drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41 #include "common.h"
  42
  43 #define BRCMF_SCAN_IE_LEN_MAX           2048
  44 #define BRCMF_PNO_VERSION               2
  45 #define BRCMF_PNO_TIME                  30
  46 #define BRCMF_PNO_REPEAT                4
  47 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  48 #define BRCMF_PNO_MAX_PFN_COUNT         16
  49 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  50 #define BRCMF_PNO_HIDDEN_BIT            2
  51 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  52 #define BRCMF_PNO_SCAN_COMPLETE         1
  53 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  54
  55 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  56 #define WPA_OUI_TYPE                    1
  57 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  58 #define WME_OUI_TYPE                    2
  59 #define WPS_OUI_TYPE                    4
  60
  61 #define VS_IE_FIXED_HDR_LEN             6
  62 #define WPA_IE_VERSION_LEN              2
  63 #define WPA_IE_MIN_OUI_LEN              4
  64 #define WPA_IE_SUITE_COUNT_LEN          2
  65
  66 #define WPA_CIPHER_NONE                 0       /* None */
  67 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  68 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  69 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  70 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  71
  72 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  73 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  74 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  75 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  76 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  77 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  78 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  79 #define RSN_CAP_MFPR_MASK               BIT(6)
  80 #define RSN_CAP_MFPC_MASK               BIT(7)
  81 #define RSN_PMKID_COUNT_LEN             2
  82
  83 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  84                                                  * string :"add", "del" (+ NUL)
  85                                                  */
  86 #define VNDR_IE_COUNT_OFFSET            4
  87 #define VNDR_IE_PKTFLAG_OFFSET          8
  88 #define VNDR_IE_VSIE_OFFSET             12
  89 #define VNDR_IE_HDR_SIZE                12
  90 #define VNDR_IE_PARSE_LIMIT             5
  91
  92 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  93 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  94
  95 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  96 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  97 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  98
  99 #define BRCMF_SCAN_CHANNEL_TIME         40
 100 #define BRCMF_SCAN_UNASSOC_TIME         40
 101 #define BRCMF_SCAN_PASSIVE_TIME         120
 102
 103 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
 104
 105 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 106         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 107
 108 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 109 {
 110         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 111                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 112                           vif->sme_state);
 113                 return false;
 114         }
 115         return true;
 116 }
 117
 118 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 119 #define RATETAB_ENT(_rateid, _flags) \
 120         {                                                               \
 121                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 122                 .hw_value       = (_rateid),                            \
 123                 .flags          = (_flags),                             \
 124         }
 125
 126 static struct ieee80211_rate __wl_rates[] = {
 127         RATETAB_ENT(BRCM_RATE_1M, 0),
 128         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(BRCM_RATE_6M, 0),
 132         RATETAB_ENT(BRCM_RATE_9M, 0),
 133         RATETAB_ENT(BRCM_RATE_12M, 0),
 134         RATETAB_ENT(BRCM_RATE_18M, 0),
 135         RATETAB_ENT(BRCM_RATE_24M, 0),
 136         RATETAB_ENT(BRCM_RATE_36M, 0),
 137         RATETAB_ENT(BRCM_RATE_48M, 0),
 138         RATETAB_ENT(BRCM_RATE_54M, 0),
 139 };
 140
 141 #define wl_g_rates              (__wl_rates + 0)
 142 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 143 #define wl_a_rates              (__wl_rates + 4)
 144 #define wl_a_rates_size         (wl_g_rates_size - 4)
 145
 146 #define CHAN2G(_channel, _freq) {                               \
 147         .band                   = NL80211_BAND_2GHZ,            \
 148         .center_freq            = (_freq),                      \
 149         .hw_value               = (_channel),                   \
 150         .flags                  = IEEE80211_CHAN_DISABLED,      \
 151         .max_antenna_gain       = 0,                            \
 152         .max_power              = 30,                           \
 153 }
 154
 155 #define CHAN5G(_channel) {                                      \
 156         .band                   = NL80211_BAND_5GHZ,            \
 157         .center_freq            = 5000 + (5 * (_channel)),      \
 158         .hw_value               = (_channel),                   \
 159         .flags                  = IEEE80211_CHAN_DISABLED,      \
 160         .max_antenna_gain       = 0,                            \
 161         .max_power              = 30,                           \
 162 }
 163
 164 static struct ieee80211_channel __wl_2ghz_channels[] = {
 165         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 166         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 167         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 168         CHAN2G(13, 2472), CHAN2G(14, 2484)
 169 };
 170
 171 static struct ieee80211_channel __wl_5ghz_channels[] = {
 172         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 173         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 174         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 175         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 176         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 177         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 178 };
 179
 180 /* Band templates duplicated per wiphy. The channel info
 181  * above is added to the band during setup.
 182  */
 183 static const struct ieee80211_supported_band __wl_band_2ghz = {
 184         .band = NL80211_BAND_2GHZ,
 185         .bitrates = wl_g_rates,
 186         .n_bitrates = wl_g_rates_size,
 187 };
 188
 189 static const struct ieee80211_supported_band __wl_band_5ghz = {
 190         .band = NL80211_BAND_5GHZ,
 191         .bitrates = wl_a_rates,
 192         .n_bitrates = wl_a_rates_size,
 193 };
 194
 195 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 196  * By default world regulatory domain defined in reg.c puts the flags
 197  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 198  * With respect to these flags, wpa_supplicant doesn't * start p2p
 199  * operations on 5GHz channels. All the changes in world regulatory
 200  * domain are to be done here.
 201  */
 202 static const struct ieee80211_regdomain brcmf_regdom = {
 203         .n_reg_rules = 4,
 204         .alpha2 =  "99",
 205         .reg_rules = {
 206                 /* IEEE 802.11b/g, channels 1..11 */
 207                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 208                 /* If any */
 209                 /* IEEE 802.11 channel 14 - Only JP enables
 210                  * this and for 802.11b only
 211                  */
 212                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 213                 /* IEEE 802.11a, channel 36..64 */
 214                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 215                 /* IEEE 802.11a, channel 100..165 */
 216                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 217 };
 218
 219 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 220  * are supported. A pointer to this array and the number of entries is passed
 221  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 222  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 223  * device does not support MFP then the number of suites will be decreased by 1
 224  */
 225 static const u32 brcmf_cipher_suites[] = {
 226         WLAN_CIPHER_SUITE_WEP40,
 227         WLAN_CIPHER_SUITE_WEP104,
 228         WLAN_CIPHER_SUITE_TKIP,
 229         WLAN_CIPHER_SUITE_CCMP,
 230         /* Keep as last entry: */
 231         WLAN_CIPHER_SUITE_AES_CMAC
 232 };
 233
 234 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 235 struct brcmf_vs_tlv {
 236         u8 id;
 237         u8 len;
 238         u8 oui[3];
 239         u8 oui_type;
 240 };
 241
 242 struct parsed_vndr_ie_info {
 243         u8 *ie_ptr;
 244         u32 ie_len;     /* total length including id & length field */
 245         struct brcmf_vs_tlv vndrie;
 246 };
 247
 248 struct parsed_vndr_ies {
 249         u32 count;
 250         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 251 };
 252
 253 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 254 {
 255         switch (band) {
 256         case NL80211_BAND_2GHZ:
 257                 return WLC_BAND_2G;
 258         case NL80211_BAND_5GHZ:
 259                 return WLC_BAND_5G;
 260         default:
 261                 WARN_ON(1);
 262                 break;
 263         }
 264         return 0;
 265 }
 266
 267 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 268                                struct cfg80211_chan_def *ch)
 269 {
 270         struct brcmu_chan ch_inf;
 271         s32 primary_offset;
 272
 273         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 274                   ch->chan->center_freq, ch->center_freq1, ch->width);
 275         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 276         primary_offset = ch->chan->center_freq - ch->center_freq1;
 277         switch (ch->width) {
 278         case NL80211_CHAN_WIDTH_20:
 279         case NL80211_CHAN_WIDTH_20_NOHT:
 280                 ch_inf.bw = BRCMU_CHAN_BW_20;
 281                 WARN_ON(primary_offset != 0);
 282                 break;
 283         case NL80211_CHAN_WIDTH_40:
 284                 ch_inf.bw = BRCMU_CHAN_BW_40;
 285                 if (primary_offset > 0)
 286                         ch_inf.sb = BRCMU_CHAN_SB_U;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_L;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80:
 291                 ch_inf.bw = BRCMU_CHAN_BW_80;
 292                 if (primary_offset == -30)
 293                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 294                 else if (primary_offset == -10)
 295                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 296                 else if (primary_offset == 10)
 297                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 298                 else
 299                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 300                 break;
 301         case NL80211_CHAN_WIDTH_80P80:
 302         case NL80211_CHAN_WIDTH_160:
 303         case NL80211_CHAN_WIDTH_5:
 304         case NL80211_CHAN_WIDTH_10:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         switch (ch->chan->band) {
 309         case NL80211_BAND_2GHZ:
 310                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 311                 break;
 312         case NL80211_BAND_5GHZ:
 313                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 314                 break;
 315         case NL80211_BAND_60GHZ:
 316         default:
 317                 WARN_ON_ONCE(1);
 318         }
 319         d11inf->encchspec(&ch_inf);
 320
 321         return ch_inf.chspec;
 322 }
 323
 324 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 325                         struct ieee80211_channel *ch)
 326 {
 327         struct brcmu_chan ch_inf;
 328
 329         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 330         ch_inf.bw = BRCMU_CHAN_BW_20;
 331         d11inf->encchspec(&ch_inf);
 332
 333         return ch_inf.chspec;
 334 }
 335
 336 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 337  * triples, returning a pointer to the substring whose first element
 338  * matches tag
 339  */
 340 const struct brcmf_tlv *
 341 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 342 {
 343         const struct brcmf_tlv *elt = buf;
 344         int totlen = buflen;
 345
 346         /* find tagged parameter */
 347         while (totlen >= TLV_HDR_LEN) {
 348                 int len = elt->len;
 349
 350                 /* validate remaining totlen */
 351                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 352                         return elt;
 353
 354                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 355                 totlen -= (len + TLV_HDR_LEN);
 356         }
 357
 358         return NULL;
 359 }
 360
 361 /* Is any of the tlvs the expected entry? If
 362  * not update the tlvs buffer pointer/length.
