("set auth failed (%d)\n", err);
1608                 return err;
1609         }
1610         sec = &profile->sec;
1611         sec->auth_type = sme->auth_type;
1612         return err;
1613 }
1614
1615 static s32
1616 brcmf_set_wsec_mode(struct net_device *ndev,
1617                     struct cfg80211_connect_params *sme)
1618 {
1619         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1620         struct brcmf_cfg80211_security *sec;
1621         s32 pval = 0;
1622         s32 gval = 0;
1623         s32 wsec;
1624         s32 err = 0;
1625
1626         if (sme->crypto.n_ciphers_pairwise) {
1627                 switch (sme->crypto.ciphers_pairwise[0]) {
1628                 case WLAN_CIPHER_SUITE_WEP40:
1629                 case WLAN_CIPHER_SUITE_WEP104:
1630                         pval = WEP_ENABLED;
1631                         break;
1632                 case WLAN_CIPHER_SUITE_TKIP:
1633                         pval = TKIP_ENABLED;
1634                         break;
1635                 case WLAN_CIPHER_SUITE_CCMP:
1636                         pval = AES_ENABLED;
1637                         break;
1638                 case WLAN_CIPHER_SUITE_AES_CMAC:
1639                         pval = AES_ENABLED;
1640                         break;
1641                 default:
1642                         brcmf_err("invalid cipher pairwise (%d)\n",
1643                                   sme->crypto.ciphers_pairwise[0]);
1644                         return -EINVAL;
1645                 }
1646         }
1647         if (sme->crypto.cipher_group) {
1648                 switch (sme->crypto.cipher_group) {
1649                 case WLAN_CIPHER_SUITE_WEP40:
1650                 case WLAN_CIPHER_SUITE_WEP104:
1651                         gval = WEP_ENABLED;
1652                         break;
1653                 case WLAN_CIPHER_SUITE_TKIP:
1654                         gval = TKIP_ENABLED;
1655                         break;
1656                 case WLAN_CIPHER_SUITE_CCMP:
1657                         gval = AES_ENABLED;
1658                         break;
1659                 case WLAN_CIPHER_SUITE_AES_CMAC:
1660                         gval = AES_ENABLED;
1661                         break;
1662                 default:
1663                         brcmf_err("invalid cipher group (%d)\n",
1664                                   sme->crypto.cipher_group);
1665                         return -EINVAL;
1666                 }
1667         }
1668
1669         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1670         /* In case of privacy, but no security and WPS then simulate */
1671         /* setting AES. WPS-2.0 allows no security                   */
1672         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1673             sme->privacy)
1674                 pval = AES_ENABLED;
1675
1676         wsec = pval | gval;
1677         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1678         if (err) {
1679                 brcmf_err("error (%d)\n", err);
1680                 return err;
1681         }
1682
1683         sec = &profile->sec;
1684         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1685         sec->cipher_group = sme->crypto.cipher_group;
1686
1687         return err;
1688 }
1689
1690 static s32
1691 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1692 {
1693         struct brcmf_if *ifp = netdev_priv(ndev);
1694         s32 val;
1695         s32 err;
1696         const struct brcmf_tlv *rsn_ie;
1697         const u8 *ie;
1698         u32 ie_len;
1699         u32 offset;
1700         u16 rsn_cap;
1701         u32 mfp;
1702         u16 count;
1703
1704         if (!sme->crypto.n_akm_suites)
1705                 return 0;
1706
1707         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1708         if (err) {
1709                 brcmf_err("could not get wpa_auth (%d)\n", err);
1710                 return err;
1711         }
1712         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1713                 switch (sme->crypto.akm_suites[0]) {
1714                 case WLAN_AKM_SUITE_8021X:
1715                         val = WPA_AUTH_UNSPECIFIED;
1716                         break;
1717                 case WLAN_AKM_SUITE_PSK:
1718                         val = WPA_AUTH_PSK;
1719                         break;
1720                 default:
1721                         brcmf_err("invalid cipher group (%d)\n",
1722                                   sme->crypto.cipher_group);
1723                         return -EINVAL;
1724                 }
1725         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1726                 switch (sme->crypto.akm_suites[0]) {
1727                 case WLAN_AKM_SUITE_8021X:
1728                         val = WPA2_AUTH_UNSPECIFIED;
1729                         break;
1730                 case WLAN_AKM_SUITE_8021X_SHA256:
1731                         val = WPA2_AUTH_1X_SHA256;
1732                         break;
1733                 case WLAN_AKM_SUITE_PSK_SHA256:
1734                         val = WPA2_AUTH_PSK_SHA256;
1735                         break;
1736                 case WLAN_AKM_SUITE_PSK:
1737                         val = WPA2_AUTH_PSK;
1738                         break;
1739                 default:
1740                         brcmf_err("invalid cipher group (%d)\n",
1741                                   sme->crypto.cipher_group);
1742                         return -EINVAL;
1743                 }
1744         }
1745
1746         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1747                 goto skip_mfp_config;
1748         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1749          * IE will not be verified, just a quick search for MFP config
1750          */
1751         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1752                                   WLAN_EID_RSN);
1753         if (!rsn_ie)
1754                 goto skip_mfp_config;
1755         ie = (const u8 *)rsn_ie;
1756         ie_len = rsn_ie->len + TLV_HDR_LEN;
1757         /* Skip unicast suite */
1758         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1759         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1760                 goto skip_mfp_config;
1761         /* Skip multicast suite */
1762         count = ie[offset] + (ie[offset + 1] << 8);
1763         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1764         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1765                 goto skip_mfp_config;
1766         /* Skip auth key management suite(s) */
1767         count = ie[offset] + (ie[offset + 1] << 8);
1768         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1769         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1770                 goto skip_mfp_config;
1771         /* Ready to read capabilities */
1772         mfp = BRCMF_MFP_NONE;
1773         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1774         if (rsn_cap & RSN_CAP_MFPR_MASK)
1775                 mfp = BRCMF_MFP_REQUIRED;
1776         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1777                 mfp = BRCMF_MFP_CAPABLE;
1778         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1779
1780 skip_mfp_config:
1781         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1782         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1783         if (err) {
1784                 brcmf_err("could not set wpa_auth (%d)\n", err);
1785                 return err;
1786         }
1787
1788         return err;
1789 }
1790
1791 static s32
1792 brcmf_set_sharedkey(struct net_device *ndev,
1793                     struct cfg80211_connect_params *sme)
1794 {
1795         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1796         struct brcmf_cfg80211_security *sec;
1797         struct brcmf_wsec_key key;
1798         s32 val;
1799         s32 err = 0;
1800
1801         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1802
1803         if (sme->key_len == 0)
1804                 return 0;
1805
1806         sec = &profile->sec;
1807         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1808                   sec->wpa_versions, sec->cipher_pairwise);
1809
1810         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1811                 return 0;
1812
1813         if (!(sec->cipher_pairwise &
1814             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1815                 return 0;
1816
1817         memset(&key, 0, sizeof(key));
1818         key.len = (u32) sme->key_len;
1819         key.index = (u32) sme->key_idx;
1820         if (key.len > sizeof(key.data)) {
1821                 brcmf_err("Too long key length (%u)\n", key.len);
1822                 return -EINVAL;
1823         }
1824         memcpy(key.data, sme->key, key.len);
1825         key.flags = BRCMF_PRIMARY_KEY;
1826         switch (sec->cipher_pairwise) {
1827         case WLAN_CIPHER_SUITE_WEP40:
1828                 key.algo = CRYPTO_ALGO_WEP1;
1829                 break;
1830         case WLAN_CIPHER_SUITE_WEP104:
1831                 key.algo = CRYPTO_ALGO_WEP128;
1832                 break;
1833         default:
1834                 brcmf_err("Invalid algorithm (%d)\n",
1835                           sme->crypto.ciphers_pairwise[0]);
1836                 return -EINVAL;
1837         }
1838         /* Set the new key/index */
1839         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1840                   key.len, key.index, key.algo);
1841         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1842         err = send_key_to_dongle(netdev_priv(ndev), &key);
1843         if (err)
1844                 return err;
1845
1846         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1847                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1848                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1849                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1850                 if (err)
1851                         brcmf_err("set auth failed (%d)\n", err);
1852         }
1853         return err;
1854 }
1855
1856 static
1857 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1858                                            enum nl80211_auth_type type)
1859 {
1860         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1861             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1862                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1863                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1864         }
1865         return type;
1866 }
1867
1868 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1869                                 struct cfg80211_bss_selection *bss_select)
1870 {
1871         struct brcmf_join_pref_params join_pref_params[2];
1872         enum nl80211_band band;
1873         int err, i = 0;
1874
1875         join_pref_params[i].len = 2;
1876         join_pref_params[i].rssi_gain = 0;
1877
1878         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1879                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1880
1881         switch (bss_select->behaviour) {
1882         case __NL80211_BSS_SELECT_ATTR_INVALID:
1883                 brcmf_c_set_joinpref_default(ifp);
1884                 return;
1885         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1886                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1887                 band = bss_select->param.band_pref;
1888                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1889                 i++;
1890                 break;
1891         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1892                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1893                 band = bss_select->param.adjust.band;
1894                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1895                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1896                 i++;
1897                 break;
1898         case NL80211_BSS_SELECT_ATTR_RSSI:
1899         default:
1900                 break;
1901         }
1902         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1903         join_pref_params[i].len = 2;
1904         join_pref_params[i].rssi_gain = 0;
1905         join_pref_params[i].band = 0;
1906         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1907                                        sizeof(join_pref_params));
1908         if (err)
1909                 brcmf_err("Set join_pref error (%d)\n", err);
1910 }
1911
1912 static s32
1913 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1914                        struct cfg80211_connect_params *sme)
1915 {
1916         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1917         struct brcmf_if *ifp = netdev_priv(ndev);
1918         struct ieee80211_channel *chan = sme->channel;
1919         struct brcmf_join_params join_params;
1920         size_t join_params_size;
1921         const struct brcmf_tlv *rsn_ie;
1922         const struct brcmf_vs_tlv *wpa_ie;
1923         const void *ie;
1924         u32 ie_len;
1925         struct brcmf_ext_join_params_le *ext_join_params;
1926         u16 chanspec;
1927         s32 err = 0;
1928         u32 ssid_len;
1929
1930         brcmf_dbg(TRACE, "Enter\n");
1931         if (!check_vif_up(ifp->vif))
1932                 return -EIO;
1933
1934         if (!sme->ssid) {
1935                 brcmf_err("Invalid ssid\n");
1936                 return -EOPNOTSUPP;
1937         }
1938
1939         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1940                 /* A normal (non P2P) connection request setup. */
1941                 ie = NULL;
1942                 ie_len = 0;
1943                 /* find the WPA_IE */
1944                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1945                 if (wpa_ie) {
1946                         ie = wpa_ie;
1947                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1948                 } else {
1949                         /* find the RSN_IE */
1950                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1951                                                   sme->ie_len,
1952                                                   WLAN_EID_RSN);
1953                         if (rsn_ie) {
1954                                 ie = rsn_ie;
1955                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1956                         }
1957                 }
1958                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1959         }
1960
1961         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1962                                     sme->ie, sme->ie_len);
1963         if (err)
1964                 brcmf_err("Set Assoc REQ IE Failed\n");
1965         else
1966                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1967
1968         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1969
1970         if (chan) {
1971                 cfg->channel =
1972                         ieee80211_frequency_to_channel(chan->center_freq);
1973                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1974                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1975                           cfg->channel, chan->center_freq, chanspec);
1976         } else {
1977                 cfg->channel = 0;
1978                 chanspec = 0;
1979         }
1980
1981         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1982
1983         err = brcmf_set_wpa_version(ndev, sme);
1984         if (err) {
1985                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1986                 goto done;
1987         }
1988
1989         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1990         err = brcmf_set_auth_type(ndev, sme);
1991         if (err) {
1992                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1993                 goto done;
1994         }
1995
1996         err = brcmf_set_wsec_mode(ndev, sme);
1997         if (err) {
1998                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1999                 goto done;
2000         }
2001
2002         err = brcmf_set_key_mgmt(ndev, sme);
2003         if (err) {
2004                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2005                 goto done;
2006         }
2007
2008         err = brcmf_set_sharedkey(ndev, sme);
2009         if (err) {
2010                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2011                 goto done;
2012         }
2013
2014         /* Join with specific BSSID and cached SSID
2015          * If SSID is zero join based on BSSID only
2016          */
2017         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2018                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2019         if (cfg->channel)
2020                 join_params_size += sizeof(u16);
2021         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2022         if (ext_join_params == NULL) {
2023                 err = -ENOMEM;
2024                 goto done;
2025         }
2026         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2027         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2028         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2029         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2030                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2031                           ext_join_params->ssid_le.SSID, ssid_len);
2032
2033         /* Set up join scan parameters */
2034         ext_join_params->scan_le.scan_type = -1;
2035         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2036
2037         if (sme->bssid)
2038                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2039         else
2040                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2041
2042         if (cfg->channel) {
2043                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2044
2045                 ext_join_params->assoc_le.chanspec_list[0] =
2046                         cpu_to_le16(chanspec);
2047                 /* Increase dwell time to receive probe response or detect
2048                  * beacon from target AP at a noisy air only during connect
2049                  * command.
2050                  */
2051                 ext_join_params->scan_le.active_time =
2052                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2053                 ext_join_params->scan_le.passive_time =
2054                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2055                 /* To sync with presence period of VSDB GO send probe request
2056                  * more frequently. Probe request will be stopped when it gets
2057                  * probe response from target AP/GO.
