drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41 #include "common.h"
  42
  43 #define BRCMF_SCAN_IE_LEN_MAX           2048
  44 #define BRCMF_PNO_VERSION               2
  45 #define BRCMF_PNO_TIME                  30
  46 #define BRCMF_PNO_REPEAT                4
  47 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  48 #define BRCMF_PNO_MAX_PFN_COUNT         16
  49 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  50 #define BRCMF_PNO_HIDDEN_BIT            2
  51 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  52 #define BRCMF_PNO_SCAN_COMPLETE         1
  53 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  54
  55 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  56 #define WPA_OUI_TYPE                    1
  57 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  58 #define WME_OUI_TYPE                    2
  59 #define WPS_OUI_TYPE                    4
  60
  61 #define VS_IE_FIXED_HDR_LEN             6
  62 #define WPA_IE_VERSION_LEN              2
  63 #define WPA_IE_MIN_OUI_LEN              4
  64 #define WPA_IE_SUITE_COUNT_LEN          2
  65
  66 #define WPA_CIPHER_NONE                 0       /* None */
  67 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  68 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  69 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  70 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  71
  72 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  73 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  74 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  75 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  76 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  77 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  78 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  79 #define RSN_CAP_MFPR_MASK               BIT(6)
  80 #define RSN_CAP_MFPC_MASK               BIT(7)
  81 #define RSN_PMKID_COUNT_LEN             2
  82
  83 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  84                                                  * string :"add", "del" (+ NUL)
  85                                                  */
  86 #define VNDR_IE_COUNT_OFFSET            4
  87 #define VNDR_IE_PKTFLAG_OFFSET          8
  88 #define VNDR_IE_VSIE_OFFSET             12
  89 #define VNDR_IE_HDR_SIZE                12
  90 #define VNDR_IE_PARSE_LIMIT             5
  91
  92 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  93 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  94
  95 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  96 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  97 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  98
  99 #define BRCMF_SCAN_CHANNEL_TIME         40
 100 #define BRCMF_SCAN_UNASSOC_TIME         40
 101 #define BRCMF_SCAN_PASSIVE_TIME         120
 102
 103 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
 104
 105 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 106         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 107
 108 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 109 {
 110         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 111                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 112                           vif->sme_state);
 113                 return false;
 114         }
 115         return true;
 116 }
 117
 118 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 119 #define RATETAB_ENT(_rateid, _flags) \
 120         {                                                               \
 121                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 122                 .hw_value       = (_rateid),                            \
 123                 .flags          = (_flags),                             \
 124         }
 125
 126 static struct ieee80211_rate __wl_rates[] = {
 127         RATETAB_ENT(BRCM_RATE_1M, 0),
 128         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(BRCM_RATE_6M, 0),
 132         RATETAB_ENT(BRCM_RATE_9M, 0),
 133         RATETAB_ENT(BRCM_RATE_12M, 0),
 134         RATETAB_ENT(BRCM_RATE_18M, 0),
 135         RATETAB_ENT(BRCM_RATE_24M, 0),
 136         RATETAB_ENT(BRCM_RATE_36M, 0),
 137         RATETAB_ENT(BRCM_RATE_48M, 0),
 138         RATETAB_ENT(BRCM_RATE_54M, 0),
 139 };
 140
 141 #define wl_g_rates              (__wl_rates + 0)
 142 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 143 #define wl_a_rates              (__wl_rates + 4)
 144 #define wl_a_rates_size         (wl_g_rates_size - 4)
 145
 146 #define CHAN2G(_channel, _freq) {                               \
 147         .band                   = NL80211_BAND_2GHZ,            \
 148         .center_freq            = (_freq),                      \
 149         .hw_value               = (_channel),                   \
 150         .flags                  = IEEE80211_CHAN_DISABLED,      \
 151         .max_antenna_gain       = 0,                            \
 152         .max_power              = 30,                           \
 153 }
 154
 155 #define CHAN5G(_channel) {                                      \
 156         .band                   = NL80211_BAND_5GHZ,            \
 157         .center_freq            = 5000 + (5 * (_channel)),      \
 158         .hw_value               = (_channel),                   \
 159         .flags                  = IEEE80211_CHAN_DISABLED,      \
 160         .max_antenna_gain       = 0,                            \
 161         .max_power              = 30,                           \
 162 }
 163
 164 static struct ieee80211_channel __wl_2ghz_channels[] = {
 165         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 166         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 167         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 168         CHAN2G(13, 2472), CHAN2G(14, 2484)
 169 };
 170
 171 static struct ieee80211_channel __wl_5ghz_channels[] = {
 172         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 173         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 174         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 175         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 176         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 177         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 178 };
 179
 180 /* Band templates duplicated per wiphy. The channel info
 181  * above is added to the band during setup.
 182  */
 183 static const struct ieee80211_supported_band __wl_band_2ghz = {
 184         .band = NL80211_BAND_2GHZ,
 185         .bitrates = wl_g_rates,
 186         .n_bitrates = wl_g_rates_size,
 187 };
 188
 189 static const struct ieee80211_supported_band __wl_band_5ghz = {
 190         .band = NL80211_BAND_5GHZ,
 191         .bitrates = wl_a_rates,
 192         .n_bitrates = wl_a_rates_size,
 193 };
 194
 195 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 196  * By default world regulatory domain defined in reg.c puts the flags
 197  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 198  * With respect to these flags, wpa_supplicant doesn't * start p2p
 199  * operations on 5GHz channels. All the changes in world regulatory
 200  * domain are to be done here.
 201  */
 202 static const struct ieee80211_regdomain brcmf_regdom = {
 203         .n_reg_rules = 4,
 204         .alpha2 =  "99",
 205         .reg_rules = {
 206                 /* IEEE 802.11b/g, channels 1..11 */
 207                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 208                 /* If any */
 209                 /* IEEE 802.11 channel 14 - Only JP enables
 210                  * this and for 802.11b only
 211                  */
 212                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 213                 /* IEEE 802.11a, channel 36..64 */
 214                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 215                 /* IEEE 802.11a, channel 100..165 */
 216                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 217 };
 218
 219 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 220  * are supported. A pointer to this array and the number of entries is passed
 221  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 222  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 223  * device does not support MFP then the number of suites will be decreased by 1
 224  */
 225 static const u32 brcmf_cipher_suites[] = {
 226         WLAN_CIPHER_SUITE_WEP40,
 227         WLAN_CIPHER_SUITE_WEP104,
 228         WLAN_CIPHER_SUITE_TKIP,
 229         WLAN_CIPHER_SUITE_CCMP,
 230         /* Keep as last entry: */
 231         WLAN_CIPHER_SUITE_AES_CMAC
 232 };
 233
 234 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 235 struct brcmf_vs_tlv {
 236         u8 id;
 237         u8 len;
 238         u8 oui[3];
 239         u8 oui_type;
 240 };
 241
 242 struct parsed_vndr_ie_info {
 243         u8 *ie_ptr;
 244         u32 ie_len;     /* total length including id & length field */
 245         struct brcmf_vs_tlv vndrie;
 246 };
 247
 248 struct parsed_vndr_ies {
 249         u32 count;
 250         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 251 };
 252
 253 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 254 {
 255         switch (band) {
 256         case NL80211_BAND_2GHZ:
 257                 return WLC_BAND_2G;
 258         case NL80211_BAND_5GHZ:
 259                 return WLC_BAND_5G;
 260         default:
 261                 WARN_ON(1);
 262                 break;
 263         }
 264         return 0;
 265 }
 266
 267 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 268                                struct cfg80211_chan_def *ch)
 269 {
 270         struct brcmu_chan ch_inf;
 271         s32 primary_offset;
 272
 273         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 274                   ch->chan->center_freq, ch->center_freq1, ch->width);
 275         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 276         primary_offset = ch->chan->center_freq - ch->center_freq1;
 277         switch (ch->width) {
 278         case NL80211_CHAN_WIDTH_20:
 279         case NL80211_CHAN_WIDTH_20_NOHT:
 280                 ch_inf.bw = BRCMU_CHAN_BW_20;
 281                 WARN_ON(primary_offset != 0);
 282                 break;
 283         case NL80211_CHAN_WIDTH_40:
 284                 ch_inf.bw = BRCMU_CHAN_BW_40;
 285                 if (primary_offset > 0)
 286                         ch_inf.sb = BRCMU_CHAN_SB_U;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_L;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80:
 291                 ch_inf.bw = BRCMU_CHAN_BW_80;
 292                 if (primary_offset == -30)
 293                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 294                 else if (primary_offset == -10)
 295                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 296                 else if (primary_offset == 10)
 297                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 298                 else
 299                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 300                 break;
 301         case NL80211_CHAN_WIDTH_80P80:
 302         case NL80211_CHAN_WIDTH_160:
 303         case NL80211_CHAN_WIDTH_5:
 304         case NL80211_CHAN_WIDTH_10:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         switch (ch->chan->band) {
 309         case NL80211_BAND_2GHZ:
 310                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 311                 break;
 312         case NL80211_BAND_5GHZ:
 313                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 314                 break;
 315         case NL80211_BAND_60GHZ:
 316         default:
 317                 WARN_ON_ONCE(1);
 318         }
 319         d11inf->encchspec(&ch_inf);
 320
 321         return ch_inf.chspec;
 322 }
 323
 324 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 325                         struct ieee80211_channel *ch)
 326 {
 327         struct brcmu_chan ch_inf;
 328
 329         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 330         ch_inf.bw = BRCMU_CHAN_BW_20;
 331         d11inf->encchspec(&ch_inf);
 332
 333         return ch_inf.chspec;
 334 }
 335
 336 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 337  * triples, returning a pointer to the substring whose first element
 338  * matches tag
 339  */
 340 const struct brcmf_tlv *
 341 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 342 {
 343         const struct brcmf_tlv *elt = buf;
 344         int totlen = buflen;
 345
 346         /* find tagged parameter */
 347         while (totlen >= TLV_HDR_LEN) {
 348                 int len = elt->len;
 349
 350                 /* validate remaining totlen */
 351                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 352                         return elt;
 353
 354                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 355                 totlen -= (len + TLV_HDR_LEN);
 356         }
 357
 358         return NULL;
 359 }
 360
 361 /* Is any of the tlvs the expected entry? If
 362  * not update the tlvs buffer pointer/length.
 363  */
 364 static bool
 365 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 366                  const u8 *oui, u32 oui_len, u8 type)
 367 {
 368         /* If the contents match the OUI and the type */
 369         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 370             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 371             type == ie[TLV_BODY_OFF + oui_len]) {
 372                 return true;
 373         }
 374
 375         if (tlvs == NULL)
 376                 return false;
 377         /* point to the next ie */
 378         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 379         /* calculate the length of the rest of the buffer */
 380         *tlvs_len -= (int)(ie - *tlvs);
 381         /* update the pointer to the start of the buffer */
 382         *tlvs = ie;
 383
 384         return false;
 385 }
 386
 387 static struct brcmf_vs_tlv *
 388 brcmf_find_wpaie(const u8 *parse, u32 len)
 389 {
 390         const struct brcmf_tlv *ie;
 391
 392         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 393                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 394                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 395                         return (struct brcmf_vs_tlv *)ie;
 396         }
 397         return NULL;
 398 }
 399
 400 static struct brcmf_vs_tlv *
 401 brcmf_find_wpsie(const u8 *parse, u32 len)
 402 {
 403         const struct brcmf_tlv *ie;
 404
 405         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 406                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 407                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 408                         return (struct brcmf_vs_tlv *)ie;
 409         }
 410         return NULL;
 411 }
 412
 413 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 414                                      struct brcmf_cfg80211_vif *vif,
 415                                      enum nl80211_iftype new_type)
 416 {
 417         int iftype_num[NUM_NL80211_IFTYPES];
 418         struct brcmf_cfg80211_vif *pos;
 419         bool check_combos = false;
 420         int ret = 0;
 421
 422         memset(&iftype_num[0], 0, sizeof(iftype_num));
 423         list_for_each_entry(pos, &cfg->vif_list, list)
 424                 if (pos == vif) {
 425                         iftype_num[new_type]++;
 426                 } else {
 427                         /* concurrent interfaces so need check combinations */
 428                         check_combos = true;
 429                         iftype_num[pos->wdev.iftype]++;
 430                 }
 431
 432         if (check_combos)
 433                 ret = cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 434
 435         return ret;
 436 }
 437
 438 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 439                                   enum nl80211_iftype new_type)
 440 {
 441         int iftype_num[NUM_NL80211_IFTYPES];
 442         struct brcmf_cfg80211_vif *pos;
 443
 444         memset(&iftype_num[0], 0, sizeof(iftype_num));
 445         list_for_each_entry(pos, &cfg->vif_list, list)
 446                 iftype_num[pos->wdev.iftype]++;
 447
 448         iftype_num[new_type]++;
 449         return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 450 }
 451
 452 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 453                                  struct brcmf_wsec_key_le *key_le)
 454 {
 455         key_le->index = cpu_to_le32(key->index);
 456         key_le->len = cpu_to_le32(key->len);
 457         key_le->algo = cpu_to_le32(key->algo);
 458         key_le->flags = cpu_to_le32(key->flags);
 459         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 460         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 461         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 462         memcpy(key_le->data, key->data, sizeof(key->data));
 463         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 464 }
 465
 466 static int
 467 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 468 {
 469         int err;
 470         struct brcmf_wsec_key_le key_le;
 471
 472         convert_key_from_CPU(key, &key_le);
 473
 474         brcmf_netdev_wait_pend8021x(ifp);
 475
 476         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 477                                         sizeof(key_le));
 478
 479         if (err)
 480                 brcmf_err("wsec_key error (%d)\n", err);
 481         return err;
 482 }
 483
 484 static s32
 485 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 486 {
 487         s32 err;
 488         u32 mode;
 489
 490         if (enable)
 491                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 492         else
 493                 mode = 0;
 494
 495         /* Try to set and enable ARP offload feature, this may fail, then it  */
 496         /* is simply not supported and err 0 will be returned                 */
 497         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 498         if (err) {
 499                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 500                           mode, err);
 501                 err = 0;
 502         } else {
 503                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 504                 if (err) {
 505                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 506                                   enable, err);
 507                         err = 0;
 508                 } else
 509                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 510                                   enable, mode);
 511         }
 512
 513         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 514         if (err) {
 515                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 516                           enable, err);
 517                 err = 0;
 518         } else
 519                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 520                           enable, mode);
 521
 522         return err;
 523 }
 524
 525 static void
 526 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 527 {
 528         struct brcmf_cfg80211_vif *vif;
 529         struct brcmf_if *ifp;
 530
 531         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 532         ifp = vif->ifp;
 533
 534         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 535             (wdev->iftype == NL80211_IFTYPE_AP) ||
 536             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 537                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 538                                                 ADDR_DIRECT);
 539         else
 540                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 541                                                 ADDR_INDIRECT);
 542 }
 543
 544 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 545 {
 546         int bsscfgidx;
 547
 548         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 549                 /* bsscfgidx 1 is reserved for legacy P2P */
 550                 if (bsscfgidx == 1)
 551                         continue;
 552                 if (!drvr->iflist[bsscfgidx])
 553                         return bsscfgidx;
 554         }
 555
 556         return -ENOMEM;
 557 }
 558
 559 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 560 {
 561         struct brcmf_mbss_ssid_le mbss_ssid_le;
 562         int bsscfgidx;
 563         int err;
 564
 565         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 566         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 567         if (bsscfgidx < 0)
 568                 return bsscfgidx;
 569
 570         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 571         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 572         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 573
 574         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 575                                         sizeof(mbss_ssid_le));
 576         if (err < 0)
 577                 brcmf_err("setting ssid failed %d\n", err);
 578
 579         return err;
 580 }
 581
 582 /**
 583  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 584  *
 585  * @wiphy: wiphy device of new interface.
 586  * @name: name of the new interface.
 587  * @flags: not used.
 588  * @params: contains mac address for AP device.
 589  */
 590 static
 591 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 592                                       u32 *flags, struct vif_params *params)
 593 {
 594         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 595         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 596         struct brcmf_cfg80211_vif *vif;
 597         int err;
 598
 599         if (brcmf_cfg80211_vif_event_armed(cfg))
 600                 return ERR_PTR(-EBUSY);
 601
 602         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 603
 604         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP, false);
 605         if (IS_ERR(vif))
 606                 return (struct wireless_dev *)vif;
 607
 608         brcmf_cfg80211_arm_vif_event(cfg, vif);
 609
 610         err = brcmf_cfg80211_request_ap_if(ifp);
 611         if (err) {
 612                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 613                 goto fail;
 614         }
 615
 616         /* wait for firmware event */
 617         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 618                                             BRCMF_VIF_EVENT_TIMEOUT);
 619         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 620         if (!err) {
 621                 brcmf_err("timeout occurred\n");
 622                 err = -EIO;
 623                 goto fail;
 624         }
 625
 626         /* interface created in firmware */
 627         ifp = vif->ifp;
 628         if (!ifp) {
 629                 brcmf_err("no if pointer provided\n");
 630                 err = -ENOENT;
 631                 goto fail;
 632         }
 633
 634         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 635         err = brcmf_net_attach(ifp, true);
 636         if (err) {
 637                 brcmf_err("Registering netdevice failed\n");
 638                 goto fail;
 639         }
 640
 641         return &ifp->vif->wdev;
 642
 643 fail:
 644         brcmf_free_vif(vif);
 645         return ERR_PTR(err);
 646 }
 647
 648 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 649 {
 650         enum nl80211_iftype iftype;
 651
 652         iftype = vif->wdev.iftype;
 653         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 654 }
 655
 656 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 657 {
 658         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 659 }
 660
 661 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 662                                                      const char *name,
 663                                                      unsigned char name_assign_type,
 664                                                      enum nl80211_iftype type,
 665                                                      u32 *flags,
 666                                                      struct vif_params *params)
 667 {
 668         struct wireless_dev *wdev;
 669         int err;
 670
 671         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 672         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 673         if (err) {
 674                 brcmf_err("iface validation failed: err=%d\n", err);
 675                 return ERR_PTR(err);
 676         }
 677         switch (type) {
 678         case NL80211_IFTYPE_ADHOC:
 679         case NL80211_IFTYPE_STATION:
 680         case NL80211_IFTYPE_AP_VLAN:
 681         case NL80211_IFTYPE_WDS:
 682         case NL80211_IFTYPE_MONITOR:
 683         case NL80211_IFTYPE_MESH_POINT:
 684                 return ERR_PTR(-EOPNOTSUPP);
 685         case NL80211_IFTYPE_AP:
 686                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 687                 if (!IS_ERR(wdev))
 688                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 689                 return wdev;
 690         case NL80211_IFTYPE_P2P_CLIENT:
 691         case NL80211_IFTYPE_P2P_GO:
 692         case NL80211_IFTYPE_P2P_DEVICE:
 693                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, flags, params);
 694                 if (!IS_ERR(wdev))
 695                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 696                 return wdev;
 697         case NL80211_IFTYPE_UNSPECIFIED:
 698         default:
 699                 return ERR_PTR(-EINVAL);
 700         }
 701 }
 702
 703 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 704 {
 705         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 706                 brcmf_set_mpc(ifp, mpc);
 707 }
 708
 709 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 710 {
 711         s32 err = 0;
 712
 713         if (check_vif_up(ifp->vif)) {
 714                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 715                 if (err) {
 716                         brcmf_err("fail to set mpc\n");
 717                         return;
 718                 }
 719                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 720         }
 721 }
 722
 723 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 724                                 struct brcmf_if *ifp, bool aborted,
 725                                 bool fw_abort)
 726 {
 727         struct brcmf_scan_params_le params_le;
 728         struct cfg80211_scan_request *scan_request;
 729         s32 err = 0;
 730
 731         brcmf_dbg(SCAN, "Enter\n");
 732
 733         /* clear scan request, because the FW abort can cause a second call */
 734         /* to this functon and might cause a double cfg80211_scan_done      */
 735         scan_request = cfg->scan_request;
 736         cfg->scan_request = NULL;
 737
 738         if (timer_pending(&cfg->escan_timeout))
 739                 del_timer_sync(&cfg->escan_timeout);
 740
 741         if (fw_abort) {
 742                 /* Do a scan abort to stop the driver's scan engine */
 743                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 744                 memset(&params_le, 0, sizeof(params_le));
 745                 eth_broadcast_addr(params_le.bssid);
 746                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 747                 params_le.scan_type = 0;
 748                 params_le.channel_num = cpu_to_le32(1);
 749                 params_le.nprobes = cpu_to_le32(1);
 750                 params_le.active_time = cpu_to_le32(-1);
 751                 params_le.passive_time = cpu_to_le32(-1);
 752                 params_le.home_time = cpu_to_le32(-1);
 753                 /* Scan is aborted by setting channel_list[0] to -1 */
 754                 params_le.channel_list[0] = cpu_to_le16(-1);
 755                 /* E-Scan (or anyother type) can be aborted by SCAN */
 756                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 757                                              &params_le, sizeof(params_le));
 758                 if (err)
 759                         brcmf_err("Scan abort  failed\n");
 760         }
 761
 762         brcmf_scan_config_mpc(ifp, 1);
 763
 764         /*
 765          * e-scan can be initiated by scheduled scan
 766          * which takes precedence.
 767          */
 768         if (cfg->sched_escan) {
 769                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 770                 cfg->sched_escan = false;
 771                 if (!aborted)
 772                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 773         } else if (scan_request) {
 774                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 775                           aborted ? "Aborted" : "Done");
 776                 cfg80211_scan_done(scan_request, aborted);
 777         }
 778         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 779                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 780
 781         return err;
 782 }
 783
 784 static
 785 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 786 {
 787         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 788         struct net_device *ndev = wdev->netdev;
 789
 790         /* vif event pending in firmware */
 791         if (brcmf_cfg80211_vif_event_armed(cfg))
 792                 return -EBUSY;
 793
 794         if (ndev) {
 795                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 796                     cfg->escan_info.ifp == netdev_priv(ndev))
 797                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 798                                                     true, true);
 799
 800                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 801         }
 802
 803         switch (wdev->iftype) {
 804         case NL80211_IFTYPE_ADHOC:
 805         case NL80211_IFTYPE_STATION:
 806         case NL80211_IFTYPE_AP:
 807         case NL80211_IFTYPE_AP_VLAN:
 808         case NL80211_IFTYPE_WDS:
 809         case NL80211_IFTYPE_MONITOR:
 810         case NL80211_IFTYPE_MESH_POINT:
 811                 return -EOPNOTSUPP;
 812         case NL80211_IFTYPE_P2P_CLIENT:
 813         case NL80211_IFTYPE_P2P_GO:
 814         case NL80211_IFTYPE_P2P_DEVICE:
 815                 return brcmf_p2p_del_vif(wiphy, wdev);
 816         case NL80211_IFTYPE_UNSPECIFIED:
 817         default:
 818                 return -EINVAL;
 819         }
 820         return -EOPNOTSUPP;
 821 }
 822
 823 static s32
 824 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 825                          enum nl80211_iftype type, u32 *flags,
 826                          struct vif_params *params)
 827 {
 828         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 829         struct brcmf_if *ifp = netdev_priv(ndev);
 830         struct brcmf_cfg80211_vif *vif = ifp->vif;
 831         s32 infra = 0;
 832         s32 ap = 0;
 833         s32 err = 0;
 834
 835         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 836                   type);
 837
 838         /* WAR: There are a number of p2p interface related problems which
 839          * need to be handled initially (before doing the validate).
 840          * wpa_supplicant tends to do iface changes on p2p device/client/go
 841          * which are not always possible/allowed. However we need to return
 842          * OK otherwise the wpa_supplicant wont start. The situation differs
 843          * on configuration and setup (p2pon=1 module param). The first check
 844          * is to see if the request is a change to station for p2p iface.
 845          */
 846         if ((type == NL80211_IFTYPE_STATION) &&
 847             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 848              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 849              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 850                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 851                 /* Now depending on whether module param p2pon=1 was used the
 852                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 853                  * that if p2pon=1 is used, but a newer supplicant is used then
 854                  * we should return an error, as this combination wont work.