 363  */
 364 static bool
 365 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 366                  const u8 *oui, u32 oui_len, u8 type)
 367 {
 368         /* If the contents match the OUI and the type */
 369         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 370             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 371             type == ie[TLV_BODY_OFF + oui_len]) {
 372                 return true;
 373         }
 374
 375         if (tlvs == NULL)
 376                 return false;
 377         /* point to the next ie */
 378         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 379         /* calculate the length of the rest of the buffer */
 380         *tlvs_len -= (int)(ie - *tlvs);
 381         /* update the pointer to the start of the buffer */
 382         *tlvs = ie;
 383
 384         return false;
 385 }
 386
 387 static struct brcmf_vs_tlv *
 388 brcmf_find_wpaie(const u8 *parse, u32 len)
 389 {
 390         const struct brcmf_tlv *ie;
 391
 392         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 393                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 394                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 395                         return (struct brcmf_vs_tlv *)ie;
 396         }
 397         return NULL;
 398 }
 399
 400 static struct brcmf_vs_tlv *
 401 brcmf_find_wpsie(const u8 *parse, u32 len)
 402 {
 403         const struct brcmf_tlv *ie;
 404
 405         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 406                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 407                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 408                         return (struct brcmf_vs_tlv *)ie;
 409         }
 410         return NULL;
 411 }
 412
 413 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 414                                      struct brcmf_cfg80211_vif *vif,
 415                                      enum nl80211_iftype new_type)
 416 {
 417         int iftype_num[NUM_NL80211_IFTYPES];
 418         struct brcmf_cfg80211_vif *pos;
 419         bool check_combos = false;
 420         int ret = 0;
 421
 422         memset(&iftype_num[0], 0, sizeof(iftype_num));
 423         list_for_each_entry(pos, &cfg->vif_list, list)
 424                 if (pos == vif) {
 425                         iftype_num[new_type]++;
 426                 } else {
 427                         /* concurrent interfaces so need check combinations */
 428                         check_combos = true;
 429                         iftype_num[pos->wdev.iftype]++;
 430                 }
 431
 432         if (check_combos)
 433                 ret = cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 434
 435         return ret;
 436 }
 437
 438 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 439                                   enum nl80211_iftype new_type)
 440 {
 441         int iftype_num[NUM_NL80211_IFTYPES];
 442         struct brcmf_cfg80211_vif *pos;
 443
 444         memset(&iftype_num[0], 0, sizeof(iftype_num));
 445         list_for_each_entry(pos, &cfg->vif_list, list)
 446                 iftype_num[pos->wdev.iftype]++;
 447
 448         iftype_num[new_type]++;
 449         return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 450 }
 451
 452 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 453                                  struct brcmf_wsec_key_le *key_le)
 454 {
 455         key_le->index = cpu_to_le32(key->index);
 456         key_le->len = cpu_to_le32(key->len);
 457         key_le->algo = cpu_to_le32(key->algo);
 458         key_le->flags = cpu_to_le32(key->flags);
 459         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 460         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 461         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 462         memcpy(key_le->data, key->data, sizeof(key->data));
 463         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 464 }
 465
 466 static int
 467 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 468 {
 469         int err;
 470         struct brcmf_wsec_key_le key_le;
 471
 472         convert_key_from_CPU(key, &key_le);
 473
 474         brcmf_netdev_wait_pend8021x(ifp);
 475
 476         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 477                                         sizeof(key_le));
 478
 479         if (err)
 480                 brcmf_err("wsec_key error (%d)\n", err);
 481         return err;
 482 }
 483
 484 static s32
 485 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 486 {
 487         s32 err;
 488         u32 mode;
 489
 490         if (enable)
 491                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 492         else
 493                 mode = 0;
 494
 495         /* Try to set and enable ARP offload feature, this may fail, then it  */
 496         /* is simply not supported and err 0 will be returned                 */
 497         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 498         if (err) {
 499                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 500                           mode, err);
 501                 err = 0;
 502         } else {
 503                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 504                 if (err) {
 505                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 506                                   enable, err);
 507                         err = 0;
 508                 } else
 509                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 510                                   enable, mode);
 511         }
 512
 513         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 514         if (err) {
 515                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 516                           enable, err);
 517                 err = 0;
 518         } else
 519                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 520                           enable, mode);
 521
 522         return err;
 523 }
 524
 525 static void
 526 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 527 {
 528         struct brcmf_cfg80211_vif *vif;
 529         struct brcmf_if *ifp;
 530
 531         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 532         ifp = vif->ifp;
 533
 534         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 535             (wdev->iftype == NL80211_IFTYPE_AP) ||
 536             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 537                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 538                                                 ADDR_DIRECT);
 539         else
 540                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 541                                                 ADDR_INDIRECT);
 542 }
 543
 544 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 545 {
 546         int bsscfgidx;
 547
 548         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 549                 /* bsscfgidx 1 is reserved for legacy P2P */
 550                 if (bsscfgidx == 1)
 551                         continue;
 552                 if (!drvr->iflist[bsscfgidx])
 553                         return bsscfgidx;
 554         }
 555
 556         return -ENOMEM;
 557 }
 558
 559 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 560 {
 561         struct brcmf_mbss_ssid_le mbss_ssid_le;
 562         int bsscfgidx;
 563         int err;
 564
 565         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 566         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 567         if (bsscfgidx < 0)
 568                 return bsscfgidx;
 569
 570         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 571         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 572         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 573
 574         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 575                                         sizeof(mbss_ssid_le));
 576         if (err < 0)
 577                 brcmf_err("setting ssid failed %d\n", err);
 578
 579         return err;
 580 }
 581
 582 /**
 583  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 584  *
 585  * @wiphy: wiphy device of new interface.
 586  * @name: name of the new interface.
 587  * @flags: not used.
 588  * @params: contains mac address for AP device.