2058                  */
2059                 ext_join_params->scan_le.nprobes =
2060                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2061                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2062         } else {
2063                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2064                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2065                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2066         }
2067
2068         brcmf_set_join_pref(ifp, &sme->bss_select);
2069
2070         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2071                                          join_params_size);
2072         kfree(ext_join_params);
2073         if (!err)
2074                 /* This is it. join command worked, we are done */
2075                 goto done;
2076
2077         /* join command failed, fallback to set ssid */
2078         memset(&join_params, 0, sizeof(join_params));
2079         join_params_size = sizeof(join_params.ssid_le);
2080
2081         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2082         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2083
2084         if (sme->bssid)
2085                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2086         else
2087                 eth_broadcast_addr(join_params.params_le.bssid);
2088
2089         if (cfg->channel) {
2090                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2091                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2092                 join_params_size += sizeof(join_params.params_le);
2093         }
2094         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2095                                      &join_params, join_params_size);
2096         if (err)
2097                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2098
2099 done:
2100         if (err)
2101                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2102         brcmf_dbg(TRACE, "Exit\n");
2103         return err;
2104 }
2105
2106 static s32
2107 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2108                        u16 reason_code)
2109 {
2110         struct brcmf_if *ifp = netdev_priv(ndev);
2111         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2112         struct brcmf_scb_val_le scbval;
2113         s32 err = 0;
2114
2115         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2116         if (!check_vif_up(ifp->vif))
2117                 return -EIO;
2118
2119         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2120         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2121         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2122
2123         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2124         scbval.val = cpu_to_le32(reason_code);
2125         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2126                                      &scbval, sizeof(scbval));
2127         if (err)
2128                 brcmf_err("error (%d)\n", err);
2129
2130         brcmf_dbg(TRACE, "Exit\n");
2131         return err;
2132 }
2133
2134 static s32
2135 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2136                             enum nl80211_tx_power_setting type, s32 mbm)
2137 {
2138         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2139         struct net_device *ndev = cfg_to_ndev(cfg);
2140         struct brcmf_if *ifp = netdev_priv(ndev);
2141         s32 err;
2142         s32 disable;
2143         u32 qdbm = 127;
2144
2145         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2146         if (!check_vif_up(ifp->vif))
2147                 return -EIO;
2148
2149         switch (type) {
2150         case NL80211_TX_POWER_AUTOMATIC:
2151                 break;
2152         case NL80211_TX_POWER_LIMITED:
2153         case NL80211_TX_POWER_FIXED:
2154                 if (mbm < 0) {
2155                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2156                         err = -EINVAL;
2157                         goto done;
2158                 }
2159                 qdbm =  MBM_TO_DBM(4 * mbm);
2160                 if (qdbm > 127)
2161                         qdbm = 127;
2162                 qdbm |= WL_TXPWR_OVERRIDE;
2163                 break;
2164         default:
2165                 brcmf_err("Unsupported type %d\n", type);
2166                 err = -EINVAL;
2167                 goto done;
2168         }
2169         /* Make sure radio is off or on as far as software is concerned */
2170         disable = WL_RADIO_SW_DISABLE << 16;
2171         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2172         if (err)
2173                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2174
2175         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2176         if (err)
2177                 brcmf_err("qtxpower error (%d)\n", err);
2178
2179 done:
2180         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2181         return err;
2182 }
2183
2184 static s32
2185 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2186                             s32 *dbm)
2187 {
2188         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2189         struct net_device *ndev = cfg_to_ndev(cfg);
2190         struct brcmf_if *ifp = netdev_priv(ndev);
2191         s32 qdbm = 0;
2192         s32 err;
2193
2194         brcmf_dbg(TRACE, "Enter\n");
2195         if (!check_vif_up(ifp->vif))
2196                 return -EIO;
2197
2198         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2199         if (err) {
2200                 brcmf_err("error (%d)\n", err);
2201                 goto done;
2202         }
2203         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2204
2205 done:
2206         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2207         return err;
2208 }
2209
2210 static s32
2211 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2212                                   u8 key_idx, bool unicast, bool multicast)
2213 {
2214         struct brcmf_if *ifp = netdev_priv(ndev);
2215         u32 index;
2216         u32 wsec;
2217         s32 err = 0;
2218
2219         brcmf_dbg(TRACE, "Enter\n");
2220         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2221         if (!check_vif_up(ifp->vif))
2222                 return -EIO;
2223
2224         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2225         if (err) {
2226                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2227                 goto done;
2228         }
2229
2230         if (wsec & WEP_ENABLED) {
2231                 /* Just select a new current key */
2232                 index = key_idx;
2233                 err = brcmf_fil_cmd_int_set(ifp,
2234                                             BRCMF_C_SET_KEY_PRIMARY, index);
2235                 if (err)
2236                         brcmf_err("error (%d)\n", err);
2237         }
2238 done:
2239         brcmf_dbg(TRACE, "Exit\n");
2240         return err;
2241 }
2242
2243 static s32
2244 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2245                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2246 {
2247         struct brcmf_if *ifp = netdev_priv(ndev);
2248         struct brcmf_wsec_key *key;
2249         s32 err;
2250
2251         brcmf_dbg(TRACE, "Enter\n");
2252         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2253
2254         if (!check_vif_up(ifp->vif))
2255                 return -EIO;
2256
2257         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2258                 /* we ignore this key index in this case */
2259                 return -EINVAL;
2260         }
2261
2262         key = &ifp->vif->profile.key[key_idx];
2263
2264         if (key->algo == CRYPTO_ALGO_OFF) {
2265                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2266                 return -EINVAL;
2267         }
2268
2269         memset(key, 0, sizeof(*key));
2270         key->index = (u32)key_idx;
2271         key->flags = BRCMF_PRIMARY_KEY;
2272
2273         /* Clear the key/index */
2274         err = send_key_to_dongle(ifp, key);
2275
2276         brcmf_dbg(TRACE, "Exit\n");
2277         return err;
2278 }
2279
2280 static s32
2281 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2282                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2283                        struct key_params *params)
2284 {
2285         struct brcmf_if *ifp = netdev_priv(ndev);
2286         struct brcmf_wsec_key *key;
2287         s32 val;
2288         s32 wsec;
2289         s32 err;
2290         u8 keybuf[8];
2291         bool ext_key;
2292
2293         brcmf_dbg(TRACE, "Enter\n");
2294         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2295         if (!check_vif_up(ifp->vif))
2296                 return -EIO;
2297
2298         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2299                 /* we ignore this key index in this case */
2300                 brcmf_err("invalid key index (%d)\n", key_idx);
2301                 return -EINVAL;
2302         }
2303
2304         if (params->key_len == 0)
2305                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2306                                               mac_addr);
2307
2308         if (params->key_len > sizeof(key->data)) {
2309                 brcmf_err("Too long key length (%u)\n", params->key_len);
2310                 return -EINVAL;
2311         }
2312
2313         ext_key = false;
2314         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2315             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2316                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2317                 ext_key = true;
2318         }
2319
2320         key = &ifp->vif->profile.key[key_idx];
2321         memset(key, 0, sizeof(*key));
2322         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2323                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2324         key->len = params->key_len;
2325         key->index = key_idx;
2326         memcpy(key->data, params->key, key->len);
2327         if (!ext_key)
2328                 key->flags = BRCMF_PRIMARY_KEY;
2329
2330         switch (params->cipher) {
2331         case WLAN_CIPHER_SUITE_WEP40:
2332                 key->algo = CRYPTO_ALGO_WEP1;
2333                 val = WEP_ENABLED;
2334                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2335                 break;
2336         case WLAN_CIPHER_SUITE_WEP104:
2337                 key->algo = CRYPTO_ALGO_WEP128;
2338                 val = WEP_ENABLED;
2339                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2340                 break;
2341         case WLAN_CIPHER_SUITE_TKIP:
2342                 if (!brcmf_is_apmode(ifp->vif)) {
2343                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2344                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2345                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2346                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2347                 }
2348                 key->algo = CRYPTO_ALGO_TKIP;
2349                 val = TKIP_ENABLED;
2350                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2351                 break;
2352         case WLAN_CIPHER_SUITE_AES_CMAC:
2353                 key->algo = CRYPTO_ALGO_AES_CCM;
2354                 val = AES_ENABLED;
2355                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2356                 break;
2357         case WLAN_CIPHER_SUITE_CCMP:
2358                 key->algo = CRYPTO_ALGO_AES_CCM;
2359                 val = AES_ENABLED;
2360                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2361                 break;
2362         default:
2363                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2364                 err = -EINVAL;
2365                 goto done;
2366         }
2367
2368         err = send_key_to_dongle(ifp, key);
2369         if (ext_key || err)
2370                 goto done;
2371
2372         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2373         if (err) {
2374                 brcmf_err("get wsec error (%d)\n", err);
2375                 goto done;
2376         }
2377         wsec |= val;
2378         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2379         if (err) {
2380                 brcmf_err("set wsec error (%d)\n", err);
2381                 goto done;
2382         }
2383
2384 done:
2385         brcmf_dbg(TRACE, "Exit\n");
2386         return err;
2387 }
2388
2389 static s32
2390 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2391                        bool pairwise, const u8 *mac_addr, void *cookie,
2392                        void (*callback)(void *cookie,
2393                                         struct key_params *params))
2394 {
2395         struct key_params params;
2396         struct brcmf_if *ifp = netdev_priv(ndev);
2397         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2398         struct brcmf_cfg80211_security *sec;
2399         s32 wsec;
2400         s32 err = 0;
2401
2402         brcmf_dbg(TRACE, "Enter\n");
2403         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2404         if (!check_vif_up(ifp->vif))
2405                 return -EIO;
2406
2407         memset(&params, 0, sizeof(params));
2408
2409         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2410         if (err) {
2411                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2412                 /* Ignore this error, may happen during DISASSOC */
2413                 err = -EAGAIN;
2414                 goto done;
2415         }
2416         if (wsec & WEP_ENABLED) {
2417                 sec = &profile->sec;
2418                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2419                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2420                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2421                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2422                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2423                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2424                 }
2425         } else if (wsec & TKIP_ENABLED) {
2426                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2427                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2428         } else if (wsec & AES_ENABLED) {
2429                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2430                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2431         } else  {
2432                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2433                 err = -EINVAL;
2434                 goto done;
2435         }
2436         callback(cookie, &params);
2437
2438 done:
2439         brcmf_dbg(TRACE, "Exit\n");
2440         return err;
2441 }
2442
2443 static s32
2444 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2445                                        struct net_device *ndev, u8 key_idx)
2446 {
2447         struct brcmf_if *ifp = netdev_priv(ndev);
2448
2449         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2450
2451         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2452                 return 0;
2453
2454         brcmf_dbg(INFO, "Not supported\n");
2455
2456         return -EOPNOTSUPP;
2457 }
2458
2459 static void
2460 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2461 {
2462         s32 err;
2463         u8 key_idx;
2464         struct brcmf_wsec_key *key;
2465         s32 wsec;
2466
2467         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2468                 key = &ifp->vif->profile.key[key_idx];
2469                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2470                     (key->algo == CRYPTO_ALGO_WEP128))
2471                         break;
2472         }
2473         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2474                 return;
2475
2476         err = send_key_to_dongle(ifp, key);
2477         if (err) {
2478                 brcmf_err("Setting WEP key failed (%d)\n", err);
2479                 return;
2480         }
2481         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2482         if (err) {
2483                 brcmf_err("get wsec error (%d)\n", err);
2484                 return;
2485         }
2486         wsec |= WEP_ENABLED;
2487         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2488         if (err)
2489                 brcmf_err("set wsec error (%d)\n", err);
2490 }
2491
2492 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2493 {
2494         struct nl80211_sta_flag_update *sfu;
2495
2496         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2497         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2498         sfu = &si->sta_flags;
2499         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2500                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2501                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2502                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2503         if (fw_sta_flags & BRCMF_STA_WME)
2504                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2505         if (fw_sta_flags & BRCMF_STA_AUTHE)
2506                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2507         if (fw_sta_flags & BRCMF_STA_ASSOC)
2508                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2509         if (fw_sta_flags & BRCMF_STA_AUTHO)
2510                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2511 }
2512
2513 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2514 {
2515         struct {
2516                 __le32 len;
2517                 struct brcmf_bss_info_le bss_le;
2518         } *buf;
2519         u16 capability;
2520         int err;
2521
2522         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2523         if (!buf)
2524                 return;
2525
2526         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2527         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2528                                      WL_BSS_INFO_MAX);
2529         if (err) {
2530                 brcmf_err("Failed to get bss info (%d)\n", err);
2531                 goto out_kfree;
2532         }
2533         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2534         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2535         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2536         capability = le16_to_cpu(buf->bss_le.capability);
2537         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2538                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2539         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2540                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2541         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2542                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2543
2544 out_kfree:
2545         kfree(buf);
2546 }
2547
2548 static s32
2549 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2550                                 struct station_info *sinfo)
2551 {
2552         struct brcmf_scb_val_le scbval;
2553         struct brcmf_pktcnt_le pktcnt;
2554         s32 err;
2555         u32 rate;
2556         u32 rssi;
2557
2558         /* Get the current tx rate */
2559         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2560         if (err < 0) {
2561                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2562                 return err;
2563         }
2564         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2565         sinfo->txrate.legacy = rate * 5;
2566
2567         memset(&scbval, 0, sizeof(scbval));
2568         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2569                                      sizeof(scbval));
2570         if (err) {
2571                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2572                 return err;
2573         }
2574         rssi = le32_to_cpu(scbval.val);
2575         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2576         sinfo->signal = rssi;
2577
2578         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2579                                      sizeof(pktcnt));
2580         if (err) {
2581                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2582                 return err;
2583         }
2584         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2585                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2586                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2587                          BIT(NL80211_STA_INFO_TX_FAILED);
2588         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2589         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2590         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2591         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2592
2593         return 0;
2594 }
2595
2596 static s32
2597 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2598                            const u8 *mac, struct station_info *sinfo)
2599 {
2600         struct brcmf_if *ifp = netdev_priv(ndev);
2601         struct brcmf_scb_val_le scb_val;
2602         s32 err = 0;
2603         struct brcmf_sta_info_le sta_info_le;
2604         u32 sta_flags;
2605         u32 is_tdls_peer;
2606         s32 total_rssi;
2607         s32 count_rssi;
2608         int rssi;
2609         u32 i;
2610
2611         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2612         if (!check_vif_up(ifp->vif))
2613                 return -EIO;
2614
2615         if (brcmf_is_ibssmode(ifp->vif))
2616                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2617
2618         memset(&sta_info_le, 0, sizeof(sta_info_le));
2619         memcpy(&sta_info_le, mac, ETH_ALEN);
2620         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2621                                        &sta_info_le,
2622                                        sizeof(sta_info_le));
2623         is_tdls_peer = !err;
2624         if (err) {
2625                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2626                                                &sta_info_le,
2627                                                sizeof(sta_info_le));
2628                 if (err < 0) {
2629                         brcmf_err("GET STA INFO failed, %d\n", err);
2630                         goto done;
2631                 }
2632         }
2633         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2634         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2635         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2636         sta_flags = le32_to_cpu(sta_info_le.flags);
2637         brcmf_convert_sta_flags(sta_flags, sinfo);
2638         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2639         if (is_tdls_peer)
2640                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2641         else
2642                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2643         if (sta_flags & BRCMF_STA_ASSOC) {
2644                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2645                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2646                 brcmf_fill_bss_param(ifp, sinfo);
2647         }
2648         if (sta_flags & BRCMF_STA_SCBSTATS) {
2649                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2650                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2651                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2652                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2653                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2654                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2655                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2656                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2657                 if (sinfo->tx_packets) {
2658                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2659                         sinfo->txrate.legacy =
2660                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2661                 }
2662                 if (sinfo->rx_packets) {
2663                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2664                         sinfo->rxrate.legacy =
2665                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2666                 }
2667                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2668                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2669                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2670                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2671                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2672                 }
2673                 total_rssi = 0;
2674                 count_rssi = 0;
2675                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2676                         if (sta_info_le.rssi[i]) {
2677                                 sinfo->chain_signal_avg[count_rssi] =
2678                                         sta_info_le.rssi[i];
2679                                 sinfo->chain_signal[count_rssi] =
2680                                         sta_info_le.rssi[i];
2681                                 total_rssi += sta_info_le.rssi[i];
2682                                 count_rssi++;
2683                         }
2684                 }
2685                 if (count_rssi) {
2686                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2687                         sinfo->chains = count_rssi;
2688
2689                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2690                         total_rssi /= count_rssi;
2691                         sinfo->signal = total_rssi;
2692                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2693                         &ifp->vif->sme_state)) {
2694                         memset(&scb_val, 0, sizeof(scb_val));
2695                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2696                                                      &scb_val, sizeof(scb_val));
2697                         if (err) {
2698                                 brcmf_err("Could not get rssi (%d)\n", err);
2699                                 goto done;
2700                         } else {
2701                                 rssi = le32_to_cpu(scb_val.val);
2702                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2703                                 sinfo->signal = rssi;
2704                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2705                         }
2706                 }
2707         }
2708 done:
2709         brcmf_dbg(TRACE, "Exit\n");
2710         return err;
2711 }
2712
2713 static int
2714 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2715                             int idx, u8 *mac, struct station_info *sinfo)
2716 {
2717         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2718         struct brcmf_if *ifp = netdev_priv(ndev);
2719         s32 err;
2720
2721         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2722
2723         if (idx == 0) {
2724                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2725                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2726                                              &cfg->assoclist,
2727                                              sizeof(cfg->assoclist));
2728                 if (err) {
2729                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2730                                   err);
2731                         cfg->assoclist.count = 0;
2732                         return -EOPNOTSUPP;
2733                 }
2734         }
2735         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2736                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2737                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2738         }
2739         return -ENOENT;
2740 }
2741
2742 static s32
2743 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2744                            bool enabled, s32 timeout)
2745 {
2746         s32 pm;
2747         s32 err = 0;
2748         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2749         struct brcmf_if *ifp = netdev_priv(ndev);
2750
2751         brcmf_dbg(TRACE, "Enter\n");
2752
2753         /*
2754          * Powersave enable/disable request is coming from the
2755          * cfg80211 even before the interface is up. In that
2756          * scenario, driver will be storing the power save
2757          * preference in cfg struct to apply this to
2758          * FW later while initializing the dongle
2759          */
2760         cfg->pwr_save = enabled;
2761         if (!check_vif_up(ifp->vif)) {
2762
2763                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2764                 goto done;
2765         }
2766
2767         pm = enabled ? PM_FAST : PM_OFF;
2768         /* Do not enable the power save after assoc if it is a p2p interface */
2769         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2770                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2771                 pm = PM_OFF;
2772         }
2773         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2774
2775         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2776         if (err) {
2777                 if (err == -ENODEV)
2778                         brcmf_err("net_device is not ready yet\n");
2779                 else
2780                         brcmf_err("error (%d)\n", err);
2781         }
2782 done:
2783         brcmf_dbg(TRACE, "Exit\n");
2784         return err;
2785 }
2786
2787 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2788                                    struct brcmf_bss_info_le *bi)
2789 {
2790         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2791         struct ieee80211_channel *notify_channel;
2792         struct cfg80211_bss *bss;
2793         struct ieee80211_supported_band *band;
2794         struct brcmu_chan ch;
2795         u16 channel;
2796         u32 freq;
2797         u16 notify_capability;
2798         u16 notify_interval;
2799         u8 *notify_ie;
2800         size_t notify_ielen;
2801         s32 notify_signal;
2802
2803         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2804                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2805                 return 0;
2806         }
2807
2808         if (!bi->ctl_ch) {
2809                 ch.chspec = le16_to_cpu(bi->chanspec);
2810                 cfg->d11inf.decchspec(&ch);
2811                 bi->ctl_ch = ch.control_ch_num;
2812         }
2813         channel = bi->ctl_ch;
2814
2815         if (channel <= CH_MAX_2G_CHANNEL)
2816                 band = wiphy->bands[NL80211_BAND_2GHZ];
2817         else
2818                 band = wiphy->bands[NL80211_BAND_5GHZ];
2819
2820         freq = ieee80211_channel_to_frequency(channel, band->band);
2821         notify_channel = ieee80211_get_channel(wiphy, freq);
2822
2823         notify_capability = le16_to_cpu(bi->capability);
2824         notify_interval = le16_to_cpu(bi->beacon_period);
2825         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2826         notify_ielen = le32_to_cpu(bi->ie_length);
2827         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2828
2829         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2830         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2831         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2832         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2833         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2834
2835         bss = cfg80211_inform_bss(wiphy, notify_channel,
2836                                   CFG80211_BSS_FTYPE_UNKNOWN,
2837                                   (const u8 *)bi->BSSID,
2838                                   0, notify_capability,
2839                                   notify_interval, notify_ie,
2840                                   notify_ielen, notify_signal,
2841                                   GFP_KERNEL);
2842
2843         if (!bss)
2844                 return -ENOMEM;
2845
2846         cfg80211_put_bss(wiphy, bss);
2847
2848         return 0;
2849 }
2850
2851 static struct brcmf_bss_info_le *
2852 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2853 {
2854         if (bss == NULL)
2855                 return list->bss_info_le;
2856         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2857                                             le32_to_cpu(bss->length));
2858 }
2859
2860 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2861 {
2862         struct brcmf_scan_results *bss_list;
2863         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2864         s32 err = 0;
2865         int i;
2866
2867         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2868         if (bss_list->count != 0 &&
2869             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2870                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2871                           bss_list->version);
2872                 return -EOPNOTSUPP;
2873         }
2874         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2875         for (i = 0; i < bss_list->count; i++) {
2876                 bi = next_bss_le(bss_list, bi);
2877                 err = brcmf_inform_single_bss(cfg, bi);
2878                 if (err)
2879                         break;
2880         }
2881         return err;
2882 }
2883
2884 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2885                              struct net_device *ndev, const u8 *bssid)
2886 {
2887         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2888         struct ieee80211_channel *notify_channel;
2889         struct brcmf_bss_info_le *bi = NULL;
2890         struct ieee80211_supported_band *band;
2891         struct cfg80211_bss *bss;
2892         struct brcmu_chan ch;
2893         u8 *buf = NULL;
2894         s32 err = 0;
2895         u32 freq;
2896         u16 notify_capability;
2897         u16 notify_interval;
2898         u8 *notify_ie;
2899         size_t notify_ielen;
2900         s32 notify_signal;
2901
2902         brcmf_dbg(TRACE, "Enter\n");
2903
2904         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2905         if (buf == NULL) {
2906                 err = -ENOMEM;
2907                 goto CleanUp;
2908         }
2909
2910         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2911
2912         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2913                                      buf, WL_BSS_INFO_MAX);
2914         if (err) {
2915                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2916                 goto CleanUp;
2917         }
2918
2919         bi = (struct brcmf_bss_info_le *)(buf + 4);
2920
2921         ch.chspec = le16_to_cpu(bi->chanspec);
2922         cfg->d11inf.decchspec(&ch);
2923
2924         if (ch.band == BRCMU_CHAN_BAND_2G)
2925                 band = wiphy->bands[NL80211_BAND_2GHZ];
2926         else
2927                 band = wiphy->bands[NL80211_BAND_5GHZ];
2928
2929         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2930         cfg->channel = freq;
2931         notify_channel = ieee80211_get_channel(wiphy, freq);
2932
2933         notify_capability = le16_to_cpu(bi->capability);
2934         notify_interval = le16_to_cpu(bi->beacon_period);
2935         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2936         notify_ielen = le32_to_cpu(bi->ie_length);
2937         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2938
2939         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2940         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2941         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2942         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2943
2944         bss = cfg80211_inform_bss(wiphy, notify_channel,
2945                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2946                                   notify_capability, notify_interval,
2947                                   notify_ie, notify_ielen, notify_signal,
2948                                   GFP_KERNEL);
2949
2950         if (!bss) {
2951                 err = -ENOMEM;
2952                 goto CleanUp;
2953         }
2954
2955         cfg80211_put_bss(wiphy, bss);
2956
2957 CleanUp:
2958
2959         kfree(buf);
2960
2961         brcmf_dbg(TRACE, "Exit\n");
2962
2963         return err;
2964 }
2965
2966 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2967                                  struct brcmf_if *ifp)
2968 {
2969         struct brcmf_bss_info_le *bi;
2970         const struct brcmf_tlv *tim;
2971         u16 beacon_interval;
2972         u8 dtim_period;
2973         size_t ie_len;
2974         u8 *ie;
2975         s32 err = 0;
2976
2977         brcmf_dbg(TRACE, "Enter\n");
2978         if (brcmf_is_ibssmode(ifp->vif))
2979                 return err;
2980
2981         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2982         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2983                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2984         if (err) {
2985                 brcmf_err("Could not get bss info %d\n", err);
2986                 goto update_bss_info_out;
2987         }
2988
2989         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2990         err = brcmf_inform_single_bss(cfg, bi);
2991         if (err)
2992                 goto update_bss_info_out;
2993
2994         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2995         ie_len = le32_to_cpu(bi->ie_length);
2996         beacon_interval = le16_to_cpu(bi->beacon_period);
2997
2998         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2999         if (tim)
3000                 dtim_period = tim->data[1];
3001         else {
3002                 /*
3003                 * active scan was done so we could not get dtim
3004                 * information out of probe response.