 855                  * In other situations 0 is returned and supplicant will start
 856                  * normally. It will give a trace in cfg80211, but it is the
 857                  * only way to get it working. Unfortunately this will result
 858                  * in situation where we wont support new supplicant in
 859                  * combination with module param p2pon=1, but that is the way
 860                  * it is. If the user tries this then unloading of driver might
 861                  * fail/lock.
 862                  */
 863                 if (cfg->p2p.p2pdev_dynamically)
 864                         return -EOPNOTSUPP;
 865                 else
 866                         return 0;
 867         }
 868         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 869         if (err) {
 870                 brcmf_err("iface validation failed: err=%d\n", err);
 871                 return err;
 872         }
 873         switch (type) {
 874         case NL80211_IFTYPE_MONITOR:
 875         case NL80211_IFTYPE_WDS:
 876                 brcmf_err("type (%d) : currently we do not support this type\n",
 877                           type);
 878                 return -EOPNOTSUPP;
 879         case NL80211_IFTYPE_ADHOC:
 880                 infra = 0;
 881                 break;
 882         case NL80211_IFTYPE_STATION:
 883                 infra = 1;
 884                 break;
 885         case NL80211_IFTYPE_AP:
 886         case NL80211_IFTYPE_P2P_GO:
 887                 ap = 1;
 888                 break;
 889         default:
 890                 err = -EINVAL;
 891                 goto done;
 892         }
 893
 894         if (ap) {
 895                 if (type == NL80211_IFTYPE_P2P_GO) {
 896                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 897                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 898                 }
 899                 if (!err) {
 900                         brcmf_dbg(INFO, "IF Type = AP\n");
 901                 }
 902         } else {
 903                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 904                 if (err) {
 905                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 906                         err = -EAGAIN;
 907                         goto done;
 908                 }
 909                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 910                           "Adhoc" : "Infra");
 911         }
 912         ndev->ieee80211_ptr->iftype = type;
 913
 914         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 915
 916 done:
 917         brcmf_dbg(TRACE, "Exit\n");
 918
 919         return err;
 920 }
 921
 922 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 923                              struct brcmf_scan_params_le *params_le,
 924                              struct cfg80211_scan_request *request)
 925 {
 926         u32 n_ssids;
 927         u32 n_channels;
 928         s32 i;
 929         s32 offset;
 930         u16 chanspec;
 931         char *ptr;
 932         struct brcmf_ssid_le ssid_le;
 933
 934         eth_broadcast_addr(params_le->bssid);
 935         params_le->bss_type = DOT11_BSSTYPE_ANY;
 936         params_le->scan_type = 0;
 937         params_le->channel_num = 0;
 938         params_le->nprobes = cpu_to_le32(-1);
 939         params_le->active_time = cpu_to_le32(-1);
 940         params_le->passive_time = cpu_to_le32(-1);
 941         params_le->home_time = cpu_to_le32(-1);
 942         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 943
 944         /* if request is null exit so it will be all channel broadcast scan */
 945         if (!request)
 946                 return;
 947
 948         n_ssids = request->n_ssids;
 949         n_channels = request->n_channels;
 950         /* Copy channel array if applicable */
 951         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 952                   n_channels);
 953         if (n_channels > 0) {
 954                 for (i = 0; i < n_channels; i++) {
 955                         chanspec = channel_to_chanspec(&cfg->d11inf,
 956                                                        request->channels[i]);
 957                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 958                                   request->channels[i]->hw_value, chanspec);
 959                         params_le->channel_list[i] = cpu_to_le16(chanspec);
 960                 }
 961         } else {
 962                 brcmf_dbg(SCAN, "Scanning all channels\n");
 963         }
 964         /* Copy ssid array if applicable */
 965         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
 966         if (n_ssids > 0) {
 967                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
 968                                 n_channels * sizeof(u16);
 969                 offset = roundup(offset, sizeof(u32));
 970                 ptr = (char *)params_le + offset;
 971                 for (i = 0; i < n_ssids; i++) {
 972                         memset(&ssid_le, 0, sizeof(ssid_le));
 973                         ssid_le.SSID_len =
 974                                         cpu_to_le32(request->ssids[i].ssid_len);
 975                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
 976                                request->ssids[i].ssid_len);
 977                         if (!ssid_le.SSID_len)
 978                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
 979                         else
 980                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
 981                                           i, ssid_le.SSID, ssid_le.SSID_len);
 982                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
 983                         ptr += sizeof(ssid_le);
 984                 }
 985         } else {
 986                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
 987                 if ((request->ssids) && request->ssids->ssid_len) {
 988                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
 989                                   params_le->ssid_le.SSID,
 990                                   request->ssids->ssid_len);
 991                         params_le->ssid_le.SSID_len =
 992                                 cpu_to_le32(request->ssids->ssid_len);
 993                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
 994                                 request->ssids->ssid_len);
 995                 }
 996         }
 997         /* Adding mask to channel numbers */
 998         params_le->channel_num =
 999                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1000                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1001 }
1002
1003 static s32
1004 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1005                 struct cfg80211_scan_request *request)
1006 {
1007         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1008                           offsetof(struct brcmf_escan_params_le, params_le);
1009         struct brcmf_escan_params_le *params;
1010         s32 err = 0;
1011
1012         brcmf_dbg(SCAN, "E-SCAN START\n");
1013
1014         if (request != NULL) {
1015                 /* Allocate space for populating ssids in struct */
1016                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1017
1018                 /* Allocate space for populating ssids in struct */
1019                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1020         }
1021
1022         params = kzalloc(params_size, GFP_KERNEL);
1023         if (!params) {
1024                 err = -ENOMEM;
1025                 goto exit;
1026         }
1027         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1028         brcmf_escan_prep(cfg, &params->params_le, request);
1029         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1030         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1031         params->sync_id = cpu_to_le16(0x1234);
1032
1033         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1034         if (err) {
1035                 if (err == -EBUSY)
1036                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1037                 else
1038                         brcmf_err("error (%d)\n", err);
1039         }
1040
1041         kfree(params);
1042 exit:
1043         return err;
1044 }
1045
1046 static s32
1047 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
1048                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1049 {
1050         s32 err;
1051         u32 passive_scan;
1052         struct brcmf_scan_results *results;
1053         struct escan_info *escan = &cfg->escan_info;
1054
1055         brcmf_dbg(SCAN, "Enter\n");
1056         escan->ifp = ifp;
1057         escan->wiphy = wiphy;
1058         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1059         passive_scan = cfg->active_scan ? 0 : 1;
1060         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1061                                     passive_scan);
1062         if (err) {
1063                 brcmf_err("error (%d)\n", err);
1064                 return err;
1065         }
1066         brcmf_scan_config_mpc(ifp, 0);
1067         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1068         results->version = 0;
1069         results->count = 0;
1070         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1071
1072         err = escan->run(cfg, ifp, request);
1073         if (err)
1074                 brcmf_scan_config_mpc(ifp, 1);
1075         return err;
1076 }
1077
1078 static s32
1079 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1080                      struct cfg80211_scan_request *request,
1081                      struct cfg80211_ssid *this_ssid)
1082 {
1083         struct brcmf_if *ifp = vif->ifp;
1084         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1085         struct cfg80211_ssid *ssids;
1086         u32 passive_scan;
1087         bool escan_req;
1088         bool spec_scan;
1089         s32 err;
1090         struct brcmf_ssid_le ssid_le;
1091         u32 SSID_len;
1092
1093         brcmf_dbg(SCAN, "START ESCAN\n");
1094
1095         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1096                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1097                 return -EAGAIN;
1098         }
1099         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1100                 brcmf_err("Scanning being aborted: status (%lu)\n",
1101                           cfg->scan_status);
1102                 return -EAGAIN;
1103         }
1104         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1105                 brcmf_err("Scanning suppressed: status (%lu)\n",
1106                           cfg->scan_status);
1107                 return -EAGAIN;
1108         }
1109         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1110                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1111                 return -EAGAIN;
1112         }
1113
1114         /* If scan req comes for p2p0, send it over primary I/F */
1115         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1116                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1117
1118         escan_req = false;
1119         if (request) {
1120                 /* scan bss */
1121                 ssids = request->ssids;
1122                 escan_req = true;
1123         } else {
1124                 /* scan in ibss */
1125                 /* we don't do escan in ibss */
1126                 ssids = this_ssid;
1127         }
1128
1129         cfg->scan_request = request;
1130         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1131         if (escan_req) {
1132                 cfg->escan_info.run = brcmf_run_escan;
1133                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1134                 if (err)
1135                         goto scan_out;
1136
1137                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1138                 if (err)
1139                         goto scan_out;
1140         } else {
1141                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1142                           ssids->ssid, ssids->ssid_len);
1143                 memset(&ssid_le, 0, sizeof(ssid_le));
1144                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1145                 ssid_le.SSID_len = cpu_to_le32(0);
1146                 spec_scan = false;
1147                 if (SSID_len) {
1148                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1149                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1150                         spec_scan = true;
1151                 } else
1152                         brcmf_dbg(SCAN, "Broadcast scan\n");
1153
1154                 passive_scan = cfg->active_scan ? 0 : 1;
1155                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1156                                             passive_scan);
1157                 if (err) {
1158                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1159                         goto scan_out;
1160                 }
1161                 brcmf_scan_config_mpc(ifp, 0);
1162                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1163                                              sizeof(ssid_le));
1164                 if (err) {
1165                         if (err == -EBUSY)
1166                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1167                                           ssid_le.SSID);
1168                         else
1169                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1170
1171                         brcmf_scan_config_mpc(ifp, 1);
1172                         goto scan_out;
1173                 }
1174         }
1175
1176         /* Arm scan timeout timer */
1177         mod_timer(&cfg->escan_timeout, jiffies +
1178                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1179
1180         return 0;
1181
1182 scan_out:
1183         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1184         cfg->scan_request = NULL;
1185         return err;
1186 }
1187
1188 static s32
1189 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1190 {
1191         struct brcmf_cfg80211_vif *vif;
1192         s32 err = 0;
1193
1194         brcmf_dbg(TRACE, "Enter\n");
1195         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1196         if (!check_vif_up(vif))
1197                 return -EIO;
1198
1199         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1200
1201         if (err)
1202                 brcmf_err("scan error (%d)\n", err);
1203
1204         brcmf_dbg(TRACE, "Exit\n");
1205         return err;
1206 }
1207
1208 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1209 {
1210         s32 err = 0;
1211
1212         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1213                                       rts_threshold);
1214         if (err)
1215                 brcmf_err("Error (%d)\n", err);
1216
1217         return err;
1218 }
1219
1220 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1221 {
1222         s32 err = 0;
1223
1224         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1225                                       frag_threshold);
1226         if (err)
1227                 brcmf_err("Error (%d)\n", err);
1228
1229         return err;
1230 }
1231
1232 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1233 {
1234         s32 err = 0;
1235         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1236
1237         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1238         if (err) {
1239                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1240                 return err;
1241         }
1242         return err;
1243 }
1244
1245 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1246 {
1247         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1248         struct net_device *ndev = cfg_to_ndev(cfg);
1249         struct brcmf_if *ifp = netdev_priv(ndev);
1250         s32 err = 0;
1251
1252         brcmf_dbg(TRACE, "Enter\n");
1253         if (!check_vif_up(ifp->vif))
1254                 return -EIO;
1255
1256         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1257             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1258                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1259                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1260                 if (!err)
1261                         goto done;
1262         }
1263         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1264             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1265                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1266                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1267                 if (!err)
1268                         goto done;
1269         }
1270         if (changed & WIPHY_PARAM_RETRY_LONG
1271             && (cfg->conf->retry_long != wiphy->retry_long)) {
1272                 cfg->conf->retry_long = wiphy->retry_long;
1273                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1274                 if (!err)
1275                         goto done;
1276         }
1277         if (changed & WIPHY_PARAM_RETRY_SHORT
1278             && (cfg->conf->retry_short != wiphy->retry_short)) {
1279                 cfg->conf->retry_short = wiphy->retry_short;
1280                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1281                 if (!err)
1282                         goto done;
1283         }
1284
1285 done:
1286         brcmf_dbg(TRACE, "Exit\n");
1287         return err;
1288 }
1289
1290 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1291 {
1292         memset(prof, 0, sizeof(*prof));
1293 }
1294
1295 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1296 {
1297         u16 reason;
1298
1299         switch (e->event_code) {
1300         case BRCMF_E_DEAUTH:
1301         case BRCMF_E_DEAUTH_IND:
1302         case BRCMF_E_DISASSOC_IND:
1303                 reason = e->reason;
1304                 break;
1305         case BRCMF_E_LINK:
1306         default:
1307                 reason = 0;
1308                 break;
1309         }
1310         return reason;
1311 }
1312
1313 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1314 {
1315         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1316         s32 err = 0;
1317
1318         brcmf_dbg(TRACE, "Enter\n");
1319
1320         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1321                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1322                 err = brcmf_fil_cmd_data_set(vif->ifp,
1323                                              BRCMF_C_DISASSOC, NULL, 0);
1324                 if (err) {
1325                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1326                 }
1327                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1328                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1329                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1330                                               true, GFP_KERNEL);
1331         }
1332         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1333         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1334         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1335         brcmf_dbg(TRACE, "Exit\n");
1336 }
1337
1338 static s32
1339 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1340                       struct cfg80211_ibss_params *params)
1341 {
1342         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1343         struct brcmf_if *ifp = netdev_priv(ndev);
1344         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1345         struct brcmf_join_params join_params;
1346         size_t join_params_size = 0;
1347         s32 err = 0;
1348         s32 wsec = 0;
1349         s32 bcnprd;
1350         u16 chanspec;
1351         u32 ssid_len;
1352
1353         brcmf_dbg(TRACE, "Enter\n");
1354         if (!check_vif_up(ifp->vif))
1355                 return -EIO;
1356
1357         if (params->ssid)
1358                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1359         else {
1360                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1361                 return -EOPNOTSUPP;
1362         }
1363
1364         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1365
1366         if (params->bssid)
1367                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1368         else
1369                 brcmf_dbg(CONN, "No BSSID specified\n");
1370
1371         if (params->chandef.chan)
1372                 brcmf_dbg(CONN, "channel: %d\n",
1373                           params->chandef.chan->center_freq);
1374         else
1375                 brcmf_dbg(CONN, "no channel specified\n");
1376
1377         if (params->channel_fixed)
1378                 brcmf_dbg(CONN, "fixed channel required\n");
1379         else
1380                 brcmf_dbg(CONN, "no fixed channel required\n");
1381
1382         if (params->ie && params->ie_len)
1383                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1384         else
1385                 brcmf_dbg(CONN, "no ie specified\n");
1386
1387         if (params->beacon_interval)
1388                 brcmf_dbg(CONN, "beacon interval: %d\n",
1389                           params->beacon_interval);
1390         else
1391                 brcmf_dbg(CONN, "no beacon interval specified\n");
1392
1393         if (params->basic_rates)
1394                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1395         else
1396                 brcmf_dbg(CONN, "no basic rates specified\n");
1397
1398         if (params->privacy)
1399                 brcmf_dbg(CONN, "privacy required\n");
1400         else
1401                 brcmf_dbg(CONN, "no privacy required\n");
1402
1403         /* Configure Privacy for starter */
1404         if (params->privacy)
1405                 wsec |= WEP_ENABLED;
1406
1407         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1408         if (err) {
1409                 brcmf_err("wsec failed (%d)\n", err);
1410                 goto done;
1411         }
1412
1413         /* Configure Beacon Interval for starter */
1414         if (params->beacon_interval)
1415                 bcnprd = params->beacon_interval;
1416         else
1417                 bcnprd = 100;
1418
1419         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1420         if (err) {
1421                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1422                 goto done;
1423         }
1424
1425         /* Configure required join parameter */
1426         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1427
1428         /* SSID */
1429         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1430         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1431         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1432         join_params_size = sizeof(join_params.ssid_le);
1433
1434         /* BSSID */
1435         if (params->bssid) {
1436                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1437                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1438                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1439         } else {
1440                 eth_broadcast_addr(join_params.params_le.bssid);
1441                 eth_zero_addr(profile->bssid);
1442         }
1443
1444         /* Channel */
1445         if (params->chandef.chan) {
1446                 u32 target_channel;
1447
1448                 cfg->channel =
1449                         ieee80211_frequency_to_channel(
1450                                 params->chandef.chan->center_freq);
1451                 if (params->channel_fixed) {
1452                         /* adding chanspec */
1453                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1454                                                        &params->chandef);
1455                         join_params.params_le.chanspec_list[0] =
1456                                 cpu_to_le16(chanspec);
1457                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1458                         join_params_size += sizeof(join_params.params_le);
1459                 }
1460
1461                 /* set channel for starter */
1462                 target_channel = cfg->channel;
1463                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1464                                             target_channel);
1465                 if (err) {
1466                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1467                         goto done;
1468                 }
1469         } else
1470                 cfg->channel = 0;
1471
1472         cfg->ibss_starter = false;
1473
1474
1475         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1476                                      &join_params, join_params_size);
1477         if (err) {
1478                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1479                 goto done;
1480         }
1481
1482 done:
1483         if (err)
1484                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1485         brcmf_dbg(TRACE, "Exit\n");
1486         return err;
1487 }
1488
1489 static s32
1490 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1491 {
1492         struct brcmf_if *ifp = netdev_priv(ndev);
1493
1494         brcmf_dbg(TRACE, "Enter\n");
1495         if (!check_vif_up(ifp->vif)) {
1496                 /* When driver is being unloaded, it can end up here. If an
1497                  * error is returned then later on a debug trace in the wireless
1498                  * core module will be printed. To avoid this 0 is returned.
