drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41 #include "common.h"
  42
  43 #define BRCMF_SCAN_IE_LEN_MAX           2048
  44 #define BRCMF_PNO_VERSION               2
  45 #define BRCMF_PNO_TIME                  30
  46 #define BRCMF_PNO_REPEAT                4
  47 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  48 #define BRCMF_PNO_MAX_PFN_COUNT         16
  49 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  50 #define BRCMF_PNO_HIDDEN_BIT            2
  51 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  52 #define BRCMF_PNO_SCAN_COMPLETE         1
  53 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  54
  55 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  56 #define WPA_OUI_TYPE                    1
  57 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  58 #define WME_OUI_TYPE                    2
  59 #define WPS_OUI_TYPE                    4
  60
  61 #define VS_IE_FIXED_HDR_LEN             6
  62 #define WPA_IE_VERSION_LEN              2
  63 #define WPA_IE_MIN_OUI_LEN              4
  64 #define WPA_IE_SUITE_COUNT_LEN          2
  65
  66 #define WPA_CIPHER_NONE                 0       /* None */
  67 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  68 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  69 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  70 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  71
  72 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  73 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  74 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  75 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  76 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    0x000C
  77
  78 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  79                                                  * string :"add", "del" (+ NUL)
  80                                                  */
  81 #define VNDR_IE_COUNT_OFFSET            4
  82 #define VNDR_IE_PKTFLAG_OFFSET          8
  83 #define VNDR_IE_VSIE_OFFSET             12
  84 #define VNDR_IE_HDR_SIZE                12
  85 #define VNDR_IE_PARSE_LIMIT             5
  86
  87 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  88 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  89
  90 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  91 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  92 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  93
  94 #define BRCMF_SCAN_CHANNEL_TIME         40
  95 #define BRCMF_SCAN_UNASSOC_TIME         40
  96 #define BRCMF_SCAN_PASSIVE_TIME         120
  97
  98 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
  99
 100 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 101         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 102
 103 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 104 {
 105         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 106                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 107                           vif->sme_state);
 108                 return false;
 109         }
 110         return true;
 111 }
 112
 113 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 114 #define RATETAB_ENT(_rateid, _flags) \
 115         {                                                               \
 116                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 117                 .hw_value       = (_rateid),                            \
 118                 .flags          = (_flags),                             \
 119         }
 120
 121 static struct ieee80211_rate __wl_rates[] = {
 122         RATETAB_ENT(BRCM_RATE_1M, 0),
 123         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 124         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 125         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 126         RATETAB_ENT(BRCM_RATE_6M, 0),
 127         RATETAB_ENT(BRCM_RATE_9M, 0),
 128         RATETAB_ENT(BRCM_RATE_12M, 0),
 129         RATETAB_ENT(BRCM_RATE_18M, 0),
 130         RATETAB_ENT(BRCM_RATE_24M, 0),
 131         RATETAB_ENT(BRCM_RATE_36M, 0),
 132         RATETAB_ENT(BRCM_RATE_48M, 0),
 133         RATETAB_ENT(BRCM_RATE_54M, 0),
 134 };
 135
 136 #define wl_g_rates              (__wl_rates + 0)
 137 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 138 #define wl_a_rates              (__wl_rates + 4)
 139 #define wl_a_rates_size         (wl_g_rates_size - 4)
 140
 141 #define CHAN2G(_channel, _freq) {                               \
 142         .band                   = IEEE80211_BAND_2GHZ,          \
 143         .center_freq            = (_freq),                      \
 144         .hw_value               = (_channel),                   \
 145         .flags                  = IEEE80211_CHAN_DISABLED,      \
 146         .max_antenna_gain       = 0,                            \
 147         .max_power              = 30,                           \
 148 }
 149
 150 #define CHAN5G(_channel) {                                      \
 151         .band                   = IEEE80211_BAND_5GHZ,          \
 152         .center_freq            = 5000 + (5 * (_channel)),      \
 153         .hw_value               = (_channel),                   \
 154         .flags                  = IEEE80211_CHAN_DISABLED,      \
 155         .max_antenna_gain       = 0,                            \
 156         .max_power              = 30,                           \
 157 }
 158
 159 static struct ieee80211_channel __wl_2ghz_channels[] = {
 160         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 161         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 162         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 163         CHAN2G(13, 2472), CHAN2G(14, 2484)
 164 };
 165
 166 static struct ieee80211_channel __wl_5ghz_channels[] = {
 167         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 168         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 169         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 170         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 171         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 172         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 173 };
 174
 175 /* Band templates duplicated per wiphy. The channel info
 176  * above is added to the band during setup.
 177  */
 178 static const struct ieee80211_supported_band __wl_band_2ghz = {
 179         .band = IEEE80211_BAND_2GHZ,
 180         .bitrates = wl_g_rates,
 181         .n_bitrates = wl_g_rates_size,
 182 };
 183
 184 static const struct ieee80211_supported_band __wl_band_5ghz = {
 185         .band = IEEE80211_BAND_5GHZ,
 186         .bitrates = wl_a_rates,
 187         .n_bitrates = wl_a_rates_size,
 188 };
 189
 190 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 191  * By default world regulatory domain defined in reg.c puts the flags
 192  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 193  * With respect to these flags, wpa_supplicant doesn't * start p2p
 194  * operations on 5GHz channels. All the changes in world regulatory
 195  * domain are to be done here.
 196  */
 197 static const struct ieee80211_regdomain brcmf_regdom = {
 198         .n_reg_rules = 4,
 199         .alpha2 =  "99",
 200         .reg_rules = {
 201                 /* IEEE 802.11b/g, channels 1..11 */
 202                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 203                 /* If any */
 204                 /* IEEE 802.11 channel 14 - Only JP enables
 205                  * this and for 802.11b only
 206                  */
 207                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 208                 /* IEEE 802.11a, channel 36..64 */
 209                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 210                 /* IEEE 802.11a, channel 100..165 */
 211                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 212 };
 213
 214 static const u32 __wl_cipher_suites[] = {
 215         WLAN_CIPHER_SUITE_WEP40,
 216         WLAN_CIPHER_SUITE_WEP104,
 217         WLAN_CIPHER_SUITE_TKIP,
 218         WLAN_CIPHER_SUITE_CCMP,
 219         WLAN_CIPHER_SUITE_AES_CMAC,
 220 };
 221
 222 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 223 struct brcmf_vs_tlv {
 224         u8 id;
 225         u8 len;
 226         u8 oui[3];
 227         u8 oui_type;
 228 };
 229
 230 struct parsed_vndr_ie_info {
 231         u8 *ie_ptr;
 232         u32 ie_len;     /* total length including id & length field */
 233         struct brcmf_vs_tlv vndrie;
 234 };
 235
 236 struct parsed_vndr_ies {
 237         u32 count;
 238         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 239 };
 240
 241 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 242                                struct cfg80211_chan_def *ch)
 243 {
 244         struct brcmu_chan ch_inf;
 245         s32 primary_offset;
 246
 247         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 248                   ch->chan->center_freq, ch->center_freq1, ch->width);
 249         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 250         primary_offset = ch->chan->center_freq - ch->center_freq1;
 251         switch (ch->width) {
 252         case NL80211_CHAN_WIDTH_20:
 253         case NL80211_CHAN_WIDTH_20_NOHT:
 254                 ch_inf.bw = BRCMU_CHAN_BW_20;
 255                 WARN_ON(primary_offset != 0);
 256                 break;
 257         case NL80211_CHAN_WIDTH_40:
 258                 ch_inf.bw = BRCMU_CHAN_BW_40;
 259                 if (primary_offset > 0)
 260                         ch_inf.sb = BRCMU_CHAN_SB_U;
 261                 else
 262                         ch_inf.sb = BRCMU_CHAN_SB_L;
 263                 break;
 264         case NL80211_CHAN_WIDTH_80:
 265                 ch_inf.bw = BRCMU_CHAN_BW_80;
 266                 if (primary_offset == -30)
 267                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 268                 else if (primary_offset == -10)
 269                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 270                 else if (primary_offset == 10)
 271                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 272                 else
 273                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 274                 break;
 275         case NL80211_CHAN_WIDTH_80P80:
 276         case NL80211_CHAN_WIDTH_160:
 277         case NL80211_CHAN_WIDTH_5:
 278         case NL80211_CHAN_WIDTH_10:
 279         default:
 280                 WARN_ON_ONCE(1);
 281         }
 282         switch (ch->chan->band) {
 283         case IEEE80211_BAND_2GHZ:
 284                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 285                 break;
 286         case IEEE80211_BAND_5GHZ:
 287                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 288                 break;
 289         case IEEE80211_BAND_60GHZ:
 290         default:
 291                 WARN_ON_ONCE(1);
 292         }
 293         d11inf->encchspec(&ch_inf);
 294
 295         return ch_inf.chspec;
 296 }
 297
 298 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 299                         struct ieee80211_channel *ch)
 300 {
 301         struct brcmu_chan ch_inf;
 302
 303         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 304         ch_inf.bw = BRCMU_CHAN_BW_20;
 305         d11inf->encchspec(&ch_inf);
 306
 307         return ch_inf.chspec;
 308 }
 309
 310 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 311  * triples, returning a pointer to the substring whose first element
 312  * matches tag
 313  */
 314 const struct brcmf_tlv *
 315 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 316 {
 317         const struct brcmf_tlv *elt = buf;
 318         int totlen = buflen;
 319
 320         /* find tagged parameter */
 321         while (totlen >= TLV_HDR_LEN) {
 322                 int len = elt->len;
 323
 324                 /* validate remaining totlen */
 325                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 326                         return elt;
 327
 328                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 329                 totlen -= (len + TLV_HDR_LEN);
 330         }
 331
 332         return NULL;
 333 }
 334
 335 /* Is any of the tlvs the expected entry? If
 336  * not update the tlvs buffer pointer/length.
 337  */
 338 static bool
 339 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 340                  const u8 *oui, u32 oui_len, u8 type)
 341 {
 342         /* If the contents match the OUI and the type */
 343         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 344             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 345             type == ie[TLV_BODY_OFF + oui_len]) {
 346                 return true;
 347         }
 348
 349         if (tlvs == NULL)
 350                 return false;
 351         /* point to the next ie */
 352         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 353         /* calculate the length of the rest of the buffer */
 354         *tlvs_len -= (int)(ie - *tlvs);
 355         /* update the pointer to the start of the buffer */
 356         *tlvs = ie;
 357
 358         return false;
 359 }
 360
 361 static struct brcmf_vs_tlv *
 362 brcmf_find_wpaie(const u8 *parse, u32 len)
 363 {
 364         const struct brcmf_tlv *ie;
 365
 366         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 367                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 368                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 369                         return (struct brcmf_vs_tlv *)ie;
 370         }
 371         return NULL;
 372 }
 373
 374 static struct brcmf_vs_tlv *
 375 brcmf_find_wpsie(const u8 *parse, u32 len)
 376 {
 377         const struct brcmf_tlv *ie;
 378
 379         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 380                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 381                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 382                         return (struct brcmf_vs_tlv *)ie;
 383         }
 384         return NULL;
 385 }
 386
 387 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 388                                      struct brcmf_cfg80211_vif *vif,
 389                                      enum nl80211_iftype new_type)
 390 {
 391         int iftype_num[NUM_NL80211_IFTYPES];
 392         struct brcmf_cfg80211_vif *pos;
 393         bool check_combos = false;
 394         int ret = 0;
 395
 396         memset(&iftype_num[0], 0, sizeof(iftype_num));
 397         list_for_each_entry(pos, &cfg->vif_list, list)
 398                 if (pos == vif) {
 399                         iftype_num[new_type]++;
 400                 } else {
 401                         /* concurrent interfaces so need check combinations */
 402                         check_combos = true;
 403                         iftype_num[pos->wdev.iftype]++;
 404                 }
 405
 406         if (check_combos)
 407                 ret = cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 408
 409         return ret;
 410 }
 411
 412 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 413                                   enum nl80211_iftype new_type)
 414 {
 415         int iftype_num[NUM_NL80211_IFTYPES];
 416         struct brcmf_cfg80211_vif *pos;
 417
 418         memset(&iftype_num[0], 0, sizeof(iftype_num));
 419         list_for_each_entry(pos, &cfg->vif_list, list)
 420                 iftype_num[pos->wdev.iftype]++;
 421
 422         iftype_num[new_type]++;
 423         return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 424 }
 425
 426 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 427                                  struct brcmf_wsec_key_le *key_le)
 428 {
 429         key_le->index = cpu_to_le32(key->index);
 430         key_le->len = cpu_to_le32(key->len);
 431         key_le->algo = cpu_to_le32(key->algo);
 432         key_le->flags = cpu_to_le32(key->flags);
 433         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 434         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 435         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 436         memcpy(key_le->data, key->data, sizeof(key->data));
 437         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 438 }
 439
 440 static int
 441 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 442 {
 443         int err;
 444         struct brcmf_wsec_key_le key_le;
 445
 446         convert_key_from_CPU(key, &key_le);
 447
 448         brcmf_netdev_wait_pend8021x(ifp);
 449
 450         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 451                                         sizeof(key_le));
 452
 453         if (err)
 454                 brcmf_err("wsec_key error (%d)\n", err);
 455         return err;
 456 }
 457
 458 static s32
 459 brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
 460 {
 461         s32 err;
 462         u32 mode;
 463
 464         if (enable)
 465                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 466         else
 467                 mode = 0;
 468
 469         /* Try to set and enable ARP offload feature, this may fail, then it  */
 470         /* is simply not supported and err 0 will be returned                 */
 471         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 472         if (err) {
 473                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 474                           mode, err);
 475                 err = 0;
 476         } else {
 477                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 478                 if (err) {
 479                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 480                                   enable, err);
 481                         err = 0;
 482                 } else
 483                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 484                                   enable, mode);
 485         }
 486
 487         return err;
 488 }
 489
 490 static void
 491 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 492 {
 493         struct brcmf_cfg80211_vif *vif;
 494         struct brcmf_if *ifp;
 495
 496         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 497         ifp = vif->ifp;
 498
 499         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 500             (wdev->iftype == NL80211_IFTYPE_AP) ||
 501             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 502                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 503                                                 ADDR_DIRECT);
 504         else
 505                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 506                                                 ADDR_INDIRECT);
 507 }
 508
 509 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 510 {
 511         struct brcmf_mbss_ssid_le mbss_ssid_le;
 512         int bsscfgidx;
 513         int err;
 514
 515         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 516         bsscfgidx = brcmf_get_next_free_bsscfgidx(ifp->drvr);
 517         if (bsscfgidx < 0)
 518                 return bsscfgidx;
 519
 520         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 521         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 522         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 523
 524         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 525                                         sizeof(mbss_ssid_le));
 526         if (err < 0)
 527                 brcmf_err("setting ssid failed %d\n", err);
 528
 529         return err;
 530 }
 531
 532 /**
 533  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 534  *
 535  * @wiphy: wiphy device of new interface.
 536  * @name: name of the new interface.
 537  * @flags: not used.
 538  * @params: contains mac address for AP device.
 539  */
 540 static
 541 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 542                                       u32 *flags, struct vif_params *params)
 543 {
 544         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 545         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 546         struct brcmf_cfg80211_vif *vif;
 547         int err;
 548
 549         if (brcmf_cfg80211_vif_event_armed(cfg))
 550                 return ERR_PTR(-EBUSY);
 551
 552         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 553
 554         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP, false);
 555         if (IS_ERR(vif))
 556                 return (struct wireless_dev *)vif;
 557
 558         brcmf_cfg80211_arm_vif_event(cfg, vif);
 559
 560         err = brcmf_cfg80211_request_ap_if(ifp);
 561         if (err) {
 562                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 563                 goto fail;
 564         }
 565
 566         /* wait for firmware event */
 567         err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
 568                                                     BRCMF_VIF_EVENT_TIMEOUT);
 569         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 570         if (!err) {
 571                 brcmf_err("timeout occurred\n");
 572                 err = -EIO;
 573                 goto fail;
 574         }
 575
 576         /* interface created in firmware */
 577         ifp = vif->ifp;
 578         if (!ifp) {
 579                 brcmf_err("no if pointer provided\n");
 580                 err = -ENOENT;
 581                 goto fail;
 582         }
 583
 584         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 585         err = brcmf_net_attach(ifp, true);
 586         if (err) {
 587                 brcmf_err("Registering netdevice failed\n");
 588                 goto fail;
 589         }
 590
 591         return &ifp->vif->wdev;
 592
 593 fail:
 594         brcmf_free_vif(vif);
 595         return ERR_PTR(err);
 596 }
 597
 598 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 599 {
 600         enum nl80211_iftype iftype;
 601
 602         iftype = vif->wdev.iftype;
 603         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 604 }
 605
 606 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 607 {
 608         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 609 }
 610
 611 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 612                                                      const char *name,
 613                                                      unsigned char name_assign_type,
 614                                                      enum nl80211_iftype type,
 615                                                      u32 *flags,
 616                                                      struct vif_params *params)
 617 {
 618         struct wireless_dev *wdev;
 619         int err;
 620
 621         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 622         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 623         if (err) {
 624                 brcmf_err("iface validation failed: err=%d\n", err);
 625                 return ERR_PTR(err);
 626         }
 627         switch (type) {
 628         case NL80211_IFTYPE_ADHOC:
 629         case NL80211_IFTYPE_STATION:
 630         case NL80211_IFTYPE_AP_VLAN:
 631         case NL80211_IFTYPE_WDS:
 632         case NL80211_IFTYPE_MONITOR:
 633         case NL80211_IFTYPE_MESH_POINT:
 634                 return ERR_PTR(-EOPNOTSUPP);
 635         case NL80211_IFTYPE_AP:
 636                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 637                 if (!IS_ERR(wdev))
 638                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 639                 return wdev;
 640         case NL80211_IFTYPE_P2P_CLIENT:
 641         case NL80211_IFTYPE_P2P_GO:
 642         case NL80211_IFTYPE_P2P_DEVICE:
 643                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, flags, params);
 644                 if (!IS_ERR(wdev))
 645                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 646                 return wdev;
 647         case NL80211_IFTYPE_UNSPECIFIED:
 648         default:
 649                 return ERR_PTR(-EINVAL);
 650         }
 651 }
 652
 653 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 654 {
 655         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 656                 brcmf_set_mpc(ifp, mpc);
 657 }
 658
 659 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 660 {
 661         s32 err = 0;
 662
 663         if (check_vif_up(ifp->vif)) {
 664                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 665                 if (err) {
 666                         brcmf_err("fail to set mpc\n");
 667                         return;
 668                 }
 669                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 670         }
 671 }
 672
 673 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 674                                 struct brcmf_if *ifp, bool aborted,
 675                                 bool fw_abort)
 676 {
 677         struct brcmf_scan_params_le params_le;
 678         struct cfg80211_scan_request *scan_request;
 679         s32 err = 0;
 680
 681         brcmf_dbg(SCAN, "Enter\n");
 682
 683         /* clear scan request, because the FW abort can cause a second call */
 684         /* to this functon and might cause a double cfg80211_scan_done      */
 685         scan_request = cfg->scan_request;
 686         cfg->scan_request = NULL;
 687
 688         if (timer_pending(&cfg->escan_timeout))
 689                 del_timer_sync(&cfg->escan_timeout);
 690
 691         if (fw_abort) {
 692                 /* Do a scan abort to stop the driver's scan engine */
 693                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 694                 memset(&params_le, 0, sizeof(params_le));
 695                 eth_broadcast_addr(params_le.bssid);
 696                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 697                 params_le.scan_type = 0;
 698                 params_le.channel_num = cpu_to_le32(1);
 699                 params_le.nprobes = cpu_to_le32(1);
 700                 params_le.active_time = cpu_to_le32(-1);
 701                 params_le.passive_time = cpu_to_le32(-1);
 702                 params_le.home_time = cpu_to_le32(-1);
 703                 /* Scan is aborted by setting channel_list[0] to -1 */
 704                 params_le.channel_list[0] = cpu_to_le16(-1);
 705                 /* E-Scan (or anyother type) can be aborted by SCAN */
 706                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 707                                              &params_le, sizeof(params_le));
 708                 if (err)
 709                         brcmf_err("Scan abort  failed\n");
 710         }
 711
 712         brcmf_scan_config_mpc(ifp, 1);
 713
 714         /*
 715          * e-scan can be initiated by scheduled scan
 716          * which takes precedence.
 717          */
 718         if (cfg->sched_escan) {
 719                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 720                 cfg->sched_escan = false;
 721                 if (!aborted)
 722                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 723         } else if (scan_request) {
 724                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 725                           aborted ? "Aborted" : "Done");
 726                 cfg80211_scan_done(scan_request, aborted);
 727         }
 728         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 729                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 730
 731         return err;
 732 }
 733
 734 static
 735 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 736 {
 737         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 738         struct net_device *ndev = wdev->netdev;
 739
 740         /* vif event pending in firmware */
 741         if (brcmf_cfg80211_vif_event_armed(cfg))
 742                 return -EBUSY;
 743
 744         if (ndev) {
 745                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 746                     cfg->escan_info.ifp == netdev_priv(ndev))
 747                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 748                                                     true, true);
 749
 750                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 751         }
 752
 753         switch (wdev->iftype) {
 754         case NL80211_IFTYPE_ADHOC:
 755         case NL80211_IFTYPE_STATION:
 756         case NL80211_IFTYPE_AP:
 757         case NL80211_IFTYPE_AP_VLAN:
 758         case NL80211_IFTYPE_WDS:
 759         case NL80211_IFTYPE_MONITOR:
 760         case NL80211_IFTYPE_MESH_POINT:
 761                 return -EOPNOTSUPP;
 762         case NL80211_IFTYPE_P2P_CLIENT:
 763         case NL80211_IFTYPE_P2P_GO:
 764         case NL80211_IFTYPE_P2P_DEVICE:
 765                 return brcmf_p2p_del_vif(wiphy, wdev);
 766         case NL80211_IFTYPE_UNSPECIFIED:
 767         default:
 768                 return -EINVAL;
 769         }
 770         return -EOPNOTSUPP;
 771 }
 772
 773 static s32
 774 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 775                          enum nl80211_iftype type, u32 *flags,
 776                          struct vif_params *params)
 777 {
 778         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 779         struct brcmf_if *ifp = netdev_priv(ndev);
 780         struct brcmf_cfg80211_vif *vif = ifp->vif;
 781         s32 infra = 0;
 782         s32 ap = 0;
 783         s32 err = 0;
 784
 785         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 786                   type);
 787
 788         /* WAR: There are a number of p2p interface related problems which
 789          * need to be handled initially (before doing the validate).
 790          * wpa_supplicant tends to do iface changes on p2p device/client/go
 791          * which are not always possible/allowed. However we need to return
 792          * OK otherwise the wpa_supplicant wont start. The situation differs
 793          * on configuration and setup (p2pon=1 module param). The first check
 794          * is to see if the request is a change to station for p2p iface.
 795          */
 796         if ((type == NL80211_IFTYPE_STATION) &&
 797             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 798              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 799              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 800                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 801                 /* Now depending on whether module param p2pon=1 was used the
 802                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 803                  * that if p2pon=1 is used, but a newer supplicant is used then
 804                  * we should return an error, as this combination wont work.
 805                  * In other situations 0 is returned and supplicant will start
 806                  * normally. It will give a trace in cfg80211, but it is the
 807                  * only way to get it working. Unfortunately this will result
 808                  * in situation where we wont support new supplicant in
 809                  * combination with module param p2pon=1, but that is the way
 810                  * it is. If the user tries this then unloading of driver might
 811                  * fail/lock.