3005                 * so we speficially query dtim information to dongle.
3006                 */
3007                 u32 var;
3008                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3009                 if (err) {
3010                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3011                         goto update_bss_info_out;
3012                 }
3013                 dtim_period = (u8)var;
3014         }
3015
3016 update_bss_info_out:
3017         brcmf_dbg(TRACE, "Exit");
3018         return err;
3019 }
3020
3021 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3022 {
3023         struct escan_info *escan = &cfg->escan_info;
3024
3025         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3026         if (cfg->int_escan_map || cfg->scan_request) {
3027                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3028                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3029         }
3030         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3031         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3032 }
3033
3034 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3035 {
3036         struct brcmf_cfg80211_info *cfg =
3037                         container_of(work, struct brcmf_cfg80211_info,
3038                                      escan_timeout_work);
3039
3040         brcmf_inform_bss(cfg);
3041         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3042 }
3043
3044 static void brcmf_escan_timeout(unsigned long data)
3045 {
3046         struct brcmf_cfg80211_info *cfg =
3047                         (struct brcmf_cfg80211_info *)data;
3048
3049         if (cfg->int_escan_map || cfg->scan_request) {
3050                 brcmf_err("timer expired\n");
3051                 schedule_work(&cfg->escan_timeout_work);
3052         }
3053 }
3054
3055 static s32
3056 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3057                               struct brcmf_bss_info_le *bss,
3058                               struct brcmf_bss_info_le *bss_info_le)
3059 {
3060         struct brcmu_chan ch_bss, ch_bss_info_le;
3061
3062         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3063         cfg->d11inf.decchspec(&ch_bss);
3064         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3065         cfg->d11inf.decchspec(&ch_bss_info_le);
3066
3067         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3068                 ch_bss.band == ch_bss_info_le.band &&
3069                 bss_info_le->SSID_len == bss->SSID_len &&
3070                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3071                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3072                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3073                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3074                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3075
3076                         /* preserve max RSSI if the measurements are
3077                         * both on-channel or both off-channel
3078                         */
3079                         if (bss_info_rssi > bss_rssi)
3080                                 bss->RSSI = bss_info_le->RSSI;
3081                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3082                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3083                         /* preserve the on-channel rssi measurement
3084                         * if the new measurement is off channel
3085                         */
3086                         bss->RSSI = bss_info_le->RSSI;
3087                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3088                 }
3089                 return 1;
3090         }
3091         return 0;
3092 }
3093
3094 static s32
3095 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3096                              const struct brcmf_event_msg *e, void *data)
3097 {
3098         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3099         s32 status;
3100         struct brcmf_escan_result_le *escan_result_le;
3101         struct brcmf_bss_info_le *bss_info_le;
3102         struct brcmf_bss_info_le *bss = NULL;
3103         u32 bi_length;
3104         struct brcmf_scan_results *list;
3105         u32 i;
3106         bool aborted;
3107
3108         status = e->status;
3109
3110         if (status == BRCMF_E_STATUS_ABORT)
3111                 goto exit;
3112
3113         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3114                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3115                 return -EPERM;
3116         }
3117
3118         if (status == BRCMF_E_STATUS_PARTIAL) {
3119                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3120                 escan_result_le = (struct brcmf_escan_result_le *) data;
3121                 if (!escan_result_le) {
3122                         brcmf_err("Invalid escan result (NULL pointer)\n");
3123                         goto exit;
3124                 }
3125                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3126                         brcmf_err("Invalid bss_count %d: ignoring\n",
3127                                   escan_result_le->bss_count);
3128                         goto exit;
3129                 }
3130                 bss_info_le = &escan_result_le->bss_info_le;
3131
3132                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3133                         goto exit;
3134
3135                 if (!cfg->int_escan_map && !cfg->scan_request) {
3136                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3137                         goto exit;
3138                 }
3139
3140                 bi_length = le32_to_cpu(bss_info_le->length);
3141                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
3142                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
3143                         brcmf_err("Invalid bss_info length %d: ignoring\n",
3144                                   bi_length);
3145                         goto exit;
3146                 }
3147
3148                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3149                                         BIT(NL80211_IFTYPE_ADHOC))) {
3150                         if (le16_to_cpu(bss_info_le->capability) &
3151                                                 WLAN_CAPABILITY_IBSS) {
3152                                 brcmf_err("Ignoring IBSS result\n");
3153                                 goto exit;
3154                         }
3155                 }
3156
3157                 list = (struct brcmf_scan_results *)
3158                                 cfg->escan_info.escan_buf;
3159                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3160                         brcmf_err("Buffer is too small: ignoring\n");
3161                         goto exit;
3162                 }
3163
3164                 for (i = 0; i < list->count; i++) {
3165                         bss = bss ? (struct brcmf_bss_info_le *)
3166                                 ((unsigned char *)bss +
3167                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3168                         if (brcmf_compare_update_same_bss(cfg, bss,
3169                                                           bss_info_le))
3170                                 goto exit;
3171                 }
3172                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3173                        bi_length);
3174                 list->version = le32_to_cpu(bss_info_le->version);
3175                 list->buflen += bi_length;
3176                 list->count++;
3177         } else {
3178                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3179                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3180                         goto exit;
3181                 if (cfg->int_escan_map || cfg->scan_request) {
3182                         brcmf_inform_bss(cfg);
3183                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3184                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3185                 } else
3186                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3187                                   status);
3188         }
3189 exit:
3190         return 0;
3191 }
3192
3193 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3194 {
3195         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3196                             brcmf_cfg80211_escan_handler);
3197         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3198         /* Init scan_timeout timer */
3199         init_timer(&cfg->escan_timeout);
3200         cfg->escan_timeout.data = (unsigned long) cfg;
3201         cfg->escan_timeout.function = brcmf_escan_timeout;
3202         INIT_WORK(&cfg->escan_timeout_work,
3203                   brcmf_cfg80211_escan_timeout_worker);
3204 }
3205
3206 static struct cfg80211_scan_request *
3207 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3208         struct cfg80211_scan_request *req;
3209         size_t req_size;
3210
3211         req_size = sizeof(*req) +
3212                    n_netinfo * sizeof(req->channels[0]) +
3213                    n_netinfo * sizeof(*req->ssids);
3214
3215         req = kzalloc(req_size, GFP_KERNEL);
3216         if (req) {
3217                 req->wiphy = wiphy;
3218                 req->ssids = (void *)(&req->channels[0]) +
3219                              n_netinfo * sizeof(req->channels[0]);
3220         }
3221         return req;
3222 }
3223
3224 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3225                                          u8 *ssid, u8 ssid_len, u8 channel)
3226 {
3227         struct ieee80211_channel *chan;
3228         enum nl80211_band band;
3229         int freq, i;
3230
3231         if (channel <= CH_MAX_2G_CHANNEL)
3232                 band = NL80211_BAND_2GHZ;
3233         else
3234                 band = NL80211_BAND_5GHZ;
3235
3236         freq = ieee80211_channel_to_frequency(channel, band);
3237         if (!freq)
3238                 return -EINVAL;
3239
3240         chan = ieee80211_get_channel(req->wiphy, freq);
3241         if (!chan)
3242                 return -EINVAL;
3243
3244         for (i = 0; i < req->n_channels; i++) {
3245                 if (req->channels[i] == chan)
3246                         break;
3247         }
3248         if (i == req->n_channels)
3249                 req->channels[req->n_channels++] = chan;
3250
3251         for (i = 0; i < req->n_ssids; i++) {
3252                 if (req->ssids[i].ssid_len == ssid_len &&
3253                     !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3254                         break;
3255         }
3256         if (i == req->n_ssids) {
3257                 memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3258                 req->ssids[req->n_ssids++].ssid_len = ssid_len;
3259         }
3260         return 0;
3261 }
3262
3263 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3264                                       struct cfg80211_scan_request *request)
3265 {
3266         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3267         int err;
3268
3269         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3270                 if (cfg->int_escan_map)
3271                         brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3272                                   cfg->int_escan_map);
3273                 /* Abort any on-going scan */
3274                 brcmf_abort_scanning(cfg);
3275         }
3276
3277         brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3278         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3279         cfg->escan_info.run = brcmf_run_escan;
3280         err = brcmf_do_escan(ifp, request);
3281         if (err) {
3282                 clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3283                 return err;
3284         }
3285         cfg->int_escan_map = fwmap;
3286         return 0;
3287 }
3288
3289 static struct brcmf_pno_net_info_le *
3290 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3291 {
3292         struct brcmf_pno_scanresults_v2_le *pfn_v2;
3293         struct brcmf_pno_net_info_le *netinfo;
3294
3295         switch (pfn_v1->version) {
3296         default:
3297                 WARN_ON(1);
3298                 /* fall-thru */
3299         case cpu_to_le32(1):
3300                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3301                 break;
3302         case cpu_to_le32(2):
3303                 pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3304                 netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3305                 break;
3306         }
3307
3308         return netinfo;
3309 }
3310
3311 /* PFN result doesn't have all the info which are required by the supplicant
3312  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3313  * via wl_inform_single_bss in the required format. Escan does require the
3314  * scan request in the form of cfg80211_scan_request. For timebeing, create
3315  * cfg80211_scan_request one out of the received PNO event.
3316  */
3317 static s32
3318 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3319                                 const struct brcmf_event_msg *e, void *data)
3320 {
3321         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3322         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3323         struct cfg80211_scan_request *request = NULL;
3324         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3325         int i, err = 0;
3326         struct brcmf_pno_scanresults_le *pfn_result;
3327         u32 bucket_map;
3328         u32 result_count;
3329         u32 status;
3330         u32 datalen;
3331
3332         brcmf_dbg(SCAN, "Enter\n");
3333
3334         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3335                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3336                 return 0;
3337         }
3338
3339         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3340                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3341                 return 0;
3342         }
3343
3344         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3345         result_count = le32_to_cpu(pfn_result->count);
3346         status = le32_to_cpu(pfn_result->status);
3347
3348         /* PFN event is limited to fit 512 bytes so we may get
3349          * multiple NET_FOUND events. For now place a warning here.
3350          */
3351         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3352         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3353         if (!result_count) {
3354                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3355                 goto out_err;
3356         }
3357
3358         netinfo_start = brcmf_get_netinfo_array(pfn_result);
3359         datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3360         if (datalen < result_count * sizeof(*netinfo)) {
3361                 brcmf_err("insufficient event data\n");
3362                 goto out_err;
3363         }
3364
3365         request = brcmf_alloc_internal_escan_request(wiphy,
3366                                                      result_count);
3367         if (!request) {
3368                 err = -ENOMEM;
3369                 goto out_err;
3370         }
3371
3372         bucket_map = 0;
3373         for (i = 0; i < result_count; i++) {
3374                 netinfo = &netinfo_start[i];
3375
3376                 if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3377                         netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3378                 brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3379                           netinfo->SSID, netinfo->channel);
3380                 bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3381                 err = brcmf_internal_escan_add_info(request,
3382                                                     netinfo->SSID,
3383                                                     netinfo->SSID_len,
3384                                                     netinfo->channel);
3385                 if (err)
3386                         goto out_err;
3387         }
3388
3389         if (!bucket_map)
3390                 goto free_req;
3391
3392         err = brcmf_start_internal_escan(ifp, bucket_map, request);
3393         if (!err)
3394                 goto free_req;
3395
3396 out_err:
3397         cfg80211_sched_scan_stopped(wiphy, 0);
3398 free_req:
3399         kfree(request);
3400         return err;
3401 }
3402
3403 static int
3404 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3405                                 struct net_device *ndev,
3406                                 struct cfg80211_sched_scan_request *req)
3407 {
3408         struct brcmf_if *ifp = netdev_priv(ndev);
3409         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3410
3411         brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3412                   req->n_match_sets, req->n_ssids);
3413
3414         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3415                 brcmf_err("Scanning suppressed: status=%lu\n",
3416                           cfg->scan_status);
3417                 return -EAGAIN;
3418         }
3419
3420         if (req->n_match_sets <= 0) {
3421                 brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3422                           req->n_match_sets);
3423                 return -EINVAL;
3424         }
3425
3426         return brcmf_pno_start_sched_scan(ifp, req);
3427 }
3428
3429 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3430                                           struct net_device *ndev, u64 reqid)
3431 {
3432         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3433         struct brcmf_if *ifp = netdev_priv(ndev);
3434
3435         brcmf_dbg(SCAN, "enter\n");
3436         brcmf_pno_stop_sched_scan(ifp, reqid);
3437         if (cfg->int_escan_map)
3438                 brcmf_notify_escan_complete(cfg, ifp, true, true);
3439         return 0;
3440 }
3441
3442 static __always_inline void brcmf_delay(u32 ms)
3443 {
3444         if (ms < 1000 / HZ) {
3445                 cond_resched();
3446                 mdelay(ms);
3447         } else {
3448                 msleep(ms);
3449         }
3450 }
3451
3452 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3453                                      u8 *pattern, u32 patternsize, u8 *mask,
3454                                      u32 packet_offset)
3455 {
3456         struct brcmf_fil_wowl_pattern_le *filter;
3457         u32 masksize;
3458         u32 patternoffset;
3459         u8 *buf;
3460         u32 bufsize;
3461         s32 ret;
3462
3463         masksize = (patternsize + 7) / 8;
3464         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3465
3466         bufsize = sizeof(*filter) + patternsize + masksize;
3467         buf = kzalloc(bufsize, GFP_KERNEL);
3468         if (!buf)
3469                 return -ENOMEM;
3470         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3471
3472         memcpy(filter->cmd, cmd, 4);
3473         filter->masksize = cpu_to_le32(masksize);
3474         filter->offset = cpu_to_le32(packet_offset);
3475         filter->patternoffset = cpu_to_le32(patternoffset);
3476         filter->patternsize = cpu_to_le32(patternsize);
3477         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3478
3479         if ((mask) && (masksize))
3480                 memcpy(buf + sizeof(*filter), mask, masksize);
3481         if ((pattern) && (patternsize))
3482                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3483
3484         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3485
3486         kfree(buf);
3487         return ret;
3488 }
3489
3490 static s32
3491 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3492                       void *data)
3493 {
3494         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3495         struct brcmf_pno_scanresults_le *pfn_result;
3496         struct brcmf_pno_net_info_le *netinfo;
3497
3498         brcmf_dbg(SCAN, "Enter\n");
3499
3500         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3501                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3502                 return 0;
3503         }
3504
3505         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3506
3507         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3508                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3509                 return 0;
3510         }
3511
3512         if (le32_to_cpu(pfn_result->count) < 1) {
3513                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3514                           le32_to_cpu(pfn_result->count));
3515                 return -EINVAL;
3516         }
3517
3518         netinfo = brcmf_get_netinfo_array(pfn_result);
3519         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3520         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3521         cfg->wowl.nd->n_channels = 1;
3522         cfg->wowl.nd->channels[0] =
3523                 ieee80211_channel_to_frequency(netinfo->channel,
3524                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3525                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3526         cfg->wowl.nd_info->n_matches = 1;
3527         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3528
3529         /* Inform (the resume task) that the net detect information was recvd */
3530         cfg->wowl.nd_data_completed = true;
3531         wake_up(&cfg->wowl.nd_data_wait);
3532
3533         return 0;
3534 }
3535
3536 #ifdef CONFIG_PM
3537
3538 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3539 {
3540         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3541         struct brcmf_wowl_wakeind_le wake_ind_le;
3542         struct cfg80211_wowlan_wakeup wakeup_data;
3543         struct cfg80211_wowlan_wakeup *wakeup;
3544         u32 wakeind;
3545         s32 err;
3546         int timeout;
3547
3548         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3549                                        sizeof(wake_ind_le));
3550         if (err) {
3551                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3552                 return;
3553         }
3554
3555         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3556         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3557                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3558                        BRCMF_WOWL_PFN_FOUND)) {
3559                 wakeup = &wakeup_data;
3560                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3561                 wakeup_data.pattern_idx = -1;
3562
3563                 if (wakeind & BRCMF_WOWL_MAGIC) {
3564                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3565                         wakeup_data.magic_pkt = true;
3566                 }
3567                 if (wakeind & BRCMF_WOWL_DIS) {
3568                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3569                         wakeup_data.disconnect = true;
3570                 }
3571                 if (wakeind & BRCMF_WOWL_BCN) {
3572                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3573                         wakeup_data.disconnect = true;
3574                 }
3575                 if (wakeind & BRCMF_WOWL_RETR) {
3576                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3577                         wakeup_data.disconnect = true;
3578                 }
3579                 if (wakeind & BRCMF_WOWL_NET) {
3580                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3581                         /* For now always map to pattern 0, no API to get
3582                          * correct information available at the moment.
3583                          */
3584                         wakeup_data.pattern_idx = 0;
3585                 }
3586                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3587                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3588                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3589                                 cfg->wowl.nd_data_completed,
3590                                 BRCMF_ND_INFO_TIMEOUT);
3591                         if (!timeout)
3592                                 brcmf_err("No result for wowl net detect\n");
3593                         else
3594                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3595                 }
3596                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3597                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3598                         wakeup_data.gtk_rekey_failure = true;
3599                 }
3600         } else {
3601                 wakeup = NULL;
3602         }
3603         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3604 }
3605
3606 #else
3607
3608 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3609 {
3610 }
3611
3612 #endif /* CONFIG_PM */
3613
3614 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3615 {
3616         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3617         struct net_device *ndev = cfg_to_ndev(cfg);
3618         struct brcmf_if *ifp = netdev_priv(ndev);
3619
3620         brcmf_dbg(TRACE, "Enter\n");
3621
3622         if (cfg->wowl.active) {
3623                 brcmf_report_wowl_wakeind(wiphy, ifp);
3624                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3625                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3626                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3627                         brcmf_configure_arp_nd_offload(ifp, true);
3628                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3629                                       cfg->wowl.pre_pmmode);
3630                 cfg->wowl.active = false;
3631                 if (cfg->wowl.nd_enabled) {
3632                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
3633                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3634                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3635                                             brcmf_notify_sched_scan_results);
3636                         cfg->wowl.nd_enabled = false;
3637                 }
3638         }
3639         return 0;
3640 }
3641
3642 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3643                                  struct brcmf_if *ifp,
3644                                  struct cfg80211_wowlan *wowl)
3645 {
3646         u32 wowl_config;
3647         struct brcmf_wowl_wakeind_le wowl_wakeind;
3648         u32 i;
3649
3650         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3651
3652         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3653                 brcmf_configure_arp_nd_offload(ifp, false);
3654         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3655         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3656
3657         wowl_config = 0;
3658         if (wowl->disconnect)
3659                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3660         if (wowl->magic_pkt)
3661                 wowl_config |= BRCMF_WOWL_MAGIC;
3662         if ((wowl->patterns) && (wowl->n_patterns)) {
3663                 wowl_config |= BRCMF_WOWL_NET;
3664                 for (i = 0; i < wowl->n_patterns; i++) {
3665                         brcmf_config_wowl_pattern(ifp, "add",
3666                                 (u8 *)wowl->patterns[i].pattern,
3667                                 wowl->patterns[i].pattern_len,
3668                                 (u8 *)wowl->patterns[i].mask,
3669                                 wowl->patterns[i].pkt_offset);
3670                 }
3671         }
3672         if (wowl->nd_config) {
3673                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3674                                                 wowl->nd_config);
3675                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3676
3677                 cfg->wowl.nd_data_completed = false;
3678                 cfg->wowl.nd_enabled = true;
3679                 /* Now reroute the event for PFN to the wowl function. */
3680                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3681                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3682                                     brcmf_wowl_nd_results);
3683         }
3684         if (wowl->gtk_rekey_failure)
3685                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3686         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3687                 wowl_config |= BRCMF_WOWL_UNASSOC;
3688
3689         memcpy(&wowl_wakeind, "clear", 6);
3690         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3691                                  sizeof(wowl_wakeind));
3692         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3693         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3694         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3695         cfg->wowl.active = true;
3696 }
3697
3698 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3699                                   struct cfg80211_wowlan *wowl)
3700 {
3701         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3702         struct net_device *ndev = cfg_to_ndev(cfg);
3703         struct brcmf_if *ifp = netdev_priv(ndev);
3704         struct brcmf_cfg80211_vif *vif;
3705
3706         brcmf_dbg(TRACE, "Enter\n");
3707
3708         /* if the primary net_device is not READY there is nothing
3709          * we can do but pray resume goes smoothly.