1499                  */
1500                 return 0;
1501         }
1502
1503         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1504         brcmf_net_setcarrier(ifp, false);
1505
1506         brcmf_dbg(TRACE, "Exit\n");
1507
1508         return 0;
1509 }
1510
1511 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1512                                  struct cfg80211_connect_params *sme)
1513 {
1514         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1515         struct brcmf_cfg80211_security *sec;
1516         s32 val = 0;
1517         s32 err = 0;
1518
1519         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1520                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1521         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1522                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1523         else
1524                 val = WPA_AUTH_DISABLED;
1525         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1526         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1527         if (err) {
1528                 brcmf_err("set wpa_auth failed (%d)\n", err);
1529                 return err;
1530         }
1531         sec = &profile->sec;
1532         sec->wpa_versions = sme->crypto.wpa_versions;
1533         return err;
1534 }
1535
1536 static s32 brcmf_set_auth_type(struct net_device *ndev,
1537                                struct cfg80211_connect_params *sme)
1538 {
1539         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1540         struct brcmf_cfg80211_security *sec;
1541         s32 val = 0;
1542         s32 err = 0;
1543
1544         switch (sme->auth_type) {
1545         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1546                 val = 0;
1547                 brcmf_dbg(CONN, "open system\n");
1548                 break;
1549         case NL80211_AUTHTYPE_SHARED_KEY:
1550                 val = 1;
1551                 brcmf_dbg(CONN, "shared key\n");
1552                 break;
1553         case NL80211_AUTHTYPE_AUTOMATIC:
1554                 val = 2;
1555                 brcmf_dbg(CONN, "automatic\n");
1556                 break;
1557         case NL80211_AUTHTYPE_NETWORK_EAP:
1558                 brcmf_dbg(CONN, "network eap\n");
1559         default:
1560                 val = 2;
1561                 brcmf_err("invalid auth type (%d)\n", sme->auth_type);
1562                 break;
1563         }
1564
1565         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1566         if (err) {
1567                 brcmf_err("set auth failed (%d)\n", err);
1568                 return err;
1569         }
1570         sec = &profile->sec;
1571         sec->auth_type = sme->auth_type;
1572         return err;
1573 }
1574
1575 static s32
1576 brcmf_set_wsec_mode(struct net_device *ndev,
1577                     struct cfg80211_connect_params *sme)
1578 {
1579         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1580         struct brcmf_cfg80211_security *sec;
1581         s32 pval = 0;
1582         s32 gval = 0;
1583         s32 wsec;
1584         s32 err = 0;
1585
1586         if (sme->crypto.n_ciphers_pairwise) {
1587                 switch (sme->crypto.ciphers_pairwise[0]) {
1588                 case WLAN_CIPHER_SUITE_WEP40:
1589                 case WLAN_CIPHER_SUITE_WEP104:
1590                         pval = WEP_ENABLED;
1591                         break;
1592                 case WLAN_CIPHER_SUITE_TKIP:
1593                         pval = TKIP_ENABLED;
1594                         break;
1595                 case WLAN_CIPHER_SUITE_CCMP:
1596                         pval = AES_ENABLED;
1597                         break;
1598                 case WLAN_CIPHER_SUITE_AES_CMAC:
1599                         pval = AES_ENABLED;
1600                         break;
1601                 default:
1602                         brcmf_err("invalid cipher pairwise (%d)\n",
1603                                   sme->crypto.ciphers_pairwise[0]);
1604                         return -EINVAL;
1605                 }
1606         }
1607         if (sme->crypto.cipher_group) {
1608                 switch (sme->crypto.cipher_group) {
1609                 case WLAN_CIPHER_SUITE_WEP40:
1610                 case WLAN_CIPHER_SUITE_WEP104:
1611                         gval = WEP_ENABLED;
1612                         break;
1613                 case WLAN_CIPHER_SUITE_TKIP:
1614                         gval = TKIP_ENABLED;
1615                         break;
1616                 case WLAN_CIPHER_SUITE_CCMP:
1617                         gval = AES_ENABLED;
1618                         break;
1619                 case WLAN_CIPHER_SUITE_AES_CMAC:
1620                         gval = AES_ENABLED;
1621                         break;
1622                 default:
1623                         brcmf_err("invalid cipher group (%d)\n",
1624                                   sme->crypto.cipher_group);
1625                         return -EINVAL;
1626                 }
1627         }
1628
1629         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1630         /* In case of privacy, but no security and WPS then simulate */
1631         /* setting AES. WPS-2.0 allows no security                   */
1632         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1633             sme->privacy)
1634                 pval = AES_ENABLED;
1635
1636         wsec = pval | gval;
1637         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1638         if (err) {
1639                 brcmf_err("error (%d)\n", err);
1640                 return err;
1641         }
1642
1643         sec = &profile->sec;
1644         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1645         sec->cipher_group = sme->crypto.cipher_group;
1646
1647         return err;
1648 }
1649
1650 static s32
1651 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1652 {
1653         struct brcmf_if *ifp = netdev_priv(ndev);
1654         s32 val;
1655         s32 err;
1656         const struct brcmf_tlv *rsn_ie;
1657         const u8 *ie;
1658         u32 ie_len;
1659         u32 offset;
1660         u16 rsn_cap;
1661         u32 mfp;
1662         u16 count;
1663
1664         if (!sme->crypto.n_akm_suites)
1665                 return 0;
1666
1667         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1668         if (err) {
1669                 brcmf_err("could not get wpa_auth (%d)\n", err);
1670                 return err;
1671         }
1672         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1673                 switch (sme->crypto.akm_suites[0]) {
1674                 case WLAN_AKM_SUITE_8021X:
1675                         val = WPA_AUTH_UNSPECIFIED;
1676                         break;
1677                 case WLAN_AKM_SUITE_PSK:
1678                         val = WPA_AUTH_PSK;
1679                         break;
1680                 default:
1681                         brcmf_err("invalid cipher group (%d)\n",
1682                                   sme->crypto.cipher_group);
1683                         return -EINVAL;
1684                 }
1685         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1686                 switch (sme->crypto.akm_suites[0]) {
1687                 case WLAN_AKM_SUITE_8021X:
1688                         val = WPA2_AUTH_UNSPECIFIED;
1689                         break;
1690                 case WLAN_AKM_SUITE_8021X_SHA256:
1691                         val = WPA2_AUTH_1X_SHA256;
1692                         break;
1693                 case WLAN_AKM_SUITE_PSK_SHA256:
1694                         val = WPA2_AUTH_PSK_SHA256;
1695                         break;
1696                 case WLAN_AKM_SUITE_PSK:
1697                         val = WPA2_AUTH_PSK;
1698                         break;
1699                 default:
1700                         brcmf_err("invalid cipher group (%d)\n",
1701                                   sme->crypto.cipher_group);
1702                         return -EINVAL;
1703                 }
1704         }
1705
1706         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1707                 goto skip_mfp_config;
1708         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1709          * IE will not be verified, just a quick search for MFP config
1710          */
1711         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1712                                   WLAN_EID_RSN);
1713         if (!rsn_ie)
1714                 goto skip_mfp_config;
1715         ie = (const u8 *)rsn_ie;
1716         ie_len = rsn_ie->len + TLV_HDR_LEN;
1717         /* Skip unicast suite */
1718         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1719         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1720                 goto skip_mfp_config;
1721         /* Skip multicast suite */
1722         count = ie[offset] + (ie[offset + 1] << 8);
1723         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1724         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1725                 goto skip_mfp_config;
1726         /* Skip auth key management suite(s) */
1727         count = ie[offset] + (ie[offset + 1] << 8);
1728         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1729         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1730                 goto skip_mfp_config;
1731         /* Ready to read capabilities */
1732         mfp = BRCMF_MFP_NONE;
1733         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1734         if (rsn_cap & RSN_CAP_MFPR_MASK)
1735                 mfp = BRCMF_MFP_REQUIRED;
1736         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1737                 mfp = BRCMF_MFP_CAPABLE;
1738         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1739
1740 skip_mfp_config:
1741         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1742         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1743         if (err) {
1744                 brcmf_err("could not set wpa_auth (%d)\n", err);
1745                 return err;
1746         }
1747
1748         return err;
1749 }
1750
1751 static s32
1752 brcmf_set_sharedkey(struct net_device *ndev,
1753                     struct cfg80211_connect_params *sme)
1754 {
1755         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1756         struct brcmf_cfg80211_security *sec;
1757         struct brcmf_wsec_key key;
1758         s32 val;
1759         s32 err = 0;
1760
1761         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1762
1763         if (sme->key_len == 0)
1764                 return 0;
1765
1766         sec = &profile->sec;
1767         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1768                   sec->wpa_versions, sec->cipher_pairwise);
1769
1770         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1771                 return 0;
1772
1773         if (!(sec->cipher_pairwise &
1774             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1775                 return 0;
1776
1777         memset(&key, 0, sizeof(key));
1778         key.len = (u32) sme->key_len;
1779         key.index = (u32) sme->key_idx;
1780         if (key.len > sizeof(key.data)) {
1781                 brcmf_err("Too long key length (%u)\n", key.len);
1782                 return -EINVAL;
1783         }
1784         memcpy(key.data, sme->key, key.len);
1785         key.flags = BRCMF_PRIMARY_KEY;
1786         switch (sec->cipher_pairwise) {
1787         case WLAN_CIPHER_SUITE_WEP40:
1788                 key.algo = CRYPTO_ALGO_WEP1;
1789                 break;
1790         case WLAN_CIPHER_SUITE_WEP104:
1791                 key.algo = CRYPTO_ALGO_WEP128;
1792                 break;
1793         default:
1794                 brcmf_err("Invalid algorithm (%d)\n",
1795                           sme->crypto.ciphers_pairwise[0]);
1796                 return -EINVAL;
1797         }
1798         /* Set the new key/index */
1799         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1800                   key.len, key.index, key.algo);
1801         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1802         err = send_key_to_dongle(netdev_priv(ndev), &key);
1803         if (err)
1804                 return err;
1805
1806         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1807                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1808                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1809                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1810                 if (err)
1811                         brcmf_err("set auth failed (%d)\n", err);
1812         }
1813         return err;
1814 }
1815
1816 static
1817 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1818                                            enum nl80211_auth_type type)
1819 {
1820         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1821             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1822                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1823                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1824         }
1825         return type;
1826 }
1827
1828 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1829                                 struct cfg80211_bss_selection *bss_select)
1830 {
1831         struct brcmf_join_pref_params join_pref_params[2];
1832         enum nl80211_band band;
1833         int err, i = 0;
1834
1835         join_pref_params[i].len = 2;
1836         join_pref_params[i].rssi_gain = 0;
1837
1838         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1839                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1840
1841         switch (bss_select->behaviour) {
1842         case __NL80211_BSS_SELECT_ATTR_INVALID:
1843                 brcmf_c_set_joinpref_default(ifp);
1844                 return;
1845         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1846                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1847                 band = bss_select->param.band_pref;
1848                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1849                 i++;
1850                 break;
1851         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1852                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1853                 band = bss_select->param.adjust.band;
1854                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1855                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1856                 i++;
1857                 break;
1858         case NL80211_BSS_SELECT_ATTR_RSSI:
1859         default:
1860                 break;
1861         }
1862         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1863         join_pref_params[i].len = 2;
1864         join_pref_params[i].rssi_gain = 0;
1865         join_pref_params[i].band = 0;
1866         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1867                                        sizeof(join_pref_params));
1868         if (err)
1869                 brcmf_err("Set join_pref error (%d)\n", err);
1870 }
1871
1872 static s32
1873 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1874                        struct cfg80211_connect_params *sme)
1875 {
1876         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1877         struct brcmf_if *ifp = netdev_priv(ndev);
1878         struct ieee80211_channel *chan = sme->channel;
1879         struct brcmf_join_params join_params;
1880         size_t join_params_size;
1881         const struct brcmf_tlv *rsn_ie;
1882         const struct brcmf_vs_tlv *wpa_ie;
1883         const void *ie;
1884         u32 ie_len;
1885         struct brcmf_ext_join_params_le *ext_join_params;
1886         u16 chanspec;
1887         s32 err = 0;
1888         u32 ssid_len;
1889
1890         brcmf_dbg(TRACE, "Enter\n");
1891         if (!check_vif_up(ifp->vif))
1892                 return -EIO;
1893
1894         if (!sme->ssid) {
1895                 brcmf_err("Invalid ssid\n");
1896                 return -EOPNOTSUPP;
1897         }
1898
1899         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1900                 /* A normal (non P2P) connection request setup. */
1901                 ie = NULL;
1902                 ie_len = 0;
1903                 /* find the WPA_IE */
1904                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1905                 if (wpa_ie) {
1906                         ie = wpa_ie;
1907                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1908                 } else {
1909                         /* find the RSN_IE */
1910                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1911                                                   sme->ie_len,
1912                                                   WLAN_EID_RSN);
1913                         if (rsn_ie) {
1914                                 ie = rsn_ie;
1915                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1916                         }
1917                 }
1918                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1919         }
1920
1921         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1922                                     sme->ie, sme->ie_len);
1923         if (err)
1924                 brcmf_err("Set Assoc REQ IE Failed\n");
1925         else
1926                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1927
1928         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1929
1930         if (chan) {
1931                 cfg->channel =
1932                         ieee80211_frequency_to_channel(chan->center_freq);
1933                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1934                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1935                           cfg->channel, chan->center_freq, chanspec);
1936         } else {
1937                 cfg->channel = 0;
1938                 chanspec = 0;
1939         }
1940
1941         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1942
1943         err = brcmf_set_wpa_version(ndev, sme);
1944         if (err) {
1945                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1946                 goto done;
1947         }
1948
1949         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1950         err = brcmf_set_auth_type(ndev, sme);
1951         if (err) {
1952                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1953                 goto done;
1954         }
1955
1956         err = brcmf_set_wsec_mode(ndev, sme);
1957         if (err) {
1958                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1959                 goto done;
1960         }
1961
1962         err = brcmf_set_key_mgmt(ndev, sme);
1963         if (err) {
1964                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1965                 goto done;
1966         }
1967
1968         err = brcmf_set_sharedkey(ndev, sme);
1969         if (err) {
1970                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1971                 goto done;
1972         }
1973
1974         /* Join with specific BSSID and cached SSID
1975          * If SSID is zero join based on BSSID only
1976          */
1977         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
1978                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
1979         if (cfg->channel)
1980                 join_params_size += sizeof(u16);
1981         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
1982         if (ext_join_params == NULL) {
1983                 err = -ENOMEM;
1984                 goto done;
1985         }
1986         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
1987         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
1988         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
1989         if (ssid_len < IEEE80211_MAX_SSID_LEN)
1990                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
1991                           ext_join_params->ssid_le.SSID, ssid_len);
1992
1993         /* Set up join scan parameters */
1994         ext_join_params->scan_le.scan_type = -1;
1995         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
1996
1997         if (sme->bssid)
1998                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
1999         else
2000                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2001
2002         if (cfg->channel) {
2003                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2004
2005                 ext_join_params->assoc_le.chanspec_list[0] =
2006                         cpu_to_le16(chanspec);
2007                 /* Increase dwell time to receive probe response or detect
2008                  * beacon from target AP at a noisy air only during connect
2009                  * command.
2010                  */
2011                 ext_join_params->scan_le.active_time =
2012                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2013                 ext_join_params->scan_le.passive_time =
2014                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2015                 /* To sync with presence period of VSDB GO send probe request
2016                  * more frequently. Probe request will be stopped when it gets
2017                  * probe response from target AP/GO.
2018                  */
2019                 ext_join_params->scan_le.nprobes =
2020                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2021                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2022         } else {
2023                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2024                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2025                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2026         }
2027
2028         brcmf_set_join_pref(ifp, &sme->bss_select);
2029
2030         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2031                                          join_params_size);
2032         kfree(ext_join_params);
2033         if (!err)
2034                 /* This is it. join command worked, we are done */
2035                 goto done;
2036
2037         /* join command failed, fallback to set ssid */
2038         memset(&join_params, 0, sizeof(join_params));
2039         join_params_size = sizeof(join_params.ssid_le);
2040
2041         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2042         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2043
2044         if (sme->bssid)
2045                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2046         else
2047                 eth_broadcast_addr(join_params.params_le.bssid);
2048
2049         if (cfg->channel) {
2050                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2051                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2052                 join_params_size += sizeof(join_params.params_le);
2053         }
2054         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2055                                      &join_params, join_params_size);
2056         if (err)
2057                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2058
2059 done:
2060         if (err)
2061                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2062         brcmf_dbg(TRACE, "Exit\n");
2063         return err;
2064 }
2065
2066 static s32
2067 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2068                        u16 reason_code)
2069 {
2070         struct brcmf_if *ifp = netdev_priv(ndev);
2071         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2072         struct brcmf_scb_val_le scbval;
2073         s32 err = 0;
2074
2075         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2076         if (!check_vif_up(ifp->vif))
2077                 return -EIO;
2078
2079         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2080         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2081         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2082
2083         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2084         scbval.val = cpu_to_le32(reason_code);
2085         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2086                                      &scbval, sizeof(scbval));
2087         if (err)
2088                 brcmf_err("error (%d)\n", err);
2089
2090         brcmf_dbg(TRACE, "Exit\n");
2091         return err;
2092 }
2093
2094 static s32
2095 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2096                             enum nl80211_tx_power_setting type, s32 mbm)
2097 {
2098         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2099         struct net_device *ndev = cfg_to_ndev(cfg);
2100         struct brcmf_if *ifp = netdev_priv(ndev);
2101         s32 err;
2102         s32 disable;
2103         u32 qdbm = 127;
2104
2105         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2106         if (!check_vif_up(ifp->vif))
2107                 return -EIO;
2108
2109         switch (type) {
2110         case NL80211_TX_POWER_AUTOMATIC:
2111                 break;
2112         case NL80211_TX_POWER_LIMITED:
2113         case NL80211_TX_POWER_FIXED:
2114                 if (mbm < 0) {
2115                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2116                         err = -EINVAL;
2117                         goto done;
2118                 }
2119                 qdbm =  MBM_TO_DBM(4 * mbm);
2120                 if (qdbm > 127)
2121                         qdbm = 127;
2122                 qdbm |= WL_TXPWR_OVERRIDE;
2123                 break;
2124         default:
2125                 brcmf_err("Unsupported type %d\n", type);
2126                 err = -EINVAL;
2127                 goto done;
2128         }
2129         /* Make sure radio is off or on as far as software is concerned */
2130         disable = WL_RADIO_SW_DISABLE << 16;
2131         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2132         if (err)
2133                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2134
2135         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2136         if (err)
2137                 brcmf_err("qtxpower error (%d)\n", err);
2138
2139 done:
2140         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2141         return err;
2142 }
2143
2144 static s32
2145 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2146                             s32 *dbm)
2147 {
2148         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2149         struct net_device *ndev = cfg_to_ndev(cfg);
2150         struct brcmf_if *ifp = netdev_priv(ndev);
2151         s32 qdbm = 0;
2152         s32 err;
2153
2154         brcmf_dbg(TRACE, "Enter\n");
2155         if (!check_vif_up(ifp->vif))
2156                 return -EIO;
2157
2158         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2159         if (err) {
2160                 brcmf_err("error (%d)\n", err);
2161                 goto done;
2162         }
2163         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2164
2165 done:
2166         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2167         return err;
2168 }
2169
2170 static s32
2171 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2172                                   u8 key_idx, bool unicast, bool multicast)
2173 {
2174         struct brcmf_if *ifp = netdev_priv(ndev);
2175         u32 index;
2176         u32 wsec;
2177         s32 err = 0;
2178
2179         brcmf_dbg(TRACE, "Enter\n");
2180         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2181         if (!check_vif_up(ifp->vif))
2182                 return -EIO;
2183
2184         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2185         if (err) {
2186                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2187                 goto done;
2188         }
2189
2190         if (wsec & WEP_ENABLED) {
2191                 /* Just select a new current key */
2192                 index = key_idx;
2193                 err = brcmf_fil_cmd_int_set(ifp,
2194                                             BRCMF_C_SET_KEY_PRIMARY, index);
2195                 if (err)
2196                         brcmf_err("error (%d)\n", err);
2197         }
2198 done:
2199         brcmf_dbg(TRACE, "Exit\n");
2200         return err;
2201 }
2202
2203 static s32
2204 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2205                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2206 {
2207         struct brcmf_if *ifp = netdev_priv(ndev);
2208         struct brcmf_wsec_key *key;
2209         s32 err;
2210
2211         brcmf_dbg(TRACE, "Enter\n");
2212         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2213
2214         if (!check_vif_up(ifp->vif))
2215                 return -EIO;
2216
2217         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2218                 /* we ignore this key index in this case */
2219                 return -EINVAL;
2220         }
2221
2222         key = &ifp->vif->profile.key[key_idx];
2223
2224         if (key->algo == CRYPTO_ALGO_OFF) {
2225                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2226                 return -EINVAL;
2227         }
2228
2229         memset(key, 0, sizeof(*key));
2230         key->index = (u32)key_idx;
2231         key->flags = BRCMF_PRIMARY_KEY;
2232
2233         /* Clear the key/index */
2234         err = send_key_to_dongle(ifp, key);
2235
2236         brcmf_dbg(TRACE, "Exit\n");
2237         return err;
2238 }
2239
2240 static s32
2241 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2242                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2243                        struct key_params *params)
2244 {
2245         struct brcmf_if *ifp = netdev_priv(ndev);
2246         struct brcmf_wsec_key *key;
2247         s32 val;
2248         s32 wsec;
2249         s32 err;
2250         u8 keybuf[8];
2251         bool ext_key;
2252
2253         brcmf_dbg(TRACE, "Enter\n");
2254         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2255         if (!check_vif_up(ifp->vif))
2256                 return -EIO;
2257
2258         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2259                 /* we ignore this key index in this case */
2260                 brcmf_err("invalid key index (%d)\n", key_idx);
2261                 return -EINVAL;
2262         }
2263
2264         if (params->key_len == 0)
2265                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2266                                               mac_addr);
2267
2268         if (params->key_len > sizeof(key->data)) {
2269                 brcmf_err("Too long key length (%u)\n", params->key_len);
2270                 return -EINVAL;
2271         }
2272
2273         ext_key = false;
2274         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2275             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2276                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2277                 ext_key = true;
2278         }
2279
2280         key = &ifp->vif->profile.key[key_idx];
2281         memset(key, 0, sizeof(*key));
2282         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2283                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2284         key->len = params->key_len;
2285         key->index = key_idx;
2286         memcpy(key->data, params->key, key->len);
2287         if (!ext_key)
2288                 key->flags = BRCMF_PRIMARY_KEY;
2289
2290         switch (params->cipher) {
2291         case WLAN_CIPHER_SUITE_WEP40:
2292                 key->algo = CRYPTO_ALGO_WEP1;
2293                 val = WEP_ENABLED;
2294                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2295                 break;
2296         case WLAN_CIPHER_SUITE_WEP104:
2297                 key->algo = CRYPTO_ALGO_WEP128;
2298                 val = WEP_ENABLED;
2299                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2300                 break;
2301         case WLAN_CIPHER_SUITE_TKIP:
2302                 if (!brcmf_is_apmode(ifp->vif)) {
2303                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2304                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2305                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2306                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2307                 }
2308                 key->algo = CRYPTO_ALGO_TKIP;
2309                 val = TKIP_ENABLED;
2310                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2311                 break;
2312         case WLAN_CIPHER_SUITE_AES_CMAC:
2313                 key->algo = CRYPTO_ALGO_AES_CCM;
2314                 val = AES_ENABLED;
2315                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2316                 break;
2317         case WLAN_CIPHER_SUITE_CCMP:
2318                 key->algo = CRYPTO_ALGO_AES_CCM;
2319                 val = AES_ENABLED;
2320                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2321                 break;
2322         default:
2323                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2324                 err = -EINVAL;
2325                 goto done;
2326         }
2327
2328         err = send_key_to_dongle(ifp, key);
2329         if (ext_key || err)
2330                 goto done;
2331
2332         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2333         if (err) {
2334                 brcmf_err("get wsec error (%d)\n", err);
2335                 goto done;
2336         }
2337         wsec |= val;
2338         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2339         if (err) {
2340                 brcmf_err("set wsec error (%d)\n", err);
2341                 goto done;
2342         }
2343
2344 done:
2345         brcmf_dbg(TRACE, "Exit\n");
2346         return err;
2347 }
2348
2349 static s32
2350 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2351                        bool pairwise, const u8 *mac_addr, void *cookie,
2352                        void (*callback)(void *cookie,
2353                                         struct key_params *params))
2354 {
2355         struct key_params params;
2356         struct brcmf_if *ifp = netdev_priv(ndev);
2357         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2358         struct brcmf_cfg80211_security *sec;
2359         s32 wsec;
2360         s32 err = 0;
2361
2362         brcmf_dbg(TRACE, "Enter\n");
2363         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2364         if (!check_vif_up(ifp->vif))
2365                 return -EIO;
2366
2367         memset(&params, 0, sizeof(params));
2368
2369         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2370         if (err) {
2371                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2372                 /* Ignore this error, may happen during DISASSOC */
2373                 err = -EAGAIN;
2374                 goto done;
2375         }
2376         if (wsec & WEP_ENABLED) {
2377                 sec = &profile->sec;
2378                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2379                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2380                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2381                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2382                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2383                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2384                 }
2385         } else if (wsec & TKIP_ENABLED) {
2386                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2387                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2388         } else if (wsec & AES_ENABLED) {
2389                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2390                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2391         } else  {
2392                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2393                 err = -EINVAL;
2394                 goto done;
2395         }
2396         callback(cookie, &params);
2397
2398 done:
2399         brcmf_dbg(TRACE, "Exit\n");
2400         return err;
2401 }
2402
2403 static s32
2404 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2405                                        struct net_device *ndev, u8 key_idx)
2406 {
2407         struct brcmf_if *ifp = netdev_priv(ndev);
2408
2409         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2410
2411         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2412                 return 0;
2413
2414         brcmf_dbg(INFO, "Not supported\n");
2415
2416         return -EOPNOTSUPP;
2417 }
2418
2419 static void
2420 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2421 {
2422         s32 err;
2423         u8 key_idx;
2424         struct brcmf_wsec_key *key;
2425         s32 wsec;
2426
2427         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2428                 key = &ifp->vif->profile.key[key_idx];
2429                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2430                     (key->algo == CRYPTO_ALGO_WEP128))
2431                         break;
2432         }
2433         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2434                 return;
2435
2436         err = send_key_to_dongle(ifp, key);
2437         if (err) {
2438                 brcmf_err("Setting WEP key failed (%d)\n", err);
2439                 return;
2440         }
2441         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2442         if (err) {
2443                 brcmf_err("get wsec error (%d)\n", err);
2444                 return;
2445         }
2446         wsec |= WEP_ENABLED;
2447         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2448         if (err)
2449                 brcmf_err("set wsec error (%d)\n", err);
2450 }
2451
2452 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2453 {
2454         struct nl80211_sta_flag_update *sfu;
2455
2456         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2457         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2458         sfu = &si->sta_flags;
2459         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2460                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2461                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2462                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2463         if (fw_sta_flags & BRCMF_STA_WME)