 812                  */
 813                 if (cfg->p2p.p2pdev_dynamically)
 814                         return -EOPNOTSUPP;
 815                 else
 816                         return 0;
 817         }
 818         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 819         if (err) {
 820                 brcmf_err("iface validation failed: err=%d\n", err);
 821                 return err;
 822         }
 823         switch (type) {
 824         case NL80211_IFTYPE_MONITOR:
 825         case NL80211_IFTYPE_WDS:
 826                 brcmf_err("type (%d) : currently we do not support this type\n",
 827                           type);
 828                 return -EOPNOTSUPP;
 829         case NL80211_IFTYPE_ADHOC:
 830                 infra = 0;
 831                 break;
 832         case NL80211_IFTYPE_STATION:
 833                 infra = 1;
 834                 break;
 835         case NL80211_IFTYPE_AP:
 836         case NL80211_IFTYPE_P2P_GO:
 837                 ap = 1;
 838                 break;
 839         default:
 840                 err = -EINVAL;
 841                 goto done;
 842         }
 843
 844         if (ap) {
 845                 if (type == NL80211_IFTYPE_P2P_GO) {
 846                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 847                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 848                 }
 849                 if (!err) {
 850                         brcmf_dbg(INFO, "IF Type = AP\n");
 851                 }
 852         } else {
 853                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 854                 if (err) {
 855                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 856                         err = -EAGAIN;
 857                         goto done;
 858                 }
 859                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 860                           "Adhoc" : "Infra");
 861         }
 862         ndev->ieee80211_ptr->iftype = type;
 863
 864         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 865
 866 done:
 867         brcmf_dbg(TRACE, "Exit\n");
 868
 869         return err;
 870 }
 871
 872 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 873                              struct brcmf_scan_params_le *params_le,
 874                              struct cfg80211_scan_request *request)
 875 {
 876         u32 n_ssids;
 877         u32 n_channels;
 878         s32 i;
 879         s32 offset;
 880         u16 chanspec;
 881         char *ptr;
 882         struct brcmf_ssid_le ssid_le;
 883
 884         eth_broadcast_addr(params_le->bssid);
 885         params_le->bss_type = DOT11_BSSTYPE_ANY;
 886         params_le->scan_type = 0;
 887         params_le->channel_num = 0;
 888         params_le->nprobes = cpu_to_le32(-1);
 889         params_le->active_time = cpu_to_le32(-1);
 890         params_le->passive_time = cpu_to_le32(-1);
 891         params_le->home_time = cpu_to_le32(-1);
 892         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 893
 894         /* if request is null exit so it will be all channel broadcast scan */
 895         if (!request)
 896                 return;
 897
 898         n_ssids = request->n_ssids;
 899         n_channels = request->n_channels;
 900         /* Copy channel array if applicable */
 901         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 902                   n_channels);
 903         if (n_channels > 0) {
 904                 for (i = 0; i < n_channels; i++) {
 905                         chanspec = channel_to_chanspec(&cfg->d11inf,
 906                                                        request->channels[i]);
 907                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 908                                   request->channels[i]->hw_value, chanspec);
 909                         params_le->channel_list[i] = cpu_to_le16(chanspec);
 910                 }
 911         } else {
 912                 brcmf_dbg(SCAN, "Scanning all channels\n");
 913         }
 914         /* Copy ssid array if applicable */
 915         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
 916         if (n_ssids > 0) {
 917                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
 918                                 n_channels * sizeof(u16);
 919                 offset = roundup(offset, sizeof(u32));
 920                 ptr = (char *)params_le + offset;
 921                 for (i = 0; i < n_ssids; i++) {
 922                         memset(&ssid_le, 0, sizeof(ssid_le));
 923                         ssid_le.SSID_len =
 924                                         cpu_to_le32(request->ssids[i].ssid_len);
 925                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
 926                                request->ssids[i].ssid_len);
 927                         if (!ssid_le.SSID_len)
 928                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
 929                         else
 930                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
 931                                           i, ssid_le.SSID, ssid_le.SSID_len);
 932                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
 933                         ptr += sizeof(ssid_le);
 934                 }
 935         } else {
 936                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
 937                 if ((request->ssids) && request->ssids->ssid_len) {
 938                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
 939                                   params_le->ssid_le.SSID,
 940                                   request->ssids->ssid_len);
 941                         params_le->ssid_le.SSID_len =
 942                                 cpu_to_le32(request->ssids->ssid_len);
 943                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
 944                                 request->ssids->ssid_len);
 945                 }
 946         }
 947         /* Adding mask to channel numbers */
 948         params_le->channel_num =
 949                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
 950                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
 951 }
 952
 953 static s32
 954 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
 955                 struct cfg80211_scan_request *request)
 956 {
 957         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
 958                           offsetof(struct brcmf_escan_params_le, params_le);
 959         struct brcmf_escan_params_le *params;
 960         s32 err = 0;
 961
 962         brcmf_dbg(SCAN, "E-SCAN START\n");
 963
 964         if (request != NULL) {
 965                 /* Allocate space for populating ssids in struct */
 966                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
 967
 968                 /* Allocate space for populating ssids in struct */
 969                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
 970         }
 971
 972         params = kzalloc(params_size, GFP_KERNEL);
 973         if (!params) {
 974                 err = -ENOMEM;
 975                 goto exit;
 976         }
 977         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
 978         brcmf_escan_prep(cfg, &params->params_le, request);
 979         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
 980         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
 981         params->sync_id = cpu_to_le16(0x1234);
 982
 983         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
 984         if (err) {
 985                 if (err == -EBUSY)
 986                         brcmf_dbg(INFO, "system busy : escan canceled\n");
 987                 else
 988                         brcmf_err("error (%d)\n", err);
 989         }
 990
 991         kfree(params);
 992 exit:
 993         return err;
 994 }
 995
 996 static s32
 997 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
 998                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
 999 {
1000         s32 err;
1001         u32 passive_scan;
1002         struct brcmf_scan_results *results;
1003         struct escan_info *escan = &cfg->escan_info;
1004
1005         brcmf_dbg(SCAN, "Enter\n");
1006         escan->ifp = ifp;
1007         escan->wiphy = wiphy;
1008         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1009         passive_scan = cfg->active_scan ? 0 : 1;
1010         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1011                                     passive_scan);
1012         if (err) {
1013                 brcmf_err("error (%d)\n", err);
1014                 return err;
1015         }
1016         brcmf_scan_config_mpc(ifp, 0);
1017         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1018         results->version = 0;
1019         results->count = 0;
1020         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1021
1022         err = escan->run(cfg, ifp, request);
1023         if (err)
1024                 brcmf_scan_config_mpc(ifp, 1);
1025         return err;
1026 }
1027
1028 static s32
1029 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1030                      struct cfg80211_scan_request *request,
1031                      struct cfg80211_ssid *this_ssid)
1032 {
1033         struct brcmf_if *ifp = vif->ifp;
1034         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1035         struct cfg80211_ssid *ssids;
1036         u32 passive_scan;
1037         bool escan_req;
1038         bool spec_scan;
1039         s32 err;
1040         struct brcmf_ssid_le ssid_le;
1041         u32 SSID_len;
1042
1043         brcmf_dbg(SCAN, "START ESCAN\n");
1044
1045         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1046                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1047                 return -EAGAIN;
1048         }
1049         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1050                 brcmf_err("Scanning being aborted: status (%lu)\n",
1051                           cfg->scan_status);
1052                 return -EAGAIN;
1053         }
1054         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1055                 brcmf_err("Scanning suppressed: status (%lu)\n",
1056                           cfg->scan_status);
1057                 return -EAGAIN;
1058         }
1059         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1060                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1061                 return -EAGAIN;
1062         }
1063
1064         /* If scan req comes for p2p0, send it over primary I/F */
1065         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1066                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1067
1068         escan_req = false;
1069         if (request) {
1070                 /* scan bss */
1071                 ssids = request->ssids;
1072                 escan_req = true;
1073         } else {
1074                 /* scan in ibss */
1075                 /* we don't do escan in ibss */
1076                 ssids = this_ssid;
1077         }
1078
1079         cfg->scan_request = request;
1080         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1081         if (escan_req) {
1082                 cfg->escan_info.run = brcmf_run_escan;
1083                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1084                 if (err)
1085                         goto scan_out;
1086
1087                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1088                 if (err)
1089                         goto scan_out;
1090         } else {
1091                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1092                           ssids->ssid, ssids->ssid_len);
1093                 memset(&ssid_le, 0, sizeof(ssid_le));
1094                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1095                 ssid_le.SSID_len = cpu_to_le32(0);
1096                 spec_scan = false;
1097                 if (SSID_len) {
1098                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1099                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1100                         spec_scan = true;
1101                 } else
1102                         brcmf_dbg(SCAN, "Broadcast scan\n");
1103
1104                 passive_scan = cfg->active_scan ? 0 : 1;
1105                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1106                                             passive_scan);
1107                 if (err) {
1108                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1109                         goto scan_out;
1110                 }
1111                 brcmf_scan_config_mpc(ifp, 0);
1112                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1113                                              sizeof(ssid_le));
1114                 if (err) {
1115                         if (err == -EBUSY)
1116                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1117                                           ssid_le.SSID);
1118                         else
1119                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1120
1121                         brcmf_scan_config_mpc(ifp, 1);
1122                         goto scan_out;
1123                 }
1124         }
1125
1126         /* Arm scan timeout timer */
1127         mod_timer(&cfg->escan_timeout, jiffies +
1128                         WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1129
1130         return 0;
1131
1132 scan_out:
1133         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1134         cfg->scan_request = NULL;
1135         return err;
1136 }
1137
1138 static s32
1139 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1140 {
1141         struct brcmf_cfg80211_vif *vif;
1142         s32 err = 0;
1143
1144         brcmf_dbg(TRACE, "Enter\n");
1145         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1146         if (!check_vif_up(vif))
1147                 return -EIO;
1148
1149         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1150
1151         if (err)
1152                 brcmf_err("scan error (%d)\n", err);
1153
1154         brcmf_dbg(TRACE, "Exit\n");
1155         return err;
1156 }
1157
1158 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1159 {
1160         s32 err = 0;
1161
1162         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1163                                       rts_threshold);
1164         if (err)
1165                 brcmf_err("Error (%d)\n", err);
1166
1167         return err;
1168 }
1169
1170 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1171 {
1172         s32 err = 0;
1173
1174         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1175                                       frag_threshold);
1176         if (err)
1177                 brcmf_err("Error (%d)\n", err);
1178
1179         return err;
1180 }
1181
1182 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1183 {
1184         s32 err = 0;
1185         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1186
1187         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1188         if (err) {
1189                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1190                 return err;
1191         }
1192         return err;
1193 }
1194
1195 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1196 {
1197         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1198         struct net_device *ndev = cfg_to_ndev(cfg);
1199         struct brcmf_if *ifp = netdev_priv(ndev);
1200         s32 err = 0;
1201
1202         brcmf_dbg(TRACE, "Enter\n");
1203         if (!check_vif_up(ifp->vif))
1204                 return -EIO;
1205
1206         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1207             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1208                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1209                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1210                 if (!err)
1211                         goto done;
1212         }
1213         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1214             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1215                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1216                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1217                 if (!err)
1218                         goto done;
1219         }
1220         if (changed & WIPHY_PARAM_RETRY_LONG
1221             && (cfg->conf->retry_long != wiphy->retry_long)) {
1222                 cfg->conf->retry_long = wiphy->retry_long;
1223                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1224                 if (!err)
1225                         goto done;
1226         }
1227         if (changed & WIPHY_PARAM_RETRY_SHORT
1228             && (cfg->conf->retry_short != wiphy->retry_short)) {
1229                 cfg->conf->retry_short = wiphy->retry_short;
1230                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1231                 if (!err)
1232                         goto done;
1233         }
1234
1235 done:
1236         brcmf_dbg(TRACE, "Exit\n");
1237         return err;
1238 }
1239
1240 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1241 {
1242         memset(prof, 0, sizeof(*prof));
1243 }
1244
1245 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1246 {
1247         u16 reason;
1248
1249         switch (e->event_code) {
1250         case BRCMF_E_DEAUTH:
1251         case BRCMF_E_DEAUTH_IND:
1252         case BRCMF_E_DISASSOC_IND:
1253                 reason = e->reason;
1254                 break;
1255         case BRCMF_E_LINK:
1256         default:
1257                 reason = 0;
1258                 break;
1259         }
1260         return reason;
1261 }
1262
1263 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1264 {
1265         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1266         s32 err = 0;
1267
1268         brcmf_dbg(TRACE, "Enter\n");
1269
1270         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1271                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1272                 err = brcmf_fil_cmd_data_set(vif->ifp,
1273                                              BRCMF_C_DISASSOC, NULL, 0);
1274                 if (err) {
1275                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1276                 }
1277                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1278                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1279                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1280                                               true, GFP_KERNEL);
1281         }
1282         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1283         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1284         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1285         brcmf_dbg(TRACE, "Exit\n");
1286 }
1287
1288 static s32
1289 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1290                       struct cfg80211_ibss_params *params)
1291 {
1292         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1293         struct brcmf_if *ifp = netdev_priv(ndev);
1294         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1295         struct brcmf_join_params join_params;
1296         size_t join_params_size = 0;
1297         s32 err = 0;
1298         s32 wsec = 0;
1299         s32 bcnprd;
1300         u16 chanspec;
1301         u32 ssid_len;
1302
1303         brcmf_dbg(TRACE, "Enter\n");
1304         if (!check_vif_up(ifp->vif))
1305                 return -EIO;
1306
1307         if (params->ssid)
1308                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1309         else {
1310                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1311                 return -EOPNOTSUPP;
1312         }
1313
1314         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1315
1316         if (params->bssid)
1317                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1318         else
1319                 brcmf_dbg(CONN, "No BSSID specified\n");
1320
1321         if (params->chandef.chan)
1322                 brcmf_dbg(CONN, "channel: %d\n",
1323                           params->chandef.chan->center_freq);
1324         else
1325                 brcmf_dbg(CONN, "no channel specified\n");
1326
1327         if (params->channel_fixed)
1328                 brcmf_dbg(CONN, "fixed channel required\n");
1329         else
1330                 brcmf_dbg(CONN, "no fixed channel required\n");
1331
1332         if (params->ie && params->ie_len)
1333                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1334         else
1335                 brcmf_dbg(CONN, "no ie specified\n");
1336
1337         if (params->beacon_interval)
1338                 brcmf_dbg(CONN, "beacon interval: %d\n",
1339                           params->beacon_interval);
1340         else
1341                 brcmf_dbg(CONN, "no beacon interval specified\n");
1342
1343         if (params->basic_rates)
1344                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1345         else
1346                 brcmf_dbg(CONN, "no basic rates specified\n");
1347
1348         if (params->privacy)
1349                 brcmf_dbg(CONN, "privacy required\n");
1350         else
1351                 brcmf_dbg(CONN, "no privacy required\n");
1352
1353         /* Configure Privacy for starter */
1354         if (params->privacy)
1355                 wsec |= WEP_ENABLED;
1356
1357         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1358         if (err) {
1359                 brcmf_err("wsec failed (%d)\n", err);
1360                 goto done;
1361         }
1362
1363         /* Configure Beacon Interval for starter */
1364         if (params->beacon_interval)
1365                 bcnprd = params->beacon_interval;
1366         else
1367                 bcnprd = 100;
1368
1369         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1370         if (err) {
1371                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1372                 goto done;
1373         }
1374
1375         /* Configure required join parameter */
1376         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1377
1378         /* SSID */
1379         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1380         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1381         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1382         join_params_size = sizeof(join_params.ssid_le);
1383
1384         /* BSSID */
1385         if (params->bssid) {
1386                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1387                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1388                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1389         } else {
1390                 eth_broadcast_addr(join_params.params_le.bssid);
1391                 eth_zero_addr(profile->bssid);
1392         }
1393
1394         /* Channel */
1395         if (params->chandef.chan) {
1396                 u32 target_channel;
1397
1398                 cfg->channel =
1399                         ieee80211_frequency_to_channel(
1400                                 params->chandef.chan->center_freq);
1401                 if (params->channel_fixed) {
1402                         /* adding chanspec */
1403                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1404                                                        &params->chandef);
1405                         join_params.params_le.chanspec_list[0] =
1406                                 cpu_to_le16(chanspec);
1407                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1408                         join_params_size += sizeof(join_params.params_le);
1409                 }
1410
1411                 /* set channel for starter */
1412                 target_channel = cfg->channel;
1413                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1414                                             target_channel);
1415                 if (err) {
1416                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1417                         goto done;
1418                 }
1419         } else
1420                 cfg->channel = 0;
1421
1422         cfg->ibss_starter = false;
1423
1424
1425         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1426                                      &join_params, join_params_size);
1427         if (err) {
1428                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1429                 goto done;
1430         }
1431
1432 done:
1433         if (err)
1434                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1435         brcmf_dbg(TRACE, "Exit\n");
1436         return err;
1437 }
1438
1439 static s32
1440 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1441 {
1442         struct brcmf_if *ifp = netdev_priv(ndev);
1443
1444         brcmf_dbg(TRACE, "Enter\n");
1445         if (!check_vif_up(ifp->vif)) {
1446                 /* When driver is being unloaded, it can end up here. If an
1447                  * error is returned then later on a debug trace in the wireless
1448                  * core module will be printed. To avoid this 0 is returned.