 589  */
 590 static
 591 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 592                                       u32 *flags, struct vif_params *params)
 593 {
 594         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 595         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 596         struct brcmf_cfg80211_vif *vif;
 597         int err;
 598
 599         if (brcmf_cfg80211_vif_event_armed(cfg))
 600                 return ERR_PTR(-EBUSY);
 601
 602         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 603
 604         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 605         if (IS_ERR(vif))
 606                 return (struct wireless_dev *)vif;
 607
 608         brcmf_cfg80211_arm_vif_event(cfg, vif);
 609
 610         err = brcmf_cfg80211_request_ap_if(ifp);
 611         if (err) {
 612                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 613                 goto fail;
 614         }
 615
 616         /* wait for firmware event */
 617         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 618                                             BRCMF_VIF_EVENT_TIMEOUT);
 619         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 620         if (!err) {
 621                 brcmf_err("timeout occurred\n");
 622                 err = -EIO;
 623                 goto fail;
 624         }
 625
 626         /* interface created in firmware */
 627         ifp = vif->ifp;
 628         if (!ifp) {
 629                 brcmf_err("no if pointer provided\n");
 630                 err = -ENOENT;
 631                 goto fail;
 632         }
 633
 634         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 635         err = brcmf_net_attach(ifp, true);
 636         if (err) {
 637                 brcmf_err("Registering netdevice failed\n");
 638                 goto fail;
 639         }
 640
 641         return &ifp->vif->wdev;
 642
 643 fail:
 644         brcmf_free_vif(vif);
 645         return ERR_PTR(err);
 646 }
 647
 648 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 649 {
 650         enum nl80211_iftype iftype;
 651
 652         iftype = vif->wdev.iftype;
 653         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 654 }
 655
 656 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 657 {
 658         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 659 }
 660
 661 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 662                                                      const char *name,
 663                                                      unsigned char name_assign_type,
 664                                                      enum nl80211_iftype type,
 665                                                      u32 *flags,
 666                                                      struct vif_params *params)
 667 {
 668         struct wireless_dev *wdev;
 669         int err;
 670
 671         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 672         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 673         if (err) {
 674                 brcmf_err("iface validation failed: err=%d\n", err);
 675                 return ERR_PTR(err);
 676         }
 677         switch (type) {
 678         case NL80211_IFTYPE_ADHOC:
 679         case NL80211_IFTYPE_STATION:
 680         case NL80211_IFTYPE_AP_VLAN:
 681         case NL80211_IFTYPE_WDS:
 682         case NL80211_IFTYPE_MONITOR:
 683         case NL80211_IFTYPE_MESH_POINT:
 684                 return ERR_PTR(-EOPNOTSUPP);
 685         case NL80211_IFTYPE_AP:
 686                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 687                 break;
 688         case NL80211_IFTYPE_P2P_CLIENT:
 689         case NL80211_IFTYPE_P2P_GO:
 690         case NL80211_IFTYPE_P2P_DEVICE:
 691                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, flags, params);
 692                 break;
 693         case NL80211_IFTYPE_UNSPECIFIED:
 694         default:
 695                 return ERR_PTR(-EINVAL);
 696         }
 697
 698         if (IS_ERR(wdev))
 699                 brcmf_err("add iface %s type %d failed: err=%d\n",
 700                           name, type, (int)PTR_ERR(wdev));
 701         else
 702                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 703
 704         return wdev;
 705 }
 706
 707 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 708 {
 709         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 710                 brcmf_set_mpc(ifp, mpc);
 711 }
 712
 713 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 714 {
 715         s32 err = 0;
 716
 717         if (check_vif_up(ifp->vif)) {
 718                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 719                 if (err) {
 720                         brcmf_err("fail to set mpc\n");
 721                         return;
 722                 }
 723                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 724         }
 725 }
 726
 727 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 728                                 struct brcmf_if *ifp, bool aborted,
 729                                 bool fw_abort)
 730 {
 731         struct brcmf_scan_params_le params_le;
 732         struct cfg80211_scan_request *scan_request;
 733         s32 err = 0;
 734
 735         brcmf_dbg(SCAN, "Enter\n");
 736
 737         /* clear scan request, because the FW abort can cause a second call */
 738         /* to this functon and might cause a double cfg80211_scan_done      */
 739         scan_request = cfg->scan_request;
 740         cfg->scan_request = NULL;
 741
 742         if (timer_pending(&cfg->escan_timeout))
 743                 del_timer_sync(&cfg->escan_timeout);
 744
 745         if (fw_abort) {
 746                 /* Do a scan abort to stop the driver's scan engine */
 747                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 748                 memset(&params_le, 0, sizeof(params_le));
 749                 eth_broadcast_addr(params_le.bssid);
 750                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 751                 params_le.scan_type = 0;
 752                 params_le.channel_num = cpu_to_le32(1);
 753                 params_le.nprobes = cpu_to_le32(1);
 754                 params_le.active_time = cpu_to_le32(-1);
 755                 params_le.passive_time = cpu_to_le32(-1);
 756                 params_le.home_time = cpu_to_le32(-1);
 757                 /* Scan is aborted by setting channel_list[0] to -1 */
 758                 params_le.channel_list[0] = cpu_to_le16(-1);
 759                 /* E-Scan (or anyother type) can be aborted by SCAN */
 760                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 761                                              &params_le, sizeof(params_le));
 762                 if (err)
 763                         brcmf_err("Scan abort  failed\n");
 764         }
 765
 766         brcmf_scan_config_mpc(ifp, 1);
 767
 768         /*
 769          * e-scan can be initiated by scheduled scan
 770          * which takes precedence.
 771          */
 772         if (cfg->sched_escan) {
 773                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 774                 cfg->sched_escan = false;
 775                 if (!aborted)
 776                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 777         } else if (scan_request) {
 778                 struct cfg80211_scan_info info = {
 779                         .aborted = aborted,
 780                 };
 781
 782                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 783                           aborted ? "Aborted" : "Done");
 784                 cfg80211_scan_done(scan_request, &info);
 785         }
 786         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 787                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 788
 789         return err;
 790 }
 791
 792 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 793                                        struct wireless_dev *wdev)
 794 {
 795         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 796         struct net_device *ndev = wdev->netdev;
 797         struct brcmf_if *ifp = netdev_priv(ndev);
 798         int ret;
 799         int err;
 800
 801         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 802
 803         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 804         if (err) {
 805                 brcmf_err("interface_remove failed %d\n", err);
 806                 goto err_unarm;
 807         }
 808
 809         /* wait for firmware event */
 810         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 811                                             BRCMF_VIF_EVENT_TIMEOUT);
 812         if (!ret) {
 813                 brcmf_err("timeout occurred\n");
 814                 err = -EIO;
 815                 goto err_unarm;
 816         }
 817
 818         brcmf_remove_interface(ifp, true);
 819
 820 err_unarm:
 821         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 822         return err;
 823 }
 824
 825 static
 826 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 827 {
 828         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 829         struct net_device *ndev = wdev->netdev;
 830
 831         if (ndev && ndev == cfg_to_ndev(cfg))
 832                 return -ENOTSUPP;
 833
 834         /* vif event pending in firmware */
 835         if (brcmf_cfg80211_vif_event_armed(cfg))
 836                 return -EBUSY;
 837
 838         if (ndev) {
 839                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 840                     cfg->escan_info.ifp == netdev_priv(ndev))
 841                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 842                                                     true, true);
 843
 844                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 845         }
 846
 847         switch (wdev->iftype) {
 848         case NL80211_IFTYPE_ADHOC:
 849         case NL80211_IFTYPE_STATION:
 850         case NL80211_IFTYPE_AP_VLAN:
 851         case NL80211_IFTYPE_WDS:
 852         case NL80211_IFTYPE_MONITOR:
 853         case NL80211_IFTYPE_MESH_POINT:
 854                 return -EOPNOTSUPP;
 855         case NL80211_IFTYPE_AP:
 856                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 857         case NL80211_IFTYPE_P2P_CLIENT:
 858         case NL80211_IFTYPE_P2P_GO:
 859         case NL80211_IFTYPE_P2P_DEVICE:
 860                 return brcmf_p2p_del_vif(wiphy, wdev);
 861         case NL80211_IFTYPE_UNSPECIFIED:
 862         default:
 863                 return -EINVAL;
 864         }
 865         return -EOPNOTSUPP;
 866 }
 867
 868 static s32
 869 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 870                          enum nl80211_iftype type, u32 *flags,
 871                          struct vif_params *params)
 872 {
 873         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 874         struct brcmf_if *ifp = netdev_priv(ndev);
 875         struct brcmf_cfg80211_vif *vif = ifp->vif;
 876         s32 infra = 0;
 877         s32 ap = 0;
 878         s32 err = 0;
 879
 880         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 881                   type);
 882
 883         /* WAR: There are a number of p2p interface related problems which
 884          * need to be handled initially (before doing the validate).
 885          * wpa_supplicant tends to do iface changes on p2p device/client/go
 886          * which are not always possible/allowed. However we need to return
 887          * OK otherwise the wpa_supplicant wont start. The situation differs
 888          * on configuration and setup (p2pon=1 module param). The first check
 889          * is to see if the request is a change to station for p2p iface.
 890          */
 891         if ((type == NL80211_IFTYPE_STATION) &&
 892             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 893              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 894              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 895                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 896                 /* Now depending on whether module param p2pon=1 was used the
 897                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 898                  * that if p2pon=1 is used, but a newer supplicant is used then
 899                  * we should return an error, as this combination wont work.
 900                  * In other situations 0 is returned and supplicant will start
 901                  * normally. It will give a trace in cfg80211, but it is the
 902                  * only way to get it working. Unfortunately this will result
 903                  * in situation where we wont support new supplicant in
 904                  * combination with module param p2pon=1, but that is the way
 905                  * it is. If the user tries this then unloading of driver might
 906                  * fail/lock.