2464                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2465         if (fw_sta_flags & BRCMF_STA_AUTHE)
2466                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2467         if (fw_sta_flags & BRCMF_STA_ASSOC)
2468                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2469         if (fw_sta_flags & BRCMF_STA_AUTHO)
2470                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2471 }
2472
2473 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2474 {
2475         struct {
2476                 __le32 len;
2477                 struct brcmf_bss_info_le bss_le;
2478         } *buf;
2479         u16 capability;
2480         int err;
2481
2482         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2483         if (!buf)
2484                 return;
2485
2486         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2487         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2488                                      WL_BSS_INFO_MAX);
2489         if (err) {
2490                 brcmf_err("Failed to get bss info (%d)\n", err);
2491                 return;
2492         }
2493         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2494         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2495         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2496         capability = le16_to_cpu(buf->bss_le.capability);
2497         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2498                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2499         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2500                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2501         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2502                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2503 }
2504
2505 static s32
2506 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2507                                 struct station_info *sinfo)
2508 {
2509         struct brcmf_scb_val_le scbval;
2510         struct brcmf_pktcnt_le pktcnt;
2511         s32 err;
2512         u32 rate;
2513         u32 rssi;
2514
2515         /* Get the current tx rate */
2516         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2517         if (err < 0) {
2518                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2519                 return err;
2520         }
2521         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2522         sinfo->txrate.legacy = rate * 5;
2523
2524         memset(&scbval, 0, sizeof(scbval));
2525         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2526                                      sizeof(scbval));
2527         if (err) {
2528                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2529                 return err;
2530         }
2531         rssi = le32_to_cpu(scbval.val);
2532         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2533         sinfo->signal = rssi;
2534
2535         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2536                                      sizeof(pktcnt));
2537         if (err) {
2538                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2539                 return err;
2540         }
2541         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2542                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2543                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2544                          BIT(NL80211_STA_INFO_TX_FAILED);
2545         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2546         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2547         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2548         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2549
2550         return 0;
2551 }
2552
2553 static s32
2554 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2555                            const u8 *mac, struct station_info *sinfo)
2556 {
2557         struct brcmf_if *ifp = netdev_priv(ndev);
2558         s32 err = 0;
2559         struct brcmf_sta_info_le sta_info_le;
2560         u32 sta_flags;
2561         u32 is_tdls_peer;
2562         s32 total_rssi;
2563         s32 count_rssi;
2564         u32 i;
2565
2566         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2567         if (!check_vif_up(ifp->vif))
2568                 return -EIO;
2569
2570         if (brcmf_is_ibssmode(ifp->vif))
2571                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2572
2573         memset(&sta_info_le, 0, sizeof(sta_info_le));
2574         memcpy(&sta_info_le, mac, ETH_ALEN);
2575         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2576                                        &sta_info_le,
2577                                        sizeof(sta_info_le));
2578         is_tdls_peer = !err;
2579         if (err) {
2580                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2581                                                &sta_info_le,
2582                                                sizeof(sta_info_le));
2583                 if (err < 0) {
2584                         brcmf_err("GET STA INFO failed, %d\n", err);
2585                         goto done;
2586                 }
2587         }
2588         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2589         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2590         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2591         sta_flags = le32_to_cpu(sta_info_le.flags);
2592         brcmf_convert_sta_flags(sta_flags, sinfo);
2593         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2594         if (is_tdls_peer)
2595                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2596         else
2597                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2598         if (sta_flags & BRCMF_STA_ASSOC) {
2599                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2600                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2601                 brcmf_fill_bss_param(ifp, sinfo);
2602         }
2603         if (sta_flags & BRCMF_STA_SCBSTATS) {
2604                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2605                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2606                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2607                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2608                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2609                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2610                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2611                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2612                 if (sinfo->tx_packets) {
2613                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2614                         sinfo->txrate.legacy =
2615                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2616                 }
2617                 if (sinfo->rx_packets) {
2618                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2619                         sinfo->rxrate.legacy =
2620                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2621                 }
2622                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2623                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2624                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2625                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2626                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2627                 }
2628                 total_rssi = 0;
2629                 count_rssi = 0;
2630                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2631                         if (sta_info_le.rssi[i]) {
2632                                 sinfo->chain_signal_avg[count_rssi] =
2633                                         sta_info_le.rssi[i];
2634                                 sinfo->chain_signal[count_rssi] =
2635                                         sta_info_le.rssi[i];
2636                                 total_rssi += sta_info_le.rssi[i];
2637                                 count_rssi++;
2638                         }
2639                 }
2640                 if (count_rssi) {
2641                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2642                         sinfo->chains = count_rssi;
2643
2644                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2645                         total_rssi /= count_rssi;
2646                         sinfo->signal = total_rssi;
2647                 }
2648         }
2649 done:
2650         brcmf_dbg(TRACE, "Exit\n");
2651         return err;
2652 }
2653
2654 static int
2655 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2656                             int idx, u8 *mac, struct station_info *sinfo)
2657 {
2658         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2659         struct brcmf_if *ifp = netdev_priv(ndev);
2660         s32 err;
2661
2662         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2663
2664         if (idx == 0) {
2665                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2666                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2667                                              &cfg->assoclist,
2668                                              sizeof(cfg->assoclist));
2669                 if (err) {
2670                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2671                                   err);
2672                         cfg->assoclist.count = 0;
2673                         return -EOPNOTSUPP;
2674                 }
2675         }
2676         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2677                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2678                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2679         }
2680         return -ENOENT;
2681 }
2682
2683 static s32
2684 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2685                            bool enabled, s32 timeout)
2686 {
2687         s32 pm;
2688         s32 err = 0;
2689         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2690         struct brcmf_if *ifp = netdev_priv(ndev);
2691
2692         brcmf_dbg(TRACE, "Enter\n");
2693
2694         /*
2695          * Powersave enable/disable request is coming from the
2696          * cfg80211 even before the interface is up. In that
2697          * scenario, driver will be storing the power save
2698          * preference in cfg struct to apply this to
2699          * FW later while initializing the dongle
2700          */
2701         cfg->pwr_save = enabled;
2702         if (!check_vif_up(ifp->vif)) {
2703
2704                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2705                 goto done;
2706         }
2707
2708         pm = enabled ? PM_FAST : PM_OFF;
2709         /* Do not enable the power save after assoc if it is a p2p interface */
2710         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2711                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2712                 pm = PM_OFF;
2713         }
2714         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2715
2716         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2717         if (err) {
2718                 if (err == -ENODEV)
2719                         brcmf_err("net_device is not ready yet\n");
2720                 else
2721                         brcmf_err("error (%d)\n", err);
2722         }
2723 done:
2724         brcmf_dbg(TRACE, "Exit\n");
2725         return err;
2726 }
2727
2728 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2729                                    struct brcmf_bss_info_le *bi)
2730 {
2731         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2732         struct ieee80211_channel *notify_channel;
2733         struct cfg80211_bss *bss;
2734         struct ieee80211_supported_band *band;
2735         struct brcmu_chan ch;
2736         u16 channel;
2737         u32 freq;
2738         u16 notify_capability;
2739         u16 notify_interval;
2740         u8 *notify_ie;
2741         size_t notify_ielen;
2742         s32 notify_signal;
2743
2744         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2745                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2746                 return 0;
2747         }
2748
2749         if (!bi->ctl_ch) {
2750                 ch.chspec = le16_to_cpu(bi->chanspec);
2751                 cfg->d11inf.decchspec(&ch);
2752                 bi->ctl_ch = ch.control_ch_num;
2753         }
2754         channel = bi->ctl_ch;
2755
2756         if (channel <= CH_MAX_2G_CHANNEL)
2757                 band = wiphy->bands[NL80211_BAND_2GHZ];
2758         else
2759                 band = wiphy->bands[NL80211_BAND_5GHZ];
2760
2761         freq = ieee80211_channel_to_frequency(channel, band->band);
2762         notify_channel = ieee80211_get_channel(wiphy, freq);
2763
2764         notify_capability = le16_to_cpu(bi->capability);
2765         notify_interval = le16_to_cpu(bi->beacon_period);
2766         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2767         notify_ielen = le32_to_cpu(bi->ie_length);
2768         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2769
2770         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2771         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2772         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2773         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2774         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2775
2776         bss = cfg80211_inform_bss(wiphy, notify_channel,
2777                                   CFG80211_BSS_FTYPE_UNKNOWN,
2778                                   (const u8 *)bi->BSSID,
2779                                   0, notify_capability,
2780                                   notify_interval, notify_ie,
2781                                   notify_ielen, notify_signal,
2782                                   GFP_KERNEL);
2783
2784         if (!bss)
2785                 return -ENOMEM;
2786
2787         cfg80211_put_bss(wiphy, bss);
2788
2789         return 0;
2790 }
2791
2792 static struct brcmf_bss_info_le *
2793 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2794 {
2795         if (bss == NULL)
2796                 return list->bss_info_le;
2797         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2798                                             le32_to_cpu(bss->length));
2799 }
2800
2801 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2802 {
2803         struct brcmf_scan_results *bss_list;
2804         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2805         s32 err = 0;
2806         int i;
2807
2808         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2809         if (bss_list->count != 0 &&
2810             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2811                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2812                           bss_list->version);
2813                 return -EOPNOTSUPP;
2814         }
2815         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2816         for (i = 0; i < bss_list->count; i++) {
2817                 bi = next_bss_le(bss_list, bi);
2818                 err = brcmf_inform_single_bss(cfg, bi);
2819                 if (err)
2820                         break;
2821         }
2822         return err;
2823 }
2824
2825 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2826                              struct net_device *ndev, const u8 *bssid)
2827 {
2828         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2829         struct ieee80211_channel *notify_channel;
2830         struct brcmf_bss_info_le *bi = NULL;
2831         struct ieee80211_supported_band *band;
2832         struct cfg80211_bss *bss;
2833         struct brcmu_chan ch;
2834         u8 *buf = NULL;
2835         s32 err = 0;
2836         u32 freq;
2837         u16 notify_capability;
2838         u16 notify_interval;
2839         u8 *notify_ie;
2840         size_t notify_ielen;
2841         s32 notify_signal;
2842
2843         brcmf_dbg(TRACE, "Enter\n");
2844
2845         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2846         if (buf == NULL) {
2847                 err = -ENOMEM;
2848                 goto CleanUp;
2849         }
2850
2851         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2852
2853         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2854                                      buf, WL_BSS_INFO_MAX);
2855         if (err) {
2856                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2857                 goto CleanUp;
2858         }
2859
2860         bi = (struct brcmf_bss_info_le *)(buf + 4);
2861
2862         ch.chspec = le16_to_cpu(bi->chanspec);
2863         cfg->d11inf.decchspec(&ch);
2864
2865         if (ch.band == BRCMU_CHAN_BAND_2G)
2866                 band = wiphy->bands[NL80211_BAND_2GHZ];
2867         else
2868                 band = wiphy->bands[NL80211_BAND_5GHZ];
2869
2870         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2871         cfg->channel = freq;
2872         notify_channel = ieee80211_get_channel(wiphy, freq);
2873
2874         notify_capability = le16_to_cpu(bi->capability);
2875         notify_interval = le16_to_cpu(bi->beacon_period);
2876         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2877         notify_ielen = le32_to_cpu(bi->ie_length);
2878         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2879
2880         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2881         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2882         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2883         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2884
2885         bss = cfg80211_inform_bss(wiphy, notify_channel,
2886                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2887                                   notify_capability, notify_interval,
2888                                   notify_ie, notify_ielen, notify_signal,
2889                                   GFP_KERNEL);
2890
2891         if (!bss) {
2892                 err = -ENOMEM;
2893                 goto CleanUp;
2894         }
2895
2896         cfg80211_put_bss(wiphy, bss);
2897
2898 CleanUp:
2899
2900         kfree(buf);
2901
2902         brcmf_dbg(TRACE, "Exit\n");
2903
2904         return err;
2905 }
2906
2907 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2908                                  struct brcmf_if *ifp)
2909 {
2910         struct brcmf_bss_info_le *bi;
2911         const struct brcmf_tlv *tim;
2912         u16 beacon_interval;
2913         u8 dtim_period;
2914         size_t ie_len;
2915         u8 *ie;
2916         s32 err = 0;
2917
2918         brcmf_dbg(TRACE, "Enter\n");
2919         if (brcmf_is_ibssmode(ifp->vif))
2920                 return err;
2921
2922         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2923         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2924                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2925         if (err) {
2926                 brcmf_err("Could not get bss info %d\n", err);
2927                 goto update_bss_info_out;
2928         }
2929
2930         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2931         err = brcmf_inform_single_bss(cfg, bi);
2932         if (err)
2933                 goto update_bss_info_out;
2934
2935         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2936         ie_len = le32_to_cpu(bi->ie_length);
2937         beacon_interval = le16_to_cpu(bi->beacon_period);
2938
2939         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2940         if (tim)
2941                 dtim_period = tim->data[1];
2942         else {
2943                 /*
2944                 * active scan was done so we could not get dtim
2945                 * information out of probe response.
2946                 * so we speficially query dtim information to dongle.
2947                 */
2948                 u32 var;
2949                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2950                 if (err) {
2951                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2952                         goto update_bss_info_out;
2953                 }
2954                 dtim_period = (u8)var;
2955         }
2956
2957 update_bss_info_out:
2958         brcmf_dbg(TRACE, "Exit");
2959         return err;
2960 }
2961
2962 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
2963 {
2964         struct escan_info *escan = &cfg->escan_info;
2965
2966         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2967         if (cfg->scan_request) {
2968                 escan->escan_state = WL_ESCAN_STATE_IDLE;
2969                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
2970         }
2971         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
2972         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2973 }
2974
2975 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
2976 {
2977         struct brcmf_cfg80211_info *cfg =
2978                         container_of(work, struct brcmf_cfg80211_info,
2979                                      escan_timeout_work);
2980
2981         brcmf_inform_bss(cfg);
2982         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
2983 }
2984
2985 static void brcmf_escan_timeout(unsigned long data)
2986 {
2987         struct brcmf_cfg80211_info *cfg =
2988                         (struct brcmf_cfg80211_info *)data;
2989
2990         if (cfg->scan_request) {
2991                 brcmf_err("timer expired\n");
2992                 schedule_work(&cfg->escan_timeout_work);
2993         }
2994 }
2995
2996 static s32
2997 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
2998                               struct brcmf_bss_info_le *bss,
2999                               struct brcmf_bss_info_le *bss_info_le)
3000 {
3001         struct brcmu_chan ch_bss, ch_bss_info_le;
3002
3003         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3004         cfg->d11inf.decchspec(&ch_bss);
3005         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3006         cfg->d11inf.decchspec(&ch_bss_info_le);
3007
3008         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3009                 ch_bss.band == ch_bss_info_le.band &&
3010                 bss_info_le->SSID_len == bss->SSID_len &&
3011                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3012                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3013                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3014                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3015                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3016
3017                         /* preserve max RSSI if the measurements are
3018                         * both on-channel or both off-channel
3019                         */
3020                         if (bss_info_rssi > bss_rssi)
3021                                 bss->RSSI = bss_info_le->RSSI;
3022                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3023                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3024                         /* preserve the on-channel rssi measurement
3025                         * if the new measurement is off channel
3026                         */
3027                         bss->RSSI = bss_info_le->RSSI;
3028                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3029                 }
3030                 return 1;
3031         }
3032         return 0;
3033 }
3034
3035 static s32
3036 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3037                              const struct brcmf_event_msg *e, void *data)
3038 {
3039         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3040         s32 status;
3041         struct brcmf_escan_result_le *escan_result_le;
3042         struct brcmf_bss_info_le *bss_info_le;
3043         struct brcmf_bss_info_le *bss = NULL;
3044         u32 bi_length;
3045         struct brcmf_scan_results *list;
3046         u32 i;
3047         bool aborted;
3048
3049         status = e->status;
3050
3051         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3052                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3053                 return -EPERM;
3054         }
3055
3056         if (status == BRCMF_E_STATUS_PARTIAL) {
3057                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3058                 escan_result_le = (struct brcmf_escan_result_le *) data;
3059                 if (!escan_result_le) {
3060                         brcmf_err("Invalid escan result (NULL pointer)\n");
3061                         goto exit;
3062                 }
3063                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3064                         brcmf_err("Invalid bss_count %d: ignoring\n",
3065                                   escan_result_le->bss_count);
3066                         goto exit;
3067                 }
3068                 bss_info_le = &escan_result_le->bss_info_le;
3069
3070                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3071                         goto exit;
3072
3073                 if (!cfg->scan_request) {
3074                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3075                         goto exit;
3076                 }
3077
3078                 bi_length = le32_to_cpu(bss_info_le->length);
3079                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
3080                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
3081                         brcmf_err("Invalid bss_info length %d: ignoring\n",
3082                                   bi_length);
3083                         goto exit;
3084                 }
3085
3086                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3087                                         BIT(NL80211_IFTYPE_ADHOC))) {
3088                         if (le16_to_cpu(bss_info_le->capability) &
3089                                                 WLAN_CAPABILITY_IBSS) {
3090                                 brcmf_err("Ignoring IBSS result\n");
3091                                 goto exit;
3092                         }
3093                 }
3094
3095                 list = (struct brcmf_scan_results *)
3096                                 cfg->escan_info.escan_buf;
3097                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3098                         brcmf_err("Buffer is too small: ignoring\n");
3099                         goto exit;
3100                 }
3101
3102                 for (i = 0; i < list->count; i++) {
3103                         bss = bss ? (struct brcmf_bss_info_le *)
3104                                 ((unsigned char *)bss +
3105                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3106                         if (brcmf_compare_update_same_bss(cfg, bss,
3107                                                           bss_info_le))
3108                                 goto exit;
3109                 }
3110                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3111                        bi_length);
3112                 list->version = le32_to_cpu(bss_info_le->version);
3113                 list->buflen += bi_length;
3114                 list->count++;
3115         } else {
3116                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3117                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3118                         goto exit;
3119                 if (cfg->scan_request) {
3120                         brcmf_inform_bss(cfg);
3121                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3122                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3123                 } else
3124                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3125                                   status);
3126         }
3127 exit:
3128         return 0;
3129 }
3130
3131 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3132 {
3133         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3134                             brcmf_cfg80211_escan_handler);
3135         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3136         /* Init scan_timeout timer */
3137         init_timer(&cfg->escan_timeout);
3138         cfg->escan_timeout.data = (unsigned long) cfg;
3139         cfg->escan_timeout.function = brcmf_escan_timeout;
3140         INIT_WORK(&cfg->escan_timeout_work,
3141                   brcmf_cfg80211_escan_timeout_worker);
3142 }
3143
3144 /* PFN result doesn't have all the info which are required by the supplicant
3145  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3146  * via wl_inform_single_bss in the required format. Escan does require the
3147  * scan request in the form of cfg80211_scan_request. For timebeing, create
3148  * cfg80211_scan_request one out of the received PNO event.
3149  */
3150 static s32
3151 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3152                                 const struct brcmf_event_msg *e, void *data)
3153 {
3154         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3155         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3156         struct cfg80211_scan_request *request = NULL;
3157         struct cfg80211_ssid *ssid = NULL;
3158         struct ieee80211_channel *channel = NULL;
3159         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3160         int err = 0;
3161         int channel_req = 0;
3162         int band = 0;
3163         struct brcmf_pno_scanresults_le *pfn_result;
3164         u32 result_count;
3165         u32 status;
3166
3167         brcmf_dbg(SCAN, "Enter\n");
3168
3169         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3170                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3171                 return 0;
3172         }
3173
3174         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3175                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3176                 return 0;
3177         }
3178
3179         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3180         result_count = le32_to_cpu(pfn_result->count);
3181         status = le32_to_cpu(pfn_result->status);
3182
3183         /* PFN event is limited to fit 512 bytes so we may get
3184          * multiple NET_FOUND events. For now place a warning here.
3185          */
3186         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3187         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3188         if (result_count > 0) {
3189                 int i;
3190
3191                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3192                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3193                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3194                 if (!request || !ssid || !channel) {
3195                         err = -ENOMEM;
3196                         goto out_err;
3197                 }
3198
3199                 request->wiphy = wiphy;
3200                 data += sizeof(struct brcmf_pno_scanresults_le);
3201                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3202
3203                 for (i = 0; i < result_count; i++) {
3204                         netinfo = &netinfo_start[i];
3205                         if (!netinfo) {
3206                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3207                                           i);
3208                                 err = -EINVAL;
3209                                 goto out_err;
3210                         }
3211
3212                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3213                                   netinfo->SSID, netinfo->channel);
3214                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3215                         ssid[i].ssid_len = netinfo->SSID_len;
3216                         request->n_ssids++;
3217
3218                         channel_req = netinfo->channel;
3219                         if (channel_req <= CH_MAX_2G_CHANNEL)
3220                                 band = NL80211_BAND_2GHZ;
3221                         else
3222                                 band = NL80211_BAND_5GHZ;
3223                         channel[i].center_freq =
3224                                 ieee80211_channel_to_frequency(channel_req,
3225                                                                band);
3226                         channel[i].band = band;
3227                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3228                         request->channels[i] = &channel[i];
3229                         request->n_channels++;
3230                 }
3231
3232                 /* assign parsed ssid array */
3233                 if (request->n_ssids)
3234                         request->ssids = &ssid[0];
3235
3236                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3237                         /* Abort any on-going scan */
3238                         brcmf_abort_scanning(cfg);
3239                 }
3240
3241                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3242                 cfg->escan_info.run = brcmf_run_escan;
3243                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3244                 if (err) {
3245                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3246                         goto out_err;
3247                 }
3248                 cfg->sched_escan = true;
3249                 cfg->scan_request = request;
3250         } else {
3251                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3252                 goto out_err;
3253         }
3254
3255         kfree(ssid);
3256         kfree(channel);
3257         kfree(request);
3258         return 0;
3259
3260 out_err:
3261         kfree(ssid);
3262         kfree(channel);
3263         kfree(request);
3264         cfg80211_sched_scan_stopped(wiphy);
3265         return err;
3266 }
3267
3268 static int brcmf_dev_pno_clean(struct net_device *ndev)
3269 {
3270         int ret;
3271
3272         /* Disable pfn */
3273         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3274         if (ret == 0) {
3275                 /* clear pfn */
3276                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3277                                                NULL, 0);
3278         }
3279         if (ret < 0)
3280                 brcmf_err("failed code %d\n", ret);
3281
3282         return ret;
3283 }
3284
3285 static int brcmf_dev_pno_config(struct brcmf_if *ifp,
3286                                 struct cfg80211_sched_scan_request *request)
3287 {
3288         struct brcmf_pno_param_le pfn_param;
3289         struct brcmf_pno_macaddr_le pfn_mac;
3290         s32 err;
3291         u8 *mac_mask;
3292         int i;
3293
3294         memset(&pfn_param, 0, sizeof(pfn_param));
3295         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3296
3297         /* set extra pno params */
3298         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3299         pfn_param.repeat = BRCMF_PNO_REPEAT;
3300         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3301
3302         /* set up pno scan fr */
3303         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3304
3305         err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
3306                                        sizeof(pfn_param));
3307         if (err) {
3308                 brcmf_err("pfn_set failed, err=%d\n", err);
3309                 return err;
3310         }
3311
3312         /* Find out if mac randomization should be turned on */
3313         if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
3314                 return 0;
3315
3316         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
3317         pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
3318
3319         memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
3320         mac_mask = request->mac_addr_mask;
3321         for (i = 0; i < ETH_ALEN; i++) {
3322                 pfn_mac.mac[i] &= mac_mask[i];
3323                 pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
3324         }
3325         /* Clear multi bit */
3326         pfn_mac.mac[0] &= 0xFE;
3327         /* Set locally administered */
3328         pfn_mac.mac[0] |= 0x02;
3329
3330         err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
3331                                        sizeof(pfn_mac));
3332         if (err)
3333                 brcmf_err("pfn_macaddr failed, err=%d\n", err);
3334
3335         return err;
3336 }
3337
3338 static int
3339 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3340                                 struct net_device *ndev,
3341                                 struct cfg80211_sched_scan_request *request)
3342 {
3343         struct brcmf_if *ifp = netdev_priv(ndev);
3344         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3345         struct brcmf_pno_net_param_le pfn;
3346         int i;
3347         int ret = 0;
3348
3349         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3350                   request->n_match_sets, request->n_ssids);
3351         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3352                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3353                 return -EAGAIN;
3354         }
3355         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3356                 brcmf_err("Scanning suppressed: status (%lu)\n",
3357                           cfg->scan_status);
3358                 return -EAGAIN;
3359         }
3360
3361         if (!request->n_ssids || !request->n_match_sets) {
3362                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3363                           request->n_ssids);
3364                 return -EINVAL;
3365         }
3366
3367         if (request->n_ssids > 0) {
3368                 for (i = 0; i < request->n_ssids; i++) {
3369                         /* Active scan req for ssids */
3370                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3371                                   request->ssids[i].ssid);
3372
3373                         /* match_set ssids is a supert set of n_ssid list,
3374                          * so we need not add these set separately.