1449                  */
1450                 return 0;
1451         }
1452
1453         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1454         brcmf_net_setcarrier(ifp, false);
1455
1456         brcmf_dbg(TRACE, "Exit\n");
1457
1458         return 0;
1459 }
1460
1461 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1462                                  struct cfg80211_connect_params *sme)
1463 {
1464         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1465         struct brcmf_cfg80211_security *sec;
1466         s32 val = 0;
1467         s32 err = 0;
1468
1469         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1470                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1471         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1472                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1473         else
1474                 val = WPA_AUTH_DISABLED;
1475         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1476         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1477         if (err) {
1478                 brcmf_err("set wpa_auth failed (%d)\n", err);
1479                 return err;
1480         }
1481         sec = &profile->sec;
1482         sec->wpa_versions = sme->crypto.wpa_versions;
1483         return err;
1484 }
1485
1486 static s32 brcmf_set_auth_type(struct net_device *ndev,
1487                                struct cfg80211_connect_params *sme)
1488 {
1489         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1490         struct brcmf_cfg80211_security *sec;
1491         s32 val = 0;
1492         s32 err = 0;
1493
1494         switch (sme->auth_type) {
1495         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1496                 val = 0;
1497                 brcmf_dbg(CONN, "open system\n");
1498                 break;
1499         case NL80211_AUTHTYPE_SHARED_KEY:
1500                 val = 1;
1501                 brcmf_dbg(CONN, "shared key\n");
1502                 break;
1503         case NL80211_AUTHTYPE_AUTOMATIC:
1504                 val = 2;
1505                 brcmf_dbg(CONN, "automatic\n");
1506                 break;
1507         case NL80211_AUTHTYPE_NETWORK_EAP:
1508                 brcmf_dbg(CONN, "network eap\n");
1509         default:
1510                 val = 2;
1511                 brcmf_err("invalid auth type (%d)\n", sme->auth_type);
1512                 break;
1513         }
1514
1515         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1516         if (err) {
1517                 brcmf_err("set auth failed (%d)\n", err);
1518                 return err;
1519         }
1520         sec = &profile->sec;
1521         sec->auth_type = sme->auth_type;
1522         return err;
1523 }
1524
1525 static s32
1526 brcmf_set_wsec_mode(struct net_device *ndev,
1527                      struct cfg80211_connect_params *sme, bool mfp)
1528 {
1529         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1530         struct brcmf_cfg80211_security *sec;
1531         s32 pval = 0;
1532         s32 gval = 0;
1533         s32 wsec;
1534         s32 err = 0;
1535
1536         if (sme->crypto.n_ciphers_pairwise) {
1537                 switch (sme->crypto.ciphers_pairwise[0]) {
1538                 case WLAN_CIPHER_SUITE_WEP40:
1539                 case WLAN_CIPHER_SUITE_WEP104:
1540                         pval = WEP_ENABLED;
1541                         break;
1542                 case WLAN_CIPHER_SUITE_TKIP:
1543                         pval = TKIP_ENABLED;
1544                         break;
1545                 case WLAN_CIPHER_SUITE_CCMP:
1546                         pval = AES_ENABLED;
1547                         break;
1548                 case WLAN_CIPHER_SUITE_AES_CMAC:
1549                         pval = AES_ENABLED;
1550                         break;
1551                 default:
1552                         brcmf_err("invalid cipher pairwise (%d)\n",
1553                                   sme->crypto.ciphers_pairwise[0]);
1554                         return -EINVAL;
1555                 }
1556         }
1557         if (sme->crypto.cipher_group) {
1558                 switch (sme->crypto.cipher_group) {
1559                 case WLAN_CIPHER_SUITE_WEP40:
1560                 case WLAN_CIPHER_SUITE_WEP104:
1561                         gval = WEP_ENABLED;
1562                         break;
1563                 case WLAN_CIPHER_SUITE_TKIP:
1564                         gval = TKIP_ENABLED;
1565                         break;
1566                 case WLAN_CIPHER_SUITE_CCMP:
1567                         gval = AES_ENABLED;
1568                         break;
1569                 case WLAN_CIPHER_SUITE_AES_CMAC:
1570                         gval = AES_ENABLED;
1571                         break;
1572                 default:
1573                         brcmf_err("invalid cipher group (%d)\n",
1574                                   sme->crypto.cipher_group);
1575                         return -EINVAL;
1576                 }
1577         }
1578
1579         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1580         /* In case of privacy, but no security and WPS then simulate */
1581         /* setting AES. WPS-2.0 allows no security                   */
1582         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1583             sme->privacy)
1584                 pval = AES_ENABLED;
1585
1586         if (mfp)
1587                 wsec = pval | gval | MFP_CAPABLE;
1588         else
1589                 wsec = pval | gval;
1590         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1591         if (err) {
1592                 brcmf_err("error (%d)\n", err);
1593                 return err;
1594         }
1595
1596         sec = &profile->sec;
1597         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1598         sec->cipher_group = sme->crypto.cipher_group;
1599
1600         return err;
1601 }
1602
1603 static s32
1604 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1605 {
1606         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1607         struct brcmf_cfg80211_security *sec;
1608         s32 val = 0;
1609         s32 err = 0;
1610
1611         if (sme->crypto.n_akm_suites) {
1612                 err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
1613                                                "wpa_auth", &val);
1614                 if (err) {
1615                         brcmf_err("could not get wpa_auth (%d)\n", err);
1616                         return err;
1617                 }
1618                 if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1619                         switch (sme->crypto.akm_suites[0]) {
1620                         case WLAN_AKM_SUITE_8021X:
1621                                 val = WPA_AUTH_UNSPECIFIED;
1622                                 break;
1623                         case WLAN_AKM_SUITE_PSK:
1624                                 val = WPA_AUTH_PSK;
1625                                 break;
1626                         default:
1627                                 brcmf_err("invalid cipher group (%d)\n",
1628                                           sme->crypto.cipher_group);
1629                                 return -EINVAL;
1630                         }
1631                 } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1632                         switch (sme->crypto.akm_suites[0]) {
1633                         case WLAN_AKM_SUITE_8021X:
1634                                 val = WPA2_AUTH_UNSPECIFIED;
1635                                 break;
1636                         case WLAN_AKM_SUITE_PSK:
1637                                 val = WPA2_AUTH_PSK;
1638                                 break;
1639                         default:
1640                                 brcmf_err("invalid cipher group (%d)\n",
1641                                           sme->crypto.cipher_group);
1642                                 return -EINVAL;
1643                         }
1644                 }
1645
1646                 brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1647                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
1648                                                "wpa_auth", val);
1649                 if (err) {
1650                         brcmf_err("could not set wpa_auth (%d)\n", err);
1651                         return err;
1652                 }
1653         }
1654         sec = &profile->sec;
1655         sec->wpa_auth = sme->crypto.akm_suites[0];
1656
1657         return err;
1658 }
1659
1660 static s32
1661 brcmf_set_sharedkey(struct net_device *ndev,
1662                     struct cfg80211_connect_params *sme)
1663 {
1664         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1665         struct brcmf_cfg80211_security *sec;
1666         struct brcmf_wsec_key key;
1667         s32 val;
1668         s32 err = 0;
1669
1670         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1671
1672         if (sme->key_len == 0)
1673                 return 0;
1674
1675         sec = &profile->sec;
1676         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1677                   sec->wpa_versions, sec->cipher_pairwise);
1678
1679         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1680                 return 0;
1681
1682         if (!(sec->cipher_pairwise &
1683             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1684                 return 0;
1685
1686         memset(&key, 0, sizeof(key));
1687         key.len = (u32) sme->key_len;
1688         key.index = (u32) sme->key_idx;
1689         if (key.len > sizeof(key.data)) {
1690                 brcmf_err("Too long key length (%u)\n", key.len);
1691                 return -EINVAL;
1692         }
1693         memcpy(key.data, sme->key, key.len);
1694         key.flags = BRCMF_PRIMARY_KEY;
1695         switch (sec->cipher_pairwise) {
1696         case WLAN_CIPHER_SUITE_WEP40:
1697                 key.algo = CRYPTO_ALGO_WEP1;
1698                 break;
1699         case WLAN_CIPHER_SUITE_WEP104:
1700                 key.algo = CRYPTO_ALGO_WEP128;
1701                 break;
1702         default:
1703                 brcmf_err("Invalid algorithm (%d)\n",
1704                           sme->crypto.ciphers_pairwise[0]);
1705                 return -EINVAL;
1706         }
1707         /* Set the new key/index */
1708         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1709                   key.len, key.index, key.algo);
1710         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1711         err = send_key_to_dongle(netdev_priv(ndev), &key);
1712         if (err)
1713                 return err;
1714
1715         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1716                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1717                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1718                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1719                 if (err)
1720                         brcmf_err("set auth failed (%d)\n", err);
1721         }
1722         return err;
1723 }
1724
1725 static
1726 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1727                                            enum nl80211_auth_type type)
1728 {
1729         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1730             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1731                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1732                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1733         }
1734         return type;
1735 }
1736
1737 static s32
1738 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1739                        struct cfg80211_connect_params *sme)
1740 {
1741         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1742         struct brcmf_if *ifp = netdev_priv(ndev);
1743         struct ieee80211_channel *chan = sme->channel;
1744         struct brcmf_join_params join_params;
1745         size_t join_params_size;
1746         const struct brcmf_tlv *rsn_ie;
1747         const struct brcmf_vs_tlv *wpa_ie;
1748         const void *ie;
1749         u32 ie_len;
1750         struct brcmf_ext_join_params_le *ext_join_params;
1751         u16 chanspec;
1752         s32 err = 0;
1753         u32 ssid_len;
1754
1755         brcmf_dbg(TRACE, "Enter\n");
1756         if (!check_vif_up(ifp->vif))
1757                 return -EIO;
1758
1759         if (!sme->ssid) {
1760                 brcmf_err("Invalid ssid\n");
1761                 return -EOPNOTSUPP;
1762         }
1763
1764         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1765                 /* A normal (non P2P) connection request setup. */
1766                 ie = NULL;
1767                 ie_len = 0;
1768                 /* find the WPA_IE */
1769                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1770                 if (wpa_ie) {
1771                         ie = wpa_ie;
1772                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1773                 } else {
1774                         /* find the RSN_IE */
1775                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1776                                                   sme->ie_len,
1777                                                   WLAN_EID_RSN);
1778                         if (rsn_ie) {
1779                                 ie = rsn_ie;
1780                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1781                         }
1782                 }
1783                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1784         }
1785
1786         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1787                                     sme->ie, sme->ie_len);
1788         if (err)
1789                 brcmf_err("Set Assoc REQ IE Failed\n");
1790         else
1791                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1792
1793         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1794
1795         if (chan) {
1796                 cfg->channel =
1797                         ieee80211_frequency_to_channel(chan->center_freq);
1798                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1799                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1800                           cfg->channel, chan->center_freq, chanspec);
1801         } else {
1802                 cfg->channel = 0;
1803                 chanspec = 0;
1804         }
1805
1806         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1807
1808         err = brcmf_set_wpa_version(ndev, sme);
1809         if (err) {
1810                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1811                 goto done;
1812         }
1813
1814         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1815         err = brcmf_set_auth_type(ndev, sme);
1816         if (err) {
1817                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1818                 goto done;
1819         }
1820
1821         err = brcmf_set_wsec_mode(ndev, sme, sme->mfp == NL80211_MFP_REQUIRED);
1822         if (err) {
1823                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1824                 goto done;
1825         }
1826
1827         err = brcmf_set_key_mgmt(ndev, sme);
1828         if (err) {
1829                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1830                 goto done;
1831         }
1832
1833         err = brcmf_set_sharedkey(ndev, sme);
1834         if (err) {
1835                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1836                 goto done;
1837         }
1838
1839         /* Join with specific BSSID and cached SSID
1840          * If SSID is zero join based on BSSID only
1841          */
1842         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
1843                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
1844         if (cfg->channel)
1845                 join_params_size += sizeof(u16);
1846         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
1847         if (ext_join_params == NULL) {
1848                 err = -ENOMEM;
1849                 goto done;
1850         }
1851         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
1852         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
1853         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
1854         if (ssid_len < IEEE80211_MAX_SSID_LEN)
1855                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
1856                           ext_join_params->ssid_le.SSID, ssid_len);
1857
1858         /* Set up join scan parameters */
1859         ext_join_params->scan_le.scan_type = -1;
1860         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
1861
1862         if (sme->bssid)
1863                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
1864         else
1865                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
1866
1867         if (cfg->channel) {
1868                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
1869
1870                 ext_join_params->assoc_le.chanspec_list[0] =
1871                         cpu_to_le16(chanspec);
1872                 /* Increase dwell time to receive probe response or detect
1873                  * beacon from target AP at a noisy air only during connect
1874                  * command.
1875                  */
1876                 ext_join_params->scan_le.active_time =
1877                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
1878                 ext_join_params->scan_le.passive_time =
1879                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
1880                 /* To sync with presence period of VSDB GO send probe request
1881                  * more frequently. Probe request will be stopped when it gets
1882                  * probe response from target AP/GO.
1883                  */
1884                 ext_join_params->scan_le.nprobes =
1885                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
1886                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
1887         } else {
1888                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
1889                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
1890                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
1891         }
1892
1893         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
1894                                          join_params_size);
1895         kfree(ext_join_params);
1896         if (!err)
1897                 /* This is it. join command worked, we are done */
1898                 goto done;
1899
1900         /* join command failed, fallback to set ssid */
1901         memset(&join_params, 0, sizeof(join_params));
1902         join_params_size = sizeof(join_params.ssid_le);
1903
1904         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
1905         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1906
1907         if (sme->bssid)
1908                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
1909         else
1910                 eth_broadcast_addr(join_params.params_le.bssid);
1911
1912         if (cfg->channel) {
1913                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
1914                 join_params.params_le.chanspec_num = cpu_to_le32(1);
1915                 join_params_size += sizeof(join_params.params_le);
1916         }
1917         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1918                                      &join_params, join_params_size);
1919         if (err)
1920                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
1921
1922 done:
1923         if (err)
1924                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1925         brcmf_dbg(TRACE, "Exit\n");
1926         return err;
1927 }
1928
1929 static s32
1930 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
1931                        u16 reason_code)
1932 {
1933         struct brcmf_if *ifp = netdev_priv(ndev);
1934         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1935         struct brcmf_scb_val_le scbval;
1936         s32 err = 0;
1937
1938         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
1939         if (!check_vif_up(ifp->vif))
1940                 return -EIO;
1941
1942         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
1943         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1944         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
1945
1946         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
1947         scbval.val = cpu_to_le32(reason_code);
1948         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
1949                                      &scbval, sizeof(scbval));
1950         if (err)
1951                 brcmf_err("error (%d)\n", err);
1952
1953         brcmf_dbg(TRACE, "Exit\n");
1954         return err;
1955 }
1956
1957 static s32
1958 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
1959                             enum nl80211_tx_power_setting type, s32 mbm)
1960 {
1961         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1962         struct net_device *ndev = cfg_to_ndev(cfg);
1963         struct brcmf_if *ifp = netdev_priv(ndev);
1964         s32 err;
1965         s32 disable;
1966         u32 qdbm = 127;
1967
1968         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
1969         if (!check_vif_up(ifp->vif))
1970                 return -EIO;
1971
1972         switch (type) {
1973         case NL80211_TX_POWER_AUTOMATIC:
1974                 break;
1975         case NL80211_TX_POWER_LIMITED:
1976         case NL80211_TX_POWER_FIXED:
1977                 if (mbm < 0) {
1978                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
1979                         err = -EINVAL;
1980                         goto done;
1981                 }
1982                 qdbm =  MBM_TO_DBM(4 * mbm);
1983                 if (qdbm > 127)
1984                         qdbm = 127;
1985                 qdbm |= WL_TXPWR_OVERRIDE;
1986                 break;
1987         default:
1988                 brcmf_err("Unsupported type %d\n", type);
1989                 err = -EINVAL;
1990                 goto done;
1991         }
1992         /* Make sure radio is off or on as far as software is concerned */
1993         disable = WL_RADIO_SW_DISABLE << 16;
1994         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
1995         if (err)
1996                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
1997
1998         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
1999         if (err)
2000                 brcmf_err("qtxpower error (%d)\n", err);
2001
2002 done:
2003         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2004         return err;
2005 }
2006
2007 static s32
2008 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2009                             s32 *dbm)
2010 {
2011         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2012         struct net_device *ndev = cfg_to_ndev(cfg);
2013         struct brcmf_if *ifp = netdev_priv(ndev);
2014         s32 qdbm = 0;
2015         s32 err;
2016
2017         brcmf_dbg(TRACE, "Enter\n");
2018         if (!check_vif_up(ifp->vif))
2019                 return -EIO;
2020
2021         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2022         if (err) {
2023                 brcmf_err("error (%d)\n", err);
2024                 goto done;
2025         }
2026         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2027
2028 done:
2029         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2030         return err;
2031 }
2032
2033 static s32
2034 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2035                                   u8 key_idx, bool unicast, bool multicast)
2036 {
2037         struct brcmf_if *ifp = netdev_priv(ndev);
2038         u32 index;
2039         u32 wsec;
2040         s32 err = 0;
2041
2042         brcmf_dbg(TRACE, "Enter\n");
2043         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2044         if (!check_vif_up(ifp->vif))
2045                 return -EIO;
2046
2047         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2048         if (err) {
2049                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2050                 goto done;
2051         }
2052
2053         if (wsec & WEP_ENABLED) {
2054                 /* Just select a new current key */
2055                 index = key_idx;
2056                 err = brcmf_fil_cmd_int_set(ifp,
2057                                             BRCMF_C_SET_KEY_PRIMARY, index);
2058                 if (err)
2059                         brcmf_err("error (%d)\n", err);
2060         }
2061 done:
2062         brcmf_dbg(TRACE, "Exit\n");
2063         return err;
2064 }
2065
2066 static s32
2067 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
2068               u8 key_idx, const u8 *mac_addr, struct key_params *params)
2069 {
2070         struct brcmf_if *ifp = netdev_priv(ndev);
2071         struct brcmf_wsec_key key;
2072         s32 err = 0;
2073         u8 keybuf[8];
2074
2075         memset(&key, 0, sizeof(key));
2076         key.index = (u32) key_idx;
2077         /* Instead of bcast for ea address for default wep keys,
2078                  driver needs it to be Null */
2079         if (!is_multicast_ether_addr(mac_addr))
2080                 memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
2081         key.len = (u32) params->key_len;
2082         /* check for key index change */
2083         if (key.len == 0) {
2084                 /* key delete */
2085                 err = send_key_to_dongle(ifp, &key);
2086                 if (err)
2087                         brcmf_err("key delete error (%d)\n", err);
2088         } else {
2089                 if (key.len > sizeof(key.data)) {
2090                         brcmf_err("Invalid key length (%d)\n", key.len);
2091                         return -EINVAL;
2092                 }
2093
2094                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
2095                 memcpy(key.data, params->key, key.len);
2096
2097                 if (!brcmf_is_apmode(ifp->vif) &&
2098                     (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
2099                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2100                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
2101                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
2102                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
2103                 }
2104
2105                 /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
2106                 if (params->seq && params->seq_len == 6) {
2107                         /* rx iv */
2108                         u8 *ivptr;
2109                         ivptr = (u8 *) params->seq;
2110                         key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2111                             (ivptr[3] << 8) | ivptr[2];
2112                         key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2113                         key.iv_initialized = true;
2114                 }
2115
2116                 switch (params->cipher) {
2117                 case WLAN_CIPHER_SUITE_WEP40:
2118                         key.algo = CRYPTO_ALGO_WEP1;
2119                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2120                         break;
2121                 case WLAN_CIPHER_SUITE_WEP104:
2122                         key.algo = CRYPTO_ALGO_WEP128;
2123                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2124                         break;
2125                 case WLAN_CIPHER_SUITE_TKIP:
2126                         key.algo = CRYPTO_ALGO_TKIP;
2127                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2128                         break;
2129                 case WLAN_CIPHER_SUITE_AES_CMAC:
2130                         key.algo = CRYPTO_ALGO_AES_CCM;
2131                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2132                         break;
2133                 case WLAN_CIPHER_SUITE_CCMP:
2134                         key.algo = CRYPTO_ALGO_AES_CCM;
2135                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2136                         break;
2137                 default:
2138                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2139                         return -EINVAL;
2140                 }
2141                 err = send_key_to_dongle(ifp, &key);
2142                 if (err)
2143                         brcmf_err("wsec_key error (%d)\n", err);
2144         }
2145         return err;
2146 }
2147
2148 static s32
2149 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2150                     u8 key_idx, bool pairwise, const u8 *mac_addr,
2151                     struct key_params *params)
2152 {
2153         struct brcmf_if *ifp = netdev_priv(ndev);
2154         struct brcmf_wsec_key *key;
2155         s32 val;
2156         s32 wsec;
2157         s32 err = 0;
2158         u8 keybuf[8];
2159
2160         brcmf_dbg(TRACE, "Enter\n");
2161         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2162         if (!check_vif_up(ifp->vif))
2163                 return -EIO;
2164
2165         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2166                 /* we ignore this key index in this case */
2167                 brcmf_err("invalid key index (%d)\n", key_idx);
2168                 return -EINVAL;
2169         }
2170
2171         if (mac_addr &&
2172                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2173                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2174                 brcmf_dbg(TRACE, "Exit");
2175                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
2176         }
2177
2178         key = &ifp->vif->profile.key[key_idx];
2179         memset(key, 0, sizeof(*key));
2180
2181         if (params->key_len > sizeof(key->data)) {
2182                 brcmf_err("Too long key length (%u)\n", params->key_len);
2183                 err = -EINVAL;
2184                 goto done;
2185         }
2186         key->len = params->key_len;
2187         key->index = key_idx;
2188
2189         memcpy(key->data, params->key, key->len);
2190
2191         key->flags = BRCMF_PRIMARY_KEY;
2192         switch (params->cipher) {
2193         case WLAN_CIPHER_SUITE_WEP40:
2194                 key->algo = CRYPTO_ALGO_WEP1;
2195                 val = WEP_ENABLED;
2196                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2197                 break;
2198         case WLAN_CIPHER_SUITE_WEP104:
2199                 key->algo = CRYPTO_ALGO_WEP128;
2200                 val = WEP_ENABLED;
2201                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2202                 break;
2203         case WLAN_CIPHER_SUITE_TKIP:
2204                 if (!brcmf_is_apmode(ifp->vif)) {
2205                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2206                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2207                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2208                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2209                 }
2210                 key->algo = CRYPTO_ALGO_TKIP;
2211                 val = TKIP_ENABLED;
2212                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2213                 break;
2214         case WLAN_CIPHER_SUITE_AES_CMAC:
2215                 key->algo = CRYPTO_ALGO_AES_CCM;
2216                 val = AES_ENABLED;
2217                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2218                 break;
2219         case WLAN_CIPHER_SUITE_CCMP:
2220                 key->algo = CRYPTO_ALGO_AES_CCM;
2221                 val = AES_ENABLED;
2222                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2223                 break;
2224         default:
2225                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2226                 err = -EINVAL;
2227                 goto done;
2228         }
2229
2230         err = send_key_to_dongle(ifp, key);
2231         if (err)
2232                 goto done;
2233
2234         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2235         if (err) {
2236                 brcmf_err("get wsec error (%d)\n", err);
2237                 goto done;
2238         }
2239         wsec |= val;
2240         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2241         if (err) {
2242                 brcmf_err("set wsec error (%d)\n", err);
2243                 goto done;
2244         }
2245
2246 done:
2247         brcmf_dbg(TRACE, "Exit\n");
2248         return err;
2249 }
2250
2251 static s32
2252 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2253                     u8 key_idx, bool pairwise, const u8 *mac_addr)
2254 {
2255         struct brcmf_if *ifp = netdev_priv(ndev);
2256         struct brcmf_wsec_key key;
2257         s32 err = 0;
2258
2259         brcmf_dbg(TRACE, "Enter\n");
2260         if (!check_vif_up(ifp->vif))
2261                 return -EIO;
2262
2263         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2264                 /* we ignore this key index in this case */
2265                 return -EINVAL;
2266         }
2267
2268         memset(&key, 0, sizeof(key));
2269
2270         key.index = (u32) key_idx;
2271         key.flags = BRCMF_PRIMARY_KEY;
2272         key.algo = CRYPTO_ALGO_OFF;
2273
2274         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2275
2276         /* Set the new key/index */
2277         err = send_key_to_dongle(ifp, &key);
2278
2279         brcmf_dbg(TRACE, "Exit\n");
2280         return err;
2281 }
2282
2283 static s32
2284 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2285                     u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
2286                     void (*callback) (void *cookie, struct key_params * params))
2287 {
2288         struct key_params params;
2289         struct brcmf_if *ifp = netdev_priv(ndev);
2290         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2291         struct brcmf_cfg80211_security *sec;
2292         s32 wsec;
2293         s32 err = 0;
2294
2295         brcmf_dbg(TRACE, "Enter\n");
2296         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2297         if (!check_vif_up(ifp->vif))
2298                 return -EIO;
2299
2300         memset(&params, 0, sizeof(params));
2301
2302         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2303         if (err) {
2304                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2305                 /* Ignore this error, may happen during DISASSOC */
2306                 err = -EAGAIN;
2307                 goto done;
2308         }
2309         if (wsec & WEP_ENABLED) {
2310                 sec = &profile->sec;
2311                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2312                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2313                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2314                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2315                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2316                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2317                 }
2318         } else if (wsec & TKIP_ENABLED) {
2319                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2320                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2321         } else if (wsec & AES_ENABLED) {
2322                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2323                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2324         } else  {
2325                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2326                 err = -EINVAL;
2327                 goto done;
2328         }
2329         callback(cookie, &params);
2330
2331 done:
2332         brcmf_dbg(TRACE, "Exit\n");
2333         return err;
2334 }
2335
2336 static s32
2337 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2338                                     struct net_device *ndev, u8 key_idx)
2339 {
2340         brcmf_dbg(INFO, "Not supported\n");
2341
2342         return -EOPNOTSUPP;
2343 }
2344
2345 static void
2346 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2347 {
2348         s32 err;
2349         u8 key_idx;
2350         struct brcmf_wsec_key *key;
2351         s32 wsec;
2352
2353         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2354                 key = &ifp->vif->profile.key[key_idx];
2355                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2356                     (key->algo == CRYPTO_ALGO_WEP128))
2357                         break;
2358         }
2359         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2360                 return;
2361
2362         err = send_key_to_dongle(ifp, key);
2363         if (err) {
2364                 brcmf_err("Setting WEP key failed (%d)\n", err);
2365                 return;
2366         }
2367         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2368         if (err) {
2369                 brcmf_err("get wsec error (%d)\n", err);
2370                 return;
2371         }
2372         wsec |= WEP_ENABLED;
2373         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2374         if (err)
2375                 brcmf_err("set wsec error (%d)\n", err);
2376 }
2377
2378 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2379 {
2380         struct nl80211_sta_flag_update *sfu;
2381
2382         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2383         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2384         sfu = &si->sta_flags;
2385         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2386                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2387                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2388                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2389         if (fw_sta_flags & BRCMF_STA_WME)
2390                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2391         if (fw_sta_flags & BRCMF_STA_AUTHE)