3710          */
3711         if (!check_vif_up(ifp->vif))
3712                 goto exit;
3713
3714         /* Stop scheduled scan */
3715         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3716                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
3717
3718         /* end any scanning */
3719         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3720                 brcmf_abort_scanning(cfg);
3721
3722         if (wowl == NULL) {
3723                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3724                 list_for_each_entry(vif, &cfg->vif_list, list) {
3725                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3726                                 continue;
3727                         /* While going to suspend if associated with AP
3728                          * disassociate from AP to save power while system is
3729                          * in suspended state
3730                          */
3731                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3732                         /* Make sure WPA_Supplicant receives all the event
3733                          * generated due to DISASSOC call to the fw to keep
3734                          * the state fw and WPA_Supplicant state consistent
3735                          */
3736                         brcmf_delay(500);
3737                 }
3738                 /* Configure MPC */
3739                 brcmf_set_mpc(ifp, 1);
3740
3741         } else {
3742                 /* Configure WOWL paramaters */
3743                 brcmf_configure_wowl(cfg, ifp, wowl);
3744         }
3745
3746 exit:
3747         brcmf_dbg(TRACE, "Exit\n");
3748         /* clear any scanning activity */
3749         cfg->scan_status = 0;
3750         return 0;
3751 }
3752
3753 static __used s32
3754 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3755 {
3756         struct brcmf_pmk_list_le *pmk_list;
3757         int i;
3758         u32 npmk;
3759         s32 err;
3760
3761         pmk_list = &cfg->pmk_list;
3762         npmk = le32_to_cpu(pmk_list->npmk);
3763
3764         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3765         for (i = 0; i < npmk; i++)
3766                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3767
3768         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3769                                        sizeof(*pmk_list));
3770
3771         return err;
3772 }
3773
3774 static s32
3775 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3776                          struct cfg80211_pmksa *pmksa)
3777 {
3778         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3779         struct brcmf_if *ifp = netdev_priv(ndev);
3780         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3781         s32 err;
3782         u32 npmk, i;
3783
3784         brcmf_dbg(TRACE, "Enter\n");
3785         if (!check_vif_up(ifp->vif))
3786                 return -EIO;
3787
3788         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3789         for (i = 0; i < npmk; i++)
3790                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3791                         break;
3792         if (i < BRCMF_MAXPMKID) {
3793                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3794                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3795                 if (i == npmk) {
3796                         npmk++;
3797                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3798                 }
3799         } else {
3800                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3801                 return -EINVAL;
3802         }
3803
3804         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3805         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3806                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3807                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3808                           pmk[npmk].pmkid[i + 3]);
3809
3810         err = brcmf_update_pmklist(cfg, ifp);
3811
3812         brcmf_dbg(TRACE, "Exit\n");
3813         return err;
3814 }
3815
3816 static s32
3817 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3818                          struct cfg80211_pmksa *pmksa)
3819 {
3820         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3821         struct brcmf_if *ifp = netdev_priv(ndev);
3822         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3823         s32 err;
3824         u32 npmk, i;
3825
3826         brcmf_dbg(TRACE, "Enter\n");
3827         if (!check_vif_up(ifp->vif))
3828                 return -EIO;
3829
3830         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3831
3832         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3833         for (i = 0; i < npmk; i++)
3834                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3835                         break;
3836
3837         if ((npmk > 0) && (i < npmk)) {
3838                 for (; i < (npmk - 1); i++) {
3839                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3840                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3841                                WLAN_PMKID_LEN);
3842                 }
3843                 memset(&pmk[i], 0, sizeof(*pmk));
3844                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3845         } else {
3846                 brcmf_err("Cache entry not found\n");
3847                 return -EINVAL;
3848         }
3849
3850         err = brcmf_update_pmklist(cfg, ifp);
3851
3852         brcmf_dbg(TRACE, "Exit\n");
3853         return err;
3854
3855 }
3856
3857 static s32
3858 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3859 {
3860         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3861         struct brcmf_if *ifp = netdev_priv(ndev);
3862         s32 err;
3863
3864         brcmf_dbg(TRACE, "Enter\n");
3865         if (!check_vif_up(ifp->vif))
3866                 return -EIO;
3867
3868         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3869         err = brcmf_update_pmklist(cfg, ifp);
3870
3871         brcmf_dbg(TRACE, "Exit\n");
3872         return err;
3873
3874 }
3875
3876 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3877 {
3878         s32 err;
3879
3880         /* set auth */
3881         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3882         if (err < 0) {
3883                 brcmf_err("auth error %d\n", err);
3884                 return err;
3885         }
3886         /* set wsec */
3887         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3888         if (err < 0) {
3889                 brcmf_err("wsec error %d\n", err);
3890                 return err;
3891         }
3892         /* set upper-layer auth */
3893         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3894         if (err < 0) {
3895                 brcmf_err("wpa_auth error %d\n", err);
3896                 return err;
3897         }
3898
3899         return 0;
3900 }
3901
3902 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3903 {
3904         if (is_rsn_ie)
3905                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3906
3907         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3908 }
3909
3910 static s32
3911 brcmf_configure_wpaie(struct brcmf_if *ifp,
3912                       const struct brcmf_vs_tlv *wpa_ie,
3913                       bool is_rsn_ie)
3914 {
3915         u32 auth = 0; /* d11 open authentication */
3916         u16 count;
3917         s32 err = 0;
3918         s32 len;
3919         u32 i;
3920         u32 wsec;
3921         u32 pval = 0;
3922         u32 gval = 0;
3923         u32 wpa_auth = 0;
3924         u32 offset;
3925         u8 *data;
3926         u16 rsn_cap;
3927         u32 wme_bss_disable;
3928         u32 mfp;
3929
3930         brcmf_dbg(TRACE, "Enter\n");
3931         if (wpa_ie == NULL)
3932                 goto exit;
3933
3934         len = wpa_ie->len + TLV_HDR_LEN;
3935         data = (u8 *)wpa_ie;
3936         offset = TLV_HDR_LEN;
3937         if (!is_rsn_ie)
3938                 offset += VS_IE_FIXED_HDR_LEN;
3939         else
3940                 offset += WPA_IE_VERSION_LEN;
3941
3942         /* check for multicast cipher suite */
3943         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3944                 err = -EINVAL;
3945                 brcmf_err("no multicast cipher suite\n");
3946                 goto exit;
3947         }
3948
3949         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3950                 err = -EINVAL;
3951                 brcmf_err("ivalid OUI\n");
3952                 goto exit;
3953         }
3954         offset += TLV_OUI_LEN;
3955
3956         /* pick up multicast cipher */
3957         switch (data[offset]) {
3958         case WPA_CIPHER_NONE:
3959                 gval = 0;
3960                 break;
3961         case WPA_CIPHER_WEP_40:
3962         case WPA_CIPHER_WEP_104:
3963                 gval = WEP_ENABLED;
3964                 break;
3965         case WPA_CIPHER_TKIP:
3966                 gval = TKIP_ENABLED;
3967                 break;
3968         case WPA_CIPHER_AES_CCM:
3969                 gval = AES_ENABLED;
3970                 break;
3971         default:
3972                 err = -EINVAL;
3973                 brcmf_err("Invalid multi cast cipher info\n");
3974                 goto exit;
3975         }
3976
3977         offset++;
3978         /* walk thru unicast cipher list and pick up what we recognize */
3979         count = data[offset] + (data[offset + 1] << 8);
3980         offset += WPA_IE_SUITE_COUNT_LEN;
3981         /* Check for unicast suite(s) */
3982         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3983                 err = -EINVAL;
3984                 brcmf_err("no unicast cipher suite\n");
3985                 goto exit;
3986         }
3987         for (i = 0; i < count; i++) {
3988                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3989                         err = -EINVAL;
3990                         brcmf_err("ivalid OUI\n");
3991                         goto exit;
3992                 }
3993                 offset += TLV_OUI_LEN;
3994                 switch (data[offset]) {
3995                 case WPA_CIPHER_NONE:
3996                         break;
3997                 case WPA_CIPHER_WEP_40:
3998                 case WPA_CIPHER_WEP_104:
3999                         pval |= WEP_ENABLED;
4000                         break;
4001                 case WPA_CIPHER_TKIP:
4002                         pval |= TKIP_ENABLED;
4003                         break;
4004                 case WPA_CIPHER_AES_CCM:
4005                         pval |= AES_ENABLED;
4006                         break;
4007                 default:
4008                         brcmf_err("Invalid unicast security info\n");
4009                 }
4010                 offset++;
4011         }
4012         /* walk thru auth management suite list and pick up what we recognize */
4013         count = data[offset] + (data[offset + 1] << 8);
4014         offset += WPA_IE_SUITE_COUNT_LEN;
4015         /* Check for auth key management suite(s) */
4016         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4017                 err = -EINVAL;
4018                 brcmf_err("no auth key mgmt suite\n");
4019                 goto exit;
4020         }
4021         for (i = 0; i < count; i++) {
4022                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4023                         err = -EINVAL;
4024                         brcmf_err("ivalid OUI\n");
4025                         goto exit;
4026                 }
4027                 offset += TLV_OUI_LEN;
4028                 switch (data[offset]) {
4029                 case RSN_AKM_NONE:
4030                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4031                         wpa_auth |= WPA_AUTH_NONE;
4032                         break;
4033                 case RSN_AKM_UNSPECIFIED:
4034                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4035                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4036                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4037                         break;
4038                 case RSN_AKM_PSK:
4039                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4040                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4041                                     (wpa_auth |= WPA_AUTH_PSK);
4042                         break;
4043                 case RSN_AKM_SHA256_PSK:
4044                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4045                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4046                         break;
4047                 case RSN_AKM_SHA256_1X:
4048                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4049                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4050                         break;
4051                 default:
4052                         brcmf_err("Invalid key mgmt info\n");
4053                 }
4054                 offset++;
4055         }
4056
4057         mfp = BRCMF_MFP_NONE;
4058         if (is_rsn_ie) {
4059                 wme_bss_disable = 1;
4060                 if ((offset + RSN_CAP_LEN) <= len) {
4061                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4062                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4063                                 wme_bss_disable = 0;
4064                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4065                                 brcmf_dbg(TRACE, "MFP Required\n");
4066                                 mfp = BRCMF_MFP_REQUIRED;
4067                                 /* Firmware only supports mfp required in
4068                                  * combination with WPA2_AUTH_PSK_SHA256 or
4069                                  * WPA2_AUTH_1X_SHA256.
4070                                  */
4071                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4072                                                   WPA2_AUTH_1X_SHA256))) {
4073                                         err = -EINVAL;
4074                                         goto exit;
4075                                 }
4076                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4077                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4078                                  * is to be included in the rsn ie.
4079                                  */
4080                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4081                                         wpa_auth |= WPA2_AUTH_PSK;
4082                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4083                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4084                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4085                                 brcmf_dbg(TRACE, "MFP Capable\n");
4086                                 mfp = BRCMF_MFP_CAPABLE;
4087                         }
4088                 }
4089                 offset += RSN_CAP_LEN;
4090                 /* set wme_bss_disable to sync RSN Capabilities */
4091                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4092                                                wme_bss_disable);
4093                 if (err < 0) {
4094                         brcmf_err("wme_bss_disable error %d\n", err);
4095                         goto exit;
4096                 }
4097
4098                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4099                 offset += RSN_PMKID_COUNT_LEN;
4100
4101                 /* See if there is BIP wpa suite left for MFP */
4102                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4103                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4104                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4105                                                         &data[offset],
4106                                                         WPA_IE_MIN_OUI_LEN);
4107                         if (err < 0) {
4108                                 brcmf_err("bip error %d\n", err);
4109                                 goto exit;
4110                         }
4111                 }
4112         }
4113         /* FOR WPS , set SES_OW_ENABLED */
4114         wsec = (pval | gval | SES_OW_ENABLED);
4115
4116         /* set auth */
4117         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4118         if (err < 0) {
4119                 brcmf_err("auth error %d\n", err);
4120                 goto exit;
4121         }
4122         /* set wsec */
4123         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4124         if (err < 0) {
4125                 brcmf_err("wsec error %d\n", err);
4126                 goto exit;
4127         }
4128         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4129          * will overwrite the values set by MFP
4130          */
4131         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4132                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4133                 if (err < 0) {
4134                         brcmf_err("mfp error %d\n", err);
4135                         goto exit;
4136                 }
4137         }
4138         /* set upper-layer auth */
4139         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4140         if (err < 0) {
4141                 brcmf_err("wpa_auth error %d\n", err);
4142                 goto exit;
4143         }
4144
4145 exit:
4146         return err;
4147 }
4148
4149 static s32
4150 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4151                      struct parsed_vndr_ies *vndr_ies)
4152 {
4153         struct brcmf_vs_tlv *vndrie;
4154         struct brcmf_tlv *ie;
4155         struct parsed_vndr_ie_info *parsed_info;
4156         s32 remaining_len;
4157
4158         remaining_len = (s32)vndr_ie_len;
4159         memset(vndr_ies, 0, sizeof(*vndr_ies));
4160
4161         ie = (struct brcmf_tlv *)vndr_ie_buf;
4162         while (ie) {
4163                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4164                         goto next;
4165                 vndrie = (struct brcmf_vs_tlv *)ie;
4166                 /* len should be bigger than OUI length + one */
4167                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4168                         brcmf_err("invalid vndr ie. length is too small %d\n",
4169                                   vndrie->len);
4170                         goto next;
4171                 }
4172                 /* if wpa or wme ie, do not add ie */
4173                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4174                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4175                     (vndrie->oui_type == WME_OUI_TYPE))) {
4176                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4177                         goto next;
4178                 }
4179
4180                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4181
4182                 /* save vndr ie information */
4183                 parsed_info->ie_ptr = (char *)vndrie;
4184                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4185                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4186
4187                 vndr_ies->count++;
4188
4189                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4190                           parsed_info->vndrie.oui[0],
4191                           parsed_info->vndrie.oui[1],
4192                           parsed_info->vndrie.oui[2],
4193                           parsed_info->vndrie.oui_type);
4194
4195                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4196                         break;
4197 next:
4198                 remaining_len -= (ie->len + TLV_HDR_LEN);
4199                 if (remaining_len <= TLV_HDR_LEN)
4200                         ie = NULL;
4201                 else
4202                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4203                                 TLV_HDR_LEN);
4204         }
4205         return 0;
4206 }
4207
4208 static u32
4209 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4210 {
4211
4212         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4213         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4214
4215         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4216
4217         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4218
4219         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4220
4221         return ie_len + VNDR_IE_HDR_SIZE;
4222 }
4223
4224 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4225                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4226 {
4227         struct brcmf_if *ifp;
4228         struct vif_saved_ie *saved_ie;
4229         s32 err = 0;
4230         u8  *iovar_ie_buf;
4231         u8  *curr_ie_buf;
4232         u8  *mgmt_ie_buf = NULL;
4233         int mgmt_ie_buf_len;
4234         u32 *mgmt_ie_len;
4235         u32 del_add_ie_buf_len = 0;
4236         u32 total_ie_buf_len = 0;
4237         u32 parsed_ie_buf_len = 0;
4238         struct parsed_vndr_ies old_vndr_ies;
4239         struct parsed_vndr_ies new_vndr_ies;
4240         struct parsed_vndr_ie_info *vndrie_info;
4241         s32 i;
4242         u8 *ptr;
4243         int remained_buf_len;
4244
4245         if (!vif)
4246                 return -ENODEV;
4247         ifp = vif->ifp;
4248         saved_ie = &vif->saved_ie;
4249
4250         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4251                   pktflag);
4252         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4253         if (!iovar_ie_buf)
4254                 return -ENOMEM;
4255         curr_ie_buf = iovar_ie_buf;
4256         switch (pktflag) {
4257         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4258                 mgmt_ie_buf = saved_ie->probe_req_ie;
4259                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4260                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4261                 break;
4262         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4263                 mgmt_ie_buf = saved_ie->probe_res_ie;
4264                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4265                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4266                 break;
4267         case BRCMF_VNDR_IE_BEACON_FLAG:
4268                 mgmt_ie_buf = saved_ie->beacon_ie;
4269                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4270                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4271                 break;
4272         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4273                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4274                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4275                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4276                 break;
4277         default:
4278                 err = -EPERM;
4279                 brcmf_err("not suitable type\n");
4280                 goto exit;
4281         }
4282
4283         if (vndr_ie_len > mgmt_ie_buf_len) {
4284                 err = -ENOMEM;
4285                 brcmf_err("extra IE size too big\n");
4286                 goto exit;
4287         }
4288
4289         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4290         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4291                 ptr = curr_ie_buf;
4292                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4293                 for (i = 0; i < new_vndr_ies.count; i++) {
4294                         vndrie_info = &new_vndr_ies.ie_info[i];
4295                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4296                                vndrie_info->ie_len);
4297                         parsed_ie_buf_len += vndrie_info->ie_len;
4298                 }
4299         }
4300
4301         if (mgmt_ie_buf && *mgmt_ie_len) {
4302                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4303                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4304                             parsed_ie_buf_len) == 0)) {
4305                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4306                         goto exit;
4307                 }
4308
4309                 /* parse old vndr_ie */
4310                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4311
4312                 /* make a command to delete old ie */
4313                 for (i = 0; i < old_vndr_ies.count; i++) {
4314                         vndrie_info = &old_vndr_ies.ie_info[i];
4315
4316                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4317                                   vndrie_info->vndrie.id,
4318                                   vndrie_info->vndrie.len,
4319                                   vndrie_info->vndrie.oui[0],
4320                                   vndrie_info->vndrie.oui[1],
4321                                   vndrie_info->vndrie.oui[2]);
4322
4323                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4324                                                            vndrie_info->ie_ptr,
4325                                                            vndrie_info->ie_len,
4326                                                            "del");
4327                         curr_ie_buf += del_add_ie_buf_len;
4328                         total_ie_buf_len += del_add_ie_buf_len;
4329                 }
4330         }
4331
4332         *mgmt_ie_len = 0;
4333         /* Add if there is any extra IE */
4334         if (mgmt_ie_buf && parsed_ie_buf_len) {
4335                 ptr = mgmt_ie_buf;
4336
4337                 remained_buf_len = mgmt_ie_buf_len;
4338
4339                 /* make a command to add new ie */
4340                 for (i = 0; i < new_vndr_ies.count; i++) {
4341                         vndrie_info = &new_vndr_ies.ie_info[i];
4342
4343                         /* verify remained buf size before copy data */
4344                         if (remained_buf_len < (vndrie_info->vndrie.len +
4345                                                         VNDR_IE_VSIE_OFFSET)) {
4346                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4347                                           remained_buf_len);
4348                                 break;
4349                         }
4350                         remained_buf_len -= (vndrie_info->ie_len +
4351                                              VNDR_IE_VSIE_OFFSET);
4352
4353                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4354                                   vndrie_info->vndrie.id,
4355                                   vndrie_info->vndrie.len,
4356                                   vndrie_info->vndrie.oui[0],
4357                                   vndrie_info->vndrie.oui[1],
4358                                   vndrie_info->vndrie.oui[2]);
4359
4360                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4361                                                            vndrie_info->ie_ptr,
4362                                                            vndrie_info->ie_len,
4363                                                            "add");
4364
4365                         /* save the parsed IE in wl struct */
4366                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4367                                vndrie_info->ie_len);
4368                         *mgmt_ie_len += vndrie_info->ie_len;
4369
4370                         curr_ie_buf += del_add_ie_buf_len;
4371                         total_ie_buf_len += del_add_ie_buf_len;
4372                 }
4373         }
4374         if (total_ie_buf_len) {
4375                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4376                                                  total_ie_buf_len);
4377                 if (err)
4378                         brcmf_err("vndr ie set error : %d\n", err);
4379         }
4380
4381 exit:
4382         kfree(iovar_ie_buf);
4383         return err;
4384 }
4385
4386 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4387 {
4388         s32 pktflags[] = {
4389                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4390                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4391                 BRCMF_VNDR_IE_BEACON_FLAG
4392         };
4393         int i;
4394
4395         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4396                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4397
4398         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4399         return 0;
4400 }
4401
4402 static s32
4403 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4404                         struct cfg80211_beacon_data *beacon)
4405 {
4406         s32 err;
4407
4408         /* Set Beacon IEs to FW */