 907                  */
 908                 if (cfg->p2p.p2pdev_dynamically)
 909                         return -EOPNOTSUPP;
 910                 else
 911                         return 0;
 912         }
 913         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 914         if (err) {
 915                 brcmf_err("iface validation failed: err=%d\n", err);
 916                 return err;
 917         }
 918         switch (type) {
 919         case NL80211_IFTYPE_MONITOR:
 920         case NL80211_IFTYPE_WDS:
 921                 brcmf_err("type (%d) : currently we do not support this type\n",
 922                           type);
 923                 return -EOPNOTSUPP;
 924         case NL80211_IFTYPE_ADHOC:
 925                 infra = 0;
 926                 break;
 927         case NL80211_IFTYPE_STATION:
 928                 infra = 1;
 929                 break;
 930         case NL80211_IFTYPE_AP:
 931         case NL80211_IFTYPE_P2P_GO:
 932                 ap = 1;
 933                 break;
 934         default:
 935                 err = -EINVAL;
 936                 goto done;
 937         }
 938
 939         if (ap) {
 940                 if (type == NL80211_IFTYPE_P2P_GO) {
 941                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 942                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 943                 }
 944                 if (!err) {
 945                         brcmf_dbg(INFO, "IF Type = AP\n");
 946                 }
 947         } else {
 948                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 949                 if (err) {
 950                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 951                         err = -EAGAIN;
 952                         goto done;
 953                 }
 954                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 955                           "Adhoc" : "Infra");
 956         }
 957         ndev->ieee80211_ptr->iftype = type;
 958
 959         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 960
 961 done:
 962         brcmf_dbg(TRACE, "Exit\n");
 963
 964         return err;
 965 }
 966
 967 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 968                              struct brcmf_scan_params_le *params_le,
 969                              struct cfg80211_scan_request *request)
 970 {
 971         u32 n_ssids;
 972         u32 n_channels;
 973         s32 i;
 974         s32 offset;
 975         u16 chanspec;
 976         char *ptr;
 977         struct brcmf_ssid_le ssid_le;
 978
 979         eth_broadcast_addr(params_le->bssid);
 980         params_le->bss_type = DOT11_BSSTYPE_ANY;
 981         params_le->scan_type = 0;
 982         params_le->channel_num = 0;
 983         params_le->nprobes = cpu_to_le32(-1);
 984         params_le->active_time = cpu_to_le32(-1);
 985         params_le->passive_time = cpu_to_le32(-1);
 986         params_le->home_time = cpu_to_le32(-1);
 987         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 988
 989         /* if request is null exit so it will be all channel broadcast scan */
 990         if (!request)
 991                 return;
 992
 993         n_ssids = request->n_ssids;
 994         n_channels = request->n_channels;
 995         /* Copy channel array if applicable */
 996         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 997                   n_channels);
 998         if (n_channels > 0) {
 999                 for (i = 0; i < n_channels; i++) {
1000                         chanspec = channel_to_chanspec(&cfg->d11inf,
1001                                                        request->channels[i]);
1002                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1003                                   request->channels[i]->hw_value, chanspec);
1004                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1005                 }
1006         } else {
1007                 brcmf_dbg(SCAN, "Scanning all channels\n");
1008         }
1009         /* Copy ssid array if applicable */
1010         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1011         if (n_ssids > 0) {
1012                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1013                                 n_channels * sizeof(u16);
1014                 offset = roundup(offset, sizeof(u32));
1015                 ptr = (char *)params_le + offset;
1016                 for (i = 0; i < n_ssids; i++) {
1017                         memset(&ssid_le, 0, sizeof(ssid_le));
1018                         ssid_le.SSID_len =
1019                                         cpu_to_le32(request->ssids[i].ssid_len);
1020                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1021                                request->ssids[i].ssid_len);
1022                         if (!ssid_le.SSID_len)
1023                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1024                         else
1025                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
1026                                           i, ssid_le.SSID, ssid_le.SSID_len);
1027                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1028                         ptr += sizeof(ssid_le);
1029                 }
1030         } else {
1031                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
1032                 if ((request->ssids) && request->ssids->ssid_len) {
1033                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
1034                                   params_le->ssid_le.SSID,
1035                                   request->ssids->ssid_len);
1036                         params_le->ssid_le.SSID_len =
1037                                 cpu_to_le32(request->ssids->ssid_len);
1038                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
1039                                 request->ssids->ssid_len);
1040                 }
1041         }
1042         /* Adding mask to channel numbers */
1043         params_le->channel_num =
1044                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1045                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1046 }
1047
1048 static s32
1049 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1050                 struct cfg80211_scan_request *request)
1051 {
1052         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1053                           offsetof(struct brcmf_escan_params_le, params_le);
1054         struct brcmf_escan_params_le *params;
1055         s32 err = 0;
1056
1057         brcmf_dbg(SCAN, "E-SCAN START\n");
1058
1059         if (request != NULL) {
1060                 /* Allocate space for populating ssids in struct */
1061                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1062
1063                 /* Allocate space for populating ssids in struct */
1064                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1065         }
1066
1067         params = kzalloc(params_size, GFP_KERNEL);
1068         if (!params) {
1069                 err = -ENOMEM;
1070                 goto exit;
1071         }
1072         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1073         brcmf_escan_prep(cfg, &params->params_le, request);
1074         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1075         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1076         params->sync_id = cpu_to_le16(0x1234);
1077
1078         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1079         if (err) {
1080                 if (err == -EBUSY)
1081                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1082                 else
1083                         brcmf_err("error (%d)\n", err);
1084         }
1085
1086         kfree(params);
1087 exit:
1088         return err;
1089 }
1090
1091 static s32
1092 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
1093                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1094 {
1095         s32 err;
1096         u32 passive_scan;
1097         struct brcmf_scan_results *results;
1098         struct escan_info *escan = &cfg->escan_info;
1099
1100         brcmf_dbg(SCAN, "Enter\n");
1101         escan->ifp = ifp;
1102         escan->wiphy = wiphy;
1103         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1104         passive_scan = cfg->active_scan ? 0 : 1;
1105         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1106                                     passive_scan);
1107         if (err) {
1108                 brcmf_err("error (%d)\n", err);
1109                 return err;
1110         }
1111         brcmf_scan_config_mpc(ifp, 0);
1112         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1113         results->version = 0;
1114         results->count = 0;
1115         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1116
1117         err = escan->run(cfg, ifp, request);
1118         if (err)
1119                 brcmf_scan_config_mpc(ifp, 1);
1120         return err;
1121 }
1122
1123 static s32
1124 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1125                      struct cfg80211_scan_request *request,
1126                      struct cfg80211_ssid *this_ssid)
1127 {
1128         struct brcmf_if *ifp = vif->ifp;
1129         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1130         struct cfg80211_ssid *ssids;
1131         u32 passive_scan;
1132         bool escan_req;
1133         bool spec_scan;
1134         s32 err;
1135         struct brcmf_ssid_le ssid_le;
1136         u32 SSID_len;
1137
1138         brcmf_dbg(SCAN, "START ESCAN\n");
1139
1140         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1141                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1142                 return -EAGAIN;
1143         }
1144         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1145                 brcmf_err("Scanning being aborted: status (%lu)\n",
1146                           cfg->scan_status);
1147                 return -EAGAIN;
1148         }
1149         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1150                 brcmf_err("Scanning suppressed: status (%lu)\n",
1151                           cfg->scan_status);
1152                 return -EAGAIN;
1153         }
1154         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1155                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1156                 return -EAGAIN;
1157         }
1158
1159         /* If scan req comes for p2p0, send it over primary I/F */
1160         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1161                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1162
1163         escan_req = false;
1164         if (request) {
1165                 /* scan bss */
1166                 ssids = request->ssids;
1167                 escan_req = true;
1168         } else {
1169                 /* scan in ibss */
1170                 /* we don't do escan in ibss */
1171                 ssids = this_ssid;
1172         }
1173
1174         cfg->scan_request = request;
1175         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1176         if (escan_req) {
1177                 cfg->escan_info.run = brcmf_run_escan;
1178                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1179                 if (err)
1180                         goto scan_out;
1181
1182                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1183                 if (err)
1184                         goto scan_out;
1185         } else {
1186                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1187                           ssids->ssid, ssids->ssid_len);
1188                 memset(&ssid_le, 0, sizeof(ssid_le));
1189                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1190                 ssid_le.SSID_len = cpu_to_le32(0);
1191                 spec_scan = false;
1192                 if (SSID_len) {
1193                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1194                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1195                         spec_scan = true;
1196                 } else
1197                         brcmf_dbg(SCAN, "Broadcast scan\n");
1198
1199                 passive_scan = cfg->active_scan ? 0 : 1;
1200                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1201                                             passive_scan);
1202                 if (err) {
1203                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1204                         goto scan_out;
1205                 }
1206                 brcmf_scan_config_mpc(ifp, 0);