2392                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2393         if (fw_sta_flags & BRCMF_STA_ASSOC)
2394                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2395         if (fw_sta_flags & BRCMF_STA_AUTHO)
2396                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2397 }
2398
2399 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2400 {
2401         struct {
2402                 __le32 len;
2403                 struct brcmf_bss_info_le bss_le;
2404         } *buf;
2405         u16 capability;
2406         int err;
2407
2408         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2409         if (!buf)
2410                 return;
2411
2412         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2413         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2414                                      WL_BSS_INFO_MAX);
2415         if (err) {
2416                 brcmf_err("Failed to get bss info (%d)\n", err);
2417                 return;
2418         }
2419         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2420         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2421         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2422         capability = le16_to_cpu(buf->bss_le.capability);
2423         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2424                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2425         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2426                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2427         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2428                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2429 }
2430
2431 static s32
2432 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2433                                 struct station_info *sinfo)
2434 {
2435         struct brcmf_scb_val_le scbval;
2436         struct brcmf_pktcnt_le pktcnt;
2437         s32 err;
2438         u32 rate;
2439         u32 rssi;
2440
2441         /* Get the current tx rate */
2442         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2443         if (err < 0) {
2444                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2445                 return err;
2446         }
2447         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2448         sinfo->txrate.legacy = rate * 5;
2449
2450         memset(&scbval, 0, sizeof(scbval));
2451         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2452                                      sizeof(scbval));
2453         if (err) {
2454                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2455                 return err;
2456         }
2457         rssi = le32_to_cpu(scbval.val);
2458         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2459         sinfo->signal = rssi;
2460
2461         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2462                                      sizeof(pktcnt));
2463         if (err) {
2464                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2465                 return err;
2466         }
2467         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2468                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2469                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2470                          BIT(NL80211_STA_INFO_TX_FAILED);
2471         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2472         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2473         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2474         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2475
2476         return 0;
2477 }
2478
2479 static s32
2480 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2481                            const u8 *mac, struct station_info *sinfo)
2482 {
2483         struct brcmf_if *ifp = netdev_priv(ndev);
2484         s32 err = 0;
2485         struct brcmf_sta_info_le sta_info_le;
2486         u32 sta_flags;
2487         u32 is_tdls_peer;
2488         s32 total_rssi;
2489         s32 count_rssi;
2490         u32 i;
2491
2492         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2493         if (!check_vif_up(ifp->vif))
2494                 return -EIO;
2495
2496         if (brcmf_is_ibssmode(ifp->vif))
2497                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2498
2499         memset(&sta_info_le, 0, sizeof(sta_info_le));
2500         memcpy(&sta_info_le, mac, ETH_ALEN);
2501         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2502                                        &sta_info_le,
2503                                        sizeof(sta_info_le));
2504         is_tdls_peer = !err;
2505         if (err) {
2506                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2507                                                &sta_info_le,
2508                                                sizeof(sta_info_le));
2509                 if (err < 0) {
2510                         brcmf_err("GET STA INFO failed, %d\n", err);
2511                         goto done;
2512                 }
2513         }
2514         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2515         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2516         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2517         sta_flags = le32_to_cpu(sta_info_le.flags);
2518         brcmf_convert_sta_flags(sta_flags, sinfo);
2519         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2520         if (is_tdls_peer)
2521                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2522         else
2523                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2524         if (sta_flags & BRCMF_STA_ASSOC) {
2525                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2526                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2527                 brcmf_fill_bss_param(ifp, sinfo);
2528         }
2529         if (sta_flags & BRCMF_STA_SCBSTATS) {
2530                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2531                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2532                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2533                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2534                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2535                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2536                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2537                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2538                 if (sinfo->tx_packets) {
2539                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2540                         sinfo->txrate.legacy =
2541                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2542                 }
2543                 if (sinfo->rx_packets) {
2544                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2545                         sinfo->rxrate.legacy =
2546                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2547                 }
2548                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2549                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2550                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2551                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2552                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2553                 }
2554                 total_rssi = 0;
2555                 count_rssi = 0;
2556                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2557                         if (sta_info_le.rssi[i]) {
2558                                 sinfo->chain_signal_avg[count_rssi] =
2559                                         sta_info_le.rssi[i];
2560                                 sinfo->chain_signal[count_rssi] =
2561                                         sta_info_le.rssi[i];
2562                                 total_rssi += sta_info_le.rssi[i];
2563                                 count_rssi++;
2564                         }
2565                 }
2566                 if (count_rssi) {
2567                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2568                         sinfo->chains = count_rssi;
2569
2570                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2571                         total_rssi /= count_rssi;
2572                         sinfo->signal = total_rssi;
2573                 }
2574         }
2575 done:
2576         brcmf_dbg(TRACE, "Exit\n");
2577         return err;
2578 }
2579
2580 static int
2581 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2582                             int idx, u8 *mac, struct station_info *sinfo)
2583 {
2584         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2585         struct brcmf_if *ifp = netdev_priv(ndev);
2586         s32 err;
2587
2588         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2589
2590         if (idx == 0) {
2591                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2592                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2593                                              &cfg->assoclist,
2594                                              sizeof(cfg->assoclist));
2595                 if (err) {
2596                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2597                                   err);
2598                         cfg->assoclist.count = 0;
2599                         return -EOPNOTSUPP;
2600                 }
2601         }
2602         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2603                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2604                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2605         }
2606         return -ENOENT;
2607 }
2608
2609 static s32
2610 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2611                            bool enabled, s32 timeout)
2612 {
2613         s32 pm;
2614         s32 err = 0;
2615         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2616         struct brcmf_if *ifp = netdev_priv(ndev);
2617
2618         brcmf_dbg(TRACE, "Enter\n");
2619
2620         /*
2621          * Powersave enable/disable request is coming from the
2622          * cfg80211 even before the interface is up. In that
2623          * scenario, driver will be storing the power save
2624          * preference in cfg struct to apply this to
2625          * FW later while initializing the dongle
2626          */
2627         cfg->pwr_save = enabled;
2628         if (!check_vif_up(ifp->vif)) {
2629
2630                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2631                 goto done;
2632         }
2633
2634         pm = enabled ? PM_FAST : PM_OFF;
2635         /* Do not enable the power save after assoc if it is a p2p interface */
2636         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2637                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2638                 pm = PM_OFF;
2639         }
2640         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2641
2642         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2643         if (err) {
2644                 if (err == -ENODEV)
2645                         brcmf_err("net_device is not ready yet\n");
2646                 else
2647                         brcmf_err("error (%d)\n", err);
2648         }
2649 done:
2650         brcmf_dbg(TRACE, "Exit\n");
2651         return err;
2652 }
2653
2654 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2655                                    struct brcmf_bss_info_le *bi)
2656 {
2657         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2658         struct ieee80211_channel *notify_channel;
2659         struct cfg80211_bss *bss;
2660         struct ieee80211_supported_band *band;
2661         struct brcmu_chan ch;
2662         u16 channel;
2663         u32 freq;
2664         u16 notify_capability;
2665         u16 notify_interval;
2666         u8 *notify_ie;
2667         size_t notify_ielen;
2668         s32 notify_signal;
2669
2670         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2671                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2672                 return 0;
2673         }
2674
2675         if (!bi->ctl_ch) {
2676                 ch.chspec = le16_to_cpu(bi->chanspec);
2677                 cfg->d11inf.decchspec(&ch);
2678                 bi->ctl_ch = ch.chnum;
2679         }
2680         channel = bi->ctl_ch;
2681
2682         if (channel <= CH_MAX_2G_CHANNEL)
2683                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2684         else
2685                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2686
2687         freq = ieee80211_channel_to_frequency(channel, band->band);
2688         notify_channel = ieee80211_get_channel(wiphy, freq);
2689
2690         notify_capability = le16_to_cpu(bi->capability);
2691         notify_interval = le16_to_cpu(bi->beacon_period);
2692         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2693         notify_ielen = le32_to_cpu(bi->ie_length);
2694         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2695
2696         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2697         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2698         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2699         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2700         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2701
2702         bss = cfg80211_inform_bss(wiphy, notify_channel,
2703                                   CFG80211_BSS_FTYPE_UNKNOWN,
2704                                   (const u8 *)bi->BSSID,
2705                                   0, notify_capability,
2706                                   notify_interval, notify_ie,
2707                                   notify_ielen, notify_signal,
2708                                   GFP_KERNEL);
2709
2710         if (!bss)
2711                 return -ENOMEM;
2712
2713         cfg80211_put_bss(wiphy, bss);
2714
2715         return 0;
2716 }
2717
2718 static struct brcmf_bss_info_le *
2719 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2720 {
2721         if (bss == NULL)
2722                 return list->bss_info_le;
2723         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2724                                             le32_to_cpu(bss->length));
2725 }
2726
2727 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2728 {
2729         struct brcmf_scan_results *bss_list;
2730         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2731         s32 err = 0;
2732         int i;
2733
2734         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2735         if (bss_list->count != 0 &&
2736             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2737                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2738                           bss_list->version);
2739                 return -EOPNOTSUPP;
2740         }
2741         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2742         for (i = 0; i < bss_list->count; i++) {
2743                 bi = next_bss_le(bss_list, bi);
2744                 err = brcmf_inform_single_bss(cfg, bi);
2745                 if (err)
2746                         break;
2747         }
2748         return err;
2749 }
2750
2751 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2752                              struct net_device *ndev, const u8 *bssid)
2753 {
2754         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2755         struct ieee80211_channel *notify_channel;
2756         struct brcmf_bss_info_le *bi = NULL;
2757         struct ieee80211_supported_band *band;
2758         struct cfg80211_bss *bss;
2759         struct brcmu_chan ch;
2760         u8 *buf = NULL;
2761         s32 err = 0;
2762         u32 freq;
2763         u16 notify_capability;
2764         u16 notify_interval;
2765         u8 *notify_ie;
2766         size_t notify_ielen;
2767         s32 notify_signal;
2768
2769         brcmf_dbg(TRACE, "Enter\n");
2770
2771         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2772         if (buf == NULL) {
2773                 err = -ENOMEM;
2774                 goto CleanUp;
2775         }
2776
2777         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2778
2779         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2780                                      buf, WL_BSS_INFO_MAX);
2781         if (err) {
2782                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2783                 goto CleanUp;
2784         }
2785
2786         bi = (struct brcmf_bss_info_le *)(buf + 4);
2787
2788         ch.chspec = le16_to_cpu(bi->chanspec);
2789         cfg->d11inf.decchspec(&ch);
2790
2791         if (ch.band == BRCMU_CHAN_BAND_2G)
2792                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2793         else
2794                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2795
2796         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
2797         cfg->channel = freq;
2798         notify_channel = ieee80211_get_channel(wiphy, freq);
2799
2800         notify_capability = le16_to_cpu(bi->capability);
2801         notify_interval = le16_to_cpu(bi->beacon_period);
2802         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2803         notify_ielen = le32_to_cpu(bi->ie_length);
2804         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2805
2806         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.chnum, freq);
2807         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2808         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2809         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2810
2811         bss = cfg80211_inform_bss(wiphy, notify_channel,
2812                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2813                                   notify_capability, notify_interval,
2814                                   notify_ie, notify_ielen, notify_signal,
2815                                   GFP_KERNEL);
2816
2817         if (!bss) {
2818                 err = -ENOMEM;
2819                 goto CleanUp;
2820         }
2821
2822         cfg80211_put_bss(wiphy, bss);
2823
2824 CleanUp:
2825
2826         kfree(buf);
2827
2828         brcmf_dbg(TRACE, "Exit\n");
2829
2830         return err;
2831 }
2832
2833 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2834                                  struct brcmf_if *ifp)
2835 {
2836         struct brcmf_bss_info_le *bi;
2837         const struct brcmf_tlv *tim;
2838         u16 beacon_interval;
2839         u8 dtim_period;
2840         size_t ie_len;
2841         u8 *ie;
2842         s32 err = 0;
2843
2844         brcmf_dbg(TRACE, "Enter\n");
2845         if (brcmf_is_ibssmode(ifp->vif))
2846                 return err;
2847
2848         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2849         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2850                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2851         if (err) {
2852                 brcmf_err("Could not get bss info %d\n", err);
2853                 goto update_bss_info_out;
2854         }
2855
2856         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2857         err = brcmf_inform_single_bss(cfg, bi);
2858         if (err)
2859                 goto update_bss_info_out;
2860
2861         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2862         ie_len = le32_to_cpu(bi->ie_length);
2863         beacon_interval = le16_to_cpu(bi->beacon_period);
2864
2865         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2866         if (tim)
2867                 dtim_period = tim->data[1];
2868         else {
2869                 /*
2870                 * active scan was done so we could not get dtim
2871                 * information out of probe response.
2872                 * so we speficially query dtim information to dongle.
2873                 */
2874                 u32 var;
2875                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2876                 if (err) {
2877                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2878                         goto update_bss_info_out;
2879                 }
2880                 dtim_period = (u8)var;
2881         }
2882
2883 update_bss_info_out:
2884         brcmf_dbg(TRACE, "Exit");
2885         return err;
2886 }
2887
2888 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
2889 {
2890         struct escan_info *escan = &cfg->escan_info;
2891
2892         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2893         if (cfg->scan_request) {
2894                 escan->escan_state = WL_ESCAN_STATE_IDLE;
2895                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
2896         }
2897         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
2898         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2899 }
2900
2901 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
2902 {
2903         struct brcmf_cfg80211_info *cfg =
2904                         container_of(work, struct brcmf_cfg80211_info,
2905                                      escan_timeout_work);
2906
2907         brcmf_inform_bss(cfg);
2908         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
2909 }
2910
2911 static void brcmf_escan_timeout(unsigned long data)
2912 {
2913         struct brcmf_cfg80211_info *cfg =
2914                         (struct brcmf_cfg80211_info *)data;
2915
2916         if (cfg->scan_request) {
2917                 brcmf_err("timer expired\n");
2918                 schedule_work(&cfg->escan_timeout_work);
2919         }
2920 }
2921
2922 static s32
2923 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
2924                               struct brcmf_bss_info_le *bss,
2925                               struct brcmf_bss_info_le *bss_info_le)
2926 {
2927         struct brcmu_chan ch_bss, ch_bss_info_le;
2928
2929         ch_bss.chspec = le16_to_cpu(bss->chanspec);
2930         cfg->d11inf.decchspec(&ch_bss);
2931         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
2932         cfg->d11inf.decchspec(&ch_bss_info_le);
2933
2934         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
2935                 ch_bss.band == ch_bss_info_le.band &&
2936                 bss_info_le->SSID_len == bss->SSID_len &&
2937                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
2938                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
2939                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
2940                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
2941                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
2942
2943                         /* preserve max RSSI if the measurements are
2944                         * both on-channel or both off-channel
2945                         */
2946                         if (bss_info_rssi > bss_rssi)
2947                                 bss->RSSI = bss_info_le->RSSI;
2948                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
2949                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
2950                         /* preserve the on-channel rssi measurement
2951                         * if the new measurement is off channel
2952                         */
2953                         bss->RSSI = bss_info_le->RSSI;
2954                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
2955                 }
2956                 return 1;
2957         }
2958         return 0;
2959 }
2960
2961 static s32
2962 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
2963                              const struct brcmf_event_msg *e, void *data)
2964 {
2965         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
2966         s32 status;
2967         struct brcmf_escan_result_le *escan_result_le;
2968         struct brcmf_bss_info_le *bss_info_le;
2969         struct brcmf_bss_info_le *bss = NULL;
2970         u32 bi_length;
2971         struct brcmf_scan_results *list;
2972         u32 i;
2973         bool aborted;
2974
2975         status = e->status;
2976
2977         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
2978                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
2979                 return -EPERM;
2980         }
2981
2982         if (status == BRCMF_E_STATUS_PARTIAL) {
2983                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
2984                 escan_result_le = (struct brcmf_escan_result_le *) data;
2985                 if (!escan_result_le) {
2986                         brcmf_err("Invalid escan result (NULL pointer)\n");
2987                         goto exit;
2988                 }
2989                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
2990                         brcmf_err("Invalid bss_count %d: ignoring\n",
2991                                   escan_result_le->bss_count);
2992                         goto exit;
2993                 }
2994                 bss_info_le = &escan_result_le->bss_info_le;
2995
2996                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
2997                         goto exit;
2998
2999                 if (!cfg->scan_request) {
3000                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3001                         goto exit;
3002                 }
3003
3004                 bi_length = le32_to_cpu(bss_info_le->length);
3005                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
3006                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
3007                         brcmf_err("Invalid bss_info length %d: ignoring\n",
3008                                   bi_length);
3009                         goto exit;
3010                 }
3011
3012                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3013                                         BIT(NL80211_IFTYPE_ADHOC))) {
3014                         if (le16_to_cpu(bss_info_le->capability) &
3015                                                 WLAN_CAPABILITY_IBSS) {
3016                                 brcmf_err("Ignoring IBSS result\n");
3017                                 goto exit;
3018                         }
3019                 }
3020
3021                 list = (struct brcmf_scan_results *)
3022                                 cfg->escan_info.escan_buf;
3023                 if (bi_length > WL_ESCAN_BUF_SIZE - list->buflen) {
3024                         brcmf_err("Buffer is too small: ignoring\n");
3025                         goto exit;
3026                 }
3027
3028                 for (i = 0; i < list->count; i++) {
3029                         bss = bss ? (struct brcmf_bss_info_le *)
3030                                 ((unsigned char *)bss +
3031                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3032                         if (brcmf_compare_update_same_bss(cfg, bss,
3033                                                           bss_info_le))
3034                                 goto exit;
3035                 }
3036                 memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
3037                         bss_info_le, bi_length);
3038                 list->version = le32_to_cpu(bss_info_le->version);
3039                 list->buflen += bi_length;
3040                 list->count++;
3041         } else {
3042                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3043                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3044                         goto exit;
3045                 if (cfg->scan_request) {
3046                         brcmf_inform_bss(cfg);
3047                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3048                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3049                 } else
3050                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3051                                   status);
3052         }
3053 exit:
3054         return 0;
3055 }
3056
3057 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3058 {
3059         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3060                             brcmf_cfg80211_escan_handler);
3061         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3062         /* Init scan_timeout timer */
3063         init_timer(&cfg->escan_timeout);
3064         cfg->escan_timeout.data = (unsigned long) cfg;
3065         cfg->escan_timeout.function = brcmf_escan_timeout;
3066         INIT_WORK(&cfg->escan_timeout_work,
3067                   brcmf_cfg80211_escan_timeout_worker);
3068 }
3069
3070 /* PFN result doesn't have all the info which are required by the supplicant
3071  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3072  * via wl_inform_single_bss in the required format. Escan does require the
3073  * scan request in the form of cfg80211_scan_request. For timebeing, create
3074  * cfg80211_scan_request one out of the received PNO event.
3075  */
3076 static s32
3077 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3078                                 const struct brcmf_event_msg *e, void *data)
3079 {
3080         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3081         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3082         struct cfg80211_scan_request *request = NULL;
3083         struct cfg80211_ssid *ssid = NULL;
3084         struct ieee80211_channel *channel = NULL;
3085         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3086         int err = 0;
3087         int channel_req = 0;
3088         int band = 0;
3089         struct brcmf_pno_scanresults_le *pfn_result;
3090         u32 result_count;
3091         u32 status;
3092
3093         brcmf_dbg(SCAN, "Enter\n");
3094
3095         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3096                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3097                 return 0;
3098         }
3099
3100         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3101         result_count = le32_to_cpu(pfn_result->count);
3102         status = le32_to_cpu(pfn_result->status);
3103
3104         /* PFN event is limited to fit 512 bytes so we may get
3105          * multiple NET_FOUND events. For now place a warning here.
3106          */
3107         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3108         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3109         if (result_count > 0) {
3110                 int i;
3111
3112                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3113                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3114                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3115                 if (!request || !ssid || !channel) {
3116                         err = -ENOMEM;
3117                         goto out_err;
3118                 }
3119
3120                 request->wiphy = wiphy;
3121                 data += sizeof(struct brcmf_pno_scanresults_le);
3122                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3123
3124                 for (i = 0; i < result_count; i++) {
3125                         netinfo = &netinfo_start[i];
3126                         if (!netinfo) {
3127                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3128                                           i);
3129                                 err = -EINVAL;
3130                                 goto out_err;
3131                         }
3132
3133                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3134                                   netinfo->SSID, netinfo->channel);
3135                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3136                         ssid[i].ssid_len = netinfo->SSID_len;
3137                         request->n_ssids++;
3138
3139                         channel_req = netinfo->channel;
3140                         if (channel_req <= CH_MAX_2G_CHANNEL)
3141                                 band = NL80211_BAND_2GHZ;
3142                         else
3143                                 band = NL80211_BAND_5GHZ;
3144                         channel[i].center_freq =
3145                                 ieee80211_channel_to_frequency(channel_req,
3146                                                                band);
3147                         channel[i].band = band;
3148                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3149                         request->channels[i] = &channel[i];
3150                         request->n_channels++;
3151                 }
3152
3153                 /* assign parsed ssid array */
3154                 if (request->n_ssids)
3155                         request->ssids = &ssid[0];
3156
3157                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3158                         /* Abort any on-going scan */
3159                         brcmf_abort_scanning(cfg);
3160                 }
3161
3162                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3163                 cfg->escan_info.run = brcmf_run_escan;
3164                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3165                 if (err) {
3166                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3167                         goto out_err;
3168                 }
3169                 cfg->sched_escan = true;
3170                 cfg->scan_request = request;
3171         } else {
3172                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3173                 goto out_err;
3174         }
3175
3176         kfree(ssid);
3177         kfree(channel);
3178         kfree(request);
3179         return 0;
3180
3181 out_err:
3182         kfree(ssid);
3183         kfree(channel);
3184         kfree(request);
3185         cfg80211_sched_scan_stopped(wiphy);
3186         return err;
3187 }
3188
3189 static int brcmf_dev_pno_clean(struct net_device *ndev)
3190 {
3191         int ret;
3192
3193         /* Disable pfn */
3194         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3195         if (ret == 0) {
3196                 /* clear pfn */
3197                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3198                                                NULL, 0);
3199         }
3200         if (ret < 0)
3201                 brcmf_err("failed code %d\n", ret);
3202
3203         return ret;
3204 }
3205
3206 static int brcmf_dev_pno_config(struct brcmf_if *ifp,
3207                                 struct cfg80211_sched_scan_request *request)
3208 {
3209         struct brcmf_pno_param_le pfn_param;
3210         struct brcmf_pno_macaddr_le pfn_mac;
3211         s32 err;
3212         u8 *mac_mask;
3213         int i;
3214
3215         memset(&pfn_param, 0, sizeof(pfn_param));
3216         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3217
3218         /* set extra pno params */
3219         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3220         pfn_param.repeat = BRCMF_PNO_REPEAT;
3221         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3222
3223         /* set up pno scan fr */
3224         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3225
3226         err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
3227                                        sizeof(pfn_param));
3228         if (err) {
3229                 brcmf_err("pfn_set failed, err=%d\n", err);
3230                 return err;
3231         }
3232
3233         /* Find out if mac randomization should be turned on */
3234         if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
3235                 return 0;
3236
3237         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
3238         pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
3239
3240         memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
3241         mac_mask = request->mac_addr_mask;
3242         for (i = 0; i < ETH_ALEN; i++) {
3243                 pfn_mac.mac[i] &= mac_mask[i];
3244                 pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
3245         }
3246         /* Clear multi bit */
3247         pfn_mac.mac[0] &= 0xFE;
3248         /* Set locally administered */
3249         pfn_mac.mac[0] |= 0x02;
3250
3251         err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
3252                                        sizeof(pfn_mac));
3253         if (err)
3254                 brcmf_err("pfn_macaddr failed, err=%d\n", err);
3255
3256         return err;
3257 }
3258
3259 static int
3260 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3261                                 struct net_device *ndev,
3262                                 struct cfg80211_sched_scan_request *request)
3263 {
3264         struct brcmf_if *ifp = netdev_priv(ndev);
3265         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3266         struct brcmf_pno_net_param_le pfn;
3267         int i;
3268         int ret = 0;
3269
3270         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3271                   request->n_match_sets, request->n_ssids);
3272         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3273                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3274                 return -EAGAIN;
3275         }
3276         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3277                 brcmf_err("Scanning suppressed: status (%lu)\n",
3278                           cfg->scan_status);
3279                 return -EAGAIN;
3280         }
3281
3282         if (!request->n_ssids || !request->n_match_sets) {
3283                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3284                           request->n_ssids);
3285                 return -EINVAL;
3286         }
3287
3288         if (request->n_ssids > 0) {
3289                 for (i = 0; i < request->n_ssids; i++) {
3290                         /* Active scan req for ssids */
3291                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3292                                   request->ssids[i].ssid);
3293
3294                         /* match_set ssids is a supert set of n_ssid list,
3295                          * so we need not add these set separately.