4409         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4410                                     beacon->tail, beacon->tail_len);
4411         if (err) {
4412                 brcmf_err("Set Beacon IE Failed\n");
4413                 return err;
4414         }
4415         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4416
4417         /* Set Probe Response IEs to FW */
4418         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4419                                     beacon->proberesp_ies,
4420                                     beacon->proberesp_ies_len);
4421         if (err)
4422                 brcmf_err("Set Probe Resp IE Failed\n");
4423         else
4424                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4425
4426         return err;
4427 }
4428
4429 static s32
4430 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4431                         struct cfg80211_ap_settings *settings)
4432 {
4433         s32 ie_offset;
4434         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4435         struct brcmf_if *ifp = netdev_priv(ndev);
4436         const struct brcmf_tlv *ssid_ie;
4437         const struct brcmf_tlv *country_ie;
4438         struct brcmf_ssid_le ssid_le;
4439         s32 err = -EPERM;
4440         const struct brcmf_tlv *rsn_ie;
4441         const struct brcmf_vs_tlv *wpa_ie;
4442         struct brcmf_join_params join_params;
4443         enum nl80211_iftype dev_role;
4444         struct brcmf_fil_bss_enable_le bss_enable;
4445         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4446         bool mbss;
4447         int is_11d;
4448         bool supports_11d;
4449
4450         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4451                   settings->chandef.chan->hw_value,
4452                   settings->chandef.center_freq1, settings->chandef.width,
4453                   settings->beacon_interval, settings->dtim_period);
4454         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4455                   settings->ssid, settings->ssid_len, settings->auth_type,
4456                   settings->inactivity_timeout);
4457         dev_role = ifp->vif->wdev.iftype;
4458         mbss = ifp->vif->mbss;
4459
4460         /* store current 11d setting */
4461         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4462                                   &ifp->vif->is_11d)) {
4463                 is_11d = supports_11d = false;
4464         } else {
4465                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4466                                               settings->beacon.tail_len,
4467                                               WLAN_EID_COUNTRY);
4468                 is_11d = country_ie ? 1 : 0;
4469                 supports_11d = true;
4470         }
4471
4472         memset(&ssid_le, 0, sizeof(ssid_le));
4473         if (settings->ssid == NULL || settings->ssid_len == 0) {
4474                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4475                 ssid_ie = brcmf_parse_tlvs(
4476                                 (u8 *)&settings->beacon.head[ie_offset],
4477                                 settings->beacon.head_len - ie_offset,
4478                                 WLAN_EID_SSID);
4479                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4480                         return -EINVAL;
4481
4482                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4483                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4484                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4485         } else {
4486                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4487                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4488         }
4489
4490         if (!mbss) {
4491                 brcmf_set_mpc(ifp, 0);
4492                 brcmf_configure_arp_nd_offload(ifp, false);
4493         }
4494
4495         /* find the RSN_IE */
4496         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4497                                   settings->beacon.tail_len, WLAN_EID_RSN);
4498
4499         /* find the WPA_IE */
4500         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4501                                   settings->beacon.tail_len);
4502
4503         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4504                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4505                 if (wpa_ie != NULL) {
4506                         /* WPA IE */
4507                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4508                         if (err < 0)
4509                                 goto exit;
4510                 } else {
4511                         struct brcmf_vs_tlv *tmp_ie;
4512
4513                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4514
4515                         /* RSN IE */
4516                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4517                         if (err < 0)
4518                                 goto exit;
4519                 }
4520         } else {
4521                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4522                 brcmf_configure_opensecurity(ifp);
4523         }
4524
4525         /* Parameters shared by all radio interfaces */
4526         if (!mbss) {
4527                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4528                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4529                                                     is_11d);
4530                         if (err < 0) {
4531                                 brcmf_err("Regulatory Set Error, %d\n", err);
4532                                 goto exit;
4533                         }
4534                 }
4535                 if (settings->beacon_interval) {
4536                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4537                                                     settings->beacon_interval);
4538                         if (err < 0) {
4539                                 brcmf_err("Beacon Interval Set Error, %d\n",
4540                                           err);
4541                                 goto exit;
4542                         }
4543                 }
4544                 if (settings->dtim_period) {
4545                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4546                                                     settings->dtim_period);
4547                         if (err < 0) {
4548                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4549                                 goto exit;
4550                         }
4551                 }
4552
4553                 if ((dev_role == NL80211_IFTYPE_AP) &&
4554                     ((ifp->ifidx == 0) ||
4555                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4556                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4557                         if (err < 0) {
4558                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4559                                 goto exit;
4560                         }
4561                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4562                 }
4563
4564                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4565                 if (err < 0) {
4566                         brcmf_err("SET INFRA error %d\n", err);
4567                         goto exit;
4568                 }
4569         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4570                 /* Multiple-BSS should use same 11d configuration */
4571                 err = -EINVAL;
4572                 goto exit;
4573         }
4574
4575         /* Interface specific setup */
4576         if (dev_role == NL80211_IFTYPE_AP) {
4577                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4578                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4579
4580                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4581                 if (err < 0) {
4582                         brcmf_err("setting AP mode failed %d\n", err);
4583                         goto exit;
4584                 }
4585                 if (!mbss) {
4586                         /* Firmware 10.x requires setting channel after enabling
4587                          * AP and before bringing interface up.
4588                          */
4589                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4590                         if (err < 0) {
4591                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4592                                           chanspec, err);
4593                                 goto exit;
4594                         }
4595                 }
4596                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4597                 if (err < 0) {
4598                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4599                         goto exit;
4600                 }
4601                 /* On DOWN the firmware removes the WEP keys, reconfigure
4602                  * them if they were set.
4603                  */
4604                 brcmf_cfg80211_reconfigure_wep(ifp);
4605
4606                 memset(&join_params, 0, sizeof(join_params));
4607                 /* join parameters starts with ssid */
4608                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4609                 /* create softap */
4610                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4611                                              &join_params, sizeof(join_params));
4612                 if (err < 0) {
4613                         brcmf_err("SET SSID error (%d)\n", err);
4614                         goto exit;
4615                 }
4616
4617                 if (settings->hidden_ssid) {
4618                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4619                         if (err) {
4620                                 brcmf_err("closednet error (%d)\n", err);
4621                                 goto exit;
4622                         }
4623                 }
4624
4625                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4626         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4627                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4628                 if (err < 0) {
4629                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4630                                   chanspec, err);
4631                         goto exit;
4632                 }
4633                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4634                                                 sizeof(ssid_le));
4635                 if (err < 0) {
4636                         brcmf_err("setting ssid failed %d\n", err);
4637                         goto exit;
4638                 }
4639                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4640                 bss_enable.enable = cpu_to_le32(1);
4641                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4642                                                sizeof(bss_enable));
4643                 if (err < 0) {
4644                         brcmf_err("bss_enable config failed %d\n", err);
4645                         goto exit;
4646                 }
4647
4648                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4649         } else {
4650                 WARN_ON(1);
4651         }
4652
4653         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4654         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4655         brcmf_net_setcarrier(ifp, true);
4656
4657 exit:
4658         if ((err) && (!mbss)) {
4659                 brcmf_set_mpc(ifp, 1);
4660                 brcmf_configure_arp_nd_offload(ifp, true);
4661         }
4662         return err;
4663 }
4664
4665 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4666 {
4667         struct brcmf_if *ifp = netdev_priv(ndev);
4668         s32 err;
4669         struct brcmf_fil_bss_enable_le bss_enable;
4670         struct brcmf_join_params join_params;
4671
4672         brcmf_dbg(TRACE, "Enter\n");
4673
4674         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4675                 /* Due to most likely deauths outstanding we sleep */
4676                 /* first to make sure they get processed by fw. */
4677                 msleep(400);
4678
4679                 if (ifp->vif->mbss) {
4680                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4681                         return err;
4682                 }
4683
4684                 /* First BSS doesn't get a full reset */
4685                 if (ifp->bsscfgidx == 0)
4686                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4687
4688                 memset(&join_params, 0, sizeof(join_params));
4689                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4690                                              &join_params, sizeof(join_params));
4691                 if (err < 0)
4692                         brcmf_err("SET SSID error (%d)\n", err);
4693                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4694                 if (err < 0)
4695                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4696                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4697                 if (err < 0)
4698                         brcmf_err("setting AP mode failed %d\n", err);
4699                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4700                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4701                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4702                                       ifp->vif->is_11d);
4703                 /* Bring device back up so it can be used again */
4704                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4705                 if (err < 0)
4706                         brcmf_err("BRCMF_C_UP error %d\n", err);
4707
4708                 brcmf_vif_clear_mgmt_ies(ifp->vif);
4709         } else {
4710                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4711                 bss_enable.enable = cpu_to_le32(0);
4712                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4713                                                sizeof(bss_enable));
4714                 if (err < 0)
4715                         brcmf_err("bss_enable config failed %d\n", err);
4716         }
4717         brcmf_set_mpc(ifp, 1);
4718         brcmf_configure_arp_nd_offload(ifp, true);
4719         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4720         brcmf_net_setcarrier(ifp, false);
4721
4722         return err;
4723 }
4724
4725 static s32
4726 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4727                              struct cfg80211_beacon_data *info)
4728 {
4729         struct brcmf_if *ifp = netdev_priv(ndev);
4730         s32 err;
4731
4732         brcmf_dbg(TRACE, "Enter\n");
4733
4734         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4735
4736         return err;
4737 }
4738
4739 static int
4740 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4741                            struct station_del_parameters *params)
4742 {
4743         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4744         struct brcmf_scb_val_le scbval;
4745         struct brcmf_if *ifp = netdev_priv(ndev);
4746         s32 err;
4747
4748         if (!params->mac)
4749                 return -EFAULT;
4750
4751         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4752
4753         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4754                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4755         if (!check_vif_up(ifp->vif))
4756                 return -EIO;
4757
4758         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4759         scbval.val = cpu_to_le32(params->reason_code);
4760         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4761                                      &scbval, sizeof(scbval));
4762         if (err)
4763                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4764
4765         brcmf_dbg(TRACE, "Exit\n");
4766         return err;
4767 }
4768
4769 static int
4770 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4771                               const u8 *mac, struct station_parameters *params)
4772 {
4773         struct brcmf_if *ifp = netdev_priv(ndev);
4774         s32 err;
4775
4776         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4777                   params->sta_flags_mask, params->sta_flags_set);
4778
4779         /* Ignore all 00 MAC */
4780         if (is_zero_ether_addr(mac))
4781                 return 0;
4782
4783         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4784                 return 0;
4785
4786         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4787                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4788                                              (void *)mac, ETH_ALEN);
4789         else
4790                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4791                                              (void *)mac, ETH_ALEN);
4792         if (err < 0)
4793                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4794
4795         return err;
4796 }
4797
4798 static void
4799 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4800                                    struct wireless_dev *wdev,
4801                                    u16 frame_type, bool reg)
4802 {
4803         struct brcmf_cfg80211_vif *vif;
4804         u16 mgmt_type;
4805
4806         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4807
4808         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4809         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4810         if (reg)
4811                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4812         else
4813                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4814 }
4815
4816
4817 static int
4818 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4819                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4820 {
4821         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4822         struct ieee80211_channel *chan = params->chan;
4823         const u8 *buf = params->buf;
4824         size_t len = params->len;
4825         const struct ieee80211_mgmt *mgmt;
4826         struct brcmf_cfg80211_vif *vif;
4827         s32 err = 0;
4828         s32 ie_offset;
4829         s32 ie_len;
4830         struct brcmf_fil_action_frame_le *action_frame;
4831         struct brcmf_fil_af_params_le *af_params;
4832         bool ack;
4833         s32 chan_nr;
4834         u32 freq;
4835
4836         brcmf_dbg(TRACE, "Enter\n");
4837
4838         *cookie = 0;
4839
4840         mgmt = (const struct ieee80211_mgmt *)buf;
4841
4842         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4843                 brcmf_err("Driver only allows MGMT packet type\n");
4844                 return -EPERM;
4845         }
4846
4847         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4848
4849         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4850                 /* Right now the only reason to get a probe response */
4851                 /* is for p2p listen response or for p2p GO from     */
4852                 /* wpa_supplicant. Unfortunately the probe is send   */
4853                 /* on primary ndev, while dongle wants it on the p2p */
4854                 /* vif. Since this is only reason for a probe        */
4855                 /* response to be sent, the vif is taken from cfg.   */
4856                 /* If ever desired to send proberesp for non p2p     */
4857                 /* response then data should be checked for          */
4858                 /* "DIRECT-". Note in future supplicant will take    */
4859                 /* dedicated p2p wdev to do this and then this 'hack'*/
4860                 /* is not needed anymore.                            */
4861                 ie_offset =  DOT11_MGMT_HDR_LEN +
4862                              DOT11_BCN_PRB_FIXED_LEN;
4863                 ie_len = len - ie_offset;
4864                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4865                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4866                 err = brcmf_vif_set_mgmt_ie(vif,
4867                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4868                                             &buf[ie_offset],
4869                                             ie_len);
4870                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4871                                         GFP_KERNEL);
4872         } else if (ieee80211_is_action(mgmt->frame_control)) {
4873                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4874                 if (af_params == NULL) {
4875                         brcmf_err("unable to allocate frame\n");
4876                         err = -ENOMEM;
4877                         goto exit;
4878                 }
4879                 action_frame = &af_params->action_frame;
4880                 /* Add the packet Id */
4881                 action_frame->packet_id = cpu_to_le32(*cookie);
4882                 /* Add BSSID */
4883                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4884                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4885                 /* Add the length exepted for 802.11 header  */
4886                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4887                 /* Add the channel. Use the one specified as parameter if any or
4888                  * the current one (got from the firmware) otherwise
4889                  */
4890                 if (chan)
4891                         freq = chan->center_freq;
4892                 else
4893                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4894                                               &freq);
4895                 chan_nr = ieee80211_frequency_to_channel(freq);
4896                 af_params->channel = cpu_to_le32(chan_nr);
4897
4898                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4899                        le16_to_cpu(action_frame->len));
4900
4901                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4902                           *cookie, le16_to_cpu(action_frame->len), freq);
4903
4904                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4905                                                   af_params);
4906
4907                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4908                                         GFP_KERNEL);
4909                 kfree(af_params);
4910         } else {
4911                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4912                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
4913         }
4914
4915 exit:
4916         return err;
4917 }
4918
4919
4920 static int
4921 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4922                                         struct wireless_dev *wdev,
4923                                         u64 cookie)
4924 {
4925         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4926         struct brcmf_cfg80211_vif *vif;
4927         int err = 0;
4928
4929         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4930
4931         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4932         if (vif == NULL) {
4933                 brcmf_err("No p2p device available for probe response\n");
4934                 err = -ENODEV;
4935                 goto exit;
4936         }
4937         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4938 exit:
4939         return err;
4940 }
4941
4942 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
4943                                       struct wireless_dev *wdev,
4944                                       struct cfg80211_chan_def *chandef)
4945 {
4946         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4947         struct net_device *ndev = wdev->netdev;
4948         struct brcmf_if *ifp;
4949         struct brcmu_chan ch;
4950         enum nl80211_band band = 0;
4951         enum nl80211_chan_width width = 0;
4952         u32 chanspec;
4953         int freq, err;
4954
4955         if (!ndev)
4956                 return -ENODEV;
4957         ifp = netdev_priv(ndev);
4958
4959         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
4960         if (err) {
4961                 brcmf_err("chanspec failed (%d)\n", err);
4962                 return err;
4963         }
4964
4965         ch.chspec = chanspec;
4966         cfg->d11inf.decchspec(&ch);
4967
4968         switch (ch.band) {
4969         case BRCMU_CHAN_BAND_2G:
4970                 band = NL80211_BAND_2GHZ;
4971                 break;
4972         case BRCMU_CHAN_BAND_5G:
4973                 band = NL80211_BAND_5GHZ;
4974                 break;
4975         }
4976
4977         switch (ch.bw) {
4978         case BRCMU_CHAN_BW_80:
4979                 width = NL80211_CHAN_WIDTH_80;
4980                 break;
4981         case BRCMU_CHAN_BW_40:
4982                 width = NL80211_CHAN_WIDTH_40;
4983                 break;
4984         case BRCMU_CHAN_BW_20:
4985                 width = NL80211_CHAN_WIDTH_20;
4986                 break;
4987         case BRCMU_CHAN_BW_80P80:
4988                 width = NL80211_CHAN_WIDTH_80P80;
4989                 break;
4990         case BRCMU_CHAN_BW_160:
4991                 width = NL80211_CHAN_WIDTH_160;
4992                 break;
4993         }
4994
4995         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
4996         chandef->chan = ieee80211_get_channel(wiphy, freq);
4997         chandef->width = width;
4998         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
4999         chandef->center_freq2 = 0;
5000
5001         return 0;
5002 }
5003
5004 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5005                                            struct wireless_dev *wdev,
5006                                            enum nl80211_crit_proto_id proto,
5007                                            u16 duration)
5008 {
5009         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5010         struct brcmf_cfg80211_vif *vif;
5011
5012         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5013
5014         /* only DHCP support for now */
5015         if (proto != NL80211_CRIT_PROTO_DHCP)
5016                 return -EINVAL;
5017
5018         /* suppress and abort scanning */
5019         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5020         brcmf_abort_scanning(cfg);
5021
5022         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5023 }
5024
5025 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5026                                            struct wireless_dev *wdev)
5027 {
5028         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5029         struct brcmf_cfg80211_vif *vif;
5030
5031         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5032
5033         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5034         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5035 }
5036
5037 static s32
5038 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5039                              const struct brcmf_event_msg *e, void *data)
5040 {
5041         switch (e->reason) {
5042         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5043                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5044                 break;
5045         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5046                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5047                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5048                 break;
5049         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5050                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5051                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5052                 break;
5053         }
5054
5055         return 0;
5056 }
5057
5058 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5059 {
5060         int ret;
5061
5062         switch (oper) {
5063         case NL80211_TDLS_DISCOVERY_REQ:
5064                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5065                 break;
5066         case NL80211_TDLS_SETUP:
5067                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5068                 break;
5069         case NL80211_TDLS_TEARDOWN:
5070                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5071                 break;
5072         default:
5073                 brcmf_err("unsupported operation: %d\n", oper);
5074                 ret = -EOPNOTSUPP;
5075         }
5076         return ret;
5077 }
5078
5079 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5080                                     struct net_device *ndev, const u8 *peer,
5081                                     enum nl80211_tdls_operation oper)