1207                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1208                                              sizeof(ssid_le));
1209                 if (err) {
1210                         if (err == -EBUSY)
1211                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1212                                           ssid_le.SSID);
1213                         else
1214                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1215
1216                         brcmf_scan_config_mpc(ifp, 1);
1217                         goto scan_out;
1218                 }
1219         }
1220
1221         /* Arm scan timeout timer */
1222         mod_timer(&cfg->escan_timeout, jiffies +
1223                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1224
1225         return 0;
1226
1227 scan_out:
1228         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1229         cfg->scan_request = NULL;
1230         return err;
1231 }
1232
1233 static s32
1234 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1235 {
1236         struct brcmf_cfg80211_vif *vif;
1237         s32 err = 0;
1238
1239         brcmf_dbg(TRACE, "Enter\n");
1240         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1241         if (!check_vif_up(vif))
1242                 return -EIO;
1243
1244         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1245
1246         if (err)
1247                 brcmf_err("scan error (%d)\n", err);
1248
1249         brcmf_dbg(TRACE, "Exit\n");
1250         return err;
1251 }
1252
1253 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1254 {
1255         s32 err = 0;
1256
1257         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1258                                       rts_threshold);
1259         if (err)
1260                 brcmf_err("Error (%d)\n", err);
1261
1262         return err;
1263 }
1264
1265 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1266 {
1267         s32 err = 0;
1268
1269         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1270                                       frag_threshold);
1271         if (err)
1272                 brcmf_err("Error (%d)\n", err);
1273
1274         return err;
1275 }
1276
1277 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1278 {
1279         s32 err = 0;
1280         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1281
1282         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1283         if (err) {
1284                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1285                 return err;
1286         }
1287         return err;
1288 }
1289
1290 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1291 {
1292         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1293         struct net_device *ndev = cfg_to_ndev(cfg);
1294         struct brcmf_if *ifp = netdev_priv(ndev);
1295         s32 err = 0;
1296
1297         brcmf_dbg(TRACE, "Enter\n");
1298         if (!check_vif_up(ifp->vif))
1299                 return -EIO;
1300
1301         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1302             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1303                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1304                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1305                 if (!err)
1306                         goto done;
1307         }
1308         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1309             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1310                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1311                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1312                 if (!err)
1313                         goto done;
1314         }
1315         if (changed & WIPHY_PARAM_RETRY_LONG
1316             && (cfg->conf->retry_long != wiphy->retry_long)) {
1317                 cfg->conf->retry_long = wiphy->retry_long;
1318                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1319                 if (!err)
1320                         goto done;
1321         }
1322         if (changed & WIPHY_PARAM_RETRY_SHORT
1323             && (cfg->conf->retry_short != wiphy->retry_short)) {
1324                 cfg->conf->retry_short = wiphy->retry_short;
1325                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1326                 if (!err)
1327                         goto done;
1328         }
1329
1330 done:
1331         brcmf_dbg(TRACE, "Exit\n");
1332         return err;
1333 }
1334
1335 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1336 {
1337         memset(prof, 0, sizeof(*prof));
1338 }
1339
1340 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1341 {
1342         u16 reason;
1343
1344         switch (e->event_code) {
1345         case BRCMF_E_DEAUTH:
1346         case BRCMF_E_DEAUTH_IND:
1347         case BRCMF_E_DISASSOC_IND:
1348                 reason = e->reason;
1349                 break;
1350         case BRCMF_E_LINK:
1351         default:
1352                 reason = 0;
1353                 break;
1354         }
1355         return reason;
1356 }
1357
1358 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1359 {
1360         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1361         s32 err = 0;
1362
1363         brcmf_dbg(TRACE, "Enter\n");
1364
1365         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1366                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1367                 err = brcmf_fil_cmd_data_set(vif->ifp,
1368                                              BRCMF_C_DISASSOC, NULL, 0);
1369                 if (err) {
1370                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1371                 }
1372                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1373                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1374                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1375                                               true, GFP_KERNEL);
1376         }
1377         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1378         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1379         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1380         brcmf_dbg(TRACE, "Exit\n");
1381 }
1382
1383 static s32
1384 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1385                       struct cfg80211_ibss_params *params)
1386 {
1387         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1388         struct brcmf_if *ifp = netdev_priv(ndev);
1389         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1390         struct brcmf_join_params join_params;
1391         size_t join_params_size = 0;
1392         s32 err = 0;
1393         s32 wsec = 0;
1394         s32 bcnprd;
1395         u16 chanspec;
1396         u32 ssid_len;
1397
1398         brcmf_dbg(TRACE, "Enter\n");
1399         if (!check_vif_up(ifp->vif))
1400                 return -EIO;
1401
1402         if (params->ssid)
1403                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1404         else {
1405                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1406                 return -EOPNOTSUPP;
1407         }
1408
1409         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1410
1411         if (params->bssid)
1412                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1413         else
1414                 brcmf_dbg(CONN, "No BSSID specified\n");
1415
1416         if (params->chandef.chan)
1417                 brcmf_dbg(CONN, "channel: %d\n",
1418                           params->chandef.chan->center_freq);
1419         else
1420                 brcmf_dbg(CONN, "no channel specified\n");
1421
1422         if (params->channel_fixed)
1423                 brcmf_dbg(CONN, "fixed channel required\n");
1424         else
1425                 brcmf_dbg(CONN, "no fixed channel required\n");
1426
1427         if (params->ie && params->ie_len)
1428                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1429         else
1430                 brcmf_dbg(CONN, "no ie specified\n");
1431
1432         if (params->beacon_interval)
1433                 brcmf_dbg(CONN, "beacon interval: %d\n",
1434                           params->beacon_interval);
1435         else
1436                 brcmf_dbg(CONN, "no beacon interval specified\n");
1437
1438         if (params->basic_rates)
1439                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1440         else
1441                 brcmf_dbg(CONN, "no basic rates specified\n");
1442
1443         if (params->privacy)
1444                 brcmf_dbg(CONN, "privacy required\n");
1445         else
1446                 brcmf_dbg(CONN, "no privacy required\n");
1447
1448         /* Configure Privacy for starter */
1449         if (params->privacy)
1450                 wsec |= WEP_ENABLED;
1451
1452         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1453         if (err) {
1454                 brcmf_err("wsec failed (%d)\n", err);
1455                 goto done;
1456         }
1457
1458         /* Configure Beacon Interval for starter */
1459         if (params->beacon_interval)
1460                 bcnprd = params->beacon_interval;
1461         else
1462                 bcnprd = 100;
1463
1464         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1465         if (err) {
1466                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1467                 goto done;
1468         }
1469
1470         /* Configure required join parameter */
1471         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1472
1473         /* SSID */
1474         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1475         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1476         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1477         join_params_size = sizeof(join_params.ssid_le);
1478
1479         /* BSSID */
1480         if (params->bssid) {
1481                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1482                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1483                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1484         } else {
1485                 eth_broadcast_addr(join_params.params_le.bssid);
1486                 eth_zero_addr(profile->bssid);
1487         }
1488
1489         /* Channel */
1490         if (params->chandef.chan) {
1491                 u32 target_channel;
1492
1493                 cfg->channel =
1494                         ieee80211_frequency_to_channel(
1495                                 params->chandef.chan->center_freq);
1496                 if (params->channel_fixed) {
1497                         /* adding chanspec */
1498                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1499                                                        &params->chandef);
1500                         join_params.params_le.chanspec_list[0] =
1501                                 cpu_to_le16(chanspec);
1502                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1503                         join_params_size += sizeof(join_params.params_le);
1504                 }
1505
1506                 /* set channel for starter */
1507                 target_channel = cfg->channel;
1508                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1509                                             target_channel);
1510                 if (err) {
1511                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1512                         goto done;
1513                 }
1514         } else
1515                 cfg->channel = 0;
1516
1517         cfg->ibss_starter = false;
1518
1519
1520         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1521                                      &join_params, join_params_size);
1522         if (err) {
1523                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1524                 goto done;
1525         }
1526
1527 done:
1528         if (err)
1529                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1530         brcmf_dbg(TRACE, "Exit\n");
1531         return err;
1532 }
1533
1534 static s32
1535 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1536 {
1537         struct brcmf_if *ifp = netdev_priv(ndev);
1538
1539         brcmf_dbg(TRACE, "Enter\n");
1540         if (!check_vif_up(ifp->vif)) {
1541                 /* When driver is being unloaded, it can end up here. If an
1542                  * error is returned then later on a debug trace in the wireless
1543                  * core module will be printed. To avoid this 0 is returned.