3296                          */
3297                 }
3298         }
3299
3300         if (request->n_match_sets > 0) {
3301                 /* clean up everything */
3302                 ret = brcmf_dev_pno_clean(ndev);
3303                 if  (ret < 0) {
3304                         brcmf_err("failed error=%d\n", ret);
3305                         return ret;
3306                 }
3307
3308                 /* configure pno */
3309                 if (brcmf_dev_pno_config(ifp, request))
3310                         return -EINVAL;
3311
3312                 /* configure each match set */
3313                 for (i = 0; i < request->n_match_sets; i++) {
3314                         struct cfg80211_ssid *ssid;
3315                         u32 ssid_len;
3316
3317                         ssid = &request->match_sets[i].ssid;
3318                         ssid_len = ssid->ssid_len;
3319
3320                         if (!ssid_len) {
3321                                 brcmf_err("skip broadcast ssid\n");
3322                                 continue;
3323                         }
3324                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3325                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3326                         pfn.wsec = cpu_to_le32(0);
3327                         pfn.infra = cpu_to_le32(1);
3328                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3329                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3330                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3331                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3332                                                        sizeof(pfn));
3333                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3334                                   ret == 0 ? "set" : "failed", ssid->ssid);
3335                 }
3336                 /* Enable the PNO */
3337                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3338                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3339                         return -EINVAL;
3340                 }
3341         } else {
3342                 return -EINVAL;
3343         }
3344
3345         return 0;
3346 }
3347
3348 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3349                                           struct net_device *ndev)
3350 {
3351         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3352
3353         brcmf_dbg(SCAN, "enter\n");
3354         brcmf_dev_pno_clean(ndev);
3355         if (cfg->sched_escan)
3356                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3357         return 0;
3358 }
3359
3360 static __always_inline void brcmf_delay(u32 ms)
3361 {
3362         if (ms < 1000 / HZ) {
3363                 cond_resched();
3364                 mdelay(ms);
3365         } else {
3366                 msleep(ms);
3367         }
3368 }
3369
3370 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3371                                      u8 *pattern, u32 patternsize, u8 *mask,
3372                                      u32 packet_offset)
3373 {
3374         struct brcmf_fil_wowl_pattern_le *filter;
3375         u32 masksize;
3376         u32 patternoffset;
3377         u8 *buf;
3378         u32 bufsize;
3379         s32 ret;
3380
3381         masksize = (patternsize + 7) / 8;
3382         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3383
3384         bufsize = sizeof(*filter) + patternsize + masksize;
3385         buf = kzalloc(bufsize, GFP_KERNEL);
3386         if (!buf)
3387                 return -ENOMEM;
3388         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3389
3390         memcpy(filter->cmd, cmd, 4);
3391         filter->masksize = cpu_to_le32(masksize);
3392         filter->offset = cpu_to_le32(packet_offset);
3393         filter->patternoffset = cpu_to_le32(patternoffset);
3394         filter->patternsize = cpu_to_le32(patternsize);
3395         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3396
3397         if ((mask) && (masksize))
3398                 memcpy(buf + sizeof(*filter), mask, masksize);
3399         if ((pattern) && (patternsize))
3400                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3401
3402         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3403
3404         kfree(buf);
3405         return ret;
3406 }
3407
3408 static s32
3409 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3410                       void *data)
3411 {
3412         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3413         struct brcmf_pno_scanresults_le *pfn_result;
3414         struct brcmf_pno_net_info_le *netinfo;
3415
3416         brcmf_dbg(SCAN, "Enter\n");
3417
3418         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3419
3420         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3421                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3422                 return 0;
3423         }
3424
3425         if (le32_to_cpu(pfn_result->count) < 1) {
3426                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3427                           le32_to_cpu(pfn_result->count));
3428                 return -EINVAL;
3429         }
3430
3431         data += sizeof(struct brcmf_pno_scanresults_le);
3432         netinfo = (struct brcmf_pno_net_info_le *)data;
3433         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3434         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3435         cfg->wowl.nd->n_channels = 1;
3436         cfg->wowl.nd->channels[0] =
3437                 ieee80211_channel_to_frequency(netinfo->channel,
3438                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3439                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3440         cfg->wowl.nd_info->n_matches = 1;
3441         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3442
3443         /* Inform (the resume task) that the net detect information was recvd */
3444         cfg->wowl.nd_data_completed = true;
3445         wake_up(&cfg->wowl.nd_data_wait);
3446
3447         return 0;
3448 }
3449
3450 #ifdef CONFIG_PM
3451
3452 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3453 {
3454         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3455         struct brcmf_wowl_wakeind_le wake_ind_le;
3456         struct cfg80211_wowlan_wakeup wakeup_data;
3457         struct cfg80211_wowlan_wakeup *wakeup;
3458         u32 wakeind;
3459         s32 err;
3460         int timeout;
3461
3462         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3463                                        sizeof(wake_ind_le));
3464         if (err) {
3465                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3466                 return;
3467         }
3468
3469         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3470         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3471                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3472                        BRCMF_WOWL_PFN_FOUND)) {
3473                 wakeup = &wakeup_data;
3474                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3475                 wakeup_data.pattern_idx = -1;
3476
3477                 if (wakeind & BRCMF_WOWL_MAGIC) {
3478                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3479                         wakeup_data.magic_pkt = true;
3480                 }
3481                 if (wakeind & BRCMF_WOWL_DIS) {
3482                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3483                         wakeup_data.disconnect = true;
3484                 }
3485                 if (wakeind & BRCMF_WOWL_BCN) {
3486                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3487                         wakeup_data.disconnect = true;
3488                 }
3489                 if (wakeind & BRCMF_WOWL_RETR) {
3490                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3491                         wakeup_data.disconnect = true;
3492                 }
3493                 if (wakeind & BRCMF_WOWL_NET) {
3494                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3495                         /* For now always map to pattern 0, no API to get
3496                          * correct information available at the moment.
3497                          */
3498                         wakeup_data.pattern_idx = 0;
3499                 }
3500                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3501                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3502                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3503                                 cfg->wowl.nd_data_completed,
3504                                 BRCMF_ND_INFO_TIMEOUT);
3505                         if (!timeout)
3506                                 brcmf_err("No result for wowl net detect\n");
3507                         else
3508                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3509                 }
3510         } else {
3511                 wakeup = NULL;
3512         }
3513         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3514 }
3515
3516 #else
3517
3518 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3519 {
3520 }
3521
3522 #endif /* CONFIG_PM */
3523
3524 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3525 {
3526         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3527         struct net_device *ndev = cfg_to_ndev(cfg);
3528         struct brcmf_if *ifp = netdev_priv(ndev);
3529
3530         brcmf_dbg(TRACE, "Enter\n");
3531
3532         if (cfg->wowl.active) {
3533                 brcmf_report_wowl_wakeind(wiphy, ifp);
3534                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3535                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3536                 brcmf_configure_arp_offload(ifp, true);
3537                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3538                                       cfg->wowl.pre_pmmode);
3539                 cfg->wowl.active = false;
3540                 if (cfg->wowl.nd_enabled) {
3541                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
3542                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3543                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3544                                             brcmf_notify_sched_scan_results);
3545                         cfg->wowl.nd_enabled = false;
3546                 }
3547         }
3548         return 0;
3549 }
3550
3551 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3552                                  struct brcmf_if *ifp,
3553                                  struct cfg80211_wowlan *wowl)
3554 {
3555         u32 wowl_config;
3556         u32 i;
3557
3558         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3559
3560         brcmf_configure_arp_offload(ifp, false);
3561         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3562         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3563
3564         wowl_config = 0;
3565         if (wowl->disconnect)
3566                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3567         if (wowl->magic_pkt)
3568                 wowl_config |= BRCMF_WOWL_MAGIC;
3569         if ((wowl->patterns) && (wowl->n_patterns)) {
3570                 wowl_config |= BRCMF_WOWL_NET;
3571                 for (i = 0; i < wowl->n_patterns; i++) {
3572                         brcmf_config_wowl_pattern(ifp, "add",
3573                                 (u8 *)wowl->patterns[i].pattern,
3574                                 wowl->patterns[i].pattern_len,
3575                                 (u8 *)wowl->patterns[i].mask,
3576                                 wowl->patterns[i].pkt_offset);
3577                 }
3578         }
3579         if (wowl->nd_config) {
3580                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3581                                                 wowl->nd_config);
3582                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3583
3584                 cfg->wowl.nd_data_completed = false;
3585                 cfg->wowl.nd_enabled = true;
3586                 /* Now reroute the event for PFN to the wowl function. */
3587                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3588                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3589                                     brcmf_wowl_nd_results);
3590         }
3591         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3592                 wowl_config |= BRCMF_WOWL_UNASSOC;
3593
3594         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear", strlen("clear"));
3595         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3596         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3597         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3598         cfg->wowl.active = true;
3599 }
3600
3601 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3602                                   struct cfg80211_wowlan *wowl)
3603 {
3604         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3605         struct net_device *ndev = cfg_to_ndev(cfg);
3606         struct brcmf_if *ifp = netdev_priv(ndev);
3607         struct brcmf_cfg80211_vif *vif;
3608
3609         brcmf_dbg(TRACE, "Enter\n");
3610
3611         /* if the primary net_device is not READY there is nothing
3612          * we can do but pray resume goes smoothly.
3613          */
3614         if (!check_vif_up(ifp->vif))
3615                 goto exit;
3616
3617         /* Stop scheduled scan */
3618         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3619                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
3620
3621         /* end any scanning */
3622         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3623                 brcmf_abort_scanning(cfg);
3624
3625         if (wowl == NULL) {
3626                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3627                 list_for_each_entry(vif, &cfg->vif_list, list) {
3628                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3629                                 continue;
3630                         /* While going to suspend if associated with AP
3631                          * disassociate from AP to save power while system is
3632                          * in suspended state
3633                          */
3634                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3635                         /* Make sure WPA_Supplicant receives all the event
3636                          * generated due to DISASSOC call to the fw to keep
3637                          * the state fw and WPA_Supplicant state consistent
3638                          */
3639                         brcmf_delay(500);
3640                 }
3641                 /* Configure MPC */
3642                 brcmf_set_mpc(ifp, 1);
3643
3644         } else {
3645                 /* Configure WOWL paramaters */
3646                 brcmf_configure_wowl(cfg, ifp, wowl);
3647         }
3648
3649 exit:
3650         brcmf_dbg(TRACE, "Exit\n");
3651         /* clear any scanning activity */
3652         cfg->scan_status = 0;
3653         return 0;
3654 }
3655
3656 static __used s32
3657 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3658 {
3659         struct brcmf_pmk_list_le *pmk_list;
3660         int i;
3661         u32 npmk;
3662         s32 err;
3663
3664         pmk_list = &cfg->pmk_list;
3665         npmk = le32_to_cpu(pmk_list->npmk);
3666
3667         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3668         for (i = 0; i < npmk; i++)
3669                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3670
3671         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3672                                        sizeof(*pmk_list));
3673
3674         return err;
3675 }
3676
3677 static s32
3678 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3679                          struct cfg80211_pmksa *pmksa)
3680 {
3681         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3682         struct brcmf_if *ifp = netdev_priv(ndev);
3683         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3684         s32 err;
3685         u32 npmk, i;
3686
3687         brcmf_dbg(TRACE, "Enter\n");
3688         if (!check_vif_up(ifp->vif))
3689                 return -EIO;
3690
3691         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3692         for (i = 0; i < npmk; i++)
3693                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3694                         break;
3695         if (i < BRCMF_MAXPMKID) {
3696                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3697                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3698                 if (i == npmk) {
3699                         npmk++;
3700                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3701                 }
3702         } else {
3703                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3704                 return -EINVAL;
3705         }
3706
3707         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3708         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3709                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3710                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3711                           pmk[npmk].pmkid[i + 3]);
3712
3713         err = brcmf_update_pmklist(cfg, ifp);
3714
3715         brcmf_dbg(TRACE, "Exit\n");
3716         return err;
3717 }
3718
3719 static s32
3720 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3721                          struct cfg80211_pmksa *pmksa)
3722 {
3723         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3724         struct brcmf_if *ifp = netdev_priv(ndev);
3725         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3726         s32 err;
3727         u32 npmk, i;
3728
3729         brcmf_dbg(TRACE, "Enter\n");
3730         if (!check_vif_up(ifp->vif))
3731                 return -EIO;
3732
3733         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", &pmksa->bssid);
3734
3735         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3736         for (i = 0; i < npmk; i++)
3737                 if (!memcmp(&pmksa->bssid, &pmk[i].bssid, ETH_ALEN))
3738                         break;
3739
3740         if ((npmk > 0) && (i < npmk)) {
3741                 for (; i < (npmk - 1); i++) {
3742                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3743                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3744                                WLAN_PMKID_LEN);
3745                 }
3746                 memset(&pmk[i], 0, sizeof(*pmk));
3747                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3748         } else {
3749                 brcmf_err("Cache entry not found\n");
3750                 return -EINVAL;
3751         }
3752
3753         err = brcmf_update_pmklist(cfg, ifp);
3754
3755         brcmf_dbg(TRACE, "Exit\n");
3756         return err;
3757
3758 }
3759
3760 static s32
3761 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3762 {
3763         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3764         struct brcmf_if *ifp = netdev_priv(ndev);
3765         s32 err;
3766
3767         brcmf_dbg(TRACE, "Enter\n");
3768         if (!check_vif_up(ifp->vif))
3769                 return -EIO;
3770
3771         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3772         err = brcmf_update_pmklist(cfg, ifp);
3773
3774         brcmf_dbg(TRACE, "Exit\n");
3775         return err;
3776
3777 }
3778
3779 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3780 {
3781         s32 err;
3782
3783         /* set auth */
3784         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3785         if (err < 0) {
3786                 brcmf_err("auth error %d\n", err);
3787                 return err;
3788         }
3789         /* set wsec */
3790         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3791         if (err < 0) {
3792                 brcmf_err("wsec error %d\n", err);
3793                 return err;
3794         }
3795         /* set upper-layer auth */
3796         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3797         if (err < 0) {
3798                 brcmf_err("wpa_auth error %d\n", err);
3799                 return err;
3800         }
3801
3802         return 0;
3803 }
3804
3805 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3806 {
3807         if (is_rsn_ie)
3808                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3809
3810         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3811 }
3812
3813 static s32
3814 brcmf_configure_wpaie(struct brcmf_if *ifp,
3815                       const struct brcmf_vs_tlv *wpa_ie,
3816                       bool is_rsn_ie)
3817 {
3818         u32 auth = 0; /* d11 open authentication */
3819         u16 count;
3820         s32 err = 0;
3821         s32 len = 0;
3822         u32 i;
3823         u32 wsec;
3824         u32 pval = 0;
3825         u32 gval = 0;
3826         u32 wpa_auth = 0;
3827         u32 offset;
3828         u8 *data;
3829         u16 rsn_cap;
3830         u32 wme_bss_disable;
3831
3832         brcmf_dbg(TRACE, "Enter\n");
3833         if (wpa_ie == NULL)
3834                 goto exit;
3835
3836         len = wpa_ie->len + TLV_HDR_LEN;
3837         data = (u8 *)wpa_ie;
3838         offset = TLV_HDR_LEN;
3839         if (!is_rsn_ie)
3840                 offset += VS_IE_FIXED_HDR_LEN;
3841         else
3842                 offset += WPA_IE_VERSION_LEN;
3843
3844         /* check for multicast cipher suite */
3845         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3846                 err = -EINVAL;
3847                 brcmf_err("no multicast cipher suite\n");
3848                 goto exit;
3849         }
3850
3851         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3852                 err = -EINVAL;
3853                 brcmf_err("ivalid OUI\n");
3854                 goto exit;
3855         }
3856         offset += TLV_OUI_LEN;
3857
3858         /* pick up multicast cipher */
3859         switch (data[offset]) {
3860         case WPA_CIPHER_NONE:
3861                 gval = 0;
3862                 break;
3863         case WPA_CIPHER_WEP_40:
3864         case WPA_CIPHER_WEP_104:
3865                 gval = WEP_ENABLED;
3866                 break;
3867         case WPA_CIPHER_TKIP:
3868                 gval = TKIP_ENABLED;
3869                 break;
3870         case WPA_CIPHER_AES_CCM:
3871                 gval = AES_ENABLED;
3872                 break;
3873         default:
3874                 err = -EINVAL;
3875                 brcmf_err("Invalid multi cast cipher info\n");
3876                 goto exit;
3877         }
3878
3879         offset++;
3880         /* walk thru unicast cipher list and pick up what we recognize */
3881         count = data[offset] + (data[offset + 1] << 8);
3882         offset += WPA_IE_SUITE_COUNT_LEN;
3883         /* Check for unicast suite(s) */
3884         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3885                 err = -EINVAL;
3886                 brcmf_err("no unicast cipher suite\n");
3887                 goto exit;
3888         }
3889         for (i = 0; i < count; i++) {
3890                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3891                         err = -EINVAL;
3892                         brcmf_err("ivalid OUI\n");
3893                         goto exit;
3894                 }
3895                 offset += TLV_OUI_LEN;
3896                 switch (data[offset]) {
3897                 case WPA_CIPHER_NONE:
3898                         break;
3899                 case WPA_CIPHER_WEP_40:
3900                 case WPA_CIPHER_WEP_104:
3901                         pval |= WEP_ENABLED;
3902                         break;
3903                 case WPA_CIPHER_TKIP:
3904                         pval |= TKIP_ENABLED;
3905                         break;
3906                 case WPA_CIPHER_AES_CCM:
3907                         pval |= AES_ENABLED;
3908                         break;
3909                 default:
3910                         brcmf_err("Ivalid unicast security info\n");
3911                 }
3912                 offset++;
3913         }
3914         /* walk thru auth management suite list and pick up what we recognize */
3915         count = data[offset] + (data[offset + 1] << 8);
3916         offset += WPA_IE_SUITE_COUNT_LEN;
3917         /* Check for auth key management suite(s) */
3918         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3919                 err = -EINVAL;
3920                 brcmf_err("no auth key mgmt suite\n");
3921                 goto exit;
3922         }
3923         for (i = 0; i < count; i++) {
3924                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3925                         err = -EINVAL;
3926                         brcmf_err("ivalid OUI\n");
3927                         goto exit;
3928                 }
3929                 offset += TLV_OUI_LEN;
3930                 switch (data[offset]) {
3931                 case RSN_AKM_NONE:
3932                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
3933                         wpa_auth |= WPA_AUTH_NONE;
3934                         break;
3935                 case RSN_AKM_UNSPECIFIED:
3936                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
3937                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
3938                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
3939                         break;
3940                 case RSN_AKM_PSK:
3941                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
3942                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
3943                                     (wpa_auth |= WPA_AUTH_PSK);
3944                         break;
3945                 default:
3946                         brcmf_err("Ivalid key mgmt info\n");
3947                 }
3948                 offset++;
3949         }
3950
3951         if (is_rsn_ie) {
3952                 wme_bss_disable = 1;
3953                 if ((offset + RSN_CAP_LEN) <= len) {
3954                         rsn_cap = data[offset] + (data[offset + 1] << 8);
3955                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
3956                                 wme_bss_disable = 0;
3957                 }
3958                 /* set wme_bss_disable to sync RSN Capabilities */
3959                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
3960                                                wme_bss_disable);
3961                 if (err < 0) {
3962                         brcmf_err("wme_bss_disable error %d\n", err);
3963                         goto exit;
3964                 }
3965         }
3966         /* FOR WPS , set SES_OW_ENABLED */
3967         wsec = (pval | gval | SES_OW_ENABLED);
3968
3969         /* set auth */
3970         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
3971         if (err < 0) {
3972                 brcmf_err("auth error %d\n", err);
3973                 goto exit;
3974         }
3975         /* set wsec */
3976         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3977         if (err < 0) {
3978                 brcmf_err("wsec error %d\n", err);
3979                 goto exit;
3980         }
3981         /* set upper-layer auth */
3982         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
3983         if (err < 0) {
3984                 brcmf_err("wpa_auth error %d\n", err);
3985                 goto exit;
3986         }
3987
3988 exit:
3989         return err;
3990 }
3991
3992 static s32
3993 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
3994                      struct parsed_vndr_ies *vndr_ies)
3995 {
3996         struct brcmf_vs_tlv *vndrie;
3997         struct brcmf_tlv *ie;
3998         struct parsed_vndr_ie_info *parsed_info;
3999         s32 remaining_len;
4000
4001         remaining_len = (s32)vndr_ie_len;
4002         memset(vndr_ies, 0, sizeof(*vndr_ies));
4003
4004         ie = (struct brcmf_tlv *)vndr_ie_buf;
4005         while (ie) {
4006                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4007                         goto next;
4008                 vndrie = (struct brcmf_vs_tlv *)ie;
4009                 /* len should be bigger than OUI length + one */
4010                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4011                         brcmf_err("invalid vndr ie. length is too small %d\n",
4012                                   vndrie->len);
4013                         goto next;
4014                 }
4015                 /* if wpa or wme ie, do not add ie */
4016                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4017                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4018                     (vndrie->oui_type == WME_OUI_TYPE))) {
4019                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4020                         goto next;
4021                 }
4022
4023                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4024
4025                 /* save vndr ie information */
4026                 parsed_info->ie_ptr = (char *)vndrie;
4027                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4028                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4029
4030                 vndr_ies->count++;
4031
4032                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4033                           parsed_info->vndrie.oui[0],
4034                           parsed_info->vndrie.oui[1],
4035                           parsed_info->vndrie.oui[2],
4036                           parsed_info->vndrie.oui_type);
4037
4038                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4039                         break;
4040 next:
4041                 remaining_len -= (ie->len + TLV_HDR_LEN);
4042                 if (remaining_len <= TLV_HDR_LEN)
4043                         ie = NULL;
4044                 else
4045                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4046                                 TLV_HDR_LEN);
4047         }
4048         return 0;
4049 }
4050
4051 static u32
4052 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4053 {
4054
4055         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4056         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4057
4058         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4059
4060         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4061
4062         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4063
4064         return ie_len + VNDR_IE_HDR_SIZE;
4065 }
4066
4067 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4068                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4069 {
4070         struct brcmf_if *ifp;
4071         struct vif_saved_ie *saved_ie;
4072         s32 err = 0;
4073         u8  *iovar_ie_buf;
4074         u8  *curr_ie_buf;
4075         u8  *mgmt_ie_buf = NULL;
4076         int mgmt_ie_buf_len;
4077         u32 *mgmt_ie_len;
4078         u32 del_add_ie_buf_len = 0;
4079         u32 total_ie_buf_len = 0;
4080         u32 parsed_ie_buf_len = 0;
4081         struct parsed_vndr_ies old_vndr_ies;
4082         struct parsed_vndr_ies new_vndr_ies;
4083         struct parsed_vndr_ie_info *vndrie_info;
4084         s32 i;
4085         u8 *ptr;
4086         int remained_buf_len;
4087
4088         if (!vif)
4089                 return -ENODEV;
4090         ifp = vif->ifp;
4091         saved_ie = &vif->saved_ie;
4092
4093         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4094                   pktflag);
4095         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4096         if (!iovar_ie_buf)
4097                 return -ENOMEM;
4098         curr_ie_buf = iovar_ie_buf;
4099         switch (pktflag) {
4100         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4101                 mgmt_ie_buf = saved_ie->probe_req_ie;
4102                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4103                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4104                 break;
4105         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4106                 mgmt_ie_buf = saved_ie->probe_res_ie;
4107                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4108                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4109                 break;
4110         case BRCMF_VNDR_IE_BEACON_FLAG:
4111                 mgmt_ie_buf = saved_ie->beacon_ie;
4112                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4113                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4114                 break;