3375                          */
3376                 }
3377         }
3378
3379         if (request->n_match_sets > 0) {
3380                 /* clean up everything */
3381                 ret = brcmf_dev_pno_clean(ndev);
3382                 if  (ret < 0) {
3383                         brcmf_err("failed error=%d\n", ret);
3384                         return ret;
3385                 }
3386
3387                 /* configure pno */
3388                 if (brcmf_dev_pno_config(ifp, request))
3389                         return -EINVAL;
3390
3391                 /* configure each match set */
3392                 for (i = 0; i < request->n_match_sets; i++) {
3393                         struct cfg80211_ssid *ssid;
3394                         u32 ssid_len;
3395
3396                         ssid = &request->match_sets[i].ssid;
3397                         ssid_len = ssid->ssid_len;
3398
3399                         if (!ssid_len) {
3400                                 brcmf_err("skip broadcast ssid\n");
3401                                 continue;
3402                         }
3403                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3404                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3405                         pfn.wsec = cpu_to_le32(0);
3406                         pfn.infra = cpu_to_le32(1);
3407                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3408                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3409                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3410                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3411                                                        sizeof(pfn));
3412                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3413                                   ret == 0 ? "set" : "failed", ssid->ssid);
3414                 }
3415                 /* Enable the PNO */
3416                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3417                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3418                         return -EINVAL;
3419                 }
3420         } else {
3421                 return -EINVAL;
3422         }
3423
3424         return 0;
3425 }
3426
3427 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3428                                           struct net_device *ndev)
3429 {
3430         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3431
3432         brcmf_dbg(SCAN, "enter\n");
3433         brcmf_dev_pno_clean(ndev);
3434         if (cfg->sched_escan)
3435                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3436         return 0;
3437 }
3438
3439 static __always_inline void brcmf_delay(u32 ms)
3440 {
3441         if (ms < 1000 / HZ) {
3442                 cond_resched();
3443                 mdelay(ms);
3444         } else {
3445                 msleep(ms);
3446         }
3447 }
3448
3449 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3450                                      u8 *pattern, u32 patternsize, u8 *mask,
3451                                      u32 packet_offset)
3452 {
3453         struct brcmf_fil_wowl_pattern_le *filter;
3454         u32 masksize;
3455         u32 patternoffset;
3456         u8 *buf;
3457         u32 bufsize;
3458         s32 ret;
3459
3460         masksize = (patternsize + 7) / 8;
3461         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3462
3463         bufsize = sizeof(*filter) + patternsize + masksize;
3464         buf = kzalloc(bufsize, GFP_KERNEL);
3465         if (!buf)
3466                 return -ENOMEM;
3467         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3468
3469         memcpy(filter->cmd, cmd, 4);
3470         filter->masksize = cpu_to_le32(masksize);
3471         filter->offset = cpu_to_le32(packet_offset);
3472         filter->patternoffset = cpu_to_le32(patternoffset);
3473         filter->patternsize = cpu_to_le32(patternsize);
3474         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3475
3476         if ((mask) && (masksize))
3477                 memcpy(buf + sizeof(*filter), mask, masksize);
3478         if ((pattern) && (patternsize))
3479                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3480
3481         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3482
3483         kfree(buf);
3484         return ret;
3485 }
3486
3487 static s32
3488 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3489                       void *data)
3490 {
3491         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3492         struct brcmf_pno_scanresults_le *pfn_result;
3493         struct brcmf_pno_net_info_le *netinfo;
3494
3495         brcmf_dbg(SCAN, "Enter\n");
3496
3497         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3498                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3499                 return 0;
3500         }
3501
3502         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3503
3504         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3505                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3506                 return 0;
3507         }
3508
3509         if (le32_to_cpu(pfn_result->count) < 1) {
3510                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3511                           le32_to_cpu(pfn_result->count));
3512                 return -EINVAL;
3513         }
3514
3515         data += sizeof(struct brcmf_pno_scanresults_le);
3516         netinfo = (struct brcmf_pno_net_info_le *)data;
3517         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3518         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3519         cfg->wowl.nd->n_channels = 1;
3520         cfg->wowl.nd->channels[0] =
3521                 ieee80211_channel_to_frequency(netinfo->channel,
3522                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3523                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3524         cfg->wowl.nd_info->n_matches = 1;
3525         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3526
3527         /* Inform (the resume task) that the net detect information was recvd */
3528         cfg->wowl.nd_data_completed = true;
3529         wake_up(&cfg->wowl.nd_data_wait);
3530
3531         return 0;
3532 }
3533
3534 #ifdef CONFIG_PM
3535
3536 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3537 {
3538         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3539         struct brcmf_wowl_wakeind_le wake_ind_le;
3540         struct cfg80211_wowlan_wakeup wakeup_data;
3541         struct cfg80211_wowlan_wakeup *wakeup;
3542         u32 wakeind;
3543         s32 err;
3544         int timeout;
3545
3546         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3547                                        sizeof(wake_ind_le));
3548         if (err) {
3549                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3550                 return;
3551         }
3552
3553         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3554         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3555                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3556                        BRCMF_WOWL_PFN_FOUND)) {
3557                 wakeup = &wakeup_data;
3558                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3559                 wakeup_data.pattern_idx = -1;
3560
3561                 if (wakeind & BRCMF_WOWL_MAGIC) {
3562                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3563                         wakeup_data.magic_pkt = true;
3564                 }
3565                 if (wakeind & BRCMF_WOWL_DIS) {
3566                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3567                         wakeup_data.disconnect = true;
3568                 }
3569                 if (wakeind & BRCMF_WOWL_BCN) {
3570                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3571                         wakeup_data.disconnect = true;
3572                 }
3573                 if (wakeind & BRCMF_WOWL_RETR) {
3574                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3575                         wakeup_data.disconnect = true;
3576                 }
3577                 if (wakeind & BRCMF_WOWL_NET) {
3578                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3579                         /* For now always map to pattern 0, no API to get
3580                          * correct information available at the moment.
3581                          */
3582                         wakeup_data.pattern_idx = 0;
3583                 }
3584                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3585                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3586                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3587                                 cfg->wowl.nd_data_completed,
3588                                 BRCMF_ND_INFO_TIMEOUT);
3589                         if (!timeout)
3590                                 brcmf_err("No result for wowl net detect\n");
3591                         else
3592                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3593                 }
3594                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3595                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3596                         wakeup_data.gtk_rekey_failure = true;
3597                 }
3598         } else {
3599                 wakeup = NULL;
3600         }
3601         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3602 }
3603
3604 #else
3605
3606 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3607 {
3608 }
3609
3610 #endif /* CONFIG_PM */
3611
3612 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3613 {
3614         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3615         struct net_device *ndev = cfg_to_ndev(cfg);
3616         struct brcmf_if *ifp = netdev_priv(ndev);
3617
3618         brcmf_dbg(TRACE, "Enter\n");
3619
3620         if (cfg->wowl.active) {
3621                 brcmf_report_wowl_wakeind(wiphy, ifp);
3622                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3623                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3624                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3625                         brcmf_configure_arp_nd_offload(ifp, true);
3626                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3627                                       cfg->wowl.pre_pmmode);
3628                 cfg->wowl.active = false;
3629                 if (cfg->wowl.nd_enabled) {
3630                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
3631                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3632                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3633                                             brcmf_notify_sched_scan_results);
3634                         cfg->wowl.nd_enabled = false;
3635                 }
3636         }
3637         return 0;
3638 }
3639
3640 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3641                                  struct brcmf_if *ifp,
3642                                  struct cfg80211_wowlan *wowl)
3643 {
3644         u32 wowl_config;
3645         u32 i;
3646
3647         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3648
3649         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3650                 brcmf_configure_arp_nd_offload(ifp, false);
3651         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3652         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3653
3654         wowl_config = 0;
3655         if (wowl->disconnect)
3656                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3657         if (wowl->magic_pkt)
3658                 wowl_config |= BRCMF_WOWL_MAGIC;
3659         if ((wowl->patterns) && (wowl->n_patterns)) {
3660                 wowl_config |= BRCMF_WOWL_NET;
3661                 for (i = 0; i < wowl->n_patterns; i++) {
3662                         brcmf_config_wowl_pattern(ifp, "add",
3663                                 (u8 *)wowl->patterns[i].pattern,
3664                                 wowl->patterns[i].pattern_len,
3665                                 (u8 *)wowl->patterns[i].mask,
3666                                 wowl->patterns[i].pkt_offset);
3667                 }
3668         }
3669         if (wowl->nd_config) {
3670                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3671                                                 wowl->nd_config);
3672                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3673
3674                 cfg->wowl.nd_data_completed = false;
3675                 cfg->wowl.nd_enabled = true;
3676                 /* Now reroute the event for PFN to the wowl function. */
3677                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3678                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3679                                     brcmf_wowl_nd_results);
3680         }
3681         if (wowl->gtk_rekey_failure)
3682                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3683         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3684                 wowl_config |= BRCMF_WOWL_UNASSOC;
3685
3686         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear",
3687                                  sizeof(struct brcmf_wowl_wakeind_le));
3688         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3689         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3690         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3691         cfg->wowl.active = true;
3692 }
3693
3694 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3695                                   struct cfg80211_wowlan *wowl)
3696 {
3697         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3698         struct net_device *ndev = cfg_to_ndev(cfg);
3699         struct brcmf_if *ifp = netdev_priv(ndev);
3700         struct brcmf_cfg80211_vif *vif;
3701
3702         brcmf_dbg(TRACE, "Enter\n");
3703
3704         /* if the primary net_device is not READY there is nothing
3705          * we can do but pray resume goes smoothly.
3706          */
3707         if (!check_vif_up(ifp->vif))
3708                 goto exit;
3709
3710         /* Stop scheduled scan */
3711         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3712                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
3713
3714         /* end any scanning */
3715         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3716                 brcmf_abort_scanning(cfg);
3717
3718         if (wowl == NULL) {
3719                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3720                 list_for_each_entry(vif, &cfg->vif_list, list) {
3721                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3722                                 continue;
3723                         /* While going to suspend if associated with AP
3724                          * disassociate from AP to save power while system is
3725                          * in suspended state
3726                          */
3727                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3728                         /* Make sure WPA_Supplicant receives all the event
3729                          * generated due to DISASSOC call to the fw to keep
3730                          * the state fw and WPA_Supplicant state consistent
3731                          */
3732                         brcmf_delay(500);
3733                 }
3734                 /* Configure MPC */
3735                 brcmf_set_mpc(ifp, 1);
3736
3737         } else {
3738                 /* Configure WOWL paramaters */
3739                 brcmf_configure_wowl(cfg, ifp, wowl);
3740         }
3741
3742 exit:
3743         brcmf_dbg(TRACE, "Exit\n");
3744         /* clear any scanning activity */
3745         cfg->scan_status = 0;
3746         return 0;
3747 }
3748
3749 static __used s32
3750 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3751 {
3752         struct brcmf_pmk_list_le *pmk_list;
3753         int i;
3754         u32 npmk;
3755         s32 err;
3756
3757         pmk_list = &cfg->pmk_list;
3758         npmk = le32_to_cpu(pmk_list->npmk);
3759
3760         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3761         for (i = 0; i < npmk; i++)
3762                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3763
3764         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3765                                        sizeof(*pmk_list));
3766
3767         return err;
3768 }
3769
3770 static s32
3771 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3772                          struct cfg80211_pmksa *pmksa)
3773 {
3774         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3775         struct brcmf_if *ifp = netdev_priv(ndev);
3776         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3777         s32 err;
3778         u32 npmk, i;
3779
3780         brcmf_dbg(TRACE, "Enter\n");
3781         if (!check_vif_up(ifp->vif))
3782                 return -EIO;
3783
3784         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3785         for (i = 0; i < npmk; i++)
3786                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3787                         break;
3788         if (i < BRCMF_MAXPMKID) {
3789                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3790                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3791                 if (i == npmk) {
3792                         npmk++;
3793                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3794                 }
3795         } else {
3796                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3797                 return -EINVAL;
3798         }
3799
3800         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3801         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3802                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3803                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3804                           pmk[npmk].pmkid[i + 3]);
3805
3806         err = brcmf_update_pmklist(cfg, ifp);
3807
3808         brcmf_dbg(TRACE, "Exit\n");
3809         return err;
3810 }
3811
3812 static s32
3813 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3814                          struct cfg80211_pmksa *pmksa)
3815 {
3816         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3817         struct brcmf_if *ifp = netdev_priv(ndev);
3818         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3819         s32 err;
3820         u32 npmk, i;
3821
3822         brcmf_dbg(TRACE, "Enter\n");
3823         if (!check_vif_up(ifp->vif))
3824                 return -EIO;
3825
3826         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", &pmksa->bssid);
3827
3828         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3829         for (i = 0; i < npmk; i++)
3830                 if (!memcmp(&pmksa->bssid, &pmk[i].bssid, ETH_ALEN))
3831                         break;
3832
3833         if ((npmk > 0) && (i < npmk)) {
3834                 for (; i < (npmk - 1); i++) {
3835                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3836                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3837                                WLAN_PMKID_LEN);
3838                 }
3839                 memset(&pmk[i], 0, sizeof(*pmk));
3840                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3841         } else {
3842                 brcmf_err("Cache entry not found\n");
3843                 return -EINVAL;
3844         }
3845
3846         err = brcmf_update_pmklist(cfg, ifp);
3847
3848         brcmf_dbg(TRACE, "Exit\n");
3849         return err;
3850
3851 }
3852
3853 static s32
3854 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3855 {
3856         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3857         struct brcmf_if *ifp = netdev_priv(ndev);
3858         s32 err;
3859
3860         brcmf_dbg(TRACE, "Enter\n");
3861         if (!check_vif_up(ifp->vif))
3862                 return -EIO;
3863
3864         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3865         err = brcmf_update_pmklist(cfg, ifp);
3866
3867         brcmf_dbg(TRACE, "Exit\n");
3868         return err;
3869
3870 }
3871
3872 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3873 {
3874         s32 err;
3875
3876         /* set auth */
3877         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3878         if (err < 0) {
3879                 brcmf_err("auth error %d\n", err);
3880                 return err;
3881         }
3882         /* set wsec */
3883         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3884         if (err < 0) {
3885                 brcmf_err("wsec error %d\n", err);
3886                 return err;
3887         }
3888         /* set upper-layer auth */
3889         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3890         if (err < 0) {
3891                 brcmf_err("wpa_auth error %d\n", err);
3892                 return err;
3893         }
3894
3895         return 0;
3896 }
3897
3898 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3899 {
3900         if (is_rsn_ie)
3901                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3902
3903         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3904 }
3905
3906 static s32
3907 brcmf_configure_wpaie(struct brcmf_if *ifp,
3908                       const struct brcmf_vs_tlv *wpa_ie,
3909                       bool is_rsn_ie)
3910 {
3911         u32 auth = 0; /* d11 open authentication */
3912         u16 count;
3913         s32 err = 0;
3914         s32 len;
3915         u32 i;
3916         u32 wsec;
3917         u32 pval = 0;
3918         u32 gval = 0;
3919         u32 wpa_auth = 0;
3920         u32 offset;
3921         u8 *data;
3922         u16 rsn_cap;
3923         u32 wme_bss_disable;
3924         u32 mfp;
3925
3926         brcmf_dbg(TRACE, "Enter\n");
3927         if (wpa_ie == NULL)
3928                 goto exit;
3929
3930         len = wpa_ie->len + TLV_HDR_LEN;
3931         data = (u8 *)wpa_ie;
3932         offset = TLV_HDR_LEN;
3933         if (!is_rsn_ie)
3934                 offset += VS_IE_FIXED_HDR_LEN;
3935         else
3936                 offset += WPA_IE_VERSION_LEN;
3937
3938         /* check for multicast cipher suite */
3939         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3940                 err = -EINVAL;
3941                 brcmf_err("no multicast cipher suite\n");
3942                 goto exit;
3943         }
3944
3945         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3946                 err = -EINVAL;
3947                 brcmf_err("ivalid OUI\n");
3948                 goto exit;
3949         }
3950         offset += TLV_OUI_LEN;
3951
3952         /* pick up multicast cipher */
3953         switch (data[offset]) {
3954         case WPA_CIPHER_NONE:
3955                 gval = 0;
3956                 break;
3957         case WPA_CIPHER_WEP_40:
3958         case WPA_CIPHER_WEP_104:
3959                 gval = WEP_ENABLED;
3960                 break;
3961         case WPA_CIPHER_TKIP:
3962                 gval = TKIP_ENABLED;
3963                 break;
3964         case WPA_CIPHER_AES_CCM:
3965                 gval = AES_ENABLED;
3966                 break;
3967         default:
3968                 err = -EINVAL;
3969                 brcmf_err("Invalid multi cast cipher info\n");
3970                 goto exit;
3971         }
3972
3973         offset++;
3974         /* walk thru unicast cipher list and pick up what we recognize */
3975         count = data[offset] + (data[offset + 1] << 8);
3976         offset += WPA_IE_SUITE_COUNT_LEN;
3977         /* Check for unicast suite(s) */
3978         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3979                 err = -EINVAL;
3980                 brcmf_err("no unicast cipher suite\n");
3981                 goto exit;
3982         }
3983         for (i = 0; i < count; i++) {
3984                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3985                         err = -EINVAL;
3986                         brcmf_err("ivalid OUI\n");
3987                         goto exit;
3988                 }
3989                 offset += TLV_OUI_LEN;
3990                 switch (data[offset]) {
3991                 case WPA_CIPHER_NONE:
3992                         break;
3993                 case WPA_CIPHER_WEP_40:
3994                 case WPA_CIPHER_WEP_104:
3995                         pval |= WEP_ENABLED;
3996                         break;
3997                 case WPA_CIPHER_TKIP:
3998                         pval |= TKIP_ENABLED;
3999                         break;
4000                 case WPA_CIPHER_AES_CCM:
4001                         pval |= AES_ENABLED;
4002                         break;
4003                 default:
4004                         brcmf_err("Ivalid unicast security info\n");
4005                 }
4006                 offset++;
4007         }
4008         /* walk thru auth management suite list and pick up what we recognize */
4009         count = data[offset] + (data[offset + 1] << 8);
4010         offset += WPA_IE_SUITE_COUNT_LEN;
4011         /* Check for auth key management suite(s) */
4012         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4013                 err = -EINVAL;
4014                 brcmf_err("no auth key mgmt suite\n");
4015                 goto exit;
4016         }
4017         for (i = 0; i < count; i++) {
4018                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4019                         err = -EINVAL;
4020                         brcmf_err("ivalid OUI\n");
4021                         goto exit;
4022                 }
4023                 offset += TLV_OUI_LEN;
4024                 switch (data[offset]) {
4025                 case RSN_AKM_NONE:
4026                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4027                         wpa_auth |= WPA_AUTH_NONE;
4028                         break;
4029                 case RSN_AKM_UNSPECIFIED:
4030                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4031                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4032                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4033                         break;
4034                 case RSN_AKM_PSK:
4035                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4036                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4037                                     (wpa_auth |= WPA_AUTH_PSK);
4038                         break;
4039                 case RSN_AKM_SHA256_PSK:
4040                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4041                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4042                         break;
4043                 case RSN_AKM_SHA256_1X:
4044                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4045                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4046                         break;
4047                 default:
4048                         brcmf_err("Ivalid key mgmt info\n");
4049                 }
4050                 offset++;
4051         }
4052
4053         mfp = BRCMF_MFP_NONE;
4054         if (is_rsn_ie) {
4055                 wme_bss_disable = 1;
4056                 if ((offset + RSN_CAP_LEN) <= len) {
4057                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4058                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4059                                 wme_bss_disable = 0;
4060                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4061                                 brcmf_dbg(TRACE, "MFP Required\n");
4062                                 mfp = BRCMF_MFP_REQUIRED;
4063                                 /* Firmware only supports mfp required in
4064                                  * combination with WPA2_AUTH_PSK_SHA256 or
4065                                  * WPA2_AUTH_1X_SHA256.
4066                                  */
4067                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4068                                                   WPA2_AUTH_1X_SHA256))) {
4069                                         err = -EINVAL;
4070                                         goto exit;
4071                                 }
4072                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4073                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4074                                  * is to be included in the rsn ie.