1544                  */
1545                 return 0;
1546         }
1547
1548         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1549         brcmf_net_setcarrier(ifp, false);
1550
1551         brcmf_dbg(TRACE, "Exit\n");
1552
1553         return 0;
1554 }
1555
1556 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1557                                  struct cfg80211_connect_params *sme)
1558 {
1559         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1560         struct brcmf_cfg80211_security *sec;
1561         s32 val = 0;
1562         s32 err = 0;
1563
1564         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1565                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1566         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1567                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1568         else
1569                 val = WPA_AUTH_DISABLED;
1570         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1571         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1572         if (err) {
1573                 brcmf_err("set wpa_auth failed (%d)\n", err);
1574                 return err;
1575         }
1576         sec = &profile->sec;
1577         sec->wpa_versions = sme->crypto.wpa_versions;
1578         return err;
1579 }
1580
1581 static s32 brcmf_set_auth_type(struct net_device *ndev,
1582                                struct cfg80211_connect_params *sme)
1583 {
1584         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1585         struct brcmf_cfg80211_security *sec;
1586         s32 val = 0;
1587         s32 err = 0;
1588
1589         switch (sme->auth_type) {
1590         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1591                 val = 0;
1592                 brcmf_dbg(CONN, "open system\n");
1593                 break;
1594         case NL80211_AUTHTYPE_SHARED_KEY:
1595                 val = 1;
1596                 brcmf_dbg(CONN, "shared key\n");
1597                 break;
1598         default:
1599                 val = 2;
1600                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1601                 break;
1602         }
1603
1604         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1605         if (err) {
1606                 brcmf_err("set auth failed (%d)\n", err);
1607                 return err;
1608         }
1609         sec = &profile->sec;
1610         sec->auth_type = sme->auth_type;
1611         return err;
1612 }
1613
1614 static s32
1615 brcmf_set_wsec_mode(struct net_device *ndev,
1616                     struct cfg80211_connect_params *sme)
1617 {
1618         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1619         struct brcmf_cfg80211_security *sec;
1620         s32 pval = 0;
1621         s32 gval = 0;
1622         s32 wsec;
1623         s32 err = 0;
1624
1625         if (sme->crypto.n_ciphers_pairwise) {
1626                 switch (sme->crypto.ciphers_pairwise[0]) {
1627                 case WLAN_CIPHER_SUITE_WEP40:
1628                 case WLAN_CIPHER_SUITE_WEP104:
1629                         pval = WEP_ENABLED;
1630                         break;
1631                 case WLAN_CIPHER_SUITE_TKIP:
1632                         pval = TKIP_ENABLED;
1633                         break;
1634                 case WLAN_CIPHER_SUITE_CCMP:
1635                         pval = AES_ENABLED;
1636                         break;
1637                 case WLAN_CIPHER_SUITE_AES_CMAC:
1638                         pval = AES_ENABLED;
1639                         break;
1640                 default:
1641                         brcmf_err("invalid cipher pairwise (%d)\n",
1642                                   sme->crypto.ciphers_pairwise[0]);
1643                         return -EINVAL;
1644                 }
1645         }
1646         if (sme->crypto.cipher_group) {
1647                 switch (sme->crypto.cipher_group) {
1648                 case WLAN_CIPHER_SUITE_WEP40:
1649                 case WLAN_CIPHER_SUITE_WEP104:
1650                         gval = WEP_ENABLED;
1651                         break;
1652                 case WLAN_CIPHER_SUITE_TKIP:
1653                         gval = TKIP_ENABLED;
1654                         break;
1655                 case WLAN_CIPHER_SUITE_CCMP:
1656                         gval = AES_ENABLED;
1657                         break;
1658                 case WLAN_CIPHER_SUITE_AES_CMAC:
1659                         gval = AES_ENABLED;
1660                         break;
1661                 default:
1662                         brcmf_err("invalid cipher group (%d)\n",
1663                                   sme->crypto.cipher_group);
1664                         return -EINVAL;
1665                 }
1666         }
1667
1668         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1669         /* In case of privacy, but no security and WPS then simulate */
1670         /* setting AES. WPS-2.0 allows no security                   */
1671         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1672             sme->privacy)
1673                 pval = AES_ENABLED;
1674
1675         wsec = pval | gval;
1676         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1677         if (err) {
1678                 brcmf_err("error (%d)\n", err);
1679                 return err;
1680         }
1681
1682         sec = &profile->sec;
1683         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1684         sec->cipher_group = sme->crypto.cipher_group;
1685
1686         return err;
1687 }
1688
1689 static s32
1690 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1691 {
1692         struct brcmf_if *ifp = netdev_priv(ndev);
1693         s32 val;
1694         s32 err;
1695         const struct brcmf_tlv *rsn_ie;
1696         const u8 *ie;
1697         u32 ie_len;
1698         u32 offset;
1699         u16 rsn_cap;
1700         u32 mfp;
1701         u16 count;
1702
1703         if (!sme->crypto.n_akm_suites)
1704                 return 0;
1705
1706         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1707         if (err) {
1708                 brcmf_err("could not get wpa_auth (%d)\n", err);
1709                 return err;
1710         }
1711         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1712                 switch (sme->crypto.akm_suites[0]) {
1713                 case WLAN_AKM_SUITE_8021X:
1714                         val = WPA_AUTH_UNSPECIFIED;
1715                         break;
1716                 case WLAN_AKM_SUITE_PSK:
1717                         val = WPA_AUTH_PSK;
1718                         break;
1719                 default:
1720                         brcmf_err("invalid cipher group (%d)\n",
1721                                   sme->crypto.cipher_group);
1722                         return -EINVAL;
1723                 }
1724         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1725                 switch (sme->crypto.akm_suites[0]) {
1726                 case WLAN_AKM_SUITE_8021X:
1727                         val = WPA2_AUTH_UNSPECIFIED;
1728                         break;
1729                 case WLAN_AKM_SUITE_8021X_SHA256:
1730                         val = WPA2_AUTH_1X_SHA256;
1731                         break;
1732                 case WLAN_AKM_SUITE_PSK_SHA256:
1733                         val = WPA2_AUTH_PSK_SHA256;
1734                         break;
1735                 case WLAN_AKM_SUITE_PSK:
1736                         val = WPA2_AUTH_PSK;
1737                         break;
1738                 default:
1739                         brcmf_err("invalid cipher group (%d)\n",
1740                                   sme->crypto.cipher_group);
1741                         return -EINVAL;
1742                 }
1743         }
1744
1745         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1746                 goto skip_mfp_config;
1747         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1748          * IE will not be verified, just a quick search for MFP config
1749          */
1750         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1751                                   WLAN_EID_RSN);
1752         if (!rsn_ie)
1753                 goto skip_mfp_config;
1754         ie = (const u8 *)rsn_ie;
1755         ie_len = rsn_ie->len + TLV_HDR_LEN;
1756         /* Skip unicast suite */
1757         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1758         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1759                 goto skip_mfp_config;
1760         /* Skip multicast suite */
1761         count = ie[offset] + (ie[offset + 1] << 8);
1762         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1763         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1764                 goto skip_mfp_config;
1765         /* Skip auth key management suite(s) */
1766         count = ie[offset] + (ie[offset + 1] << 8);
1767         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1768         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1769                 goto skip_mfp_config;
1770         /* Ready to read capabilities */
1771         mfp = BRCMF_MFP_NONE;
1772         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1773         if (rsn_cap & RSN_CAP_MFPR_MASK)
1774                 mfp = BRCMF_MFP_REQUIRED;
1775         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1776                 mfp = BRCMF_MFP_CAPABLE;
1777         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1778
1779 skip_mfp_config:
1780         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1781         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1782         if (err) {
1783                 brcmf_err("could not set wpa_auth (%d)\n", err);
1784                 return err;
1785         }
1786
1787         return err;
1788 }
1789
1790 static s32
1791 brcmf_set_sharedkey(struct net_device *ndev,
1792                     struct cfg80211_connect_params *sme)
1793 {
1794         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1795         struct brcmf_cfg80211_security *sec;
1796         struct brcmf_wsec_key key;
1797         s32 val;
1798         s32 err = 0;
1799
1800         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1801
1802         if (sme->key_len == 0)
1803                 return 0;
1804
1805         sec = &profile->sec;
1806         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1807                   sec->wpa_versions, sec->cipher_pairwise);
1808
1809         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1810                 return 0;