4115         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4116                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4117                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4118                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4119                 break;
4120         default:
4121                 err = -EPERM;
4122                 brcmf_err("not suitable type\n");
4123                 goto exit;
4124         }
4125
4126         if (vndr_ie_len > mgmt_ie_buf_len) {
4127                 err = -ENOMEM;
4128                 brcmf_err("extra IE size too big\n");
4129                 goto exit;
4130         }
4131
4132         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4133         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4134                 ptr = curr_ie_buf;
4135                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4136                 for (i = 0; i < new_vndr_ies.count; i++) {
4137                         vndrie_info = &new_vndr_ies.ie_info[i];
4138                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4139                                vndrie_info->ie_len);
4140                         parsed_ie_buf_len += vndrie_info->ie_len;
4141                 }
4142         }
4143
4144         if (mgmt_ie_buf && *mgmt_ie_len) {
4145                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4146                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4147                             parsed_ie_buf_len) == 0)) {
4148                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4149                         goto exit;
4150                 }
4151
4152                 /* parse old vndr_ie */
4153                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4154
4155                 /* make a command to delete old ie */
4156                 for (i = 0; i < old_vndr_ies.count; i++) {
4157                         vndrie_info = &old_vndr_ies.ie_info[i];
4158
4159                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4160                                   vndrie_info->vndrie.id,
4161                                   vndrie_info->vndrie.len,
4162                                   vndrie_info->vndrie.oui[0],
4163                                   vndrie_info->vndrie.oui[1],
4164                                   vndrie_info->vndrie.oui[2]);
4165
4166                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4167                                                            vndrie_info->ie_ptr,
4168                                                            vndrie_info->ie_len,
4169                                                            "del");
4170                         curr_ie_buf += del_add_ie_buf_len;
4171                         total_ie_buf_len += del_add_ie_buf_len;
4172                 }
4173         }
4174
4175         *mgmt_ie_len = 0;
4176         /* Add if there is any extra IE */
4177         if (mgmt_ie_buf && parsed_ie_buf_len) {
4178                 ptr = mgmt_ie_buf;
4179
4180                 remained_buf_len = mgmt_ie_buf_len;
4181
4182                 /* make a command to add new ie */
4183                 for (i = 0; i < new_vndr_ies.count; i++) {
4184                         vndrie_info = &new_vndr_ies.ie_info[i];
4185
4186                         /* verify remained buf size before copy data */
4187                         if (remained_buf_len < (vndrie_info->vndrie.len +
4188                                                         VNDR_IE_VSIE_OFFSET)) {
4189                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4190                                           remained_buf_len);
4191                                 break;
4192                         }
4193                         remained_buf_len -= (vndrie_info->ie_len +
4194                                              VNDR_IE_VSIE_OFFSET);
4195
4196                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4197                                   vndrie_info->vndrie.id,
4198                                   vndrie_info->vndrie.len,
4199                                   vndrie_info->vndrie.oui[0],
4200                                   vndrie_info->vndrie.oui[1],
4201                                   vndrie_info->vndrie.oui[2]);
4202
4203                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4204                                                            vndrie_info->ie_ptr,
4205                                                            vndrie_info->ie_len,
4206                                                            "add");
4207
4208                         /* save the parsed IE in wl struct */
4209                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4210                                vndrie_info->ie_len);
4211                         *mgmt_ie_len += vndrie_info->ie_len;
4212
4213                         curr_ie_buf += del_add_ie_buf_len;
4214                         total_ie_buf_len += del_add_ie_buf_len;
4215                 }
4216         }
4217         if (total_ie_buf_len) {
4218                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4219                                                  total_ie_buf_len);
4220                 if (err)
4221                         brcmf_err("vndr ie set error : %d\n", err);
4222         }
4223
4224 exit:
4225         kfree(iovar_ie_buf);
4226         return err;
4227 }
4228
4229 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4230 {
4231         s32 pktflags[] = {
4232                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4233                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4234                 BRCMF_VNDR_IE_BEACON_FLAG
4235         };
4236         int i;
4237
4238         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4239                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4240
4241         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4242         return 0;
4243 }
4244
4245 static s32
4246 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4247                         struct cfg80211_beacon_data *beacon)
4248 {
4249         s32 err;
4250
4251         /* Set Beacon IEs to FW */
4252         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4253                                     beacon->tail, beacon->tail_len);
4254         if (err) {
4255                 brcmf_err("Set Beacon IE Failed\n");
4256                 return err;
4257         }
4258         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4259
4260         /* Set Probe Response IEs to FW */
4261         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4262                                     beacon->proberesp_ies,
4263                                     beacon->proberesp_ies_len);
4264         if (err)
4265                 brcmf_err("Set Probe Resp IE Failed\n");
4266         else
4267                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4268
4269         return err;
4270 }
4271
4272 static s32
4273 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4274                         struct cfg80211_ap_settings *settings)
4275 {
4276         s32 ie_offset;
4277         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4278         struct brcmf_if *ifp = netdev_priv(ndev);
4279         const struct brcmf_tlv *ssid_ie;
4280         const struct brcmf_tlv *country_ie;
4281         struct brcmf_ssid_le ssid_le;
4282         s32 err = -EPERM;
4283         const struct brcmf_tlv *rsn_ie;
4284         const struct brcmf_vs_tlv *wpa_ie;
4285         struct brcmf_join_params join_params;
4286         enum nl80211_iftype dev_role;
4287         struct brcmf_fil_bss_enable_le bss_enable;
4288         u16 chanspec;
4289         bool mbss;
4290         int is_11d;
4291
4292         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4293                   settings->chandef.chan->hw_value,
4294                   settings->chandef.center_freq1, settings->chandef.width,
4295                   settings->beacon_interval, settings->dtim_period);
4296         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4297                   settings->ssid, settings->ssid_len, settings->auth_type,
4298                   settings->inactivity_timeout);
4299         dev_role = ifp->vif->wdev.iftype;
4300         mbss = ifp->vif->mbss;
4301
4302         /* store current 11d setting */
4303         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
4304         country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4305                                       settings->beacon.tail_len,
4306                                       WLAN_EID_COUNTRY);
4307         is_11d = country_ie ? 1 : 0;
4308
4309         memset(&ssid_le, 0, sizeof(ssid_le));
4310         if (settings->ssid == NULL || settings->ssid_len == 0) {
4311                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4312                 ssid_ie = brcmf_parse_tlvs(
4313                                 (u8 *)&settings->beacon.head[ie_offset],
4314                                 settings->beacon.head_len - ie_offset,
4315                                 WLAN_EID_SSID);
4316                 if (!ssid_ie)
4317                         return -EINVAL;
4318
4319                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4320                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4321                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4322         } else {
4323                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4324                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4325         }
4326
4327         if (!mbss) {
4328                 brcmf_set_mpc(ifp, 0);
4329                 brcmf_configure_arp_offload(ifp, false);
4330         }
4331
4332         /* find the RSN_IE */
4333         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4334                                   settings->beacon.tail_len, WLAN_EID_RSN);
4335
4336         /* find the WPA_IE */
4337         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4338                                   settings->beacon.tail_len);
4339
4340         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4341                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4342                 if (wpa_ie != NULL) {
4343                         /* WPA IE */
4344                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4345                         if (err < 0)
4346                                 goto exit;
4347                 } else {
4348                         struct brcmf_vs_tlv *tmp_ie;
4349
4350                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4351
4352                         /* RSN IE */
4353                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4354                         if (err < 0)
4355                                 goto exit;
4356                 }
4357         } else {
4358                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4359                 brcmf_configure_opensecurity(ifp);
4360         }
4361
4362         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4363
4364         if (!mbss) {
4365                 chanspec = chandef_to_chanspec(&cfg->d11inf,
4366                                                &settings->chandef);
4367                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4368                 if (err < 0) {
4369                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4370                                   chanspec, err);
4371                         goto exit;
4372                 }
4373
4374                 if (is_11d != ifp->vif->is_11d) {
4375                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4376                                                     is_11d);
4377                         if (err < 0) {
4378                                 brcmf_err("Regulatory Set Error, %d\n", err);
4379                                 goto exit;
4380                         }
4381                 }
4382                 if (settings->beacon_interval) {
4383                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4384                                                     settings->beacon_interval);
4385                         if (err < 0) {
4386                                 brcmf_err("Beacon Interval Set Error, %d\n",
4387                                           err);
4388                                 goto exit;
4389                         }
4390                 }
4391                 if (settings->dtim_period) {
4392                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4393                                                     settings->dtim_period);
4394                         if (err < 0) {
4395                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4396                                 goto exit;
4397                         }
4398                 }
4399
4400                 if ((dev_role == NL80211_IFTYPE_AP) &&
4401                     ((ifp->ifidx == 0) ||
4402                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4403                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4404                         if (err < 0) {
4405                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4406                                 goto exit;
4407                         }
4408                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4409                 }
4410
4411                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4412                 if (err < 0) {
4413                         brcmf_err("SET INFRA error %d\n", err);
4414                         goto exit;
4415                 }
4416         } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
4417                 /* Multiple-BSS should use same 11d configuration */
4418                 err = -EINVAL;
4419                 goto exit;
4420         }
4421         if (dev_role == NL80211_IFTYPE_AP) {
4422                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4423                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4424
4425                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4426                 if (err < 0) {
4427                         brcmf_err("setting AP mode failed %d\n", err);
4428                         goto exit;
4429                 }
4430                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4431                 if (err < 0) {
4432                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4433                         goto exit;
4434                 }
4435                 /* On DOWN the firmware removes the WEP keys, reconfigure
4436                  * them if they were set.
4437                  */
4438                 brcmf_cfg80211_reconfigure_wep(ifp);
4439
4440                 memset(&join_params, 0, sizeof(join_params));
4441                 /* join parameters starts with ssid */
4442                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4443                 /* create softap */
4444                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4445                                              &join_params, sizeof(join_params));
4446                 if (err < 0) {
4447                         brcmf_err("SET SSID error (%d)\n", err);
4448                         goto exit;
4449                 }
4450                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4451         } else {
4452                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4453                                                 sizeof(ssid_le));
4454                 if (err < 0) {
4455                         brcmf_err("setting ssid failed %d\n", err);
4456                         goto exit;
4457                 }
4458                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4459                 bss_enable.enable = cpu_to_le32(1);
4460                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4461                                                sizeof(bss_enable));
4462                 if (err < 0) {
4463                         brcmf_err("bss_enable config failed %d\n", err);
4464                         goto exit;
4465                 }
4466
4467                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4468         }
4469         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4470         brcmf_net_setcarrier(ifp, true);
4471
4472 exit:
4473         if ((err) && (!mbss)) {
4474                 brcmf_set_mpc(ifp, 1);
4475                 brcmf_configure_arp_offload(ifp, true);
4476         }
4477         return err;
4478 }
4479
4480 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4481 {
4482         struct brcmf_if *ifp = netdev_priv(ndev);
4483         s32 err;
4484         struct brcmf_fil_bss_enable_le bss_enable;
4485         struct brcmf_join_params join_params;
4486
4487         brcmf_dbg(TRACE, "Enter\n");
4488
4489         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4490                 /* Due to most likely deauths outstanding we sleep */
4491                 /* first to make sure they get processed by fw. */
4492                 msleep(400);
4493
4494                 if (ifp->vif->mbss) {
4495                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4496                         return err;
4497                 }
4498
4499                 memset(&join_params, 0, sizeof(join_params));
4500                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4501                                              &join_params, sizeof(join_params));
4502                 if (err < 0)
4503                         brcmf_err("SET SSID error (%d)\n", err);
4504                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4505                 if (err < 0)
4506                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4507                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4508                 if (err < 0)
4509                         brcmf_err("setting AP mode failed %d\n", err);
4510                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4511                 if (err < 0)
4512                         brcmf_err("setting INFRA mode failed %d\n", err);
4513                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4514                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4515                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4516                                             ifp->vif->is_11d);
4517                 if (err < 0)
4518                         brcmf_err("restoring REGULATORY setting failed %d\n",
4519                                   err);
4520                 /* Bring device back up so it can be used again */
4521                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4522                 if (err < 0)
4523                         brcmf_err("BRCMF_C_UP error %d\n", err);
4524         } else {
4525                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4526                 bss_enable.enable = cpu_to_le32(0);
4527                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4528                                                sizeof(bss_enable));
4529                 if (err < 0)
4530                         brcmf_err("bss_enable config failed %d\n", err);
4531         }
4532         brcmf_set_mpc(ifp, 1);
4533         brcmf_configure_arp_offload(ifp, true);
4534         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4535         brcmf_net_setcarrier(ifp, false);
4536
4537         return err;
4538 }
4539
4540 static s32
4541 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4542                              struct cfg80211_beacon_data *info)
4543 {
4544         struct brcmf_if *ifp = netdev_priv(ndev);
4545         s32 err;
4546
4547         brcmf_dbg(TRACE, "Enter\n");
4548
4549         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4550
4551         return err;
4552 }
4553
4554 static int
4555 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4556                            struct station_del_parameters *params)
4557 {
4558         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4559         struct brcmf_scb_val_le scbval;
4560         struct brcmf_if *ifp = netdev_priv(ndev);
4561         s32 err;
4562
4563         if (!params->mac)
4564                 return -EFAULT;
4565
4566         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4567
4568         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4569                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4570         if (!check_vif_up(ifp->vif))
4571                 return -EIO;
4572
4573         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4574         scbval.val = cpu_to_le32(params->reason_code);
4575         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4576                                      &scbval, sizeof(scbval));
4577         if (err)
4578                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4579
4580         brcmf_dbg(TRACE, "Exit\n");
4581         return err;
4582 }
4583
4584 static int
4585 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4586                               const u8 *mac, struct station_parameters *params)
4587 {
4588         struct brcmf_if *ifp = netdev_priv(ndev);
4589         s32 err;
4590
4591         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4592                   params->sta_flags_mask, params->sta_flags_set);
4593
4594         /* Ignore all 00 MAC */
4595         if (is_zero_ether_addr(mac))
4596                 return 0;
4597
4598         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4599                 return 0;
4600
4601         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4602                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4603                                              (void *)mac, ETH_ALEN);
4604         else
4605                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4606                                              (void *)mac, ETH_ALEN);
4607         if (err < 0)
4608                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4609
4610         return err;
4611 }
4612
4613 static void
4614 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4615                                    struct wireless_dev *wdev,
4616                                    u16 frame_type, bool reg)
4617 {
4618         struct brcmf_cfg80211_vif *vif;
4619         u16 mgmt_type;
4620
4621         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4622
4623         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4624         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4625         if (reg)
4626                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4627         else
4628                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4629 }
4630
4631
4632 static int
4633 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4634                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4635 {
4636         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4637         struct ieee80211_channel *chan = params->chan;
4638         const u8 *buf = params->buf;
4639         size_t len = params->len;
4640         const struct ieee80211_mgmt *mgmt;
4641         struct brcmf_cfg80211_vif *vif;
4642         s32 err = 0;
4643         s32 ie_offset;
4644         s32 ie_len;
4645         struct brcmf_fil_action_frame_le *action_frame;
4646         struct brcmf_fil_af_params_le *af_params;
4647         bool ack;
4648         s32 chan_nr;
4649         u32 freq;
4650
4651         brcmf_dbg(TRACE, "Enter\n");
4652
4653         *cookie = 0;
4654
4655         mgmt = (const struct ieee80211_mgmt *)buf;
4656
4657         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4658                 brcmf_err("Driver only allows MGMT packet type\n");
4659                 return -EPERM;
4660         }
4661
4662         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4663
4664         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4665                 /* Right now the only reason to get a probe response */
4666                 /* is for p2p listen response or for p2p GO from     */
4667                 /* wpa_supplicant. Unfortunately the probe is send   */
4668                 /* on primary ndev, while dongle wants it on the p2p */
4669                 /* vif. Since this is only reason for a probe        */
4670                 /* response to be sent, the vif is taken from cfg.   */
4671                 /* If ever desired to send proberesp for non p2p     */
4672                 /* response then data should be checked for          */
4673                 /* "DIRECT-". Note in future supplicant will take    */
4674                 /* dedicated p2p wdev to do this and then this 'hack'*/
4675                 /* is not needed anymore.                            */
4676                 ie_offset =  DOT11_MGMT_HDR_LEN +
4677                              DOT11_BCN_PRB_FIXED_LEN;
4678                 ie_len = len - ie_offset;
4679                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4680                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4681                 err = brcmf_vif_set_mgmt_ie(vif,
4682                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4683                                             &buf[ie_offset],
4684                                             ie_len);
4685                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4686                                         GFP_KERNEL);
4687         } else if (ieee80211_is_action(mgmt->frame_control)) {
4688                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4689                 if (af_params == NULL) {
4690                         brcmf_err("unable to allocate frame\n");
4691                         err = -ENOMEM;
4692                         goto exit;
4693                 }
4694                 action_frame = &af_params->action_frame;
4695                 /* Add the packet Id */
4696                 action_frame->packet_id = cpu_to_le32(*cookie);
4697                 /* Add BSSID */
4698                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4699                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4700                 /* Add the length exepted for 802.11 header  */
4701                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4702                 /* Add the channel. Use the one specified as parameter if any or
4703                  * the current one (got from the firmware) otherwise
4704                  */
4705                 if (chan)
4706                         freq = chan->center_freq;
4707                 else
4708                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4709                                               &freq);
4710                 chan_nr = ieee80211_frequency_to_channel(freq);
4711                 af_params->channel = cpu_to_le32(chan_nr);
4712
4713                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4714                        le16_to_cpu(action_frame->len));
4715
4716                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4717                           *cookie, le16_to_cpu(action_frame->len), freq);
4718
4719                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4720                                                   af_params);
4721
4722                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4723                                         GFP_KERNEL);
4724                 kfree(af_params);
4725         } else {
4726                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4727                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4728         }
4729
4730 exit:
4731         return err;
4732 }
4733
4734
4735 static int
4736 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4737                                         struct wireless_dev *wdev,
4738                                         u64 cookie)
4739 {
4740         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4741         struct brcmf_cfg80211_vif *vif;
4742         int err = 0;
4743
4744         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4745
4746         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4747         if (vif == NULL) {
4748                 brcmf_err("No p2p device available for probe response\n");
4749                 err = -ENODEV;
4750                 goto exit;
4751         }
4752         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4753 exit:
4754         return err;
4755 }
4756
4757 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
4758                                            struct wireless_dev *wdev,
4759                                            enum nl80211_crit_proto_id proto,
4760                                            u16 duration)
4761 {
4762         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4763         struct brcmf_cfg80211_vif *vif;
4764
4765         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4766
4767         /* only DHCP support for now */
4768         if (proto != NL80211_CRIT_PROTO_DHCP)
4769                 return -EINVAL;
4770
4771         /* suppress and abort scanning */
4772         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4773         brcmf_abort_scanning(cfg);
4774
4775         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
4776 }
4777
4778 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
4779                                            struct wireless_dev *wdev)
4780 {
4781         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4782         struct brcmf_cfg80211_vif *vif;
4783
4784         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4785
4786         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
4787         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4788 }
4789
4790 static s32
4791 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
4792                              const struct brcmf_event_msg *e, void *data)
4793 {
4794         switch (e->reason) {
4795         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
4796                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
4797                 break;
4798         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
4799                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
4800                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4801                 break;
4802         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
4803                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
4804                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4805                 break;
4806         }
4807
4808         return 0;
4809 }
4810
4811 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
4812 {
4813         int ret;
4814
4815         switch (oper) {
4816         case NL80211_TDLS_DISCOVERY_REQ:
4817                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
4818                 break;
4819         case NL80211_TDLS_SETUP:
4820                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
4821                 break;
4822         case NL80211_TDLS_TEARDOWN:
4823                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
4824                 break;
4825         default:
4826                 brcmf_err("unsupported operation: %d\n", oper);
4827                 ret = -EOPNOTSUPP;
4828         }
4829         return ret;
4830 }
4831
4832 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
4833                                     struct net_device *ndev, const u8 *peer,
4834                                     enum nl80211_tdls_operation oper)
4835 {
4836         struct brcmf_if *ifp;
4837         struct brcmf_tdls_iovar_le info;
4838         int ret = 0;
4839
4840         ret = brcmf_convert_nl80211_tdls_oper(oper);
4841         if (ret < 0)
4842                 return ret;
4843
4844         ifp = netdev_priv(ndev);
4845         memset(&info, 0, sizeof(info));
4846         info.mode = (u8)ret;
4847         if (peer)
4848                 memcpy(info.ea, peer, ETH_ALEN);
4849
4850         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
4851                                        &info, sizeof(info));
4852         if (ret < 0)
4853                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
4854
4855         return ret;
4856 }
4857
4858 static struct cfg80211_ops wl_cfg80211_ops = {
4859         .add_virtual_intf = brcmf_cfg80211_add_iface,
4860         .del_virtual_intf = brcmf_cfg80211_del_iface,
4861         .change_virtual_intf = brcmf_cfg80211_change_iface,
4862         .scan = brcmf_cfg80211_scan,
4863         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
4864         .join_ibss = brcmf_cfg80211_join_ibss,
4865         .leave_ibss = brcmf_cfg80211_leave_ibss,
4866         .get_station = brcmf_cfg80211_get_station,
4867         .dump_station = brcmf_cfg80211_dump_station,