4075                                  */
4076                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4077                                         wpa_auth |= WPA2_AUTH_PSK;
4078                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4079                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4080                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4081                                 brcmf_dbg(TRACE, "MFP Capable\n");
4082                                 mfp = BRCMF_MFP_CAPABLE;
4083                         }
4084                 }
4085                 offset += RSN_CAP_LEN;
4086                 /* set wme_bss_disable to sync RSN Capabilities */
4087                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4088                                                wme_bss_disable);
4089                 if (err < 0) {
4090                         brcmf_err("wme_bss_disable error %d\n", err);
4091                         goto exit;
4092                 }
4093
4094                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4095                 offset += RSN_PMKID_COUNT_LEN;
4096
4097                 /* See if there is BIP wpa suite left for MFP */
4098                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4099                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4100                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4101                                                         &data[offset],
4102                                                         WPA_IE_MIN_OUI_LEN);
4103                         if (err < 0) {
4104                                 brcmf_err("bip error %d\n", err);
4105                                 goto exit;
4106                         }
4107                 }
4108         }
4109         /* FOR WPS , set SES_OW_ENABLED */
4110         wsec = (pval | gval | SES_OW_ENABLED);
4111
4112         /* set auth */
4113         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4114         if (err < 0) {
4115                 brcmf_err("auth error %d\n", err);
4116                 goto exit;
4117         }
4118         /* set wsec */
4119         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4120         if (err < 0) {
4121                 brcmf_err("wsec error %d\n", err);
4122                 goto exit;
4123         }
4124         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4125          * will overwrite the values set by MFP
4126          */
4127         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4128                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4129                 if (err < 0) {
4130                         brcmf_err("mfp error %d\n", err);
4131                         goto exit;
4132                 }
4133         }
4134         /* set upper-layer auth */
4135         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4136         if (err < 0) {
4137                 brcmf_err("wpa_auth error %d\n", err);
4138                 goto exit;
4139         }
4140
4141 exit:
4142         return err;
4143 }
4144
4145 static s32
4146 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4147                      struct parsed_vndr_ies *vndr_ies)
4148 {
4149         struct brcmf_vs_tlv *vndrie;
4150         struct brcmf_tlv *ie;
4151         struct parsed_vndr_ie_info *parsed_info;
4152         s32 remaining_len;
4153
4154         remaining_len = (s32)vndr_ie_len;
4155         memset(vndr_ies, 0, sizeof(*vndr_ies));
4156
4157         ie = (struct brcmf_tlv *)vndr_ie_buf;
4158         while (ie) {
4159                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4160                         goto next;
4161                 vndrie = (struct brcmf_vs_tlv *)ie;
4162                 /* len should be bigger than OUI length + one */
4163                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4164                         brcmf_err("invalid vndr ie. length is too small %d\n",
4165                                   vndrie->len);
4166                         goto next;
4167                 }
4168                 /* if wpa or wme ie, do not add ie */
4169                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4170                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4171                     (vndrie->oui_type == WME_OUI_TYPE))) {
4172                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4173                         goto next;
4174                 }
4175
4176                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4177
4178                 /* save vndr ie information */
4179                 parsed_info->ie_ptr = (char *)vndrie;
4180                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4181                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4182
4183                 vndr_ies->count++;
4184
4185                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4186                           parsed_info->vndrie.oui[0],
4187                           parsed_info->vndrie.oui[1],
4188                           parsed_info->vndrie.oui[2],
4189                           parsed_info->vndrie.oui_type);
4190
4191                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4192                         break;
4193 next:
4194                 remaining_len -= (ie->len + TLV_HDR_LEN);
4195                 if (remaining_len <= TLV_HDR_LEN)
4196                         ie = NULL;
4197                 else
4198                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4199                                 TLV_HDR_LEN);
4200         }
4201         return 0;
4202 }
4203
4204 static u32
4205 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4206 {
4207
4208         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4209         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4210
4211         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4212
4213         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4214
4215         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4216
4217         return ie_len + VNDR_IE_HDR_SIZE;
4218 }
4219
4220 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4221                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4222 {
4223         struct brcmf_if *ifp;
4224         struct vif_saved_ie *saved_ie;
4225         s32 err = 0;
4226         u8  *iovar_ie_buf;
4227         u8  *curr_ie_buf;
4228         u8  *mgmt_ie_buf = NULL;
4229         int mgmt_ie_buf_len;
4230         u32 *mgmt_ie_len;
4231         u32 del_add_ie_buf_len = 0;
4232         u32 total_ie_buf_len = 0;
4233         u32 parsed_ie_buf_len = 0;
4234         struct parsed_vndr_ies old_vndr_ies;
4235         struct parsed_vndr_ies new_vndr_ies;
4236         struct parsed_vndr_ie_info *vndrie_info;
4237         s32 i;
4238         u8 *ptr;
4239         int remained_buf_len;
4240
4241         if (!vif)
4242                 return -ENODEV;
4243         ifp = vif->ifp;
4244         saved_ie = &vif->saved_ie;
4245
4246         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4247                   pktflag);
4248         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4249         if (!iovar_ie_buf)
4250                 return -ENOMEM;
4251         curr_ie_buf = iovar_ie_buf;
4252         switch (pktflag) {
4253         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4254                 mgmt_ie_buf = saved_ie->probe_req_ie;
4255                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4256                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4257                 break;
4258         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4259                 mgmt_ie_buf = saved_ie->probe_res_ie;
4260                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4261                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4262                 break;
4263         case BRCMF_VNDR_IE_BEACON_FLAG:
4264                 mgmt_ie_buf = saved_ie->beacon_ie;
4265                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4266                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4267                 break;
4268         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4269                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4270                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4271                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4272                 break;
4273         default:
4274                 err = -EPERM;
4275                 brcmf_err("not suitable type\n");
4276                 goto exit;
4277         }
4278
4279         if (vndr_ie_len > mgmt_ie_buf_len) {
4280                 err = -ENOMEM;
4281                 brcmf_err("extra IE size too big\n");
4282                 goto exit;
4283         }
4284
4285         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4286         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4287                 ptr = curr_ie_buf;
4288                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4289                 for (i = 0; i < new_vndr_ies.count; i++) {
4290                         vndrie_info = &new_vndr_ies.ie_info[i];
4291                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4292                                vndrie_info->ie_len);
4293                         parsed_ie_buf_len += vndrie_info->ie_len;
4294                 }
4295         }
4296
4297         if (mgmt_ie_buf && *mgmt_ie_len) {
4298                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4299                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4300                             parsed_ie_buf_len) == 0)) {
4301                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4302                         goto exit;
4303                 }
4304
4305                 /* parse old vndr_ie */
4306                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4307
4308                 /* make a command to delete old ie */
4309                 for (i = 0; i < old_vndr_ies.count; i++) {
4310                         vndrie_info = &old_vndr_ies.ie_info[i];
4311
4312                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4313                                   vndrie_info->vndrie.id,
4314                                   vndrie_info->vndrie.len,
4315                                   vndrie_info->vndrie.oui[0],
4316                                   vndrie_info->vndrie.oui[1],
4317                                   vndrie_info->vndrie.oui[2]);
4318
4319                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4320                                                            vndrie_info->ie_ptr,
4321                                                            vndrie_info->ie_len,
4322                                                            "del");
4323                         curr_ie_buf += del_add_ie_buf_len;
4324                         total_ie_buf_len += del_add_ie_buf_len;
4325                 }
4326         }
4327
4328         *mgmt_ie_len = 0;
4329         /* Add if there is any extra IE */
4330         if (mgmt_ie_buf && parsed_ie_buf_len) {
4331                 ptr = mgmt_ie_buf;
4332
4333                 remained_buf_len = mgmt_ie_buf_len;
4334
4335                 /* make a command to add new ie */
4336                 for (i = 0; i < new_vndr_ies.count; i++) {
4337                         vndrie_info = &new_vndr_ies.ie_info[i];
4338
4339                         /* verify remained buf size before copy data */
4340                         if (remained_buf_len < (vndrie_info->vndrie.len +
4341                                                         VNDR_IE_VSIE_OFFSET)) {
4342                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4343                                           remained_buf_len);
4344                                 break;
4345                         }
4346                         remained_buf_len -= (vndrie_info->ie_len +
4347                                              VNDR_IE_VSIE_OFFSET);
4348
4349                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4350                                   vndrie_info->vndrie.id,
4351                                   vndrie_info->vndrie.len,
4352                                   vndrie_info->vndrie.oui[0],
4353                                   vndrie_info->vndrie.oui[1],
4354                                   vndrie_info->vndrie.oui[2]);
4355
4356                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4357                                                            vndrie_info->ie_ptr,
4358                                                            vndrie_info->ie_len,
4359                                                            "add");
4360
4361                         /* save the parsed IE in wl struct */
4362                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4363                                vndrie_info->ie_len);
4364                         *mgmt_ie_len += vndrie_info->ie_len;
4365
4366                         curr_ie_buf += del_add_ie_buf_len;
4367                         total_ie_buf_len += del_add_ie_buf_len;
4368                 }
4369         }
4370         if (total_ie_buf_len) {
4371                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4372                                                  total_ie_buf_len);
4373                 if (err)
4374                         brcmf_err("vndr ie set error : %d\n", err);
4375         }
4376
4377 exit:
4378         kfree(iovar_ie_buf);
4379         return err;
4380 }
4381
4382 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4383 {
4384         s32 pktflags[] = {
4385                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4386                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4387                 BRCMF_VNDR_IE_BEACON_FLAG
4388         };
4389         int i;
4390
4391         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4392                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4393
4394         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4395         return 0;
4396 }
4397
4398 static s32
4399 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4400                         struct cfg80211_beacon_data *beacon)
4401 {
4402         s32 err;
4403
4404         /* Set Beacon IEs to FW */
4405         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4406                                     beacon->tail, beacon->tail_len);
4407         if (err) {
4408                 brcmf_err("Set Beacon IE Failed\n");
4409                 return err;
4410         }
4411         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4412
4413         /* Set Probe Response IEs to FW */
4414         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4415                                     beacon->proberesp_ies,
4416                                     beacon->proberesp_ies_len);
4417         if (err)
4418                 brcmf_err("Set Probe Resp IE Failed\n");
4419         else
4420                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4421
4422         return err;
4423 }
4424
4425 static s32
4426 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4427                         struct cfg80211_ap_settings *settings)
4428 {
4429         s32 ie_offset;
4430         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4431         struct brcmf_if *ifp = netdev_priv(ndev);
4432         const struct brcmf_tlv *ssid_ie;
4433         const struct brcmf_tlv *country_ie;
4434         struct brcmf_ssid_le ssid_le;
4435         s32 err = -EPERM;
4436         const struct brcmf_tlv *rsn_ie;
4437         const struct brcmf_vs_tlv *wpa_ie;
4438         struct brcmf_join_params join_params;
4439         enum nl80211_iftype dev_role;
4440         struct brcmf_fil_bss_enable_le bss_enable;
4441         u16 chanspec;
4442         bool mbss;
4443         int is_11d;
4444
4445         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4446                   settings->chandef.chan->hw_value,
4447                   settings->chandef.center_freq1, settings->chandef.width,
4448                   settings->beacon_interval, settings->dtim_period);
4449         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4450                   settings->ssid, settings->ssid_len, settings->auth_type,
4451                   settings->inactivity_timeout);
4452         dev_role = ifp->vif->wdev.iftype;
4453         mbss = ifp->vif->mbss;
4454
4455         /* store current 11d setting */
4456         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
4457         country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4458                                       settings->beacon.tail_len,
4459                                       WLAN_EID_COUNTRY);
4460         is_11d = country_ie ? 1 : 0;
4461
4462         memset(&ssid_le, 0, sizeof(ssid_le));
4463         if (settings->ssid == NULL || settings->ssid_len == 0) {
4464                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4465                 ssid_ie = brcmf_parse_tlvs(
4466                                 (u8 *)&settings->beacon.head[ie_offset],
4467                                 settings->beacon.head_len - ie_offset,
4468                                 WLAN_EID_SSID);
4469                 if (!ssid_ie)
4470                         return -EINVAL;
4471
4472                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4473                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4474                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4475         } else {
4476                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4477                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4478         }
4479
4480         if (!mbss) {
4481                 brcmf_set_mpc(ifp, 0);
4482                 brcmf_configure_arp_nd_offload(ifp, false);
4483         }
4484
4485         /* find the RSN_IE */
4486         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4487                                   settings->beacon.tail_len, WLAN_EID_RSN);
4488
4489         /* find the WPA_IE */
4490         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4491                                   settings->beacon.tail_len);
4492
4493         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4494                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4495                 if (wpa_ie != NULL) {
4496                         /* WPA IE */
4497                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4498                         if (err < 0)
4499                                 goto exit;
4500                 } else {
4501                         struct brcmf_vs_tlv *tmp_ie;
4502
4503                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4504
4505                         /* RSN IE */
4506                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4507                         if (err < 0)
4508                                 goto exit;
4509                 }
4510         } else {
4511                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4512                 brcmf_configure_opensecurity(ifp);
4513         }
4514
4515         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4516
4517         if (!mbss) {
4518                 chanspec = chandef_to_chanspec(&cfg->d11inf,
4519                                                &settings->chandef);
4520                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4521                 if (err < 0) {
4522                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4523                                   chanspec, err);
4524                         goto exit;
4525                 }
4526
4527                 if (is_11d != ifp->vif->is_11d) {
4528                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4529                                                     is_11d);
4530                         if (err < 0) {
4531                                 brcmf_err("Regulatory Set Error, %d\n", err);
4532                                 goto exit;
4533                         }
4534                 }
4535                 if (settings->beacon_interval) {
4536                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4537                                                     settings->beacon_interval);
4538                         if (err < 0) {
4539                                 brcmf_err("Beacon Interval Set Error, %d\n",
4540                                           err);
4541                                 goto exit;
4542                         }
4543                 }
4544                 if (settings->dtim_period) {
4545                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4546                                                     settings->dtim_period);
4547                         if (err < 0) {
4548                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4549                                 goto exit;
4550                         }
4551                 }
4552
4553                 if ((dev_role == NL80211_IFTYPE_AP) &&
4554                     ((ifp->ifidx == 0) ||
4555                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4556                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4557                         if (err < 0) {
4558                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4559                                 goto exit;
4560                         }
4561                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4562                 }
4563
4564                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4565                 if (err < 0) {
4566                         brcmf_err("SET INFRA error %d\n", err);
4567                         goto exit;
4568                 }
4569         } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
4570                 /* Multiple-BSS should use same 11d configuration */
4571                 err = -EINVAL;
4572                 goto exit;
4573         }
4574         if (dev_role == NL80211_IFTYPE_AP) {
4575                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4576                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4577
4578                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4579                 if (err < 0) {
4580                         brcmf_err("setting AP mode failed %d\n", err);
4581                         goto exit;
4582                 }
4583                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4584                 if (err < 0) {
4585                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4586                         goto exit;
4587                 }
4588                 /* On DOWN the firmware removes the WEP keys, reconfigure
4589                  * them if they were set.
4590                  */
4591                 brcmf_cfg80211_reconfigure_wep(ifp);
4592
4593                 memset(&join_params, 0, sizeof(join_params));
4594                 /* join parameters starts with ssid */
4595                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4596                 /* create softap */
4597                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4598                                              &join_params, sizeof(join_params));
4599                 if (err < 0) {
4600                         brcmf_err("SET SSID error (%d)\n", err);
4601                         goto exit;
4602                 }
4603                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4604         } else {
4605                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4606                                                 sizeof(ssid_le));
4607                 if (err < 0) {
4608                         brcmf_err("setting ssid failed %d\n", err);
4609                         goto exit;
4610                 }
4611                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4612                 bss_enable.enable = cpu_to_le32(1);
4613                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4614                                                sizeof(bss_enable));
4615                 if (err < 0) {
4616                         brcmf_err("bss_enable config failed %d\n", err);
4617                         goto exit;
4618                 }
4619
4620                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4621         }
4622         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4623         brcmf_net_setcarrier(ifp, true);
4624
4625 exit:
4626         if ((err) && (!mbss)) {
4627                 brcmf_set_mpc(ifp, 1);
4628                 brcmf_configure_arp_nd_offload(ifp, true);
4629         }
4630         return err;
4631 }
4632
4633 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4634 {
4635         struct brcmf_if *ifp = netdev_priv(ndev);
4636         s32 err;
4637         struct brcmf_fil_bss_enable_le bss_enable;
4638         struct brcmf_join_params join_params;
4639
4640         brcmf_dbg(TRACE, "Enter\n");
4641
4642         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4643                 /* Due to most likely deauths outstanding we sleep */
4644                 /* first to make sure they get processed by fw. */
4645                 msleep(400);
4646
4647                 if (ifp->vif->mbss) {
4648                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4649                         return err;
4650                 }
4651
4652                 memset(&join_params, 0, sizeof(join_params));
4653                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4654                                              &join_params, sizeof(join_params));
4655                 if (err < 0)
4656                         brcmf_err("SET SSID error (%d)\n", err);
4657                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4658                 if (err < 0)
4659                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4660                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4661                 if (err < 0)
4662                         brcmf_err("setting AP mode failed %d\n", err);
4663                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4664                 if (err < 0)
4665                         brcmf_err("setting INFRA mode failed %d\n", err);
4666                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4667                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4668                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4669                                             ifp->vif->is_11d);
4670                 if (err < 0)
4671                         brcmf_err("restoring REGULATORY setting failed %d\n",
4672                                   err);
4673                 /* Bring device back up so it can be used again */
4674                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4675                 if (err < 0)
4676                         brcmf_err("BRCMF_C_UP error %d\n", err);
4677         } else {
4678                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4679                 bss_enable.enable = cpu_to_le32(0);
4680                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4681                                                sizeof(bss_enable));
4682                 if (err < 0)
4683                         brcmf_err("bss_enable config failed %d\n", err);
4684         }
4685         brcmf_set_mpc(ifp, 1);
4686         brcmf_configure_arp_nd_offload(ifp, true);
4687         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4688         brcmf_net_setcarrier(ifp, false);
4689
4690         return err;
4691 }
4692
4693 static s32
4694 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4695                              struct cfg80211_beacon_data *info)
4696 {
4697         struct brcmf_if *ifp = netdev_priv(ndev);
4698         s32 err;
4699
4700         brcmf_dbg(TRACE, "Enter\n");
4701
4702         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4703
4704         return err;
4705 }
4706
4707 static int
4708 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4709                            struct station_del_parameters *params)
4710 {
4711         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4712         struct brcmf_scb_val_le scbval;
4713         struct brcmf_if *ifp = netdev_priv(ndev);
4714         s32 err;
4715
4716         if (!params->mac)
4717                 return -EFAULT;
4718
4719         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4720
4721         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4722                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4723         if (!check_vif_up(ifp->vif))
4724                 return -EIO;
4725
4726         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4727         scbval.val = cpu_to_le32(params->reason_code);
4728         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4729                                      &scbval, sizeof(scbval));
4730         if (err)
4731                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4732
4733         brcmf_dbg(TRACE, "Exit\n");
4734         return err;
4735 }
4736
4737 static int
4738 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4739                               const u8 *mac, struct station_parameters *params)
4740 {
4741         struct brcmf_if *ifp = netdev_priv(ndev);
4742         s32 err;
4743
4744         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4745                   params->sta_flags_mask, params->sta_flags_set);
4746
4747         /* Ignore all 00 MAC */
4748         if (is_zero_ether_addr(mac))
4749                 return 0;
4750
4751         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4752                 return 0;
4753
4754         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4755                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4756                                              (void *)mac, ETH_ALEN);
4757         else
4758                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4759                                              (void *)mac, ETH_ALEN);
4760         if (err < 0)
4761                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4762
4763         return err;
4764 }
4765
4766 static void
4767 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4768                                    struct wireless_dev *wdev,
4769                                    u16 frame_type, bool reg)
4770 {
4771         struct brcmf_cfg80211_vif *vif;
4772         u16 mgmt_type;
4773
4774         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4775
4776         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4777         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4778         if (reg)
4779                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4780         else
4781                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4782 }
4783
4784
4785 static int
4786 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4787                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4788 {
4789         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4790         struct ieee80211_channel *chan = params->chan;
4791         const u8 *buf = params->buf;
4792         size_t len = params->len;
4793         const struct ieee80211_mgmt *mgmt;
4794         struct brcmf_cfg80211_vif *vif;
4795         s32 err = 0;
4796         s32 ie_offset;
4797         s32 ie_len;
4798         struct brcmf_fil_action_frame_le *action_frame;
4799         struct brcmf_fil_af_params_le *af_params;
4800         bool ack;
4801         s32 chan_nr;
4802         u32 freq;
4803
4804         brcmf_dbg(TRACE, "Enter\n");
4805
4806         *cookie = 0;
4807
4808         mgmt = (const struct ieee80211_mgmt *)buf;
4809
4810         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4811                 brcmf_err("Driver only allows MGMT packet type\n");
4812                 return -EPERM;
4813         }
4814
4815         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4816
4817         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4818                 /* Right now the only reason to get a probe response */
4819                 /* is for p2p listen response or for p2p GO from     */
4820                 /* wpa_supplicant. Unfortunately the probe is send   */
4821                 /* on primary ndev, while dongle wants it on the p2p */
4822                 /* vif. Since this is only reason for a probe        */
4823                 /* response to be sent, the vif is taken from cfg.   */
4824                 /* If ever desired to send proberesp for non p2p     */
4825                 /* response then data should be checked for          */
4826                 /* "DIRECT-". Note in future supplicant will take    */
4827                 /* dedicated p2p wdev to do this and then this 'hack'*/
4828                 /* is not needed anymore.                            */
4829                 ie_offset =  DOT11_MGMT_HDR_LEN +
4830                              DOT11_BCN_PRB_FIXED_LEN;
4831                 ie_len = len - ie_offset;
4832                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4833                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4834                 err = brcmf_vif_set_mgmt_ie(vif,
4835                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4836                                             &buf[ie_offset],
4837                                             ie_len);
4838                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4839                                         GFP_KERNEL);
4840         } else if (ieee80211_is_action(mgmt->frame_control)) {
4841                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4842                 if (af_params == NULL) {
4843                         brcmf_err("unable to allocate frame\n");
4844                         err = -ENOMEM;
4845                         goto exit;
4846                 }
4847                 action_frame = &af_params->action_frame;
4848                 /* Add the packet Id */
4849                 action_frame->packet_id = cpu_to_le32(*cookie);
4850                 /* Add BSSID */
4851                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4852                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4853                 /* Add the length exepted for 802.11 header  */
4854                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4855                 /* Add the channel. Use the one specified as parameter if any or
4856                  * the current one (got from the firmware) otherwise
4857                  */
4858                 if (chan)
4859                         freq = chan->center_freq;
4860                 else
4861                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4862                                               &freq);
4863                 chan_nr = ieee80211_frequency_to_channel(freq);
4864                 af_params->channel = cpu_to_le32(chan_nr);
4865
4866                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4867                        le16_to_cpu(action_frame->len));
4868
4869                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4870                           *cookie, le16_to_cpu(action_frame->len), freq);
4871
4872                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4873                                                   af_params);
4874
4875                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4876                                         GFP_KERNEL);
4877                 kfree(af_params);
4878         } else {
4879                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4880                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4881         }
4882
4883 exit:
4884         return err;
4885 }
4886
4887
4888 static int
4889 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4890                                         struct wireless_dev *wdev,
4891                                         u64 cookie)
4892 {
4893         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4894         struct brcmf_cfg80211_vif *vif;
4895         int err = 0;
4896
4897         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4898
4899         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4900         if (vif == NULL) {
4901                 brcmf_err("No p2p device available for probe response\n");
4902                 err = -ENODEV;
4903                 goto exit;
4904         }
4905         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4906 exit:
4907         return err;
4908 }
4909
4910 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
4911                                            struct wireless_dev *wdev,
4912                                            enum nl80211_crit_proto_id proto,
4913                                            u16 duration)
4914 {
4915         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4916         struct brcmf_cfg80211_vif *vif;
4917
4918         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4919
4920         /* only DHCP support for now */
4921         if (proto != NL80211_CRIT_PROTO_DHCP)
4922                 return -EINVAL;
4923
4924         /* suppress and abort scanning */