5082 {
5083         struct brcmf_if *ifp;
5084         struct brcmf_tdls_iovar_le info;
5085         int ret = 0;
5086
5087         ret = brcmf_convert_nl80211_tdls_oper(oper);
5088         if (ret < 0)
5089                 return ret;
5090
5091         ifp = netdev_priv(ndev);
5092         memset(&info, 0, sizeof(info));
5093         info.mode = (u8)ret;
5094         if (peer)
5095                 memcpy(info.ea, peer, ETH_ALEN);
5096
5097         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5098                                        &info, sizeof(info));
5099         if (ret < 0)
5100                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5101
5102         return ret;
5103 }
5104
5105 static int
5106 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5107                                   struct net_device *ndev,
5108                                   struct cfg80211_connect_params *sme,
5109                                   u32 changed)
5110 {
5111         struct brcmf_if *ifp;
5112         int err;
5113
5114         if (!(changed & UPDATE_ASSOC_IES))
5115                 return 0;
5116
5117         ifp = netdev_priv(ndev);
5118         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5119                                     sme->ie, sme->ie_len);
5120         if (err)
5121                 brcmf_err("Set Assoc REQ IE Failed\n");
5122         else
5123                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5124
5125         return err;
5126 }
5127
5128 #ifdef CONFIG_PM
5129 static int
5130 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5131                               struct cfg80211_gtk_rekey_data *gtk)
5132 {
5133         struct brcmf_if *ifp = netdev_priv(ndev);
5134         struct brcmf_gtk_keyinfo_le gtk_le;
5135         int ret;
5136
5137         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5138
5139         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5140         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5141         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5142                sizeof(gtk_le.replay_counter));
5143
5144         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5145                                        sizeof(gtk_le));
5146         if (ret < 0)
5147                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5148
5149         return ret;
5150 }
5151 #endif
5152
5153 static struct cfg80211_ops brcmf_cfg80211_ops = {
5154         .add_virtual_intf = brcmf_cfg80211_add_iface,
5155         .del_virtual_intf = brcmf_cfg80211_del_iface,
5156         .change_virtual_intf = brcmf_cfg80211_change_iface,
5157         .scan = brcmf_cfg80211_scan,
5158         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5159         .join_ibss = brcmf_cfg80211_join_ibss,
5160         .leave_ibss = brcmf_cfg80211_leave_ibss,
5161         .get_station = brcmf_cfg80211_get_station,
5162         .dump_station = brcmf_cfg80211_dump_station,
5163         .set_tx_power = brcmf_cfg80211_set_tx_power,
5164         .get_tx_power = brcmf_cfg80211_get_tx_power,
5165         .add_key = brcmf_cfg80211_add_key,
5166         .del_key = brcmf_cfg80211_del_key,
5167         .get_key = brcmf_cfg80211_get_key,
5168         .set_default_key = brcmf_cfg80211_config_default_key,
5169         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5170         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5171         .connect = brcmf_cfg80211_connect,
5172         .disconnect = brcmf_cfg80211_disconnect,
5173         .suspend = brcmf_cfg80211_suspend,
5174         .resume = brcmf_cfg80211_resume,
5175         .set_pmksa = brcmf_cfg80211_set_pmksa,
5176         .del_pmksa = brcmf_cfg80211_del_pmksa,
5177         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5178         .start_ap = brcmf_cfg80211_start_ap,
5179         .stop_ap = brcmf_cfg80211_stop_ap,
5180         .change_beacon = brcmf_cfg80211_change_beacon,
5181         .del_station = brcmf_cfg80211_del_station,
5182         .change_station = brcmf_cfg80211_change_station,
5183         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5184         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5185         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5186         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5187         .remain_on_channel = brcmf_p2p_remain_on_channel,
5188         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5189         .get_channel = brcmf_cfg80211_get_channel,
5190         .start_p2p_device = brcmf_p2p_start_device,
5191         .stop_p2p_device = brcmf_p2p_stop_device,
5192         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5193         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5194         .tdls_oper = brcmf_cfg80211_tdls_oper,
5195         .update_connect_params = brcmf_cfg80211_update_conn_params,
5196 };
5197
5198 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5199                                            enum nl80211_iftype type)
5200 {
5201         struct brcmf_cfg80211_vif *vif_walk;
5202         struct brcmf_cfg80211_vif *vif;
5203         bool mbss;
5204
5205         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5206                   sizeof(*vif));
5207         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5208         if (!vif)
5209                 return ERR_PTR(-ENOMEM);
5210
5211         vif->wdev.wiphy = cfg->wiphy;
5212         vif->wdev.iftype = type;
5213
5214         brcmf_init_prof(&vif->profile);
5215
5216         if (type == NL80211_IFTYPE_AP) {
5217                 mbss = false;
5218                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5219                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5220                                 mbss = true;
5221                                 break;
5222                         }
5223                 }
5224                 vif->mbss = mbss;
5225         }
5226
5227         list_add_tail(&vif->list, &cfg->vif_list);
5228         return vif;
5229 }
5230
5231 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5232 {
5233         list_del(&vif->list);
5234         kfree(vif);
5235 }
5236
5237 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5238 {
5239         struct brcmf_cfg80211_vif *vif;
5240         struct brcmf_if *ifp;
5241
5242         ifp = netdev_priv(ndev);
5243         vif = ifp->vif;
5244
5245         if (vif)
5246                 brcmf_free_vif(vif);
5247 }
5248
5249 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
5250 {
5251         u32 event = e->event_code;
5252         u32 status = e->status;
5253
5254         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5255                 brcmf_dbg(CONN, "Processing set ssid\n");
5256                 return true;
5257         }
5258
5259         return false;
5260 }
5261
5262 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5263 {
5264         u32 event = e->event_code;
5265         u16 flags = e->flags;
5266
5267         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5268             (event == BRCMF_E_DISASSOC_IND) ||
5269             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5270                 brcmf_dbg(CONN, "Processing link down\n");
5271                 return true;
5272         }
5273         return false;
5274 }
5275
5276 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5277                                const struct brcmf_event_msg *e)
5278 {
5279         u32 event = e->event_code;
5280         u32 status = e->status;
5281
5282         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5283                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5284                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5285                 return true;
5286         }
5287
5288         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5289                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5290                 return true;
5291         }
5292
5293         return false;
5294 }
5295
5296 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5297 {
5298         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5299
5300         kfree(conn_info->req_ie);
5301         conn_info->req_ie = NULL;
5302         conn_info->req_ie_len = 0;
5303         kfree(conn_info->resp_ie);
5304         conn_info->resp_ie = NULL;
5305         conn_info->resp_ie_len = 0;
5306 }
5307
5308 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5309                                struct brcmf_if *ifp)
5310 {
5311         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5312         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5313         u32 req_len;
5314         u32 resp_len;
5315         s32 err = 0;
5316
5317         brcmf_clear_assoc_ies(cfg);
5318
5319         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5320                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5321         if (err) {
5322                 brcmf_err("could not get assoc info (%d)\n", err);
5323                 return err;
5324         }
5325         assoc_info =
5326                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5327         req_len = le32_to_cpu(assoc_info->req_len);
5328         resp_len = le32_to_cpu(assoc_info->resp_len);
5329         if (req_len) {
5330                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5331                                                cfg->extra_buf,
5332                                                WL_ASSOC_INFO_MAX);
5333                 if (err) {
5334                         brcmf_err("could not get assoc req (%d)\n", err);
5335                         return err;
5336                 }
5337                 conn_info->req_ie_len = req_len;
5338                 conn_info->req_ie =
5339                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5340                             GFP_KERNEL);
5341         } else {
5342                 conn_info->req_ie_len = 0;
5343                 conn_info->req_ie = NULL;
5344         }
5345         if (resp_len) {
5346                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5347                                                cfg->extra_buf,
5348                                                WL_ASSOC_INFO_MAX);
5349                 if (err) {
5350                         brcmf_err("could not get assoc resp (%d)\n", err);
5351                         return err;
5352                 }
5353                 conn_info->resp_ie_len = resp_len;
5354                 conn_info->resp_ie =
5355                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5356                             GFP_KERNEL);
5357         } else {
5358                 conn_info->resp_ie_len = 0;
5359                 conn_info->resp_ie = NULL;
5360         }
5361         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5362                   conn_info->req_ie_len, conn_info->resp_ie_len);
5363
5364         return err;
5365 }
5366
5367 static s32
5368 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5369                        struct net_device *ndev,
5370                        const struct brcmf_event_msg *e)
5371 {
5372         struct brcmf_if *ifp = netdev_priv(ndev);
5373         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5374         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5375         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5376         struct ieee80211_channel *notify_channel = NULL;
5377         struct ieee80211_supported_band *band;
5378         struct brcmf_bss_info_le *bi;
5379         struct brcmu_chan ch;
5380         struct cfg80211_roam_info roam_info = {};
5381         u32 freq;
5382         s32 err = 0;
5383         u8 *buf;
5384
5385         brcmf_dbg(TRACE, "Enter\n");
5386
5387         brcmf_get_assoc_ies(cfg, ifp);
5388         memcpy(profile->bssid, e->addr, ETH_ALEN);
5389         brcmf_update_bss_info(cfg, ifp);
5390
5391         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5392         if (buf == NULL) {
5393                 err = -ENOMEM;
5394                 goto done;
5395         }
5396
5397         /* data sent to dongle has to be little endian */
5398         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5399         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5400                                      buf, WL_BSS_INFO_MAX);
5401
5402         if (err)
5403                 goto done;
5404
5405         bi = (struct brcmf_bss_info_le *)(buf + 4);
5406         ch.chspec = le16_to_cpu(bi->chanspec);
5407         cfg->d11inf.decchspec(&ch);
5408
5409         if (ch.band == BRCMU_CHAN_BAND_2G)
5410                 band = wiphy->bands[NL80211_BAND_2GHZ];
5411         else
5412                 band = wiphy->bands[NL80211_BAND_5GHZ];
5413
5414         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5415         notify_channel = ieee80211_get_channel(wiphy, freq);
5416
5417 done:
5418         kfree(buf);
5419
5420         roam_info.channel = notify_channel;
5421         roam_info.bssid = profile->bssid;
5422         roam_info.req_ie = conn_info->req_ie;
5423         roam_info.req_ie_len = conn_info->req_ie_len;
5424         roam_info.resp_ie = conn_info->resp_ie;
5425         roam_info.resp_ie_len = conn_info->resp_ie_len;
5426
5427         cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
5428         brcmf_dbg(CONN, "Report roaming result\n");
5429
5430         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5431         brcmf_dbg(TRACE, "Exit\n");
5432         return err;
5433 }
5434
5435 static s32
5436 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5437                        struct net_device *ndev, const struct brcmf_event_msg *e,
5438                        bool completed)
5439 {
5440         struct brcmf_if *ifp = netdev_priv(ndev);
5441         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5442         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5443
5444         brcmf_dbg(TRACE, "Enter\n");
5445
5446         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5447                                &ifp->vif->sme_state)) {
5448                 if (completed) {
5449                         brcmf_get_assoc_ies(cfg, ifp);
5450                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5451                         brcmf_update_bss_info(cfg, ifp);
5452                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5453                                 &ifp->vif->sme_state);
5454                 }
5455                 cfg80211_connect_result(ndev,
5456                                         (u8 *)profile->bssid,
5457                                         conn_info->req_ie,
5458                                         conn_info->req_ie_len,
5459                                         conn_info->resp_ie,
5460                                         conn_info->resp_ie_len,
5461                                         completed ? WLAN_STATUS_SUCCESS :
5462                                                     WLAN_STATUS_AUTH_TIMEOUT,
5463                                         GFP_KERNEL);
5464                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5465                           completed ? "succeeded" : "failed");
5466         }
5467         brcmf_dbg(TRACE, "Exit\n");
5468         return 0;
5469 }
5470
5471 static s32
5472 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5473                                struct net_device *ndev,
5474                                const struct brcmf_event_msg *e, void *data)
5475 {
5476         static int generation;
5477         u32 event = e->event_code;
5478         u32 reason = e->reason;
5479         struct station_info sinfo;
5480
5481         brcmf_dbg(CONN, "event %s (%u), reason %d\n",
5482                   brcmf_fweh_event_name(event), event, reason);
5483         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5484             ndev != cfg_to_ndev(cfg)) {
5485                 brcmf_dbg(CONN, "AP mode link down\n");
5486                 complete(&cfg->vif_disabled);
5487                 return 0;
5488         }
5489
5490         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5491             (reason == BRCMF_E_STATUS_SUCCESS)) {
5492                 memset(&sinfo, 0, sizeof(sinfo));
5493                 if (!data) {
5494                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5495                         return -EINVAL;
5496                 }
5497                 sinfo.assoc_req_ies = data;
5498                 sinfo.assoc_req_ies_len = e->datalen;
5499                 generation++;
5500                 sinfo.generation = generation;
5501                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5502         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5503                    (event == BRCMF_E_DEAUTH_IND) ||
5504                    (event == BRCMF_E_DEAUTH)) {
5505                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5506         }
5507         return 0;
5508 }
5509
5510 static s32
5511 brcmf_notify_connect_status(struct brcmf_if *ifp,
5512                             const struct brcmf_event_msg *e, void *data)
5513 {
5514         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5515         struct net_device *ndev = ifp->ndev;
5516         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5517         struct ieee80211_channel *chan;
5518         s32 err = 0;
5519
5520         if ((e->event_code == BRCMF_E_DEAUTH) ||
5521             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5522             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5523             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5524                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5525         }
5526
5527         if (brcmf_is_apmode(ifp->vif)) {
5528                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5529         } else if (brcmf_is_linkup(e)) {
5530                 brcmf_dbg(CONN, "Linkup\n");
5531                 if (brcmf_is_ibssmode(ifp->vif)) {
5532                         brcmf_inform_ibss(cfg, ndev, e->addr);
5533                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5534                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5535                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5536                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5537                                   &ifp->vif->sme_state);
5538                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5539                                 &ifp->vif->sme_state);
5540                 } else
5541                         brcmf_bss_connect_done(cfg, ndev, e, true);
5542                 brcmf_net_setcarrier(ifp, true);
5543         } else if (brcmf_is_linkdown(e)) {
5544                 brcmf_dbg(CONN, "Linkdown\n");
5545                 if (!brcmf_is_ibssmode(ifp->vif)) {
5546                         brcmf_bss_connect_done(cfg, ndev, e, false);
5547                         brcmf_link_down(ifp->vif,
5548                                         brcmf_map_fw_linkdown_reason(e));
5549                         brcmf_init_prof(ndev_to_prof(ndev));
5550                         if (ndev != cfg_to_ndev(cfg))
5551                                 complete(&cfg->vif_disabled);
5552                         brcmf_net_setcarrier(ifp, false);
5553                 }
5554         } else if (brcmf_is_nonetwork(cfg, e)) {
5555                 if (brcmf_is_ibssmode(ifp->vif))
5556                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5557                                   &ifp->vif->sme_state);
5558                 else
5559                         brcmf_bss_connect_done(cfg, ndev, e, false);
5560         }
5561
5562         return err;
5563 }
5564
5565 static s32
5566 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5567                             const struct brcmf_event_msg *e, void *data)
5568 {
5569         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5570         u32 event = e->event_code;
5571         u32 status = e->status;
5572
5573         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5574                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5575                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5576                 else
5577                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5578         }
5579
5580         return 0;
5581 }
5582
5583 static s32
5584 brcmf_notify_mic_status(struct brcmf_if *ifp,
5585                         const struct brcmf_event_msg *e, void *data)
5586 {
5587         u16 flags = e->flags;
5588         enum nl80211_key_type key_type;
5589
5590         if (flags & BRCMF_EVENT_MSG_GROUP)
5591                 key_type = NL80211_KEYTYPE_GROUP;
5592         else
5593                 key_type = NL80211_KEYTYPE_PAIRWISE;
5594
5595         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5596                                      NULL, GFP_KERNEL);
5597
5598         return 0;
5599 }
5600
5601 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5602                                   const struct brcmf_event_msg *e, void *data)
5603 {
5604         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5605         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5606         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5607         struct brcmf_cfg80211_vif *vif;
5608
5609         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5610                   ifevent->action, ifevent->flags, ifevent->ifidx,
5611                   ifevent->bsscfgidx);
5612
5613         spin_lock(&event->vif_event_lock);
5614         event->action = ifevent->action;
5615         vif = event->vif;
5616
5617         switch (ifevent->action) {
5618         case BRCMF_E_IF_ADD:
5619                 /* waiting process may have timed out */
5620                 if (!cfg->vif_event.vif) {
5621                         spin_unlock(&event->vif_event_lock);
5622                         return -EBADF;
5623                 }
5624
5625                 ifp->vif = vif;
5626                 vif->ifp = ifp;
5627                 if (ifp->ndev) {
5628                         vif->wdev.netdev = ifp->ndev;
5629                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5630                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5631                 }
5632                 spin_unlock(&event->vif_event_lock);
5633                 wake_up(&event->vif_wq);
5634                 return 0;
5635
5636         case BRCMF_E_IF_DEL:
5637                 spin_unlock(&event->vif_event_lock);
5638                 /* event may not be upon user request */
5639                 if (brcmf_cfg80211_vif_event_armed(cfg))
5640                         wake_up(&event->vif_wq);
5641                 return 0;
5642
5643         case BRCMF_E_IF_CHANGE:
5644                 spin_unlock(&event->vif_event_lock);
5645                 wake_up(&event->vif_wq);
5646                 return 0;
5647
5648         default:
5649                 spin_unlock(&event->vif_event_lock);
5650                 break;
5651         }
5652         return -EINVAL;
5653 }
5654
5655 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5656 {
5657         conf->frag_threshold = (u32)-1;
5658         conf->rts_threshold = (u32)-1;
5659         conf->retry_short = (u32)-1;
5660         conf->retry_long = (u32)-1;
5661 }
5662
5663 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5664 {
5665         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5666                             brcmf_notify_connect_status);
5667         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5668                             brcmf_notify_connect_status);
5669         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5670                             brcmf_notify_connect_status);
5671         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5672                             brcmf_notify_connect_status);
5673         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5674                             brcmf_notify_connect_status);
5675         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5676                             brcmf_notify_connect_status);
5677         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5678                             brcmf_notify_roaming_status);
5679         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5680                             brcmf_notify_mic_status);
5681         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5682                             brcmf_notify_connect_status);
5683         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5684                             brcmf_notify_sched_scan_results);
5685         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5686                             brcmf_notify_vif_event);
5687         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5688                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5689         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5690                             brcmf_p2p_notify_listen_complete);
5691         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5692                             brcmf_p2p_notify_action_frame_rx);
5693         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5694                             brcmf_p2p_notify_action_tx_complete);
5695         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5696                             brcmf_p2p_notify_action_tx_complete);
5697 }
5698
5699 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5700 {
5701         kfree(cfg->conf);
5702         cfg->conf = NULL;
5703         kfree(cfg->extra_buf);
5704         cfg->extra_buf = NULL;
5705         kfree(cfg->wowl.nd);
5706         cfg->wowl.nd = NULL;
5707         kfree(cfg->wowl.nd_info);
5708         cfg->wowl.nd_info = NULL;
5709         kfree(cfg->escan_info.escan_buf);
5710         cfg->escan_info.escan_buf = NULL;
5711 }
5712
5713 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5714 {
5715         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5716         if (!cfg->conf)
5717                 goto init_priv_mem_out;
5718         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5719         if (!cfg->extra_buf)
5720                 goto init_priv_mem_out;
5721         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5722         if (!cfg->wowl.nd)
5723                 goto init_priv_mem_out;
5724         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5725                                     sizeof(struct cfg80211_wowlan_nd_match *),
5726                                     GFP_KERNEL);
5727         if (!cfg->wowl.nd_info)
5728                 goto init_priv_mem_out;
5729         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5730         if (!cfg->escan_info.escan_buf)
5731                 goto init_priv_mem_out;
5732
5733         return 0;
5734
5735 init_priv_mem_out:
5736         brcmf_deinit_priv_mem(cfg);
5737
5738         return -ENOMEM;
5739 }
5740
5741 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5742 {
5743         s32 err = 0;
5744
5745         cfg->scan_request = NULL;
5746         cfg->pwr_save = true;
5747         cfg->active_scan = true;        /* we do active scan per default */
5748         cfg->dongle_up = false;         /* dongle is not up yet */
5749         err = brcmf_init_priv_mem(cfg);
5750         if (err)
5751                 return err;
5752         brcmf_register_event_handlers(cfg);
5753         mutex_init(&cfg->usr_sync);
5754         brcmf_init_escan(cfg);
5755         brcmf_init_conf(cfg->conf);
5756         init_completion(&cfg->vif_disabled);
5757         return err;
5758 }
5759
5760 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5761 {
5762         cfg->dongle_up = false; /* dongle down */
5763         brcmf_abort_scanning(cfg);
5764         brcmf_deinit_priv_mem(cfg);
5765 }
5766
5767 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5768 {
5769         init_waitqueue_head(&event->vif_wq);
5770         spin_lock_init(&event->vif_event_lock);
5771 }
5772
5773 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5774 {
5775         s32 err;
5776         u32 bcn_timeout;
5777         __le32 roamtrigger[2];
5778         __le32 roam_delta[2];
5779
5780         /* Configure beacon timeout value based upon roaming setting */
5781         if (ifp->drvr->settings->roamoff)
5782                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5783         else
5784                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5785         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5786         if (err) {
5787                 brcmf_err("bcn_timeout error (%d)\n", err);
5788                 goto roam_setup_done;
5789         }
5790
5791         /* Enable/Disable built-in roaming to allow supplicant to take care of
5792          * roaming.