4868         .set_tx_power = brcmf_cfg80211_set_tx_power,
4869         .get_tx_power = brcmf_cfg80211_get_tx_power,
4870         .add_key = brcmf_cfg80211_add_key,
4871         .del_key = brcmf_cfg80211_del_key,
4872         .get_key = brcmf_cfg80211_get_key,
4873         .set_default_key = brcmf_cfg80211_config_default_key,
4874         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
4875         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
4876         .connect = brcmf_cfg80211_connect,
4877         .disconnect = brcmf_cfg80211_disconnect,
4878         .suspend = brcmf_cfg80211_suspend,
4879         .resume = brcmf_cfg80211_resume,
4880         .set_pmksa = brcmf_cfg80211_set_pmksa,
4881         .del_pmksa = brcmf_cfg80211_del_pmksa,
4882         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
4883         .start_ap = brcmf_cfg80211_start_ap,
4884         .stop_ap = brcmf_cfg80211_stop_ap,
4885         .change_beacon = brcmf_cfg80211_change_beacon,
4886         .del_station = brcmf_cfg80211_del_station,
4887         .change_station = brcmf_cfg80211_change_station,
4888         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
4889         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
4890         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
4891         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
4892         .remain_on_channel = brcmf_p2p_remain_on_channel,
4893         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
4894         .start_p2p_device = brcmf_p2p_start_device,
4895         .stop_p2p_device = brcmf_p2p_stop_device,
4896         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
4897         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
4898         .tdls_oper = brcmf_cfg80211_tdls_oper,
4899 };
4900
4901 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
4902                                            enum nl80211_iftype type,
4903                                            bool pm_block)
4904 {
4905         struct brcmf_cfg80211_vif *vif_walk;
4906         struct brcmf_cfg80211_vif *vif;
4907         bool mbss;
4908
4909         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
4910                   sizeof(*vif));
4911         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
4912         if (!vif)
4913                 return ERR_PTR(-ENOMEM);
4914
4915         vif->wdev.wiphy = cfg->wiphy;
4916         vif->wdev.iftype = type;
4917
4918         vif->pm_block = pm_block;
4919
4920         brcmf_init_prof(&vif->profile);
4921
4922         if (type == NL80211_IFTYPE_AP) {
4923                 mbss = false;
4924                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
4925                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
4926                                 mbss = true;
4927                                 break;
4928                         }
4929                 }
4930                 vif->mbss = mbss;
4931         }
4932
4933         list_add_tail(&vif->list, &cfg->vif_list);
4934         return vif;
4935 }
4936
4937 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
4938 {
4939         list_del(&vif->list);
4940         kfree(vif);
4941 }
4942
4943 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
4944 {
4945         struct brcmf_cfg80211_vif *vif;
4946         struct brcmf_if *ifp;
4947
4948         ifp = netdev_priv(ndev);
4949         vif = ifp->vif;
4950
4951         if (vif)
4952                 brcmf_free_vif(vif);
4953         free_netdev(ndev);
4954 }
4955
4956 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
4957 {
4958         u32 event = e->event_code;
4959         u32 status = e->status;
4960
4961         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
4962                 brcmf_dbg(CONN, "Processing set ssid\n");
4963                 return true;
4964         }
4965
4966         return false;
4967 }
4968
4969 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
4970 {
4971         u32 event = e->event_code;
4972         u16 flags = e->flags;
4973
4974         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
4975             (event == BRCMF_E_DISASSOC_IND) ||
4976             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
4977                 brcmf_dbg(CONN, "Processing link down\n");
4978                 return true;
4979         }
4980         return false;
4981 }
4982
4983 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
4984                                const struct brcmf_event_msg *e)
4985 {
4986         u32 event = e->event_code;
4987         u32 status = e->status;
4988
4989         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
4990                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
4991                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
4992                 return true;
4993         }
4994
4995         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
4996                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
4997                 return true;
4998         }
4999
5000         return false;
5001 }
5002
5003 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5004 {
5005         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5006
5007         kfree(conn_info->req_ie);
5008         conn_info->req_ie = NULL;
5009         conn_info->req_ie_len = 0;
5010         kfree(conn_info->resp_ie);
5011         conn_info->resp_ie = NULL;
5012         conn_info->resp_ie_len = 0;
5013 }
5014
5015 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5016                                struct brcmf_if *ifp)
5017 {
5018         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5019         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5020         u32 req_len;
5021         u32 resp_len;
5022         s32 err = 0;
5023
5024         brcmf_clear_assoc_ies(cfg);
5025
5026         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5027                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5028         if (err) {
5029                 brcmf_err("could not get assoc info (%d)\n", err);
5030                 return err;
5031         }
5032         assoc_info =
5033                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5034         req_len = le32_to_cpu(assoc_info->req_len);
5035         resp_len = le32_to_cpu(assoc_info->resp_len);
5036         if (req_len) {
5037                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5038                                                cfg->extra_buf,
5039                                                WL_ASSOC_INFO_MAX);
5040                 if (err) {
5041                         brcmf_err("could not get assoc req (%d)\n", err);
5042                         return err;
5043                 }
5044                 conn_info->req_ie_len = req_len;
5045                 conn_info->req_ie =
5046                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5047                             GFP_KERNEL);
5048         } else {
5049                 conn_info->req_ie_len = 0;
5050                 conn_info->req_ie = NULL;
5051         }
5052         if (resp_len) {
5053                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5054                                                cfg->extra_buf,
5055                                                WL_ASSOC_INFO_MAX);
5056                 if (err) {
5057                         brcmf_err("could not get assoc resp (%d)\n", err);
5058                         return err;
5059                 }
5060                 conn_info->resp_ie_len = resp_len;
5061                 conn_info->resp_ie =
5062                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5063                             GFP_KERNEL);
5064         } else {
5065                 conn_info->resp_ie_len = 0;
5066                 conn_info->resp_ie = NULL;
5067         }
5068         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5069                   conn_info->req_ie_len, conn_info->resp_ie_len);
5070
5071         return err;
5072 }
5073
5074 static s32
5075 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5076                        struct net_device *ndev,
5077                        const struct brcmf_event_msg *e)
5078 {
5079         struct brcmf_if *ifp = netdev_priv(ndev);
5080         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5081         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5082         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5083         struct ieee80211_channel *notify_channel = NULL;
5084         struct ieee80211_supported_band *band;
5085         struct brcmf_bss_info_le *bi;
5086         struct brcmu_chan ch;
5087         u32 freq;
5088         s32 err = 0;
5089         u8 *buf;
5090
5091         brcmf_dbg(TRACE, "Enter\n");
5092
5093         brcmf_get_assoc_ies(cfg, ifp);
5094         memcpy(profile->bssid, e->addr, ETH_ALEN);
5095         brcmf_update_bss_info(cfg, ifp);
5096
5097         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5098         if (buf == NULL) {
5099                 err = -ENOMEM;
5100                 goto done;
5101         }
5102
5103         /* data sent to dongle has to be little endian */
5104         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5105         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5106                                      buf, WL_BSS_INFO_MAX);
5107
5108         if (err)
5109                 goto done;
5110
5111         bi = (struct brcmf_bss_info_le *)(buf + 4);
5112         ch.chspec = le16_to_cpu(bi->chanspec);
5113         cfg->d11inf.decchspec(&ch);
5114
5115         if (ch.band == BRCMU_CHAN_BAND_2G)
5116                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
5117         else
5118                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
5119
5120         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
5121         notify_channel = ieee80211_get_channel(wiphy, freq);
5122
5123 done:
5124         kfree(buf);
5125         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
5126                         conn_info->req_ie, conn_info->req_ie_len,
5127                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
5128         brcmf_dbg(CONN, "Report roaming result\n");
5129
5130         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5131         brcmf_dbg(TRACE, "Exit\n");
5132         return err;
5133 }
5134
5135 static s32
5136 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5137                        struct net_device *ndev, const struct brcmf_event_msg *e,
5138                        bool completed)
5139 {
5140         struct brcmf_if *ifp = netdev_priv(ndev);
5141         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5142         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5143
5144         brcmf_dbg(TRACE, "Enter\n");
5145
5146         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5147                                &ifp->vif->sme_state)) {
5148                 if (completed) {
5149                         brcmf_get_assoc_ies(cfg, ifp);
5150                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5151                         brcmf_update_bss_info(cfg, ifp);
5152                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5153                                 &ifp->vif->sme_state);
5154                 }
5155                 cfg80211_connect_result(ndev,
5156                                         (u8 *)profile->bssid,
5157                                         conn_info->req_ie,
5158                                         conn_info->req_ie_len,
5159                                         conn_info->resp_ie,
5160                                         conn_info->resp_ie_len,
5161                                         completed ? WLAN_STATUS_SUCCESS :
5162                                                     WLAN_STATUS_AUTH_TIMEOUT,
5163                                         GFP_KERNEL);
5164                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5165                           completed ? "succeeded" : "failed");
5166         }
5167         brcmf_dbg(TRACE, "Exit\n");
5168         return 0;
5169 }
5170
5171 static s32
5172 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5173                                struct net_device *ndev,
5174                                const struct brcmf_event_msg *e, void *data)
5175 {
5176         struct brcmf_if *ifp = netdev_priv(ndev);
5177         static int generation;
5178         u32 event = e->event_code;
5179         u32 reason = e->reason;
5180         struct station_info sinfo;
5181
5182         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
5183         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5184             ndev != cfg_to_ndev(cfg)) {
5185                 brcmf_dbg(CONN, "AP mode link down\n");
5186                 complete(&cfg->vif_disabled);
5187                 if (ifp->vif->mbss)
5188                         brcmf_remove_interface(ifp);
5189                 return 0;
5190         }
5191
5192         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5193             (reason == BRCMF_E_STATUS_SUCCESS)) {
5194                 memset(&sinfo, 0, sizeof(sinfo));
5195                 if (!data) {
5196                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5197                         return -EINVAL;
5198                 }
5199                 sinfo.assoc_req_ies = data;
5200                 sinfo.assoc_req_ies_len = e->datalen;
5201                 generation++;
5202                 sinfo.generation = generation;
5203                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5204         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5205                    (event == BRCMF_E_DEAUTH_IND) ||
5206                    (event == BRCMF_E_DEAUTH)) {
5207                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5208         }
5209         return 0;
5210 }
5211
5212 static s32
5213 brcmf_notify_connect_status(struct brcmf_if *ifp,
5214                             const struct brcmf_event_msg *e, void *data)
5215 {
5216         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5217         struct net_device *ndev = ifp->ndev;
5218         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5219         struct ieee80211_channel *chan;
5220         s32 err = 0;
5221
5222         if ((e->event_code == BRCMF_E_DEAUTH) ||
5223             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5224             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5225             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5226                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5227         }
5228
5229         if (brcmf_is_apmode(ifp->vif)) {
5230                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5231         } else if (brcmf_is_linkup(e)) {
5232                 brcmf_dbg(CONN, "Linkup\n");
5233                 if (brcmf_is_ibssmode(ifp->vif)) {
5234                         brcmf_inform_ibss(cfg, ndev, e->addr);
5235                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5236                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5237                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5238                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5239                                   &ifp->vif->sme_state);
5240                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5241                                 &ifp->vif->sme_state);
5242                 } else
5243                         brcmf_bss_connect_done(cfg, ndev, e, true);
5244                 brcmf_net_setcarrier(ifp, true);
5245         } else if (brcmf_is_linkdown(e)) {
5246                 brcmf_dbg(CONN, "Linkdown\n");
5247                 if (!brcmf_is_ibssmode(ifp->vif)) {
5248                         brcmf_bss_connect_done(cfg, ndev, e, false);
5249                         brcmf_link_down(ifp->vif,
5250                                         brcmf_map_fw_linkdown_reason(e));
5251                         brcmf_init_prof(ndev_to_prof(ndev));
5252                         if (ndev != cfg_to_ndev(cfg))
5253                                 complete(&cfg->vif_disabled);
5254                         brcmf_net_setcarrier(ifp, false);
5255                 }
5256         } else if (brcmf_is_nonetwork(cfg, e)) {
5257                 if (brcmf_is_ibssmode(ifp->vif))
5258                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5259                                   &ifp->vif->sme_state);
5260                 else
5261                         brcmf_bss_connect_done(cfg, ndev, e, false);
5262         }
5263
5264         return err;
5265 }
5266
5267 static s32
5268 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5269                             const struct brcmf_event_msg *e, void *data)
5270 {
5271         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5272         u32 event = e->event_code;
5273         u32 status = e->status;
5274
5275         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5276                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5277                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5278                 else
5279                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5280         }
5281
5282         return 0;
5283 }
5284
5285 static s32
5286 brcmf_notify_mic_status(struct brcmf_if *ifp,
5287                         const struct brcmf_event_msg *e, void *data)
5288 {
5289         u16 flags = e->flags;
5290         enum nl80211_key_type key_type;
5291
5292         if (flags & BRCMF_EVENT_MSG_GROUP)
5293                 key_type = NL80211_KEYTYPE_GROUP;
5294         else
5295                 key_type = NL80211_KEYTYPE_PAIRWISE;
5296
5297         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5298                                      NULL, GFP_KERNEL);
5299
5300         return 0;
5301 }
5302
5303 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5304                                   const struct brcmf_event_msg *e, void *data)
5305 {
5306         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5307         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5308         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5309         struct brcmf_cfg80211_vif *vif;
5310
5311         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5312                   ifevent->action, ifevent->flags, ifevent->ifidx,
5313                   ifevent->bsscfgidx);
5314
5315         mutex_lock(&event->vif_event_lock);
5316         event->action = ifevent->action;
5317         vif = event->vif;
5318
5319         switch (ifevent->action) {
5320         case BRCMF_E_IF_ADD:
5321                 /* waiting process may have timed out */
5322                 if (!cfg->vif_event.vif) {
5323                         mutex_unlock(&event->vif_event_lock);
5324                         return -EBADF;
5325                 }
5326
5327                 ifp->vif = vif;
5328                 vif->ifp = ifp;
5329                 if (ifp->ndev) {
5330                         vif->wdev.netdev = ifp->ndev;
5331                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5332                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5333                 }
5334                 mutex_unlock(&event->vif_event_lock);
5335                 wake_up(&event->vif_wq);
5336                 return 0;
5337
5338         case BRCMF_E_IF_DEL:
5339                 mutex_unlock(&event->vif_event_lock);
5340                 /* event may not be upon user request */
5341                 if (brcmf_cfg80211_vif_event_armed(cfg))
5342                         wake_up(&event->vif_wq);
5343                 return 0;
5344
5345         case BRCMF_E_IF_CHANGE:
5346                 mutex_unlock(&event->vif_event_lock);
5347                 wake_up(&event->vif_wq);
5348                 return 0;
5349
5350         default:
5351                 mutex_unlock(&event->vif_event_lock);
5352                 break;
5353         }
5354         return -EINVAL;
5355 }
5356
5357 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5358 {
5359         conf->frag_threshold = (u32)-1;
5360         conf->rts_threshold = (u32)-1;
5361         conf->retry_short = (u32)-1;
5362         conf->retry_long = (u32)-1;
5363 }
5364
5365 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5366 {
5367         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5368                             brcmf_notify_connect_status);
5369         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5370                             brcmf_notify_connect_status);
5371         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5372                             brcmf_notify_connect_status);
5373         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5374                             brcmf_notify_connect_status);
5375         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5376                             brcmf_notify_connect_status);
5377         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5378                             brcmf_notify_connect_status);
5379         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5380                             brcmf_notify_roaming_status);
5381         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5382                             brcmf_notify_mic_status);
5383         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5384                             brcmf_notify_connect_status);
5385         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5386                             brcmf_notify_sched_scan_results);
5387         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5388                             brcmf_notify_vif_event);
5389         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5390                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5391         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5392                             brcmf_p2p_notify_listen_complete);
5393         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5394                             brcmf_p2p_notify_action_frame_rx);
5395         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5396                             brcmf_p2p_notify_action_tx_complete);
5397         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5398                             brcmf_p2p_notify_action_tx_complete);
5399 }
5400
5401 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5402 {
5403         kfree(cfg->conf);
5404         cfg->conf = NULL;
5405         kfree(cfg->escan_ioctl_buf);
5406         cfg->escan_ioctl_buf = NULL;
5407         kfree(cfg->extra_buf);
5408         cfg->extra_buf = NULL;
5409         kfree(cfg->wowl.nd);
5410         cfg->wowl.nd = NULL;
5411         kfree(cfg->wowl.nd_info);
5412         cfg->wowl.nd_info = NULL;
5413 }
5414
5415 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5416 {
5417         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5418         if (!cfg->conf)
5419                 goto init_priv_mem_out;
5420         cfg->escan_ioctl_buf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5421         if (!cfg->escan_ioctl_buf)
5422                 goto init_priv_mem_out;
5423         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5424         if (!cfg->extra_buf)
5425                 goto init_priv_mem_out;
5426         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5427         if (!cfg->wowl.nd)
5428                 goto init_priv_mem_out;
5429         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5430                                     sizeof(struct cfg80211_wowlan_nd_match *),
5431                                     GFP_KERNEL);
5432         if (!cfg->wowl.nd_info)
5433                 goto init_priv_mem_out;
5434
5435         return 0;
5436
5437 init_priv_mem_out:
5438         brcmf_deinit_priv_mem(cfg);
5439
5440         return -ENOMEM;
5441 }
5442
5443 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5444 {
5445         s32 err = 0;
5446
5447         cfg->scan_request = NULL;
5448         cfg->pwr_save = true;
5449         cfg->active_scan = true;        /* we do active scan per default */
5450         cfg->dongle_up = false;         /* dongle is not up yet */
5451         err = brcmf_init_priv_mem(cfg);
5452         if (err)
5453                 return err;
5454         brcmf_register_event_handlers(cfg);
5455         mutex_init(&cfg->usr_sync);
5456         brcmf_init_escan(cfg);
5457         brcmf_init_conf(cfg->conf);
5458         init_completion(&cfg->vif_disabled);
5459         return err;
5460 }
5461
5462 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5463 {
5464         cfg->dongle_up = false; /* dongle down */
5465         brcmf_abort_scanning(cfg);
5466         brcmf_deinit_priv_mem(cfg);
5467 }
5468
5469 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5470 {
5471         init_waitqueue_head(&event->vif_wq);
5472         mutex_init(&event->vif_event_lock);
5473 }
5474
5475 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5476 {
5477         s32 err;
5478         u32 bcn_timeout;
5479         __le32 roamtrigger[2];
5480         __le32 roam_delta[2];
5481
5482         /* Configure beacon timeout value based upon roaming setting */
5483         if (ifp->drvr->settings->roamoff)
5484                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5485         else
5486                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5487         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5488         if (err) {
5489                 brcmf_err("bcn_timeout error (%d)\n", err);
5490                 goto roam_setup_done;
5491         }
5492
5493         /* Enable/Disable built-in roaming to allow supplicant to take care of
5494          * roaming.
5495          */
5496         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5497                   ifp->drvr->settings->roamoff ? "Off" : "On");
5498         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5499                                       ifp->drvr->settings->roamoff);
5500         if (err) {
5501                 brcmf_err("roam_off error (%d)\n", err);
5502                 goto roam_setup_done;
5503         }
5504
5505         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5506         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5507         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5508                                      (void *)roamtrigger, sizeof(roamtrigger));
5509         if (err) {
5510                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5511                 goto roam_setup_done;
5512         }
5513
5514         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5515         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5516         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5517                                      (void *)roam_delta, sizeof(roam_delta));
5518         if (err) {
5519                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5520                 goto roam_setup_done;
5521         }
5522
5523 roam_setup_done:
5524         return err;
5525 }
5526
5527 static s32
5528 brcmf_dongle_scantime(struct brcmf_if *ifp)
5529 {
5530         s32 err = 0;
5531
5532         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5533                                     BRCMF_SCAN_CHANNEL_TIME);
5534         if (err) {
5535                 brcmf_err("Scan assoc time error (%d)\n", err);
5536                 goto dongle_scantime_out;
5537         }
5538         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5539                                     BRCMF_SCAN_UNASSOC_TIME);
5540         if (err) {
5541                 brcmf_err("Scan unassoc time error (%d)\n", err);
5542                 goto dongle_scantime_out;
5543         }
5544
5545         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5546                                     BRCMF_SCAN_PASSIVE_TIME);
5547         if (err) {
5548                 brcmf_err("Scan passive time error (%d)\n", err);
5549                 goto dongle_scantime_out;
5550         }
5551
5552 dongle_scantime_out:
5553         return err;
5554 }
5555
5556 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5557                                            struct brcmu_chan *ch)
5558 {
5559         u32 ht40_flag;
5560
5561         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5562         if (ch->sb == BRCMU_CHAN_SB_U) {
5563                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5564                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5565                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5566         } else {
5567                 /* It should be one of
5568                  * IEEE80211_CHAN_NO_HT40 or
5569                  * IEEE80211_CHAN_NO_HT40PLUS
5570                  */
5571                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5572                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5573                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5574         }
5575 }
5576
5577 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5578                                     u32 bw_cap[])
5579 {
5580         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5581         struct ieee80211_supported_band *band;
5582         struct ieee80211_channel *channel;
5583         struct wiphy *wiphy;
5584         struct brcmf_chanspec_list *list;
5585         struct brcmu_chan ch;
5586         int err;
5587         u8 *pbuf;
5588         u32 i, j;
5589         u32 total;
5590         u32 chaninfo;
5591         u32 index;
5592
5593         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5594
5595         if (pbuf == NULL)
5596                 return -ENOMEM;
5597
5598         list = (struct brcmf_chanspec_list *)pbuf;
5599
5600         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5601                                        BRCMF_DCMD_MEDLEN);
5602         if (err) {
5603                 brcmf_err("get chanspecs error (%d)\n", err);
5604                 goto fail_pbuf;
5605         }
5606
5607         wiphy = cfg_to_wiphy(cfg);
5608         band = wiphy->bands[IEEE80211_BAND_2GHZ];
5609         if (band)
5610                 for (i = 0; i < band->n_channels; i++)
5611                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5612         band = wiphy->bands[IEEE80211_BAND_5GHZ];
5613         if (band)
5614                 for (i = 0; i < band->n_channels; i++)
5615                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5616
5617         total = le32_to_cpu(list->count);
5618         for (i = 0; i < total; i++) {
5619                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5620                 cfg->d11inf.decchspec(&ch);
5621
5622                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5623                         band = wiphy->bands[IEEE80211_BAND_2GHZ];
5624                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5625                         band = wiphy->bands[IEEE80211_BAND_5GHZ];
5626                 } else {
5627                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5628                         continue;
5629                 }
5630                 if (!band)
5631                         continue;
5632                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5633                     ch.bw == BRCMU_CHAN_BW_40)
5634                         continue;
5635                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5636                     ch.bw == BRCMU_CHAN_BW_80)
5637                         continue;
5638
5639                 channel = band->channels;
5640                 index = band->n_channels;
5641                 for (j = 0; j < band->n_channels; j++) {
5642                         if (channel[j].hw_value == ch.chnum) {
5643                                 index = j;
5644                                 break;
5645                         }
5646                 }
5647                 channel[index].center_freq =
5648                         ieee80211_channel_to_frequency(ch.chnum, band->band);
5649                 channel[index].hw_value = ch.chnum;
5650
5651                 /* assuming the chanspecs order is HT20,
5652                  * HT40 upper, HT40 lower, and VHT80.
5653                  */
5654                 if (ch.bw == BRCMU_CHAN_BW_80) {
5655                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5656                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5657                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5658                 } else {
5659                         /* enable the channel and disable other bandwidths
5660                          * for now as mentioned order assure they are enabled
5661                          * for subsequent chanspecs.