4925         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4926         brcmf_abort_scanning(cfg);
4927
4928         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
4929 }
4930
4931 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
4932                                            struct wireless_dev *wdev)
4933 {
4934         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4935         struct brcmf_cfg80211_vif *vif;
4936
4937         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4938
4939         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
4940         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4941 }
4942
4943 static s32
4944 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
4945                              const struct brcmf_event_msg *e, void *data)
4946 {
4947         switch (e->reason) {
4948         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
4949                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
4950                 break;
4951         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
4952                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
4953                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4954                 break;
4955         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
4956                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
4957                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4958                 break;
4959         }
4960
4961         return 0;
4962 }
4963
4964 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
4965 {
4966         int ret;
4967
4968         switch (oper) {
4969         case NL80211_TDLS_DISCOVERY_REQ:
4970                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
4971                 break;
4972         case NL80211_TDLS_SETUP:
4973                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
4974                 break;
4975         case NL80211_TDLS_TEARDOWN:
4976                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
4977                 break;
4978         default:
4979                 brcmf_err("unsupported operation: %d\n", oper);
4980                 ret = -EOPNOTSUPP;
4981         }
4982         return ret;
4983 }
4984
4985 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
4986                                     struct net_device *ndev, const u8 *peer,
4987                                     enum nl80211_tdls_operation oper)
4988 {
4989         struct brcmf_if *ifp;
4990         struct brcmf_tdls_iovar_le info;
4991         int ret = 0;
4992
4993         ret = brcmf_convert_nl80211_tdls_oper(oper);
4994         if (ret < 0)
4995                 return ret;
4996
4997         ifp = netdev_priv(ndev);
4998         memset(&info, 0, sizeof(info));
4999         info.mode = (u8)ret;
5000         if (peer)
5001                 memcpy(info.ea, peer, ETH_ALEN);
5002
5003         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5004                                        &info, sizeof(info));
5005         if (ret < 0)
5006                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5007
5008         return ret;
5009 }
5010
5011 #ifdef CONFIG_PM
5012 static int
5013 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5014                               struct cfg80211_gtk_rekey_data *gtk)
5015 {
5016         struct brcmf_if *ifp = netdev_priv(ndev);
5017         struct brcmf_gtk_keyinfo_le gtk_le;
5018         int ret;
5019
5020         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5021
5022         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5023         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5024         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5025                sizeof(gtk_le.replay_counter));
5026
5027         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5028                                        sizeof(gtk_le));
5029         if (ret < 0)
5030                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5031
5032         return ret;
5033 }
5034 #endif
5035
5036 static struct cfg80211_ops brcmf_cfg80211_ops = {
5037         .add_virtual_intf = brcmf_cfg80211_add_iface,
5038         .del_virtual_intf = brcmf_cfg80211_del_iface,
5039         .change_virtual_intf = brcmf_cfg80211_change_iface,
5040         .scan = brcmf_cfg80211_scan,
5041         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5042         .join_ibss = brcmf_cfg80211_join_ibss,
5043         .leave_ibss = brcmf_cfg80211_leave_ibss,
5044         .get_station = brcmf_cfg80211_get_station,
5045         .dump_station = brcmf_cfg80211_dump_station,
5046         .set_tx_power = brcmf_cfg80211_set_tx_power,
5047         .get_tx_power = brcmf_cfg80211_get_tx_power,
5048         .add_key = brcmf_cfg80211_add_key,
5049         .del_key = brcmf_cfg80211_del_key,
5050         .get_key = brcmf_cfg80211_get_key,
5051         .set_default_key = brcmf_cfg80211_config_default_key,
5052         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5053         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5054         .connect = brcmf_cfg80211_connect,
5055         .disconnect = brcmf_cfg80211_disconnect,
5056         .suspend = brcmf_cfg80211_suspend,
5057         .resume = brcmf_cfg80211_resume,
5058         .set_pmksa = brcmf_cfg80211_set_pmksa,
5059         .del_pmksa = brcmf_cfg80211_del_pmksa,
5060         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5061         .start_ap = brcmf_cfg80211_start_ap,
5062         .stop_ap = brcmf_cfg80211_stop_ap,
5063         .change_beacon = brcmf_cfg80211_change_beacon,
5064         .del_station = brcmf_cfg80211_del_station,
5065         .change_station = brcmf_cfg80211_change_station,
5066         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5067         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5068         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5069         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5070         .remain_on_channel = brcmf_p2p_remain_on_channel,
5071         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5072         .start_p2p_device = brcmf_p2p_start_device,
5073         .stop_p2p_device = brcmf_p2p_stop_device,
5074         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5075         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5076         .tdls_oper = brcmf_cfg80211_tdls_oper,
5077 };
5078
5079 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5080                                            enum nl80211_iftype type,
5081                                            bool pm_block)
5082 {
5083         struct brcmf_cfg80211_vif *vif_walk;
5084         struct brcmf_cfg80211_vif *vif;
5085         bool mbss;
5086
5087         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5088                   sizeof(*vif));
5089         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5090         if (!vif)
5091                 return ERR_PTR(-ENOMEM);
5092
5093         vif->wdev.wiphy = cfg->wiphy;
5094         vif->wdev.iftype = type;
5095
5096         vif->pm_block = pm_block;
5097
5098         brcmf_init_prof(&vif->profile);
5099
5100         if (type == NL80211_IFTYPE_AP) {
5101                 mbss = false;
5102                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5103                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5104                                 mbss = true;
5105                                 break;
5106                         }
5107                 }
5108                 vif->mbss = mbss;
5109         }
5110
5111         list_add_tail(&vif->list, &cfg->vif_list);
5112         return vif;
5113 }
5114
5115 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5116 {
5117         list_del(&vif->list);
5118         kfree(vif);
5119 }
5120
5121 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5122 {
5123         struct brcmf_cfg80211_vif *vif;
5124         struct brcmf_if *ifp;
5125
5126         ifp = netdev_priv(ndev);
5127         vif = ifp->vif;
5128
5129         if (vif)
5130                 brcmf_free_vif(vif);
5131         free_netdev(ndev);
5132 }
5133
5134 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
5135 {
5136         u32 event = e->event_code;
5137         u32 status = e->status;
5138
5139         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5140                 brcmf_dbg(CONN, "Processing set ssid\n");
5141                 return true;
5142         }
5143
5144         return false;
5145 }
5146
5147 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5148 {
5149         u32 event = e->event_code;
5150         u16 flags = e->flags;
5151
5152         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5153             (event == BRCMF_E_DISASSOC_IND) ||
5154             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5155                 brcmf_dbg(CONN, "Processing link down\n");
5156                 return true;
5157         }
5158         return false;
5159 }
5160
5161 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5162                                const struct brcmf_event_msg *e)
5163 {
5164         u32 event = e->event_code;
5165         u32 status = e->status;
5166
5167         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5168                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5169                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5170                 return true;
5171         }
5172
5173         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5174                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5175                 return true;
5176         }
5177
5178         return false;
5179 }
5180
5181 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5182 {
5183         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5184
5185         kfree(conn_info->req_ie);
5186         conn_info->req_ie = NULL;
5187         conn_info->req_ie_len = 0;
5188         kfree(conn_info->resp_ie);
5189         conn_info->resp_ie = NULL;
5190         conn_info->resp_ie_len = 0;
5191 }
5192
5193 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5194                                struct brcmf_if *ifp)
5195 {
5196         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5197         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5198         u32 req_len;
5199         u32 resp_len;
5200         s32 err = 0;
5201
5202         brcmf_clear_assoc_ies(cfg);
5203
5204         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5205                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5206         if (err) {
5207                 brcmf_err("could not get assoc info (%d)\n", err);
5208                 return err;
5209         }
5210         assoc_info =
5211                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5212         req_len = le32_to_cpu(assoc_info->req_len);
5213         resp_len = le32_to_cpu(assoc_info->resp_len);
5214         if (req_len) {
5215                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5216                                                cfg->extra_buf,
5217                                                WL_ASSOC_INFO_MAX);
5218                 if (err) {
5219                         brcmf_err("could not get assoc req (%d)\n", err);
5220                         return err;
5221                 }
5222                 conn_info->req_ie_len = req_len;
5223                 conn_info->req_ie =
5224                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5225                             GFP_KERNEL);
5226         } else {
5227                 conn_info->req_ie_len = 0;
5228                 conn_info->req_ie = NULL;
5229         }
5230         if (resp_len) {
5231                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5232                                                cfg->extra_buf,
5233                                                WL_ASSOC_INFO_MAX);
5234                 if (err) {
5235                         brcmf_err("could not get assoc resp (%d)\n", err);
5236                         return err;
5237                 }
5238                 conn_info->resp_ie_len = resp_len;
5239                 conn_info->resp_ie =
5240                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5241                             GFP_KERNEL);
5242         } else {
5243                 conn_info->resp_ie_len = 0;
5244                 conn_info->resp_ie = NULL;
5245         }
5246         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5247                   conn_info->req_ie_len, conn_info->resp_ie_len);
5248
5249         return err;
5250 }
5251
5252 static s32
5253 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5254                        struct net_device *ndev,
5255                        const struct brcmf_event_msg *e)
5256 {
5257         struct brcmf_if *ifp = netdev_priv(ndev);
5258         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5259         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5260         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5261         struct ieee80211_channel *notify_channel = NULL;
5262         struct ieee80211_supported_band *band;
5263         struct brcmf_bss_info_le *bi;
5264         struct brcmu_chan ch;
5265         u32 freq;
5266         s32 err = 0;
5267         u8 *buf;
5268
5269         brcmf_dbg(TRACE, "Enter\n");
5270
5271         brcmf_get_assoc_ies(cfg, ifp);
5272         memcpy(profile->bssid, e->addr, ETH_ALEN);
5273         brcmf_update_bss_info(cfg, ifp);
5274
5275         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5276         if (buf == NULL) {
5277                 err = -ENOMEM;
5278                 goto done;
5279         }
5280
5281         /* data sent to dongle has to be little endian */
5282         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5283         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5284                                      buf, WL_BSS_INFO_MAX);
5285
5286         if (err)
5287                 goto done;
5288
5289         bi = (struct brcmf_bss_info_le *)(buf + 4);
5290         ch.chspec = le16_to_cpu(bi->chanspec);
5291         cfg->d11inf.decchspec(&ch);
5292
5293         if (ch.band == BRCMU_CHAN_BAND_2G)
5294                 band = wiphy->bands[NL80211_BAND_2GHZ];
5295         else
5296                 band = wiphy->bands[NL80211_BAND_5GHZ];
5297
5298         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5299         notify_channel = ieee80211_get_channel(wiphy, freq);
5300
5301 done:
5302         kfree(buf);
5303         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
5304                         conn_info->req_ie, conn_info->req_ie_len,
5305                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
5306         brcmf_dbg(CONN, "Report roaming result\n");
5307
5308         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5309         brcmf_dbg(TRACE, "Exit\n");
5310         return err;
5311 }
5312
5313 static s32
5314 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5315                        struct net_device *ndev, const struct brcmf_event_msg *e,
5316                        bool completed)
5317 {
5318         struct brcmf_if *ifp = netdev_priv(ndev);
5319         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5320         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5321
5322         brcmf_dbg(TRACE, "Enter\n");
5323
5324         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5325                                &ifp->vif->sme_state)) {
5326                 if (completed) {
5327                         brcmf_get_assoc_ies(cfg, ifp);
5328                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5329                         brcmf_update_bss_info(cfg, ifp);
5330                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5331                                 &ifp->vif->sme_state);
5332                 }
5333                 cfg80211_connect_result(ndev,
5334                                         (u8 *)profile->bssid,
5335                                         conn_info->req_ie,
5336                                         conn_info->req_ie_len,
5337                                         conn_info->resp_ie,
5338                                         conn_info->resp_ie_len,
5339                                         completed ? WLAN_STATUS_SUCCESS :
5340                                                     WLAN_STATUS_AUTH_TIMEOUT,
5341                                         GFP_KERNEL);
5342                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5343                           completed ? "succeeded" : "failed");
5344         }
5345         brcmf_dbg(TRACE, "Exit\n");
5346         return 0;
5347 }
5348
5349 static s32
5350 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5351                                struct net_device *ndev,
5352                                const struct brcmf_event_msg *e, void *data)
5353 {
5354         struct brcmf_if *ifp = netdev_priv(ndev);
5355         static int generation;
5356         u32 event = e->event_code;
5357         u32 reason = e->reason;
5358         struct station_info sinfo;
5359
5360         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
5361         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5362             ndev != cfg_to_ndev(cfg)) {
5363                 brcmf_dbg(CONN, "AP mode link down\n");
5364                 complete(&cfg->vif_disabled);
5365                 if (ifp->vif->mbss)
5366                         brcmf_remove_interface(ifp);
5367                 return 0;
5368         }
5369
5370         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5371             (reason == BRCMF_E_STATUS_SUCCESS)) {
5372                 memset(&sinfo, 0, sizeof(sinfo));
5373                 if (!data) {
5374                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5375                         return -EINVAL;
5376                 }
5377                 sinfo.assoc_req_ies = data;
5378                 sinfo.assoc_req_ies_len = e->datalen;
5379                 generation++;
5380                 sinfo.generation = generation;
5381                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5382         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5383                    (event == BRCMF_E_DEAUTH_IND) ||
5384                    (event == BRCMF_E_DEAUTH)) {
5385                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5386         }
5387         return 0;
5388 }
5389
5390 static s32
5391 brcmf_notify_connect_status(struct brcmf_if *ifp,
5392                             const struct brcmf_event_msg *e, void *data)
5393 {
5394         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5395         struct net_device *ndev = ifp->ndev;
5396         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5397         struct ieee80211_channel *chan;
5398         s32 err = 0;
5399
5400         if ((e->event_code == BRCMF_E_DEAUTH) ||
5401             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5402             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5403             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5404                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5405         }
5406
5407         if (brcmf_is_apmode(ifp->vif)) {
5408                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5409         } else if (brcmf_is_linkup(e)) {
5410                 brcmf_dbg(CONN, "Linkup\n");
5411                 if (brcmf_is_ibssmode(ifp->vif)) {
5412                         brcmf_inform_ibss(cfg, ndev, e->addr);
5413                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5414                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5415                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5416                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5417                                   &ifp->vif->sme_state);
5418                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5419                                 &ifp->vif->sme_state);
5420                 } else
5421                         brcmf_bss_connect_done(cfg, ndev, e, true);
5422                 brcmf_net_setcarrier(ifp, true);
5423         } else if (brcmf_is_linkdown(e)) {
5424                 brcmf_dbg(CONN, "Linkdown\n");
5425                 if (!brcmf_is_ibssmode(ifp->vif)) {
5426                         brcmf_bss_connect_done(cfg, ndev, e, false);
5427                         brcmf_link_down(ifp->vif,
5428                                         brcmf_map_fw_linkdown_reason(e));
5429                         brcmf_init_prof(ndev_to_prof(ndev));
5430                         if (ndev != cfg_to_ndev(cfg))
5431                                 complete(&cfg->vif_disabled);
5432                         brcmf_net_setcarrier(ifp, false);
5433                 }
5434         } else if (brcmf_is_nonetwork(cfg, e)) {
5435                 if (brcmf_is_ibssmode(ifp->vif))
5436                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5437                                   &ifp->vif->sme_state);
5438                 else
5439                         brcmf_bss_connect_done(cfg, ndev, e, false);
5440         }
5441
5442         return err;
5443 }
5444
5445 static s32
5446 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5447                             const struct brcmf_event_msg *e, void *data)
5448 {
5449         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5450         u32 event = e->event_code;
5451         u32 status = e->status;
5452
5453         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5454                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5455                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5456                 else
5457                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5458         }
5459
5460         return 0;
5461 }
5462
5463 static s32
5464 brcmf_notify_mic_status(struct brcmf_if *ifp,
5465                         const struct brcmf_event_msg *e, void *data)
5466 {
5467         u16 flags = e->flags;
5468         enum nl80211_key_type key_type;
5469
5470         if (flags & BRCMF_EVENT_MSG_GROUP)
5471                 key_type = NL80211_KEYTYPE_GROUP;
5472         else
5473                 key_type = NL80211_KEYTYPE_PAIRWISE;
5474
5475         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5476                                      NULL, GFP_KERNEL);
5477
5478         return 0;
5479 }
5480
5481 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5482                                   const struct brcmf_event_msg *e, void *data)
5483 {
5484         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5485         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5486         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5487         struct brcmf_cfg80211_vif *vif;
5488
5489         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5490                   ifevent->action, ifevent->flags, ifevent->ifidx,
5491                   ifevent->bsscfgidx);
5492
5493         mutex_lock(&event->vif_event_lock);
5494         event->action = ifevent->action;
5495         vif = event->vif;
5496
5497         switch (ifevent->action) {
5498         case BRCMF_E_IF_ADD:
5499                 /* waiting process may have timed out */
5500                 if (!cfg->vif_event.vif) {
5501                         mutex_unlock(&event->vif_event_lock);
5502                         return -EBADF;
5503                 }
5504
5505                 ifp->vif = vif;
5506                 vif->ifp = ifp;
5507                 if (ifp->ndev) {
5508                         vif->wdev.netdev = ifp->ndev;
5509                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5510                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5511                 }
5512                 mutex_unlock(&event->vif_event_lock);
5513                 wake_up(&event->vif_wq);
5514                 return 0;
5515
5516         case BRCMF_E_IF_DEL:
5517                 mutex_unlock(&event->vif_event_lock);
5518                 /* event may not be upon user request */
5519                 if (brcmf_cfg80211_vif_event_armed(cfg))
5520                         wake_up(&event->vif_wq);
5521                 return 0;
5522
5523         case BRCMF_E_IF_CHANGE:
5524                 mutex_unlock(&event->vif_event_lock);
5525                 wake_up(&event->vif_wq);
5526                 return 0;
5527
5528         default:
5529                 mutex_unlock(&event->vif_event_lock);
5530                 break;
5531         }
5532         return -EINVAL;
5533 }
5534
5535 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5536 {
5537         conf->frag_threshold = (u32)-1;
5538         conf->rts_threshold = (u32)-1;
5539         conf->retry_short = (u32)-1;
5540         conf->retry_long = (u32)-1;
5541 }
5542
5543 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5544 {
5545         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5546                             brcmf_notify_connect_status);
5547         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5548                             brcmf_notify_connect_status);
5549         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5550                             brcmf_notify_connect_status);
5551         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5552                             brcmf_notify_connect_status);
5553         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5554                             brcmf_notify_connect_status);
5555         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5556                             brcmf_notify_connect_status);
5557         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5558                             brcmf_notify_roaming_status);
5559         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5560                             brcmf_notify_mic_status);
5561         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5562                             brcmf_notify_connect_status);
5563         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5564                             brcmf_notify_sched_scan_results);
5565         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5566                             brcmf_notify_vif_event);
5567         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5568                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5569         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5570                             brcmf_p2p_notify_listen_complete);
5571         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5572                             brcmf_p2p_notify_action_frame_rx);
5573         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5574                             brcmf_p2p_notify_action_tx_complete);
5575         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5576                             brcmf_p2p_notify_action_tx_complete);
5577 }
5578
5579 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5580 {
5581         kfree(cfg->conf);
5582         cfg->conf = NULL;
5583         kfree(cfg->extra_buf);
5584         cfg->extra_buf = NULL;
5585         kfree(cfg->wowl.nd);
5586         cfg->wowl.nd = NULL;
5587         kfree(cfg->wowl.nd_info);
5588         cfg->wowl.nd_info = NULL;
5589         kfree(cfg->escan_info.escan_buf);
5590         cfg->escan_info.escan_buf = NULL;
5591 }
5592
5593 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5594 {
5595         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5596         if (!cfg->conf)
5597                 goto init_priv_mem_out;
5598         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5599         if (!cfg->extra_buf)
5600                 goto init_priv_mem_out;
5601         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5602         if (!cfg->wowl.nd)
5603                 goto init_priv_mem_out;
5604         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5605                                     sizeof(struct cfg80211_wowlan_nd_match *),
5606                                     GFP_KERNEL);
5607         if (!cfg->wowl.nd_info)
5608                 goto init_priv_mem_out;
5609         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5610         if (!cfg->escan_info.escan_buf)
5611                 goto init_priv_mem_out;
5612
5613         return 0;
5614
5615 init_priv_mem_out:
5616         brcmf_deinit_priv_mem(cfg);
5617
5618         return -ENOMEM;
5619 }
5620
5621 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5622 {
5623         s32 err = 0;
5624
5625         cfg->scan_request = NULL;
5626         cfg->pwr_save = true;
5627         cfg->active_scan = true;        /* we do active scan per default */
5628         cfg->dongle_up = false;         /* dongle is not up yet */
5629         err = brcmf_init_priv_mem(cfg);
5630         if (err)
5631                 return err;
5632         brcmf_register_event_handlers(cfg);
5633         mutex_init(&cfg->usr_sync);
5634         brcmf_init_escan(cfg);
5635         brcmf_init_conf(cfg->conf);
5636         init_completion(&cfg->vif_disabled);
5637         return err;
5638 }
5639
5640 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5641 {
5642         cfg->dongle_up = false; /* dongle down */
5643         brcmf_abort_scanning(cfg);
5644         brcmf_deinit_priv_mem(cfg);
5645 }
5646
5647 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5648 {
5649         init_waitqueue_head(&event->vif_wq);
5650         mutex_init(&event->vif_event_lock);
5651 }
5652
5653 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5654 {
5655         s32 err;
5656         u32 bcn_timeout;
5657         __le32 roamtrigger[2];
5658         __le32 roam_delta[2];
5659
5660         /* Configure beacon timeout value based upon roaming setting */
5661         if (ifp->drvr->settings->roamoff)
5662                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5663         else
5664                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5665         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5666         if (err) {
5667                 brcmf_err("bcn_timeout error (%d)\n", err);
5668                 goto roam_setup_done;
5669         }
5670
5671         /* Enable/Disable built-in roaming to allow supplicant to take care of
5672          * roaming.
5673          */
5674         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5675                   ifp->drvr->settings->roamoff ? "Off" : "On");
5676         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5677                                       ifp->drvr->settings->roamoff);
5678         if (err) {
5679                 brcmf_err("roam_off error (%d)\n", err);
5680                 goto roam_setup_done;
5681         }
5682
5683         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5684         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5685         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5686                                      (void *)roamtrigger, sizeof(roamtrigger));
5687         if (err) {
5688                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5689                 goto roam_setup_done;
5690         }
5691
5692         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5693         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5694         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5695                                      (void *)roam_delta, sizeof(roam_delta));
5696         if (err) {
5697                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5698                 goto roam_setup_done;
5699         }
5700
5701 roam_setup_done:
5702         return err;
5703 }
5704
5705 static s32
5706 brcmf_dongle_scantime(struct brcmf_if *ifp)
5707 {
5708         s32 err = 0;
5709
5710         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5711                                     BRCMF_SCAN_CHANNEL_TIME);
5712         if (err) {
5713                 brcmf_err("Scan assoc time error (%d)\n", err);
5714                 goto dongle_scantime_out;
5715         }
5716         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5717                                     BRCMF_SCAN_UNASSOC_TIME);
5718         if (err) {
5719                 brcmf_err("Scan unassoc time error (%d)\n", err);
5720                 goto dongle_scantime_out;
5721         }
5722
5723         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5724                                     BRCMF_SCAN_PASSIVE_TIME);
5725         if (err) {
5726                 brcmf_err("Scan passive time error (%d)\n", err);
5727                 goto dongle_scantime_out;
5728         }
5729
5730 dongle_scantime_out:
5731         return err;
5732 }
5733
5734 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5735                                            struct brcmu_chan *ch)
5736 {
5737         u32 ht40_flag;
5738
5739         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5740         if (ch->sb == BRCMU_CHAN_SB_U) {
5741                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5742                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5743                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5744         } else {
5745                 /* It should be one of
5746                  * IEEE80211_CHAN_NO_HT40 or
5747                  * IEEE80211_CHAN_NO_HT40PLUS
5748                  */
5749                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5750                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5751                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5752         }
5753 }
5754
5755 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5756                                     u32 bw_cap[])
5757 {
5758         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5759         struct ieee80211_supported_band *band;
5760         struct ieee80211_channel *channel;
5761         struct wiphy *wiphy;
5762         struct brcmf_chanspec_list *list;
5763         struct brcmu_chan ch;
5764         int err;
5765         u8 *pbuf;
5766         u32 i, j;
5767         u32 total;
5768         u32 chaninfo;
5769         u32 index;
5770
5771         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5772
5773         if (pbuf == NULL)
5774                 return -ENOMEM;
5775
5776         list = (struct brcmf_chanspec_list *)pbuf;
5777
5778         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5779                                        BRCMF_DCMD_MEDLEN);
5780         if (err) {
5781                 brcmf_err("get chanspecs error (%d)\n", err);
5782                 goto fail_pbuf;
5783         }
5784
5785         wiphy = cfg_to_wiphy(cfg);
5786         band = wiphy->bands[NL80211_BAND_2GHZ];
5787         if (band)
5788                 for (i = 0; i < band->n_channels; i++)
5789                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5790         band = wiphy->bands[NL80211_BAND_5GHZ];
5791         if (band)
5792                 for (i = 0; i < band->n_channels; i++)
5793                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5794
5795         total = le32_to_cpu(list->count);
5796         for (i = 0; i < total; i++) {
5797                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5798                 cfg->d11inf.decchspec(&ch);
5799
5800                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5801                         band = wiphy->bands[NL80211_BAND_2GHZ];
5802                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5803                         band = wiphy->bands[NL80211_BAND_5GHZ];
5804                 } else {
5805                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5806                         continue;
5807                 }
5808                 if (!band)
5809                         continue;
5810                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5811                     ch.bw == BRCMU_CHAN_BW_40)
5812                         continue;
5813                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5814                     ch.bw == BRCMU_CHAN_BW_80)
5815                         continue;
5816
5817                 channel = band->channels;
5818                 index = band->n_channels;
5819                 for (j = 0; j < band->n_channels; j++) {
5820                         if (channel[j].hw_value == ch.control_ch_num) {
5821                                 index = j;
5822                                 break;
5823                         }
5824                 }
5825                 channel[index].center_freq =
5826                         ieee80211_channel_to_frequency(ch.control_ch_num,
5827                                                        band->band);
5828                 channel[index].hw_value = ch.control_ch_num;
5829
5830                 /* assuming the chanspecs order is HT20,
5831                  * HT40 upper, HT40 lower, and VHT80.
5832                  */
5833                 if (ch.bw == BRCMU_CHAN_BW_80) {
5834                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5835                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5836                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5837                 } else {
5838                         /* enable the channel and disable other bandwidths
5839                          * for now as mentioned order assure they are enabled
5840                          * for subsequent chanspecs.