5793          */
5794         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5795                   ifp->drvr->settings->roamoff ? "Off" : "On");
5796         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5797                                       ifp->drvr->settings->roamoff);
5798         if (err) {
5799                 brcmf_err("roam_off error (%d)\n", err);
5800                 goto roam_setup_done;
5801         }
5802
5803         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5804         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5805         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5806                                      (void *)roamtrigger, sizeof(roamtrigger));
5807         if (err) {
5808                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5809                 goto roam_setup_done;
5810         }
5811
5812         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5813         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5814         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5815                                      (void *)roam_delta, sizeof(roam_delta));
5816         if (err) {
5817                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5818                 goto roam_setup_done;
5819         }
5820
5821 roam_setup_done:
5822         return err;
5823 }
5824
5825 static s32
5826 brcmf_dongle_scantime(struct brcmf_if *ifp)
5827 {
5828         s32 err = 0;
5829
5830         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5831                                     BRCMF_SCAN_CHANNEL_TIME);
5832         if (err) {
5833                 brcmf_err("Scan assoc time error (%d)\n", err);
5834                 goto dongle_scantime_out;
5835         }
5836         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5837                                     BRCMF_SCAN_UNASSOC_TIME);
5838         if (err) {
5839                 brcmf_err("Scan unassoc time error (%d)\n", err);
5840                 goto dongle_scantime_out;
5841         }
5842
5843         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5844                                     BRCMF_SCAN_PASSIVE_TIME);
5845         if (err) {
5846                 brcmf_err("Scan passive time error (%d)\n", err);
5847                 goto dongle_scantime_out;
5848         }
5849
5850 dongle_scantime_out:
5851         return err;
5852 }
5853
5854 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5855                                            struct brcmu_chan *ch)
5856 {
5857         u32 ht40_flag;
5858
5859         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5860         if (ch->sb == BRCMU_CHAN_SB_U) {
5861                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5862                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5863                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5864         } else {
5865                 /* It should be one of
5866                  * IEEE80211_CHAN_NO_HT40 or
5867                  * IEEE80211_CHAN_NO_HT40PLUS
5868                  */
5869                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5870                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5871                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5872         }
5873 }
5874
5875 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5876                                     u32 bw_cap[])
5877 {
5878         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5879         struct ieee80211_supported_band *band;
5880         struct ieee80211_channel *channel;
5881         struct wiphy *wiphy;
5882         struct brcmf_chanspec_list *list;
5883         struct brcmu_chan ch;
5884         int err;
5885         u8 *pbuf;
5886         u32 i, j;
5887         u32 total;
5888         u32 chaninfo;
5889
5890         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5891
5892         if (pbuf == NULL)
5893                 return -ENOMEM;
5894
5895         list = (struct brcmf_chanspec_list *)pbuf;
5896
5897         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5898                                        BRCMF_DCMD_MEDLEN);
5899         if (err) {
5900                 brcmf_err("get chanspecs error (%d)\n", err);
5901                 goto fail_pbuf;
5902         }
5903
5904         wiphy = cfg_to_wiphy(cfg);
5905         band = wiphy->bands[NL80211_BAND_2GHZ];
5906         if (band)
5907                 for (i = 0; i < band->n_channels; i++)
5908                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5909         band = wiphy->bands[NL80211_BAND_5GHZ];
5910         if (band)
5911                 for (i = 0; i < band->n_channels; i++)
5912                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5913
5914         total = le32_to_cpu(list->count);
5915         for (i = 0; i < total; i++) {
5916                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5917                 cfg->d11inf.decchspec(&ch);
5918
5919                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5920                         band = wiphy->bands[NL80211_BAND_2GHZ];
5921                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5922                         band = wiphy->bands[NL80211_BAND_5GHZ];
5923                 } else {
5924                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5925                         continue;
5926                 }
5927                 if (!band)
5928                         continue;
5929                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5930                     ch.bw == BRCMU_CHAN_BW_40)
5931                         continue;
5932                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5933                     ch.bw == BRCMU_CHAN_BW_80)
5934                         continue;
5935
5936                 channel = NULL;
5937                 for (j = 0; j < band->n_channels; j++) {
5938                         if (band->channels[j].hw_value == ch.control_ch_num) {
5939                                 channel = &band->channels[j];
5940                                 break;
5941                         }
5942                 }
5943                 if (!channel) {
5944                         /* It seems firmware supports some channel we never
5945                          * considered. Something new in IEEE standard?
5946                          */
5947                         brcmf_err("Ignoring unexpected firmware channel %d\n",
5948                                   ch.control_ch_num);
5949                         continue;
5950                 }
5951
5952                 if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
5953                         continue;
5954
5955                 /* assuming the chanspecs order is HT20,
5956                  * HT40 upper, HT40 lower, and VHT80.
5957                  */
5958                 if (ch.bw == BRCMU_CHAN_BW_80) {
5959                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
5960                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5961                         brcmf_update_bw40_channel_flag(channel, &ch);
5962                 } else {
5963                         /* enable the channel and disable other bandwidths
5964                          * for now as mentioned order assure they are enabled
5965                          * for subsequent chanspecs.
5966                          */
5967                         channel->flags = IEEE80211_CHAN_NO_HT40 |
5968                                          IEEE80211_CHAN_NO_80MHZ;
5969                         ch.bw = BRCMU_CHAN_BW_20;
5970                         cfg->d11inf.encchspec(&ch);
5971                         chaninfo = ch.chspec;
5972                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5973                                                        &chaninfo);
5974                         if (!err) {
5975                                 if (chaninfo & WL_CHAN_RADAR)
5976                                         channel->flags |=
5977                                                 (IEEE80211_CHAN_RADAR |
5978                                                  IEEE80211_CHAN_NO_IR);
5979                                 if (chaninfo & WL_CHAN_PASSIVE)
5980                                         channel->flags |=
5981                                                 IEEE80211_CHAN_NO_IR;
5982                         }
5983                 }
5984         }
5985
5986 fail_pbuf:
5987         kfree(pbuf);
5988         return err;
5989 }
5990
5991 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
5992 {
5993         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5994         struct ieee80211_supported_band *band;
5995         struct brcmf_fil_bwcap_le band_bwcap;
5996         struct brcmf_chanspec_list *list;
5997         u8 *pbuf;
5998         u32 val;
5999         int err;
6000         struct brcmu_chan ch;
6001         u32 num_chan;
6002         int i, j;
6003
6004         /* verify support for bw_cap command */
6005         val = WLC_BAND_5G;
6006         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6007
6008         if (!err) {
6009                 /* only set 2G bandwidth using bw_cap command */
6010                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6011                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6012                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6013                                                sizeof(band_bwcap));
6014         } else {
6015                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6016                 val = WLC_N_BW_40ALL;
6017                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6018         }
6019
6020         if (!err) {
6021                 /* update channel info in 2G band */
6022                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6023
6024                 if (pbuf == NULL)
6025                         return -ENOMEM;
6026
6027                 ch.band = BRCMU_CHAN_BAND_2G;
6028                 ch.bw = BRCMU_CHAN_BW_40;
6029                 ch.sb = BRCMU_CHAN_SB_NONE;
6030                 ch.chnum = 0;
6031                 cfg->d11inf.encchspec(&ch);
6032
6033                 /* pass encoded chanspec in query */
6034                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6035
6036                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6037                                                BRCMF_DCMD_MEDLEN);
6038                 if (err) {
6039                         brcmf_err("get chanspecs error (%d)\n", err);
6040                         kfree(pbuf);
6041                         return err;
6042                 }
6043
6044                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6045                 list = (struct brcmf_chanspec_list *)pbuf;
6046                 num_chan = le32_to_cpu(list->count);
6047                 for (i = 0; i < num_chan; i++) {
6048                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6049                         cfg->d11inf.decchspec(&ch);
6050                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6051                                 continue;
6052                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6053                                 continue;
6054                         for (j = 0; j < band->n_channels; j++) {
6055                                 if (band->channels[j].hw_value == ch.control_ch_num)
6056                                         break;
6057                         }
6058                         if (WARN_ON(j == band->n_channels))
6059                                 continue;
6060
6061                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6062                 }
6063                 kfree(pbuf);
6064         }
6065         return err;
6066 }
6067
6068 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6069 {
6070         u32 band, mimo_bwcap;
6071         int err;
6072
6073         band = WLC_BAND_2G;
6074         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6075         if (!err) {
6076                 bw_cap[NL80211_BAND_2GHZ] = band;
6077                 band = WLC_BAND_5G;
6078                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6079                 if (!err) {
6080                         bw_cap[NL80211_BAND_5GHZ] = band;
6081                         return;
6082                 }
6083                 WARN_ON(1);
6084                 return;
6085         }
6086         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6087         mimo_bwcap = 0;
6088         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6089         if (err)
6090                 /* assume 20MHz if firmware does not give a clue */
6091                 mimo_bwcap = WLC_N_BW_20ALL;
6092
6093         switch (mimo_bwcap) {
6094         case WLC_N_BW_40ALL:
6095                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6096                 /* fall-thru */
6097         case WLC_N_BW_20IN2G_40IN5G:
6098                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6099                 /* fall-thru */
6100         case WLC_N_BW_20ALL:
6101                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6102                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6103                 break;
6104         default:
6105                 brcmf_err("invalid mimo_bw_cap value\n");
6106         }
6107 }
6108
6109 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6110                                 u32 bw_cap[2], u32 nchain)
6111 {
6112         band->ht_cap.ht_supported = true;
6113         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6114                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6115                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6116         }
6117         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6118         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6119         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6120         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6121         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6122         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6123 }
6124
6125 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6126 {
6127         u16 mcs_map;
6128         int i;
6129
6130         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6131                 mcs_map = (mcs_map << 2) | supp;
6132
6133         return cpu_to_le16(mcs_map);
6134 }
6135
6136 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6137                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6138                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6139 {
6140         __le16 mcs_map;
6141
6142         /* not allowed in 2.4G band */
6143         if (band->band == NL80211_BAND_2GHZ)
6144                 return;
6145
6146         band->vht_cap.vht_supported = true;
6147         /* 80MHz is mandatory */
6148         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6149         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6150                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6151                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6152         }
6153         /* all support 256-QAM */
6154         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6155         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6156         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6157
6158         /* Beamforming support information */
6159         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6160                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6161         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6162                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6163         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6164                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6165         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6166                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6167
6168         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6169                 band->vht_cap.cap |=
6170                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6171                 band->vht_cap.cap |= ((txstreams - 1) <<
6172                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6173                 band->vht_cap.cap |=
6174                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6175         }
6176 }
6177
6178 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6179 {
6180         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6181         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6182         u32 nmode = 0;
6183         u32 vhtmode = 0;
6184         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6185         u32 rxchain;
6186         u32 nchain;
6187         int err;
6188         s32 i;
6189         struct ieee80211_supported_band *band;
6190         u32 txstreams = 0;
6191         u32 txbf_bfe_cap = 0;
6192         u32 txbf_bfr_cap = 0;
6193
6194         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6195         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6196         if (err) {
6197                 brcmf_err("nmode error (%d)\n", err);
6198         } else {
6199                 brcmf_get_bwcap(ifp, bw_cap);
6200         }
6201         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6202                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6203                   bw_cap[NL80211_BAND_5GHZ]);
6204
6205         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6206         if (err) {
6207                 brcmf_err("rxchain error (%d)\n", err);
6208                 nchain = 1;
6209         } else {
6210                 for (nchain = 0; rxchain; nchain++)
6211                         rxchain = rxchain & (rxchain - 1);
6212         }
6213         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6214
6215         err = brcmf_construct_chaninfo(cfg, bw_cap);
6216         if (err) {
6217                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6218                 return err;
6219         }
6220
6221         if (vhtmode) {
6222                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6223                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6224                                               &txbf_bfe_cap);
6225                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6226                                               &txbf_bfr_cap);
6227         }
6228
6229         wiphy = cfg_to_wiphy(cfg);
6230         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6231                 band = wiphy->bands[i];
6232                 if (band == NULL)
6233                         continue;
6234
6235                 if (nmode)
6236                         brcmf_update_ht_cap(band, bw_cap, nchain);
6237                 if (vhtmode)
6238                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6239                                              txbf_bfe_cap, txbf_bfr_cap);
6240         }
6241
6242         return 0;
6243 }
6244
6245 static const struct ieee80211_txrx_stypes
6246 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6247         [NL80211_IFTYPE_STATION] = {
6248                 .tx = 0xffff,
6249                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6250                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6251         },
6252         [NL80211_IFTYPE_P2P_CLIENT] = {
6253                 .tx = 0xffff,
6254                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6255                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6256         },
6257         [NL80211_IFTYPE_P2P_GO] = {
6258                 .tx = 0xffff,
6259                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6260                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6261                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6262                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6263                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6264                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6265                       BIT(IEEE80211_STYPE_ACTION >> 4)
6266         },
6267         [NL80211_IFTYPE_P2P_DEVICE] = {
6268                 .tx = 0xffff,
6269                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6270                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6271         }
6272 };
6273
6274 /**
6275  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6276  *
6277  * @wiphy: wiphy object.
6278  * @ifp: interface object needed for feat module api.
6279  *
6280  * The interface modes and combinations are determined dynamically here
6281  * based on firmware functionality.