5662                          */
5663                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5664                                                IEEE80211_CHAN_NO_80MHZ;
5665                         ch.bw = BRCMU_CHAN_BW_20;
5666                         cfg->d11inf.encchspec(&ch);
5667                         chaninfo = ch.chspec;
5668                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5669                                                        &chaninfo);
5670                         if (!err) {
5671                                 if (chaninfo & WL_CHAN_RADAR)
5672                                         channel[index].flags |=
5673                                                 (IEEE80211_CHAN_RADAR |
5674                                                  IEEE80211_CHAN_NO_IR);
5675                                 if (chaninfo & WL_CHAN_PASSIVE)
5676                                         channel[index].flags |=
5677                                                 IEEE80211_CHAN_NO_IR;
5678                         }
5679                 }
5680         }
5681
5682 fail_pbuf:
5683         kfree(pbuf);
5684         return err;
5685 }
5686
5687 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
5688 {
5689         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5690         struct ieee80211_supported_band *band;
5691         struct brcmf_fil_bwcap_le band_bwcap;
5692         struct brcmf_chanspec_list *list;
5693         u8 *pbuf;
5694         u32 val;
5695         int err;
5696         struct brcmu_chan ch;
5697         u32 num_chan;
5698         int i, j;
5699
5700         /* verify support for bw_cap command */
5701         val = WLC_BAND_5G;
5702         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
5703
5704         if (!err) {
5705                 /* only set 2G bandwidth using bw_cap command */
5706                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
5707                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
5708                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
5709                                                sizeof(band_bwcap));
5710         } else {
5711                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
5712                 val = WLC_N_BW_40ALL;
5713                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
5714         }
5715
5716         if (!err) {
5717                 /* update channel info in 2G band */
5718                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5719
5720                 if (pbuf == NULL)
5721                         return -ENOMEM;
5722
5723                 ch.band = BRCMU_CHAN_BAND_2G;
5724                 ch.bw = BRCMU_CHAN_BW_40;
5725                 ch.sb = BRCMU_CHAN_SB_NONE;
5726                 ch.chnum = 0;
5727                 cfg->d11inf.encchspec(&ch);
5728
5729                 /* pass encoded chanspec in query */
5730                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
5731
5732                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5733                                                BRCMF_DCMD_MEDLEN);
5734                 if (err) {
5735                         brcmf_err("get chanspecs error (%d)\n", err);
5736                         kfree(pbuf);
5737                         return err;
5738                 }
5739
5740                 band = cfg_to_wiphy(cfg)->bands[IEEE80211_BAND_2GHZ];
5741                 list = (struct brcmf_chanspec_list *)pbuf;
5742                 num_chan = le32_to_cpu(list->count);
5743                 for (i = 0; i < num_chan; i++) {
5744                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
5745                         cfg->d11inf.decchspec(&ch);
5746                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
5747                                 continue;
5748                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
5749                                 continue;
5750                         for (j = 0; j < band->n_channels; j++) {
5751                                 if (band->channels[j].hw_value == ch.chnum)
5752                                         break;
5753                         }
5754                         if (WARN_ON(j == band->n_channels))
5755                                 continue;
5756
5757                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
5758                 }
5759                 kfree(pbuf);
5760         }
5761         return err;
5762 }
5763
5764 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
5765 {
5766         u32 band, mimo_bwcap;
5767         int err;
5768
5769         band = WLC_BAND_2G;
5770         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5771         if (!err) {
5772                 bw_cap[IEEE80211_BAND_2GHZ] = band;
5773                 band = WLC_BAND_5G;
5774                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5775                 if (!err) {
5776                         bw_cap[IEEE80211_BAND_5GHZ] = band;
5777                         return;
5778                 }
5779                 WARN_ON(1);
5780                 return;
5781         }
5782         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
5783         mimo_bwcap = 0;
5784         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
5785         if (err)
5786                 /* assume 20MHz if firmware does not give a clue */
5787                 mimo_bwcap = WLC_N_BW_20ALL;
5788
5789         switch (mimo_bwcap) {
5790         case WLC_N_BW_40ALL:
5791                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
5792                 /* fall-thru */
5793         case WLC_N_BW_20IN2G_40IN5G:
5794                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
5795                 /* fall-thru */
5796         case WLC_N_BW_20ALL:
5797                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
5798                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
5799                 break;
5800         default:
5801                 brcmf_err("invalid mimo_bw_cap value\n");
5802         }
5803 }
5804
5805 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
5806                                 u32 bw_cap[2], u32 nchain)
5807 {
5808         band->ht_cap.ht_supported = true;
5809         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
5810                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
5811                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5812         }
5813         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
5814         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
5815         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
5816         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
5817         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
5818         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5819 }
5820
5821 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
5822 {
5823         u16 mcs_map;
5824         int i;
5825
5826         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
5827                 mcs_map = (mcs_map << 2) | supp;
5828
5829         return cpu_to_le16(mcs_map);
5830 }
5831
5832 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
5833                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
5834                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
5835 {
5836         __le16 mcs_map;
5837
5838         /* not allowed in 2.4G band */
5839         if (band->band == IEEE80211_BAND_2GHZ)
5840                 return;
5841
5842         band->vht_cap.vht_supported = true;
5843         /* 80MHz is mandatory */
5844         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
5845         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
5846                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
5847                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
5848         }
5849         /* all support 256-QAM */
5850         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
5851         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
5852         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
5853
5854         /* Beamforming support information */
5855         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
5856                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
5857         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
5858                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
5859         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
5860                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
5861         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
5862                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
5863
5864         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
5865                 band->vht_cap.cap |=
5866                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
5867                 band->vht_cap.cap |= ((txstreams - 1) <<
5868                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
5869                 band->vht_cap.cap |=
5870                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
5871         }
5872 }
5873
5874 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
5875 {
5876         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
5877         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5878         u32 nmode = 0;
5879         u32 vhtmode = 0;
5880         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
5881         u32 rxchain;
5882         u32 nchain;
5883         int err;
5884         s32 i;
5885         struct ieee80211_supported_band *band;
5886         u32 txstreams = 0;
5887         u32 txbf_bfe_cap = 0;
5888         u32 txbf_bfr_cap = 0;
5889
5890         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
5891         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
5892         if (err) {
5893                 brcmf_err("nmode error (%d)\n", err);
5894         } else {
5895                 brcmf_get_bwcap(ifp, bw_cap);
5896         }
5897         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
5898                   nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
5899                   bw_cap[IEEE80211_BAND_5GHZ]);
5900
5901         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
5902         if (err) {
5903                 brcmf_err("rxchain error (%d)\n", err);
5904                 nchain = 1;
5905         } else {
5906                 for (nchain = 0; rxchain; nchain++)
5907                         rxchain = rxchain & (rxchain - 1);
5908         }
5909         brcmf_dbg(INFO, "nchain=%d\n", nchain);
5910
5911         err = brcmf_construct_chaninfo(cfg, bw_cap);
5912         if (err) {
5913                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
5914                 return err;
5915         }
5916
5917         if (vhtmode) {
5918                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
5919                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
5920                                               &txbf_bfe_cap);
5921                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
5922                                               &txbf_bfr_cap);
5923         }
5924
5925         wiphy = cfg_to_wiphy(cfg);
5926         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
5927                 band = wiphy->bands[i];
5928                 if (band == NULL)
5929                         continue;
5930
5931                 if (nmode)
5932                         brcmf_update_ht_cap(band, bw_cap, nchain);
5933                 if (vhtmode)
5934                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
5935                                              txbf_bfe_cap, txbf_bfr_cap);
5936         }
5937
5938         return 0;
5939 }
5940
5941 static const struct ieee80211_txrx_stypes
5942 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
5943         [NL80211_IFTYPE_STATION] = {
5944                 .tx = 0xffff,
5945                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5946                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5947         },
5948         [NL80211_IFTYPE_P2P_CLIENT] = {
5949                 .tx = 0xffff,
5950                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5951                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5952         },
5953         [NL80211_IFTYPE_P2P_GO] = {
5954                 .tx = 0xffff,
5955                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
5956                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
5957                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
5958                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
5959                       BIT(IEEE80211_STYPE_AUTH >> 4) |
5960                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
5961                       BIT(IEEE80211_STYPE_ACTION >> 4)
5962         },
5963         [NL80211_IFTYPE_P2P_DEVICE] = {
5964                 .tx = 0xffff,
5965                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5966                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5967         }
5968 };
5969
5970 /**
5971  * brcmf_setup_ifmodes() - determine interface modes and combinations.
5972  *
5973  * @wiphy: wiphy object.
5974  * @ifp: interface object needed for feat module api.
5975  *
5976  * The interface modes and combinations are determined dynamically here
5977  * based on firmware functionality.
5978  *
5979  * no p2p and no mbss:
5980  *
5981  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
5982  *
5983  * no p2p and mbss:
5984  *
5985  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
5986  *      #AP <= 4, matching BI, channels = 1, 4 total
5987  *
5988  * p2p, no mchan, and mbss:
5989  *
5990  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
5991  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
5992  *      #AP <= 4, matching BI, channels = 1, 4 total
5993  *
5994  * p2p, mchan, and mbss:
5995  *
5996  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
5997  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
5998  *      #AP <= 4, matching BI, channels = 1, 4 total
5999  */
6000 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6001 {
6002         struct ieee80211_iface_combination *combo = NULL;
6003         struct ieee80211_iface_limit *c0_limits = NULL;
6004         struct ieee80211_iface_limit *p2p_limits = NULL;
6005         struct ieee80211_iface_limit *mbss_limits = NULL;
6006         bool mbss, p2p;
6007         int i, c, n_combos;
6008
6009         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6010         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6011
6012         n_combos = 1 + !!p2p + !!mbss;
6013         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6014         if (!combo)
6015                 goto err;
6016
6017         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6018         if (!c0_limits)
6019                 goto err;
6020
6021         if (p2p) {
6022                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6023                 if (!p2p_limits)
6024                         goto err;
6025         }
6026
6027         if (mbss) {
6028                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6029                 if (!mbss_limits)
6030                         goto err;
6031         }
6032
6033         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6034                                  BIT(NL80211_IFTYPE_ADHOC) |
6035                                  BIT(NL80211_IFTYPE_AP);
6036
6037         c = 0;
6038         i = 0;
6039         combo[c].num_different_channels = 1;
6040         c0_limits[i].max = 1;
6041         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6042         if (p2p) {
6043                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6044                         combo[c].num_different_channels = 2;
6045                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6046                                           BIT(NL80211_IFTYPE_P2P_GO) |
6047                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6048                 c0_limits[i].max = 1;
6049                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6050                 c0_limits[i].max = 1;
6051                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6052                                        BIT(NL80211_IFTYPE_P2P_GO);
6053         } else {
6054                 c0_limits[i].max = 1;
6055                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6056         }
6057         combo[c].max_interfaces = i;
6058         combo[c].n_limits = i;
6059         combo[c].limits = c0_limits;
6060
6061         if (p2p) {
6062                 c++;
6063                 i = 0;
6064                 combo[c].num_different_channels = 1;
6065                 p2p_limits[i].max = 1;
6066                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6067                 p2p_limits[i].max = 1;
6068                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6069                 p2p_limits[i].max = 1;
6070                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6071                 p2p_limits[i].max = 1;
6072                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6073                 combo[c].max_interfaces = i;
6074                 combo[c].n_limits = i;
6075                 combo[c].limits = p2p_limits;
6076         }
6077
6078         if (mbss) {
6079                 c++;
6080                 combo[c].beacon_int_infra_match = true;
6081                 combo[c].num_different_channels = 1;
6082                 mbss_limits[0].max = 4;
6083                 mbss_limits[0].types = BIT(NL80211_IFTYPE_AP);
6084                 combo[c].max_interfaces = 4;
6085                 combo[c].n_limits = 1;
6086                 combo[c].limits = mbss_limits;
6087         }
6088         wiphy->n_iface_combinations = n_combos;
6089         wiphy->iface_combinations = combo;
6090         return 0;
6091
6092 err:
6093         kfree(c0_limits);
6094         kfree(p2p_limits);
6095         kfree(mbss_limits);
6096         kfree(combo);
6097         return -ENOMEM;
6098 }
6099
6100 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
6101 {
6102         /* scheduled scan settings */
6103         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
6104         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6105         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6106         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
6107 }
6108
6109 #ifdef CONFIG_PM
6110 static struct wiphy_wowlan_support brcmf_wowlan_support = {
6111         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6112         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6113         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6114         .pattern_min_len = 1,
6115         .max_pkt_offset = 1500,
6116 };
6117 #endif
6118
6119 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6120 {
6121 #ifdef CONFIG_PM
6122         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6123         s32 err;
6124         u32 wowl_cap;
6125
6126         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6127                 err = brcmf_fil_iovar_int_get(ifp, "wowl_cap", &wowl_cap);
6128                 if (!err) {
6129                         if (wowl_cap & BRCMF_WOWL_PFN_FOUND) {
6130                                 brcmf_wowlan_support.flags |=
6131                                                         WIPHY_WOWLAN_NET_DETECT;
6132                                 init_waitqueue_head(&cfg->wowl.nd_data_wait);
6133                         }
6134                 }
6135         }
6136         wiphy->wowlan = &brcmf_wowlan_support;
6137 #endif
6138 }
6139
6140 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6141 {
6142         struct brcmf_pub *drvr = ifp->drvr;
6143         const struct ieee80211_iface_combination *combo;
6144         struct ieee80211_supported_band *band;
6145         u16 max_interfaces = 0;
6146         __le32 bandlist[3];
6147         u32 n_bands;
6148         int err, i;
6149
6150         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6151         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6152         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6153
6154         err = brcmf_setup_ifmodes(wiphy, ifp);
6155         if (err)
6156                 return err;
6157
6158         for (i = 0, combo = wiphy->iface_combinations;
6159              i < wiphy->n_iface_combinations; i++, combo++) {
6160                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6161         }
6162
6163         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6164              i++) {
6165                 u8 *addr = drvr->addresses[i].addr;
6166
6167                 memcpy(addr, drvr->mac, ETH_ALEN);
6168                 if (i) {
6169                         addr[0] |= BIT(1);
6170                         addr[ETH_ALEN - 1] ^= i;
6171                 }
6172         }
6173         wiphy->addresses = drvr->addresses;
6174         wiphy->n_addresses = i;
6175
6176         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6177         wiphy->cipher_suites = __wl_cipher_suites;
6178         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
6179         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
6180                         WIPHY_FLAG_OFFCHAN_TX |
6181                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6182         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6183                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6184         if (!ifp->drvr->settings->roamoff)
6185                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6186         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6187         wiphy->max_remain_on_channel_duration = 5000;
6188         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
6189                 brcmf_wiphy_pno_params(wiphy);
6190
6191         /* vendor commands/events support */
6192         wiphy->vendor_commands = brcmf_vendor_cmds;
6193         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6194
6195         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6196                 brcmf_wiphy_wowl_params(wiphy, ifp);
6197         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6198                                      sizeof(bandlist));
6199         if (err) {
6200                 brcmf_err("could not obtain band info: err=%d\n", err);
6201                 return err;
6202         }
6203         /* first entry in bandlist is number of bands */
6204         n_bands = le32_to_cpu(bandlist[0]);
6205         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6206                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6207                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6208                                        GFP_KERNEL);
6209                         if (!band)
6210                                 return -ENOMEM;
6211
6212                         band->channels = kmemdup(&__wl_2ghz_channels,
6213                                                  sizeof(__wl_2ghz_channels),
6214                                                  GFP_KERNEL);
6215                         if (!band->channels) {
6216                                 kfree(band);
6217                                 return -ENOMEM;
6218                         }
6219
6220                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6221                         wiphy->bands[IEEE80211_BAND_2GHZ] = band;
6222                 }
6223                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6224                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6225                                        GFP_KERNEL);
6226                         if (!band)
6227                                 return -ENOMEM;
6228
6229                         band->channels = kmemdup(&__wl_5ghz_channels,
6230                                                  sizeof(__wl_5ghz_channels),
6231                                                  GFP_KERNEL);
6232                         if (!band->channels) {
6233                                 kfree(band);
6234                                 return -ENOMEM;
6235                         }
6236
6237                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6238                         wiphy->bands[IEEE80211_BAND_5GHZ] = band;
6239                 }
6240         }
6241         err = brcmf_setup_wiphybands(wiphy);
6242         return err;
6243 }
6244
6245 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6246 {
6247         struct net_device *ndev;
6248         struct wireless_dev *wdev;
6249         struct brcmf_if *ifp;
6250         s32 power_mode;
6251         s32 err = 0;
6252
6253         if (cfg->dongle_up)
6254                 return err;
6255
6256         ndev = cfg_to_ndev(cfg);
6257         wdev = ndev->ieee80211_ptr;
6258         ifp = netdev_priv(ndev);
6259
6260         /* make sure RF is ready for work */
6261         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6262
6263         brcmf_dongle_scantime(ifp);
6264
6265         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6266         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6267         if (err)
6268                 goto default_conf_out;
6269         brcmf_dbg(INFO, "power save set to %s\n",
6270                   (power_mode ? "enabled" : "disabled"));
6271
6272         err = brcmf_dongle_roam(ifp);
6273         if (err)
6274                 goto default_conf_out;
6275         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6276                                           NULL, NULL);
6277         if (err)
6278                 goto default_conf_out;
6279
6280         brcmf_configure_arp_offload(ifp, true);
6281
6282         cfg->dongle_up = true;
6283 default_conf_out:
6284
6285         return err;
6286
6287 }
6288
6289 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6290 {
6291         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6292
6293         return brcmf_config_dongle(ifp->drvr->config);
6294 }
6295
6296 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6297 {
6298         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6299
6300         /*
6301          * While going down, if associated with AP disassociate
6302          * from AP to save power
6303          */
6304         if (check_vif_up(ifp->vif)) {
6305                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6306
6307                 /* Make sure WPA_Supplicant receives all the event
6308                    generated due to DISASSOC call to the fw to keep
6309                    the state fw and WPA_Supplicant state consistent
6310                  */
6311                 brcmf_delay(500);
6312         }
6313
6314         brcmf_abort_scanning(cfg);
6315         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6316
6317         return 0;
6318 }
6319
6320 s32 brcmf_cfg80211_up(struct net_device *ndev)
6321 {
6322         struct brcmf_if *ifp = netdev_priv(ndev);
6323         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6324         s32 err = 0;
6325
6326         mutex_lock(&cfg->usr_sync);
6327         err = __brcmf_cfg80211_up(ifp);
6328         mutex_unlock(&cfg->usr_sync);
6329
6330         return err;
6331 }
6332
6333 s32 brcmf_cfg80211_down(struct net_device *ndev)
6334 {
6335         struct brcmf_if *ifp = netdev_priv(ndev);
6336         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6337         s32 err = 0;
6338
6339         mutex_lock(&cfg->usr_sync);
6340         err = __brcmf_cfg80211_down(ifp);
6341         mutex_unlock(&cfg->usr_sync);
6342
6343         return err;
6344 }
6345
6346 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6347 {
6348         struct wireless_dev *wdev = &ifp->vif->wdev;
6349
6350         return wdev->iftype;
6351 }
6352
6353 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6354                              unsigned long state)
6355 {
6356         struct brcmf_cfg80211_vif *vif;
6357
6358         list_for_each_entry(vif, &cfg->vif_list, list) {
6359                 if (test_bit(state, &vif->sme_state))
6360                         return true;
6361         }
6362         return false;
6363 }
6364
6365 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6366                                     u8 action)
6367 {
6368         u8 evt_action;
6369
6370         mutex_lock(&event->vif_event_lock);
6371         evt_action = event->action;
6372         mutex_unlock(&event->vif_event_lock);
6373         return evt_action == action;
6374 }
6375
6376 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6377                                   struct brcmf_cfg80211_vif *vif)
6378 {
6379         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6380
6381         mutex_lock(&event->vif_event_lock);
6382         event->vif = vif;
6383         event->action = 0;
6384         mutex_unlock(&event->vif_event_lock);
6385 }
6386
6387 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6388 {
6389         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6390         bool armed;
6391
6392         mutex_lock(&event->vif_event_lock);
6393         armed = event->vif != NULL;
6394         mutex_unlock(&event->vif_event_lock);
6395
6396         return armed;
6397 }
6398 int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
6399                                           u8 action, ulong timeout)
6400 {
6401         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6402
6403         return wait_event_timeout(event->vif_wq,
6404                                   vif_event_equals(event, action), timeout);
6405 }
6406
6407 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6408                                         struct regulatory_request *req)
6409 {
6410         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6411         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6412         struct brcmf_fil_country_le ccreq;
6413         int i;
6414
6415         brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
6416                   req->alpha2[0], req->alpha2[1]);
6417
6418         /* ignore non-ISO3166 country codes */
6419         for (i = 0; i < sizeof(req->alpha2); i++)
6420                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6421                         brcmf_err("not a ISO3166 code\n");
6422                         return;
6423                 }
6424         memset(&ccreq, 0, sizeof(ccreq));
6425         ccreq.rev = cpu_to_le32(-1);
6426         memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
6427         if (brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq))) {
6428                 brcmf_err("firmware rejected country setting\n");
6429                 return;
6430         }
6431         brcmf_setup_wiphybands(wiphy);
6432 }
6433
6434 static void brcmf_free_wiphy(struct wiphy *wiphy)
6435 {
6436         int i;
6437
6438         if (!wiphy)
6439                 return;
6440
6441         if (wiphy->iface_combinations) {
6442                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6443                         kfree(wiphy->iface_combinations[i].limits);
6444         }
6445         kfree(wiphy->iface_combinations);
6446         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
6447                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
6448                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
6449         }
6450         if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
6451                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]->channels);
6452                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]);
6453         }
6454         wiphy_free(wiphy);
6455 }
6456
6457 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6458                                                   struct device *busdev,
6459                                                   bool p2pdev_forced)
6460 {
6461         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6462         struct brcmf_cfg80211_info *cfg;
6463         struct wiphy *wiphy;
6464         struct brcmf_cfg80211_vif *vif;
6465         struct brcmf_if *ifp;
6466         s32 err = 0;
6467         s32 io_type;
6468         u16 *cap = NULL;
6469
6470         if (!ndev) {
6471                 brcmf_err("ndev is invalid\n");
6472                 return NULL;
6473         }
6474
6475         ifp = netdev_priv(ndev);
6476         wiphy = wiphy_new(&wl_cfg80211_ops, sizeof(struct brcmf_cfg80211_info));
6477         if (!wiphy) {
6478                 brcmf_err("Could not allocate wiphy device\n");
6479                 return NULL;
6480         }
6481         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6482         set_wiphy_dev(wiphy, busdev);
6483
6484         cfg = wiphy_priv(wiphy);
6485         cfg->wiphy = wiphy;
6486         cfg->pub = drvr;
6487         init_vif_event(&cfg->vif_event);
6488         INIT_LIST_HEAD(&cfg->vif_list);
6489
6490         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
6491         if (IS_ERR(vif))
6492                 goto wiphy_out;
6493
6494         vif->ifp = ifp;
6495         vif->wdev.netdev = ndev;
6496         ndev->ieee80211_ptr = &vif->wdev;
6497         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6498
6499         err = wl_init_priv(cfg);
6500         if (err) {
6501                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6502                 brcmf_free_vif(vif);
6503                 goto wiphy_out;
6504         }
6505         ifp->vif = vif;
6506
6507         /* determine d11 io type before wiphy setup */
6508         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6509         if (err) {
6510                 brcmf_err("Failed to get D11 version (%d)\n", err);
6511                 goto priv_out;
6512         }
6513         cfg->d11inf.io_type = (u8)io_type;
6514         brcmu_d11_attach(&cfg->d11inf);
6515
6516         err = brcmf_setup_wiphy(wiphy, ifp);
6517         if (err < 0)
6518                 goto priv_out;
6519
6520         brcmf_dbg(INFO, "Registering custom regulatory\n");
6521         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6522         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6523         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6524
6525         /* firmware defaults to 40MHz disabled in 2G band. We signal
6526          * cfg80211 here that we do and have it decide we can enable
6527          * it. But first check if device does support 2G operation.
6528          */
6529         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
6530                 cap = &wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap.cap;
6531                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6532         }
6533         err = wiphy_register(wiphy);
6534         if (err < 0) {
6535                 brcmf_err("Could not register wiphy device (%d)\n", err);
6536                 goto priv_out;
6537         }
6538
6539         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6540          * setup 40MHz in 2GHz band and enable OBSS scanning.
6541          */
6542         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6543                 err = brcmf_enable_bw40_2g(cfg);
6544                 if (!err)
6545                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6546                                                       BRCMF_OBSS_COEX_AUTO);
6547                 else
6548                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6549         }
6550         /* p2p might require that "if-events" get processed by fweh. So
6551          * activate the already registered event handlers now and activate
6552          * the rest when initialization has completed. drvr->config needs to
6553          * be assigned before activating events.
6554          */
6555         drvr->config = cfg;
6556         err = brcmf_fweh_activate_events(ifp);
6557         if (err) {
6558                 brcmf_err("FWEH activation failed (%d)\n", err);
6559                 goto wiphy_unreg_out;
6560         }
6561
6562         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6563         if (err) {
6564                 brcmf_err("P2P initilisation failed (%d)\n", err);
6565                 goto wiphy_unreg_out;
6566         }
6567         err = brcmf_btcoex_attach(cfg);
6568         if (err) {
6569                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6570                 brcmf_p2p_detach(&cfg->p2p);
6571                 goto wiphy_unreg_out;
6572         }
6573
6574         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6575                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6576                 if (err) {
6577                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6578                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6579                 } else {
6580                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6581                                             brcmf_notify_tdls_peer_event);
6582                 }
6583         }
6584
6585         /* (re-) activate FWEH event handling */
6586         err = brcmf_fweh_activate_events(ifp);
6587         if (err) {
6588                 brcmf_err("FWEH activation failed (%d)\n", err);
6589                 goto wiphy_unreg_out;
6590         }
6591
6592         /* Fill in some of the advertised nl80211 supported features */
6593         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
6594                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6595 #ifdef CONFIG_PM
6596                 if (wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
6597                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6598 #endif
6599         }
6600
6601         return cfg;
6602
6603 wiphy_unreg_out:
6604         wiphy_unregister(cfg->wiphy);
6605 priv_out:
6606         wl_deinit_priv(cfg);
6607         brcmf_free_vif(vif);
6608         ifp->vif = NULL;
6609 wiphy_out:
6610         brcmf_free_wiphy(wiphy);
6611         return NULL;
6612 }
6613
6614 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
6615 {
6616         if (!cfg)
6617                 return;
6618
6619         brcmf_btcoex_detach(cfg);
6620         wiphy_unregister(cfg->wiphy);
6621         wl_deinit_priv(cfg);
6622         brcmf_free_wiphy(cfg->wiphy);
6623 }