1811
1812         if (!(sec->cipher_pairwise &
1813             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1814                 return 0;
1815
1816         memset(&key, 0, sizeof(key));
1817         key.len = (u32) sme->key_len;
1818         key.index = (u32) sme->key_idx;
1819         if (key.len > sizeof(key.data)) {
1820                 brcmf_err("Too long key length (%u)\n", key.len);
1821                 return -EINVAL;
1822         }
1823         memcpy(key.data, sme->key, key.len);
1824         key.flags = BRCMF_PRIMARY_KEY;
1825         switch (sec->cipher_pairwise) {
1826         case WLAN_CIPHER_SUITE_WEP40:
1827                 key.algo = CRYPTO_ALGO_WEP1;
1828                 break;
1829         case WLAN_CIPHER_SUITE_WEP104:
1830                 key.algo = CRYPTO_ALGO_WEP128;
1831                 break;
1832         default:
1833                 brcmf_err("Invalid algorithm (%d)\n",
1834                           sme->crypto.ciphers_pairwise[0]);
1835                 return -EINVAL;
1836         }
1837         /* Set the new key/index */
1838         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1839                   key.len, key.index, key.algo);
1840         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1841         err = send_key_to_dongle(netdev_priv(ndev), &key);
1842         if (err)
1843                 return err;
1844
1845         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1846                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1847                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1848                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1849                 if (err)
1850                         brcmf_err("set auth failed (%d)\n", err);
1851         }
1852         return err;
1853 }
1854
1855 static
1856 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1857                                            enum nl80211_auth_type type)
1858 {
1859         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1860             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1861                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1862                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1863         }
1864         return type;
1865 }
1866
1867 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1868                                 struct cfg80211_bss_selection *bss_select)
1869 {
1870         struct brcmf_join_pref_params join_pref_params[2];
1871         enum nl80211_band band;
1872         int err, i = 0;
1873
1874         join_pref_params[i].len = 2;
1875         join_pref_params[i].rssi_gain = 0;
1876
1877         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1878                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1879
1880         switch (bss_select->behaviour) {
1881         case __NL80211_BSS_SELECT_ATTR_INVALID:
1882                 brcmf_c_set_joinpref_default(ifp);
1883                 return;
1884         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1885                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1886                 band = bss_select->param.band_pref;
1887                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1888                 i++;
1889                 break;
1890         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1891                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1892                 band = bss_select->param.adjust.band;
1893                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1894                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1895                 i++;
1896                 break;
1897         case NL80211_BSS_SELECT_ATTR_RSSI:
1898         default:
1899                 break;
1900         }
1901         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1902         join_pref_params[i].len = 2;
1903         join_pref_params[i].rssi_gain = 0;
1904         join_pref_params[i].band = 0;
1905         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1906                                        sizeof(join_pref_params));
1907         if (err)
1908                 brcmf_err("Set join_pref error (%d)\n", err);
1909 }
1910
1911 static s32
1912 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1913                        struct cfg80211_connect_params *sme)
1914 {
1915         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1916         struct brcmf_if *ifp = netdev_priv(ndev);
1917         struct ieee80211_channel *chan = sme->channel;
1918         struct brcmf_join_params join_params;
1919         size_t join_params_size;
1920         const struct brcmf_tlv *rsn_ie;
1921         const struct brcmf_vs_tlv *wpa_ie;
1922         const void *ie;
1923         u32 ie_len;
1924         struct brcmf_ext_join_params_le *ext_join_params;
1925         u16 chanspec;
1926         s32 err = 0;
1927         u32 ssid_len;
1928
1929         brcmf_dbg(TRACE, "Enter\n");
1930         if (!check_vif_up(ifp->vif))
1931                 return -EIO;
1932
1933         if (!sme->ssid) {
1934                 brcmf_err("Invalid ssid\n");
1935                 return -EOPNOTSUPP;
1936         }
1937
1938         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1939                 /* A normal (non P2P) connection request setup. */
1940                 ie = NULL;
1941                 ie_len = 0;
1942                 /* find the WPA_IE */
1943                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1944                 if (wpa_ie) {
1945                         ie = wpa_ie;
1946                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1947                 } else {
1948                         /* find the RSN_IE */
1949                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1950                                                   sme->ie_len,
1951                                                   WLAN_EID_RSN);
1952                         if (rsn_ie) {
1953                                 ie = rsn_ie;
1954                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1955                         }
1956                 }
1957                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1958         }
1959
1960         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1961                                     sme->ie, sme->ie_len);
1962         if (err)
1963                 brcmf_err("Set Assoc REQ IE Failed\n");
1964         else
1965                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1966
1967         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1968
1969         if (chan) {
1970                 cfg->channel =
1971                         ieee80211_frequency_to_channel(chan->center_freq);
1972                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1973                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1974                           cfg->channel, chan->center_freq, chanspec);
1975         } else {
1976                 cfg->channel = 0;
1977                 chanspec = 0;
1978         }
1979
1980         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1981
1982         err = brcmf_set_wpa_version(ndev, sme);
1983         if (err) {
1984                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1985                 goto done;
1986         }
1987
1988         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1989         err = brcmf_set_auth_type(ndev, sme);
1990         if (err) {
1991                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1992                 goto done;
1993         }
1994
1995         err = brcmf_set_wsec_mode(ndev, sme);
1996         if (err) {
1997                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1998                 goto done;
1999         }
2000
2001         err = brcmf_set_key_mgmt(ndev, sme);
2002         if (err) {
2003                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2004                 goto done;
2005         }
2006
2007         err = brcmf_set_sharedkey(ndev, sme);
2008         if (err) {
2009                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2010                 goto done;
2011         }
2012
2013         /* Join with specific BSSID and cached SSID
2014          * If SSID is zero join based on BSSID only
2015          */
2016         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2017                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2018         if (cfg->channel)
2019                 join_params_size += sizeof(u16);
2020         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2021         if (ext_join_params == NULL) {
2022                 err = -ENOMEM;
2023                 goto done;
2024         }
2025         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2026         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2027         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2028         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2029                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2030                           ext_join_params->ssid_le.SSID, ssid_len);
2031
2032         /* Set up join scan parameters */
2033         ext_join_params->scan_le.scan_type = -1;
2034         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2035
2036         if (sme->bssid)
2037                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2038         else
2039                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2040
2041         if (cfg->channel) {
2042                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2043
2044                 ext_join_params->assoc_le.chanspec_list[0] =
2045                         cpu_to_le16(chanspec);
2046                 /* Increase dwell time to receive probe response or detect
2047                  * beacon from target AP at a noisy air only during connect
2048                  * command.
2049                  */
2050                 ext_join_params->scan_le.active_time =
2051                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2052                 ext_join_params->scan_le.passive_time =
2053                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2054                 /* To sync with presence period of VSDB GO send probe request
2055                  * more frequently. Probe request will be stopped when it gets
2056                  * probe response from target AP/GO.