6282  *
6283  * no p2p and no mbss:
6284  *
6285  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6286  *
6287  * no p2p and mbss:
6288  *
6289  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6290  *      #AP <= 4, matching BI, channels = 1, 4 total
6291  *
6292  * p2p, no mchan, and mbss:
6293  *
6294  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6295  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6296  *      #AP <= 4, matching BI, channels = 1, 4 total
6297  *
6298  * p2p, mchan, and mbss:
6299  *
6300  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6301  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6302  *      #AP <= 4, matching BI, channels = 1, 4 total
6303  */
6304 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6305 {
6306         struct ieee80211_iface_combination *combo = NULL;
6307         struct ieee80211_iface_limit *c0_limits = NULL;
6308         struct ieee80211_iface_limit *p2p_limits = NULL;
6309         struct ieee80211_iface_limit *mbss_limits = NULL;
6310         bool mbss, p2p;
6311         int i, c, n_combos;
6312
6313         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6314         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6315
6316         n_combos = 1 + !!p2p + !!mbss;
6317         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6318         if (!combo)
6319                 goto err;
6320
6321         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6322                                  BIT(NL80211_IFTYPE_ADHOC) |
6323                                  BIT(NL80211_IFTYPE_AP);
6324
6325         c = 0;
6326         i = 0;
6327         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6328         if (!c0_limits)
6329                 goto err;
6330         c0_limits[i].max = 1;
6331         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6332         if (p2p) {
6333                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6334                         combo[c].num_different_channels = 2;
6335                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6336                                           BIT(NL80211_IFTYPE_P2P_GO) |
6337                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6338                 c0_limits[i].max = 1;
6339                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6340                 c0_limits[i].max = 1;
6341                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6342                                        BIT(NL80211_IFTYPE_P2P_GO);
6343         } else {
6344                 c0_limits[i].max = 1;
6345                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6346         }
6347         combo[c].num_different_channels = 1;
6348         combo[c].max_interfaces = i;
6349         combo[c].n_limits = i;
6350         combo[c].limits = c0_limits;
6351
6352         if (p2p) {
6353                 c++;
6354                 i = 0;
6355                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6356                 if (!p2p_limits)
6357                         goto err;
6358                 p2p_limits[i].max = 1;
6359                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6360                 p2p_limits[i].max = 1;
6361                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6362                 p2p_limits[i].max = 1;
6363                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6364                 p2p_limits[i].max = 1;
6365                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6366                 combo[c].num_different_channels = 1;
6367                 combo[c].max_interfaces = i;
6368                 combo[c].n_limits = i;
6369                 combo[c].limits = p2p_limits;
6370         }
6371
6372         if (mbss) {
6373                 c++;
6374                 i = 0;
6375                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6376                 if (!mbss_limits)
6377                         goto err;
6378                 mbss_limits[i].max = 4;
6379                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6380                 combo[c].beacon_int_infra_match = true;
6381                 combo[c].num_different_channels = 1;
6382                 combo[c].max_interfaces = 4;
6383                 combo[c].n_limits = i;
6384                 combo[c].limits = mbss_limits;
6385         }
6386
6387         wiphy->n_iface_combinations = n_combos;
6388         wiphy->iface_combinations = combo;
6389         return 0;
6390
6391 err:
6392         kfree(c0_limits);
6393         kfree(p2p_limits);
6394         kfree(mbss_limits);
6395         kfree(combo);
6396         return -ENOMEM;
6397 }
6398
6399 #ifdef CONFIG_PM
6400 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
6401         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6402         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6403         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6404         .pattern_min_len = 1,
6405         .max_pkt_offset = 1500,
6406 };
6407 #endif
6408
6409 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6410 {
6411 #ifdef CONFIG_PM
6412         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6413         struct wiphy_wowlan_support *wowl;
6414
6415         wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
6416                        GFP_KERNEL);
6417         if (!wowl) {
6418                 brcmf_err("only support basic wowlan features\n");
6419                 wiphy->wowlan = &brcmf_wowlan_support;
6420                 return;
6421         }
6422
6423         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6424                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6425                         wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
6426                         wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6427                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6428                 }
6429         }
6430         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6431                 wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6432                 wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6433         }
6434
6435         wiphy->wowlan = wowl;
6436 #endif
6437 }
6438
6439 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6440 {
6441         struct brcmf_pub *drvr = ifp->drvr;
6442         const struct ieee80211_iface_combination *combo;
6443         struct ieee80211_supported_band *band;
6444         u16 max_interfaces = 0;
6445         bool gscan;
6446         __le32 bandlist[3];
6447         u32 n_bands;
6448         int err, i;
6449
6450         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6451         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6452         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6453
6454         err = brcmf_setup_ifmodes(wiphy, ifp);
6455         if (err)
6456                 return err;
6457
6458         for (i = 0, combo = wiphy->iface_combinations;
6459              i < wiphy->n_iface_combinations; i++, combo++) {
6460                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6461         }
6462
6463         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6464              i++) {
6465                 u8 *addr = drvr->addresses[i].addr;
6466
6467                 memcpy(addr, drvr->mac, ETH_ALEN);
6468                 if (i) {
6469                         addr[0] |= BIT(1);
6470                         addr[ETH_ALEN - 1] ^= i;
6471                 }
6472         }
6473         wiphy->addresses = drvr->addresses;
6474         wiphy->n_addresses = i;
6475
6476         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6477         wiphy->cipher_suites = brcmf_cipher_suites;
6478         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6479         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6480                 wiphy->n_cipher_suites--;
6481         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6482                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6483                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6484
6485         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
6486                         WIPHY_FLAG_PS_ON_BY_DEFAULT |
6487                         WIPHY_FLAG_OFFCHAN_TX |
6488                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6489         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6490                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6491         if (!ifp->drvr->settings->roamoff)
6492                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6493         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6494         wiphy->max_remain_on_channel_duration = 5000;
6495         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6496                 gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
6497                 brcmf_pno_wiphy_params(wiphy, gscan);
6498         }
6499         /* vendor commands/events support */
6500         wiphy->vendor_commands = brcmf_vendor_cmds;
6501         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6502
6503         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6504                 brcmf_wiphy_wowl_params(wiphy, ifp);
6505         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6506                                      sizeof(bandlist));
6507         if (err) {
6508                 brcmf_err("could not obtain band info: err=%d\n", err);
6509                 return err;
6510         }
6511         /* first entry in bandlist is number of bands */
6512         n_bands = le32_to_cpu(bandlist[0]);
6513         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6514                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6515                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6516                                        GFP_KERNEL);
6517                         if (!band)
6518                                 return -ENOMEM;
6519
6520                         band->channels = kmemdup(&__wl_2ghz_channels,
6521                                                  sizeof(__wl_2ghz_channels),
6522                                                  GFP_KERNEL);
6523                         if (!band->channels) {
6524                                 kfree(band);
6525                                 return -ENOMEM;
6526                         }
6527
6528                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6529                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6530                 }
6531                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6532                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6533                                        GFP_KERNEL);
6534                         if (!band)
6535                                 return -ENOMEM;
6536
6537                         band->channels = kmemdup(&__wl_5ghz_channels,
6538                                                  sizeof(__wl_5ghz_channels),
6539                                                  GFP_KERNEL);
6540                         if (!band->channels) {
6541                                 kfree(band);
6542                                 return -ENOMEM;
6543                         }
6544
6545                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6546                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6547                 }
6548         }
6549
6550         wiphy_read_of_freq_limits(wiphy);
6551
6552         return 0;
6553 }
6554
6555 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6556 {
6557         struct net_device *ndev;
6558         struct wireless_dev *wdev;
6559         struct brcmf_if *ifp;
6560         s32 power_mode;
6561         s32 err = 0;
6562
6563         if (cfg->dongle_up)
6564                 return err;
6565
6566         ndev = cfg_to_ndev(cfg);
6567         wdev = ndev->ieee80211_ptr;
6568         ifp = netdev_priv(ndev);
6569
6570         /* make sure RF is ready for work */
6571         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6572
6573         brcmf_dongle_scantime(ifp);
6574
6575         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6576         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6577         if (err)
6578                 goto default_conf_out;
6579         brcmf_dbg(INFO, "power save set to %s\n",
6580                   (power_mode ? "enabled" : "disabled"));
6581
6582         err = brcmf_dongle_roam(ifp);
6583         if (err)
6584                 goto default_conf_out;
6585         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6586                                           NULL);
6587         if (err)
6588                 goto default_conf_out;
6589
6590         brcmf_configure_arp_nd_offload(ifp, true);
6591
6592         cfg->dongle_up = true;
6593 default_conf_out:
6594
6595         return err;
6596
6597 }
6598
6599 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6600 {
6601         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6602
6603         return brcmf_config_dongle(ifp->drvr->config);
6604 }
6605
6606 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6607 {
6608         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6609
6610         /*
6611          * While going down, if associated with AP disassociate
6612          * from AP to save power
6613          */
6614         if (check_vif_up(ifp->vif)) {
6615                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6616
6617                 /* Make sure WPA_Supplicant receives all the event
6618                    generated due to DISASSOC call to the fw to keep
6619                    the state fw and WPA_Supplicant state consistent
6620                  */
6621                 brcmf_delay(500);
6622         }
6623
6624         brcmf_abort_scanning(cfg);
6625         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6626
6627         return 0;
6628 }
6629
6630 s32 brcmf_cfg80211_up(struct net_device *ndev)
6631 {
6632         struct brcmf_if *ifp = netdev_priv(ndev);
6633         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6634         s32 err = 0;
6635
6636         mutex_lock(&cfg->usr_sync);
6637         err = __brcmf_cfg80211_up(ifp);
6638         mutex_unlock(&cfg->usr_sync);
6639
6640         return err;
6641 }
6642
6643 s32 brcmf_cfg80211_down(struct net_device *ndev)
6644 {
6645         struct brcmf_if *ifp = netdev_priv(ndev);
6646         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6647         s32 err = 0;
6648
6649         mutex_lock(&cfg->usr_sync);
6650         err = __brcmf_cfg80211_down(ifp);
6651         mutex_unlock(&cfg->usr_sync);
6652
6653         return err;
6654 }
6655
6656 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6657 {
6658         struct wireless_dev *wdev = &ifp->vif->wdev;
6659
6660         return wdev->iftype;
6661 }
6662
6663 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6664                              unsigned long state)
6665 {
6666         struct brcmf_cfg80211_vif *vif;
6667
6668         list_for_each_entry(vif, &cfg->vif_list, list) {
6669                 if (test_bit(state, &vif->sme_state))
6670                         return true;
6671         }
6672         return false;
6673 }
6674
6675 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6676                                     u8 action)
6677 {
6678         u8 evt_action;
6679
6680         spin_lock(&event->vif_event_lock);
6681         evt_action = event->action;
6682         spin_unlock(&event->vif_event_lock);
6683         return evt_action == action;
6684 }
6685
6686 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6687                                   struct brcmf_cfg80211_vif *vif)
6688 {
6689         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6690
6691         spin_lock(&event->vif_event_lock);
6692         event->vif = vif;
6693         event->action = 0;
6694         spin_unlock(&event->vif_event_lock);
6695 }
6696
6697 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6698 {
6699         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6700         bool armed;
6701
6702         spin_lock(&event->vif_event_lock);
6703         armed = event->vif != NULL;
6704         spin_unlock(&event->vif_event_lock);
6705
6706         return armed;
6707 }
6708
6709 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6710                                   u8 action, ulong timeout)
6711 {
6712         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6713
6714         return wait_event_timeout(event->vif_wq,
6715                                   vif_event_equals(event, action), timeout);
6716 }
6717
6718 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6719                                         struct brcmf_fil_country_le *ccreq)
6720 {
6721         struct brcmfmac_pd_cc *country_codes;
6722         struct brcmfmac_pd_cc_entry *cc;
6723         s32 found_index;
6724         int i;
6725
6726         country_codes = drvr->settings->country_codes;
6727         if (!country_codes) {
6728                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6729                 return -EINVAL;
6730         }
6731
6732         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6733             (alpha2[1] == ccreq->country_abbrev[1])) {
6734                 brcmf_dbg(TRACE, "Country code already set\n");
6735                 return -EAGAIN;
6736         }
6737
6738         found_index = -1;
6739         for (i = 0; i < country_codes->table_size; i++) {
6740                 cc = &country_codes->table[i];
6741                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6742                         found_index = i;
6743                 if ((cc->iso3166[0] == alpha2[0]) &&
6744                     (cc->iso3166[1] == alpha2[1])) {
6745                         found_index = i;
6746                         break;
6747                 }
6748         }
6749         if (found_index == -1) {
6750                 brcmf_dbg(TRACE, "No country code match found\n");
6751                 return -EINVAL;
6752         }
6753         memset(ccreq, 0, sizeof(*ccreq));
6754         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6755         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6756                BRCMF_COUNTRY_BUF_SZ);
6757         ccreq->country_abbrev[0] = alpha2[0];
6758         ccreq->country_abbrev[1] = alpha2[1];
6759         ccreq->country_abbrev[2] = 0;
6760
6761         return 0;
6762 }
6763
6764 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6765                                         struct regulatory_request *req)
6766 {
6767         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6768         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6769         struct brcmf_fil_country_le ccreq;
6770         s32 err;
6771         int i;
6772
6773         /* The country code gets set to "00" by default at boot, ignore */
6774         if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
6775                 return;
6776
6777         /* ignore non-ISO3166 country codes */
6778         for (i = 0; i < sizeof(req->alpha2); i++)
6779                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6780                         brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n",
6781                                   req->alpha2[0], req->alpha2[1]);
6782                         return;
6783                 }
6784
6785         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6786                   req->alpha2[0], req->alpha2[1]);
6787
6788         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6789         if (err) {
6790                 brcmf_err("Country code iovar returned err = %d\n", err);
6791                 return;
6792         }
6793
6794         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6795         if (err)
6796                 return;
6797
6798         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6799         if (err) {
6800                 brcmf_err("Firmware rejected country setting\n");
6801                 return;
6802         }
6803         brcmf_setup_wiphybands(wiphy);
6804 }
6805
6806 static void brcmf_free_wiphy(struct wiphy *wiphy)
6807 {
6808         int i;
6809
6810         if (!wiphy)
6811                 return;
6812
6813         if (wiphy->iface_combinations) {
6814                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6815                         kfree(wiphy->iface_combinations[i].limits);
6816         }
6817         kfree(wiphy->iface_combinations);
6818         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6819                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6820                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6821         }
6822         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6823                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6824                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6825         }
6826 #if IS_ENABLED(CONFIG_PM)
6827         if (wiphy->wowlan != &brcmf_wowlan_support)
6828                 kfree(wiphy->wowlan);
6829 #endif
6830         wiphy_free(wiphy);
6831 }
6832
6833 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6834                                                   struct device *busdev,
6835                                                   bool p2pdev_forced)
6836 {
6837         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6838         struct brcmf_cfg80211_info *cfg;
6839         struct wiphy *wiphy;
6840         struct cfg80211_ops *ops;
6841         struct brcmf_cfg80211_vif *vif;
6842         struct brcmf_if *ifp;
6843         s32 err = 0;
6844         s32 io_type;
6845         u16 *cap = NULL;
6846
6847         if (!ndev) {
6848                 brcmf_err("ndev is invalid\n");
6849                 return NULL;
6850         }
6851
6852         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6853         if (!ops)
6854                 return NULL;
6855
6856         ifp = netdev_priv(ndev);
6857 #ifdef CONFIG_PM
6858         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6859                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6860 #endif
6861         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
6862         if (!wiphy) {
6863                 brcmf_err("Could not allocate wiphy device\n");
6864                 return NULL;
6865         }
6866         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6867         set_wiphy_dev(wiphy, busdev);
6868
6869         cfg = wiphy_priv(wiphy);
6870         cfg->wiphy = wiphy;
6871         cfg->ops = ops;
6872         cfg->pub = drvr;
6873         init_vif_event(&cfg->vif_event);
6874         INIT_LIST_HEAD(&cfg->vif_list);
6875
6876         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
6877         if (IS_ERR(vif))
6878                 goto wiphy_out;
6879
6880         vif->ifp = ifp;
6881         vif->wdev.netdev = ndev;
6882         ndev->ieee80211_ptr = &vif->wdev;
6883         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6884
6885         err = wl_init_priv(cfg);
6886         if (err) {
6887                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6888                 brcmf_free_vif(vif);
6889                 goto wiphy_out;
6890         }
6891         ifp->vif = vif;
6892
6893         /* determine d11 io type before wiphy setup */
6894         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6895         if (err) {
6896                 brcmf_err("Failed to get D11 version (%d)\n", err);
6897                 goto priv_out;
6898         }
6899         cfg->d11inf.io_type = (u8)io_type;
6900         brcmu_d11_attach(&cfg->d11inf);
6901
6902         err = brcmf_setup_wiphy(wiphy, ifp);
6903         if (err < 0)
6904                 goto priv_out;
6905
6906         brcmf_dbg(INFO, "Registering custom regulatory\n");
6907         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6908         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6909         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6910
6911         /* firmware defaults to 40MHz disabled in 2G band. We signal
6912          * cfg80211 here that we do and have it decide we can enable
6913          * it. But first check if device does support 2G operation.
6914          */
6915         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6916                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6917                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6918         }
6919         err = wiphy_register(wiphy);
6920         if (err < 0) {
6921                 brcmf_err("Could not register wiphy device (%d)\n", err);
6922                 goto priv_out;
6923         }
6924
6925         err = brcmf_setup_wiphybands(wiphy);
6926         if (err) {
6927                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
6928                 goto wiphy_unreg_out;
6929         }
6930
6931         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6932          * setup 40MHz in 2GHz band and enable OBSS scanning.
6933          */
6934         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6935                 err = brcmf_enable_bw40_2g(cfg);
6936                 if (!err)
6937                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6938                                                       BRCMF_OBSS_COEX_AUTO);
6939                 else
6940                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6941         }
6942         /* p2p might require that "if-events" get processed by fweh. So
6943          * activate the already registered event handlers now and activate
6944          * the rest when initialization has completed. drvr->config needs to
6945          * be assigned before activating events.
6946          */
6947         drvr->config = cfg;
6948         err = brcmf_fweh_activate_events(ifp);
6949         if (err) {
6950                 brcmf_err("FWEH activation failed (%d)\n", err);
6951                 goto wiphy_unreg_out;
6952         }
6953
6954         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6955         if (err) {
6956                 brcmf_err("P2P initialisation failed (%d)\n", err);
6957                 goto wiphy_unreg_out;
6958         }
6959         err = brcmf_btcoex_attach(cfg);
6960         if (err) {
6961                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6962                 brcmf_p2p_detach(&cfg->p2p);
6963                 goto wiphy_unreg_out;
6964         }
6965         err = brcmf_pno_attach(cfg);
6966         if (err) {
6967                 brcmf_err("PNO initialisation failed (%d)\n", err);
6968                 brcmf_btcoex_detach(cfg);
6969                 brcmf_p2p_detach(&cfg->p2p);
6970                 goto wiphy_unreg_out;
6971         }
6972
6973         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6974                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6975                 if (err) {
6976                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6977                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6978                 } else {
6979                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6980                                             brcmf_notify_tdls_peer_event);
6981                 }
6982         }
6983
6984         /* (re-) activate FWEH event handling */
6985         err = brcmf_fweh_activate_events(ifp);
6986         if (err) {
6987                 brcmf_err("FWEH activation failed (%d)\n", err);
6988                 goto detach;
6989         }
6990
6991         /* Fill in some of the advertised nl80211 supported features */
6992         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
6993                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6994 #ifdef CONFIG_PM
6995                 if (wiphy->wowlan &&
6996                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
6997                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6998 #endif
6999         }
7000
7001         return cfg;
7002
7003 detach:
7004         brcmf_pno_detach(cfg);
7005         brcmf_btcoex_detach(cfg);
7006         brcmf_p2p_detach(&cfg->p2p);
7007 wiphy_unreg_out:
7008         wiphy_unregister(cfg->wiphy);
7009 priv_out:
7010         wl_deinit_priv(cfg);
7011         brcmf_free_vif(vif);
7012         ifp->vif = NULL;
7013 wiphy_out:
7014         brcmf_free_wiphy(wiphy);
7015         kfree(ops);
7016         return NULL;
7017 }
7018
7019 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7020 {
7021         if (!cfg)
7022                 return;
7023
7024         brcmf_pno_detach(cfg);
7025         brcmf_btcoex_detach(cfg);
7026         wiphy_unregister(cfg->wiphy);
7027         kfree(cfg->ops);
7028         wl_deinit_priv(cfg);
7029         brcmf_free_wiphy(cfg->wiphy);
7030 }