5841                          */
5842                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5843                                                IEEE80211_CHAN_NO_80MHZ;
5844                         ch.bw = BRCMU_CHAN_BW_20;
5845                         cfg->d11inf.encchspec(&ch);
5846                         chaninfo = ch.chspec;
5847                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5848                                                        &chaninfo);
5849                         if (!err) {
5850                                 if (chaninfo & WL_CHAN_RADAR)
5851                                         channel[index].flags |=
5852                                                 (IEEE80211_CHAN_RADAR |
5853                                                  IEEE80211_CHAN_NO_IR);
5854                                 if (chaninfo & WL_CHAN_PASSIVE)
5855                                         channel[index].flags |=
5856                                                 IEEE80211_CHAN_NO_IR;
5857                         }
5858                 }
5859         }
5860
5861 fail_pbuf:
5862         kfree(pbuf);
5863         return err;
5864 }
5865
5866 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
5867 {
5868         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5869         struct ieee80211_supported_band *band;
5870         struct brcmf_fil_bwcap_le band_bwcap;
5871         struct brcmf_chanspec_list *list;
5872         u8 *pbuf;
5873         u32 val;
5874         int err;
5875         struct brcmu_chan ch;
5876         u32 num_chan;
5877         int i, j;
5878
5879         /* verify support for bw_cap command */
5880         val = WLC_BAND_5G;
5881         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
5882
5883         if (!err) {
5884                 /* only set 2G bandwidth using bw_cap command */
5885                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
5886                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
5887                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
5888                                                sizeof(band_bwcap));
5889         } else {
5890                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
5891                 val = WLC_N_BW_40ALL;
5892                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
5893         }
5894
5895         if (!err) {
5896                 /* update channel info in 2G band */
5897                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5898
5899                 if (pbuf == NULL)
5900                         return -ENOMEM;
5901
5902                 ch.band = BRCMU_CHAN_BAND_2G;
5903                 ch.bw = BRCMU_CHAN_BW_40;
5904                 ch.sb = BRCMU_CHAN_SB_NONE;
5905                 ch.chnum = 0;
5906                 cfg->d11inf.encchspec(&ch);
5907
5908                 /* pass encoded chanspec in query */
5909                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
5910
5911                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5912                                                BRCMF_DCMD_MEDLEN);
5913                 if (err) {
5914                         brcmf_err("get chanspecs error (%d)\n", err);
5915                         kfree(pbuf);
5916                         return err;
5917                 }
5918
5919                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
5920                 list = (struct brcmf_chanspec_list *)pbuf;
5921                 num_chan = le32_to_cpu(list->count);
5922                 for (i = 0; i < num_chan; i++) {
5923                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
5924                         cfg->d11inf.decchspec(&ch);
5925                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
5926                                 continue;
5927                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
5928                                 continue;
5929                         for (j = 0; j < band->n_channels; j++) {
5930                                 if (band->channels[j].hw_value == ch.control_ch_num)
5931                                         break;
5932                         }
5933                         if (WARN_ON(j == band->n_channels))
5934                                 continue;
5935
5936                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
5937                 }
5938                 kfree(pbuf);
5939         }
5940         return err;
5941 }
5942
5943 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
5944 {
5945         u32 band, mimo_bwcap;
5946         int err;
5947
5948         band = WLC_BAND_2G;
5949         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5950         if (!err) {
5951                 bw_cap[NL80211_BAND_2GHZ] = band;
5952                 band = WLC_BAND_5G;
5953                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5954                 if (!err) {
5955                         bw_cap[NL80211_BAND_5GHZ] = band;
5956                         return;
5957                 }
5958                 WARN_ON(1);
5959                 return;
5960         }
5961         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
5962         mimo_bwcap = 0;
5963         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
5964         if (err)
5965                 /* assume 20MHz if firmware does not give a clue */
5966                 mimo_bwcap = WLC_N_BW_20ALL;
5967
5968         switch (mimo_bwcap) {
5969         case WLC_N_BW_40ALL:
5970                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
5971                 /* fall-thru */
5972         case WLC_N_BW_20IN2G_40IN5G:
5973                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
5974                 /* fall-thru */
5975         case WLC_N_BW_20ALL:
5976                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
5977                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
5978                 break;
5979         default:
5980                 brcmf_err("invalid mimo_bw_cap value\n");
5981         }
5982 }
5983
5984 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
5985                                 u32 bw_cap[2], u32 nchain)
5986 {
5987         band->ht_cap.ht_supported = true;
5988         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
5989                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
5990                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5991         }
5992         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
5993         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
5994         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
5995         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
5996         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
5997         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5998 }
5999
6000 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6001 {
6002         u16 mcs_map;
6003         int i;
6004
6005         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6006                 mcs_map = (mcs_map << 2) | supp;
6007
6008         return cpu_to_le16(mcs_map);
6009 }
6010
6011 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6012                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6013                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6014 {
6015         __le16 mcs_map;
6016
6017         /* not allowed in 2.4G band */
6018         if (band->band == NL80211_BAND_2GHZ)
6019                 return;
6020
6021         band->vht_cap.vht_supported = true;
6022         /* 80MHz is mandatory */
6023         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6024         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6025                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6026                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6027         }
6028         /* all support 256-QAM */
6029         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6030         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6031         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6032
6033         /* Beamforming support information */
6034         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6035                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6036         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6037                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6038         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6039                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6040         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6041                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6042
6043         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6044                 band->vht_cap.cap |=
6045                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6046                 band->vht_cap.cap |= ((txstreams - 1) <<
6047                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6048                 band->vht_cap.cap |=
6049                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6050         }
6051 }
6052
6053 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6054 {
6055         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6056         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6057         u32 nmode = 0;
6058         u32 vhtmode = 0;
6059         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6060         u32 rxchain;
6061         u32 nchain;
6062         int err;
6063         s32 i;
6064         struct ieee80211_supported_band *band;
6065         u32 txstreams = 0;
6066         u32 txbf_bfe_cap = 0;
6067         u32 txbf_bfr_cap = 0;
6068
6069         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6070         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6071         if (err) {
6072                 brcmf_err("nmode error (%d)\n", err);
6073         } else {
6074                 brcmf_get_bwcap(ifp, bw_cap);
6075         }
6076         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6077                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6078                   bw_cap[NL80211_BAND_5GHZ]);
6079
6080         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6081         if (err) {
6082                 brcmf_err("rxchain error (%d)\n", err);
6083                 nchain = 1;
6084         } else {
6085                 for (nchain = 0; rxchain; nchain++)
6086                         rxchain = rxchain & (rxchain - 1);
6087         }
6088         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6089
6090         err = brcmf_construct_chaninfo(cfg, bw_cap);
6091         if (err) {
6092                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6093                 return err;
6094         }
6095
6096         if (vhtmode) {
6097                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6098                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6099                                               &txbf_bfe_cap);
6100                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6101                                               &txbf_bfr_cap);
6102         }
6103
6104         wiphy = cfg_to_wiphy(cfg);
6105         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6106                 band = wiphy->bands[i];
6107                 if (band == NULL)
6108                         continue;
6109
6110                 if (nmode)
6111                         brcmf_update_ht_cap(band, bw_cap, nchain);
6112                 if (vhtmode)
6113                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6114                                              txbf_bfe_cap, txbf_bfr_cap);
6115         }
6116
6117         return 0;
6118 }
6119
6120 static const struct ieee80211_txrx_stypes
6121 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6122         [NL80211_IFTYPE_STATION] = {
6123                 .tx = 0xffff,
6124                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6125                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6126         },
6127         [NL80211_IFTYPE_P2P_CLIENT] = {
6128                 .tx = 0xffff,
6129                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6130                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6131         },
6132         [NL80211_IFTYPE_P2P_GO] = {
6133                 .tx = 0xffff,
6134                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6135                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6136                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6137                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6138                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6139                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6140                       BIT(IEEE80211_STYPE_ACTION >> 4)
6141         },
6142         [NL80211_IFTYPE_P2P_DEVICE] = {
6143                 .tx = 0xffff,
6144                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6145                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6146         }
6147 };
6148
6149 /**
6150  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6151  *
6152  * @wiphy: wiphy object.
6153  * @ifp: interface object needed for feat module api.
6154  *
6155  * The interface modes and combinations are determined dynamically here
6156  * based on firmware functionality.
6157  *
6158  * no p2p and no mbss:
6159  *
6160  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6161  *
6162  * no p2p and mbss:
6163  *
6164  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6165  *      #AP <= 4, matching BI, channels = 1, 4 total
6166  *
6167  * p2p, no mchan, and mbss:
6168  *
6169  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6170  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6171  *      #AP <= 4, matching BI, channels = 1, 4 total
6172  *
6173  * p2p, mchan, and mbss:
6174  *
6175  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6176  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6177  *      #AP <= 4, matching BI, channels = 1, 4 total
6178  */
6179 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6180 {
6181         struct ieee80211_iface_combination *combo = NULL;
6182         struct ieee80211_iface_limit *c0_limits = NULL;
6183         struct ieee80211_iface_limit *p2p_limits = NULL;
6184         struct ieee80211_iface_limit *mbss_limits = NULL;
6185         bool mbss, p2p;
6186         int i, c, n_combos;
6187
6188         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6189         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6190
6191         n_combos = 1 + !!p2p + !!mbss;
6192         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6193         if (!combo)
6194                 goto err;
6195
6196         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6197         if (!c0_limits)
6198                 goto err;
6199
6200         if (p2p) {
6201                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6202                 if (!p2p_limits)
6203                         goto err;
6204         }
6205
6206         if (mbss) {
6207                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6208                 if (!mbss_limits)
6209                         goto err;
6210         }
6211
6212         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6213                                  BIT(NL80211_IFTYPE_ADHOC) |
6214                                  BIT(NL80211_IFTYPE_AP);
6215
6216         c = 0;
6217         i = 0;
6218         combo[c].num_different_channels = 1;
6219         c0_limits[i].max = 1;
6220         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6221         if (p2p) {
6222                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6223                         combo[c].num_different_channels = 2;
6224                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6225                                           BIT(NL80211_IFTYPE_P2P_GO) |
6226                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6227                 c0_limits[i].max = 1;
6228                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6229                 c0_limits[i].max = 1;
6230                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6231                                        BIT(NL80211_IFTYPE_P2P_GO);
6232         } else {
6233                 c0_limits[i].max = 1;
6234                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6235         }
6236         combo[c].max_interfaces = i;
6237         combo[c].n_limits = i;
6238         combo[c].limits = c0_limits;
6239
6240         if (p2p) {
6241                 c++;
6242                 i = 0;
6243                 combo[c].num_different_channels = 1;
6244                 p2p_limits[i].max = 1;
6245                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6246                 p2p_limits[i].max = 1;
6247                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6248                 p2p_limits[i].max = 1;
6249                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6250                 p2p_limits[i].max = 1;
6251                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6252                 combo[c].max_interfaces = i;
6253                 combo[c].n_limits = i;
6254                 combo[c].limits = p2p_limits;
6255         }
6256
6257         if (mbss) {
6258                 c++;
6259                 combo[c].beacon_int_infra_match = true;
6260                 combo[c].num_different_channels = 1;
6261                 mbss_limits[0].max = 4;
6262                 mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
6263                 combo[c].max_interfaces = 4;
6264                 combo[c].n_limits = 1;
6265                 combo[c].limits = mbss_limits;
6266         }
6267         wiphy->n_iface_combinations = n_combos;
6268         wiphy->iface_combinations = combo;
6269         return 0;
6270
6271 err:
6272         kfree(c0_limits);
6273         kfree(p2p_limits);
6274         kfree(mbss_limits);
6275         kfree(combo);
6276         return -ENOMEM;
6277 }
6278
6279 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
6280 {
6281         /* scheduled scan settings */
6282         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
6283         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6284         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6285         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
6286 }
6287
6288 #ifdef CONFIG_PM
6289 static struct wiphy_wowlan_support brcmf_wowlan_support = {
6290         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6291         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6292         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6293         .pattern_min_len = 1,
6294         .max_pkt_offset = 1500,
6295 };
6296 #endif
6297
6298 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6299 {
6300 #ifdef CONFIG_PM
6301         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6302
6303         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6304                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6305                         brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
6306                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6307                 }
6308         }
6309         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6310                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6311                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6312         }
6313
6314         wiphy->wowlan = &brcmf_wowlan_support;
6315 #endif
6316 }
6317
6318 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6319 {
6320         struct brcmf_pub *drvr = ifp->drvr;
6321         const struct ieee80211_iface_combination *combo;
6322         struct ieee80211_supported_band *band;
6323         u16 max_interfaces = 0;
6324         __le32 bandlist[3];
6325         u32 n_bands;
6326         int err, i;
6327
6328         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6329         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6330         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6331
6332         err = brcmf_setup_ifmodes(wiphy, ifp);
6333         if (err)
6334                 return err;
6335
6336         for (i = 0, combo = wiphy->iface_combinations;
6337              i < wiphy->n_iface_combinations; i++, combo++) {
6338                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6339         }
6340
6341         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6342              i++) {
6343                 u8 *addr = drvr->addresses[i].addr;
6344
6345                 memcpy(addr, drvr->mac, ETH_ALEN);
6346                 if (i) {
6347                         addr[0] |= BIT(1);
6348                         addr[ETH_ALEN - 1] ^= i;
6349                 }
6350         }
6351         wiphy->addresses = drvr->addresses;
6352         wiphy->n_addresses = i;
6353
6354         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6355         wiphy->cipher_suites = brcmf_cipher_suites;
6356         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6357         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6358                 wiphy->n_cipher_suites--;
6359         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6360                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6361                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6362
6363         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
6364                         WIPHY_FLAG_OFFCHAN_TX |
6365                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6366         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6367                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6368         if (!ifp->drvr->settings->roamoff)
6369                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6370         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6371         wiphy->max_remain_on_channel_duration = 5000;
6372         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
6373                 brcmf_wiphy_pno_params(wiphy);
6374
6375         /* vendor commands/events support */
6376         wiphy->vendor_commands = brcmf_vendor_cmds;
6377         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6378
6379         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6380                 brcmf_wiphy_wowl_params(wiphy, ifp);
6381         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6382                                      sizeof(bandlist));
6383         if (err) {
6384                 brcmf_err("could not obtain band info: err=%d\n", err);
6385                 return err;
6386         }
6387         /* first entry in bandlist is number of bands */
6388         n_bands = le32_to_cpu(bandlist[0]);
6389         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6390                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6391                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6392                                        GFP_KERNEL);
6393                         if (!band)
6394                                 return -ENOMEM;
6395
6396                         band->channels = kmemdup(&__wl_2ghz_channels,
6397                                                  sizeof(__wl_2ghz_channels),
6398                                                  GFP_KERNEL);
6399                         if (!band->channels) {
6400                                 kfree(band);
6401                                 return -ENOMEM;
6402                         }
6403
6404                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6405                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6406                 }
6407                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6408                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6409                                        GFP_KERNEL);
6410                         if (!band)
6411                                 return -ENOMEM;
6412
6413                         band->channels = kmemdup(&__wl_5ghz_channels,
6414                                                  sizeof(__wl_5ghz_channels),
6415                                                  GFP_KERNEL);
6416                         if (!band->channels) {
6417                                 kfree(band);
6418                                 return -ENOMEM;
6419                         }
6420
6421                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6422                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6423                 }
6424         }
6425         err = brcmf_setup_wiphybands(wiphy);
6426         return err;
6427 }
6428
6429 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6430 {
6431         struct net_device *ndev;
6432         struct wireless_dev *wdev;
6433         struct brcmf_if *ifp;
6434         s32 power_mode;
6435         s32 err = 0;
6436
6437         if (cfg->dongle_up)
6438                 return err;
6439
6440         ndev = cfg_to_ndev(cfg);
6441         wdev = ndev->ieee80211_ptr;
6442         ifp = netdev_priv(ndev);
6443
6444         /* make sure RF is ready for work */
6445         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6446
6447         brcmf_dongle_scantime(ifp);
6448
6449         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6450         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6451         if (err)
6452                 goto default_conf_out;
6453         brcmf_dbg(INFO, "power save set to %s\n",
6454                   (power_mode ? "enabled" : "disabled"));
6455
6456         err = brcmf_dongle_roam(ifp);
6457         if (err)
6458                 goto default_conf_out;
6459         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6460                                           NULL, NULL);
6461         if (err)
6462                 goto default_conf_out;
6463
6464         brcmf_configure_arp_nd_offload(ifp, true);
6465
6466         cfg->dongle_up = true;
6467 default_conf_out:
6468
6469         return err;
6470
6471 }
6472
6473 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6474 {
6475         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6476
6477         return brcmf_config_dongle(ifp->drvr->config);
6478 }
6479
6480 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6481 {
6482         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6483
6484         /*
6485          * While going down, if associated with AP disassociate
6486          * from AP to save power
6487          */
6488         if (check_vif_up(ifp->vif)) {
6489                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6490
6491                 /* Make sure WPA_Supplicant receives all the event
6492                    generated due to DISASSOC call to the fw to keep
6493                    the state fw and WPA_Supplicant state consistent
6494                  */
6495                 brcmf_delay(500);
6496         }
6497
6498         brcmf_abort_scanning(cfg);
6499         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6500
6501         return 0;
6502 }
6503
6504 s32 brcmf_cfg80211_up(struct net_device *ndev)
6505 {
6506         struct brcmf_if *ifp = netdev_priv(ndev);
6507         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6508         s32 err = 0;
6509
6510         mutex_lock(&cfg->usr_sync);
6511         err = __brcmf_cfg80211_up(ifp);
6512         mutex_unlock(&cfg->usr_sync);
6513
6514         return err;
6515 }
6516
6517 s32 brcmf_cfg80211_down(struct net_device *ndev)
6518 {
6519         struct brcmf_if *ifp = netdev_priv(ndev);
6520         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6521         s32 err = 0;
6522
6523         mutex_lock(&cfg->usr_sync);
6524         err = __brcmf_cfg80211_down(ifp);
6525         mutex_unlock(&cfg->usr_sync);
6526
6527         return err;
6528 }
6529
6530 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6531 {
6532         struct wireless_dev *wdev = &ifp->vif->wdev;
6533
6534         return wdev->iftype;
6535 }
6536
6537 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6538                              unsigned long state)
6539 {
6540         struct brcmf_cfg80211_vif *vif;
6541
6542         list_for_each_entry(vif, &cfg->vif_list, list) {
6543                 if (test_bit(state, &vif->sme_state))
6544                         return true;
6545         }
6546         return false;
6547 }
6548
6549 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6550                                     u8 action)
6551 {
6552         u8 evt_action;
6553
6554         mutex_lock(&event->vif_event_lock);
6555         evt_action = event->action;
6556         mutex_unlock(&event->vif_event_lock);
6557         return evt_action == action;
6558 }
6559
6560 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6561                                   struct brcmf_cfg80211_vif *vif)
6562 {
6563         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6564
6565         mutex_lock(&event->vif_event_lock);
6566         event->vif = vif;
6567         event->action = 0;
6568         mutex_unlock(&event->vif_event_lock);
6569 }
6570
6571 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6572 {
6573         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6574         bool armed;
6575
6576         mutex_lock(&event->vif_event_lock);
6577         armed = event->vif != NULL;
6578         mutex_unlock(&event->vif_event_lock);
6579
6580         return armed;
6581 }
6582
6583 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6584                                   u8 action, ulong timeout)
6585 {
6586         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6587
6588         return wait_event_timeout(event->vif_wq,
6589                                   vif_event_equals(event, action), timeout);
6590 }
6591
6592 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6593                                         struct brcmf_fil_country_le *ccreq)
6594 {
6595         struct brcmfmac_pd_cc *country_codes;
6596         struct brcmfmac_pd_cc_entry *cc;
6597         s32 found_index;
6598         int i;
6599
6600         country_codes = drvr->settings->country_codes;
6601         if (!country_codes) {
6602                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6603                 return -EINVAL;
6604         }
6605
6606         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6607             (alpha2[1] == ccreq->country_abbrev[1])) {
6608                 brcmf_dbg(TRACE, "Country code already set\n");
6609                 return -EAGAIN;
6610         }
6611
6612         found_index = -1;
6613         for (i = 0; i < country_codes->table_size; i++) {
6614                 cc = &country_codes->table[i];
6615                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6616                         found_index = i;
6617                 if ((cc->iso3166[0] == alpha2[0]) &&
6618                     (cc->iso3166[1] == alpha2[1])) {
6619                         found_index = i;
6620                         break;
6621                 }
6622         }
6623         if (found_index == -1) {
6624                 brcmf_dbg(TRACE, "No country code match found\n");
6625                 return -EINVAL;
6626         }
6627         memset(ccreq, 0, sizeof(*ccreq));
6628         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6629         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6630                BRCMF_COUNTRY_BUF_SZ);
6631         ccreq->country_abbrev[0] = alpha2[0];
6632         ccreq->country_abbrev[1] = alpha2[1];
6633         ccreq->country_abbrev[2] = 0;
6634
6635         return 0;
6636 }
6637
6638 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6639                                         struct regulatory_request *req)
6640 {
6641         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6642         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6643         struct brcmf_fil_country_le ccreq;
6644         s32 err;
6645         int i;
6646
6647         /* ignore non-ISO3166 country codes */
6648         for (i = 0; i < sizeof(req->alpha2); i++)
6649                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6650                         brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
6651                                   req->alpha2[0], req->alpha2[1]);
6652                         return;
6653                 }
6654
6655         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6656                   req->alpha2[0], req->alpha2[1]);
6657
6658         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6659         if (err) {
6660                 brcmf_err("Country code iovar returned err = %d\n", err);
6661                 return;
6662         }
6663
6664         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6665         if (err)
6666                 return;
6667
6668         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6669         if (err) {
6670                 brcmf_err("Firmware rejected country setting\n");
6671                 return;
6672         }
6673         brcmf_setup_wiphybands(wiphy);
6674 }
6675
6676 static void brcmf_free_wiphy(struct wiphy *wiphy)
6677 {
6678         int i;
6679
6680         if (!wiphy)
6681                 return;
6682
6683         if (wiphy->iface_combinations) {
6684                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6685                         kfree(wiphy->iface_combinations[i].limits);
6686         }
6687         kfree(wiphy->iface_combinations);
6688         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6689                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6690                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6691         }
6692         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6693                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6694                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6695         }
6696         wiphy_free(wiphy);
6697 }
6698
6699 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6700                                                   struct device *busdev,
6701                                                   bool p2pdev_forced)
6702 {
6703         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6704         struct brcmf_cfg80211_info *cfg;
6705         struct wiphy *wiphy;
6706         struct cfg80211_ops *ops;
6707         struct brcmf_cfg80211_vif *vif;
6708         struct brcmf_if *ifp;
6709         s32 err = 0;
6710         s32 io_type;
6711         u16 *cap = NULL;
6712
6713         if (!ndev) {
6714                 brcmf_err("ndev is invalid\n");
6715                 return NULL;
6716         }
6717
6718         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6719         if (!ops)
6720                 return NULL;
6721
6722         ifp = netdev_priv(ndev);
6723 #ifdef CONFIG_PM
6724         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6725                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6726 #endif
6727         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
6728         if (!wiphy) {
6729                 brcmf_err("Could not allocate wiphy device\n");
6730                 return NULL;
6731         }
6732         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6733         set_wiphy_dev(wiphy, busdev);
6734
6735         cfg = wiphy_priv(wiphy);
6736         cfg->wiphy = wiphy;
6737         cfg->ops = ops;
6738         cfg->pub = drvr;
6739         init_vif_event(&cfg->vif_event);
6740         INIT_LIST_HEAD(&cfg->vif_list);
6741
6742         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
6743         if (IS_ERR(vif))
6744                 goto wiphy_out;
6745
6746         vif->ifp = ifp;
6747         vif->wdev.netdev = ndev;
6748         ndev->ieee80211_ptr = &vif->wdev;
6749         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6750
6751         err = wl_init_priv(cfg);
6752         if (err) {
6753                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6754                 brcmf_free_vif(vif);
6755                 goto wiphy_out;
6756         }
6757         ifp->vif = vif;
6758
6759         /* determine d11 io type before wiphy setup */
6760         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6761         if (err) {
6762                 brcmf_err("Failed to get D11 version (%d)\n", err);
6763                 goto priv_out;
6764         }
6765         cfg->d11inf.io_type = (u8)io_type;
6766         brcmu_d11_attach(&cfg->d11inf);
6767
6768         err = brcmf_setup_wiphy(wiphy, ifp);
6769         if (err < 0)
6770                 goto priv_out;
6771
6772         brcmf_dbg(INFO, "Registering custom regulatory\n");
6773         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6774         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6775         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6776
6777         /* firmware defaults to 40MHz disabled in 2G band. We signal
6778          * cfg80211 here that we do and have it decide we can enable
6779          * it. But first check if device does support 2G operation.
6780          */
6781         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6782                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6783                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6784         }
6785         err = wiphy_register(wiphy);
6786         if (err < 0) {
6787                 brcmf_err("Could not register wiphy device (%d)\n", err);
6788                 goto priv_out;
6789         }
6790
6791         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6792          * setup 40MHz in 2GHz band and enable OBSS scanning.
6793          */
6794         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6795                 err = brcmf_enable_bw40_2g(cfg);
6796                 if (!err)
6797                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6798                                                       BRCMF_OBSS_COEX_AUTO);
6799                 else
6800                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6801         }
6802         /* p2p might require that "if-events" get processed by fweh. So
6803          * activate the already registered event handlers now and activate
6804          * the rest when initialization has completed. drvr->config needs to
6805          * be assigned before activating events.
6806          */
6807         drvr->config = cfg;
6808         err = brcmf_fweh_activate_events(ifp);
6809         if (err) {
6810                 brcmf_err("FWEH activation failed (%d)\n", err);
6811                 goto wiphy_unreg_out;
6812         }
6813
6814         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6815         if (err) {
6816                 brcmf_err("P2P initilisation failed (%d)\n", err);
6817                 goto wiphy_unreg_out;
6818         }
6819         err = brcmf_btcoex_attach(cfg);
6820         if (err) {
6821                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6822                 brcmf_p2p_detach(&cfg->p2p);
6823                 goto wiphy_unreg_out;
6824         }
6825
6826         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6827                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6828                 if (err) {
6829                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6830                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6831                 } else {
6832                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6833                                             brcmf_notify_tdls_peer_event);
6834                 }
6835         }
6836
6837         /* (re-) activate FWEH event handling */
6838         err = brcmf_fweh_activate_events(ifp);
6839         if (err) {
6840                 brcmf_err("FWEH activation failed (%d)\n", err);
6841                 goto wiphy_unreg_out;
6842         }
6843
6844         /* Fill in some of the advertised nl80211 supported features */
6845         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
6846                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6847 #ifdef CONFIG_PM
6848                 if (wiphy->wowlan &&
6849                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
6850                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6851 #endif
6852         }
6853
6854         return cfg;
6855
6856 wiphy_unreg_out:
6857         wiphy_unregister(cfg->wiphy);
6858 priv_out:
6859         wl_deinit_priv(cfg);
6860         brcmf_free_vif(vif);
6861         ifp->vif = NULL;
6862 wiphy_out:
6863         brcmf_free_wiphy(wiphy);
6864         kfree(ops);
6865         return NULL;
6866 }
6867
6868 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
6869 {
6870         if (!cfg)
6871                 return;
6872
6873         brcmf_btcoex_detach(cfg);
6874         wiphy_unregister(cfg->wiphy);
6875         kfree(cfg->ops);
6876         wl_deinit_priv(cfg);
6877         brcmf_free_wiphy(cfg->wiphy);
6878 }