2057                  */
2058                 ext_join_params->scan_le.nprobes =
2059                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2060                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2061         } else {
2062                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2063                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2064                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2065         }
2066
2067         brcmf_set_join_pref(ifp, &sme->bss_select);
2068
2069         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2070                                          join_params_size);
2071         kfree(ext_join_params);
2072         if (!err)
2073                 /* This is it. join command worked, we are done */
2074                 goto done;
2075
2076         /* join command failed, fallback to set ssid */
2077         memset(&join_params, 0, sizeof(join_params));
2078         join_params_size = sizeof(join_params.ssid_le);
2079
2080         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2081         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2082
2083         if (sme->bssid)
2084                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2085         else
2086                 eth_broadcast_addr(join_params.params_le.bssid);
2087
2088         if (cfg->channel) {
2089                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2090                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2091                 join_params_size += sizeof(join_params.params_le);
2092         }
2093         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2094                                      &join_params, join_params_size);
2095         if (err)
2096                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2097
2098 done:
2099         if (err)
2100                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2101         brcmf_dbg(TRACE, "Exit\n");
2102         return err;
2103 }
2104
2105 static s32
2106 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2107                        u16 reason_code)
2108 {
2109         struct brcmf_if *ifp = netdev_priv(ndev);
2110         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2111         struct brcmf_scb_val_le scbval;
2112         s32 err = 0;
2113
2114         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2115         if (!check_vif_up(ifp->vif))
2116                 return -EIO;
2117
2118         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2119         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2120         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2121
2122         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2123         scbval.val = cpu_to_le32(reason_code);
2124         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2125                                      &scbval, sizeof(scbval));
2126         if (err)
2127                 brcmf_err("error (%d)\n", err);
2128
2129         brcmf_dbg(TRACE, "Exit\n");
2130         return err;
2131 }
2132
2133 static s32
2134 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2135                             enum nl80211_tx_power_setting type, s32 mbm)
2136 {
2137         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2138         struct net_device *ndev = cfg_to_ndev(cfg);
2139         struct brcmf_if *ifp = netdev_priv(ndev);
2140         s32 err;
2141         s32 disable;
2142         u32 qdbm = 127;
2143
2144         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2145         if (!check_vif_up(ifp->vif))
2146                 return -EIO;
2147
2148         switch (type) {
2149         case NL80211_TX_POWER_AUTOMATIC:
2150                 break;
2151         case NL80211_TX_POWER_LIMITED:
2152         case NL80211_TX_POWER_FIXED:
2153                 if (mbm < 0) {
2154                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2155                         err = -EINVAL;
2156                         goto done;
2157                 }
2158                 qdbm =  MBM_TO_DBM(4 * mbm);
2159                 if (qdbm > 127)
2160                         qdbm = 127;
2161                 qdbm |= WL_TXPWR_OVERRIDE;
2162                 break;
2163         default:
2164                 brcmf_err("Unsupported type %d\n", type);
2165                 err = -EINVAL;
2166                 goto done;
2167         }
2168         /* Make sure radio is off or on as far as software is concerned */
2169         disable = WL_RADIO_SW_DISABLE << 16;
2170         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2171         if (err)
2172                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2173
2174         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2175         if (err)
2176                 brcmf_err("qtxpower error (%d)\n", err);
2177
2178 done:
2179         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2180         return err;
2181 }
2182
2183 static s32
2184 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2185                             s32 *dbm)
2186 {
2187         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2188         struct net_device *ndev = cfg_to_ndev(cfg);
2189         struct brcmf_if *ifp = netdev_priv(ndev);
2190         s32 qdbm = 0;
2191         s32 err;
2192
2193         brcmf_dbg(TRACE, "Enter\n");
2194         if (!check_vif_up(ifp->vif))
2195                 return -EIO;
2196
2197         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2198         if (err) {
2199                 brcmf_err("error (%d)\n", err);
2200                 goto done;
2201         }
2202         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2203
2204 done:
2205         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2206         return err;
2207 }
2208
2209 static s32
2210 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2211                                   u8 key_idx, bool unicast, bool multicast)
2212 {
2213         struct brcmf_if *ifp = netdev_priv(ndev);
2214         u32 index;
2215         u32 wsec;
2216         s32 err = 0;
2217
2218         brcmf_dbg(TRACE, "Enter\n");
2219         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2220         if (!check_vif_up(ifp->vif))
2221                 return -EIO;
2222
2223         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2224         if (err) {
2225                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2226                 goto done;
2227         }
2228
2229         if (wsec & WEP_ENABLED) {
2230                 /* Just select a new current key */
2231                 index = key_idx;
2232                 err = brcmf_fil_cmd_int_set(ifp,
2233                                             BRCMF_C_SET_KEY_PRIMARY, index);
2234                 if (err)
2235                         brcmf_err("error (%d)\n", err);
2236         }
2237 done:
2238         brcmf_dbg(TRACE, "Exit\n");
2239         return err;
2240 }
2241
2242 static s32
2243 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2244                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2245 {
2246         struct brcmf_if *ifp = netdev_priv(ndev);
2247         struct brcmf_wsec_key *key;
2248         s32 err;
2249
2250         brcmf_dbg(TRACE, "Enter\n");
2251         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2252
2253         if (!check_vif_up(ifp->vif))
2254                 return -EIO;
2255
2256         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2257                 /* we ignore this key index in this case */
2258                 return -EINVAL;
2259         }
2260
2261         key = &ifp->vif->profile.key[key_idx];
2262
2263         if (key->algo == CRYPTO_ALGO_OFF) {
2264                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2265                 return -EINVAL;
2266         }
2267
2268         memset(key, 0, sizeof(*key));
2269         key->index = (u32)key_idx;
2270         key->flags = BRCMF_PRIMARY_KEY;
2271
2272         /* Clear the key/index */
2273         err = send_key_to_dongle(ifp, key);
2274
2275         brcmf_dbg(TRACE, "Exit\n");
2276         return err;
2277 }
2278
2279 static s32
2280 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2281                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2282                        struct key_params *params)
2283 {
2284         struct brcmf_if *ifp = netdev_priv(ndev);
2285         struct brcmf_wsec_key *key;
2286         s32 val;
2287         s32 wsec;
2288         s32 err;
2289         u8 keybuf[8];
2290         bool ext_key;
2291
2292         brcmf_dbg(TRACE, "Enter\n");
2293         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2294         if (!check_vif_up(ifp->vif))
2295                 return -EIO;
2296
2297         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2298                 /* we ignore this key index in this case */
2299                 brcmf_err("invalid key index (%d)\n", key_idx);
2300                 return -EINVAL;
2301         }
2302
2303         if (params->key_len == 0)
2304                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2305                                               mac_addr);
2306
2307         if (params->key_len > sizeof(key->data)) {
2308                 brcmf_err("Too long key length (%u)\n", params->key_len);
2309                 return -EINVAL;
2310         }
2311
2312         ext_key = false;
2313         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2314             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2315                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2316                 ext_key = true;
2317         }
2318
2319         key = &ifp->vif->profile.key[key_idx];
2320         memset(key, 0, sizeof(*key));
2321         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2322                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2323         key->len = params->key_len;
2324         key->index = key_idx;
2325         memcpy(key->data, params->key, key->len);
2326         if (!ext_key)
2327                 key->flags = BRCMF_PRIMARY_KEY;
2328
2329         switch (params->cipher) {
2330         case WLAN_CIPHER_SUITE_WEP40:
2331                 key->algo = CRYPTO_ALGO_WEP1;
2332                 val = WEP_ENABLED;
2333                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2334                 break;
2335         case WLAN_CIPHER_SUITE_WEP104:
2336                 key->algo = CRYPTO_ALGO_WEP128;
2337                 val = WEP_ENABLED;
2338                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2339                 break;
2340         case WLAN_CIPHER_SUITE_TKIP:
2341                 if (!brcmf_is_apmode(ifp->vif)) {
2342                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2343                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2344                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2345                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2346                 }
2347                 key->algo = CRYPTO_ALGO_TKIP;
2348                 val = TKIP_ENABLED;
2349                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2350                 break;
2351         case WLAN_CIPHER_SUITE_AES_CMAC:
2352                 key->algo = CRYPTO_ALGO_AES_CCM;
2353                 val = AES_ENABLED;
2354                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2355                 break;
2356         case WLAN_CIPHER_SUITE_CCMP:
2357                 key->algo = CRYPTO_ALGO_AES_CCM;
2358                 val = AES_ENABLED;
2359                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2360                 break;
2361         default:
2362                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2363                 err = -EINVAL;
2364                 goto done;
2365         }
2366
2367         err = send_key_to_dongle(ifp, key);
2368         if (ext_key || err)
2369                 goto done;
2370
2371         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2372         if (err) {
2373                 brcmf_err("get wsec error (%d)\n", err);
2374                 goto done;
2375         }
2376         wsec |= val;
2377         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2378         if (err) {
2379                 brcmf_err("set wsec error (%d)\n", err);
2380                 goto done;
2381         }
2382
2383 done:
2384         brcmf_dbg(TRACE, "Exit\n");
2385         return err;
2386 }
2387
2388 static s32
2389 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2390                        bool pairwise, const u8 *mac_addr, void *cookie,
2391                        void (*callback)(void *cookie,
2392                                         struct key_params *params))
2393 {
2394         struct key_params params;
2395         struct brcmf_if *ifp = netdev_priv(ndev);
2396         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2397         struct brcmf_cfg80211_security *sec;
2398         s32 wsec;
2399         s32 err = 0;
2400
2401         brcmf_dbg(TRACE, "Enter\n");
2402         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2403         if (!check_vif_up(ifp->vif))
2404                 return -EIO;
2405
2406         memset(&params, 0, sizeof(params));
2407
2408         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2409         if (err) {
2410                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2411                 /* Ignore this error, may happen during DISASSOC */
2412                 err = -EAGAIN;
2413                 goto done;
2414         }
2415         if (wsec & WEP_ENABLED) {
2416                 sec = &profile->sec;
2417                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2418                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2419                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2420                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2421                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2422                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2423                 }
2424         } else if (wsec & TKIP_ENABLED) {
2425                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2426                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2427         } else if (wsec & AES_ENABLED) {
2428                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2429                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2430         } else  {
2431                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2432                 err = -EINVAL;
2433                 goto done;
2434         }
2435         callback(cookie, &params);
2436
2437 done:
2438         brcmf_dbg(TRACE, "Exit\n");
2439         return err;
2440 }
2441
2442 static s32
2443 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2444                                        struct net_device *ndev, u8 key_idx)
2445 {
2446         struct brcmf_if *ifp = netdev_priv(ndev);
2447
2448         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2449
2450         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2451                 return 0;
2452
2453         brcmf_dbg(INFO, "Not supported\n");
2454
2455         return -EOPNOTSUPP;
2456 }
2457
2458 static void
2459 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2460 {
2461         s32 err;
2462         u8 key_idx;
2463         struct brcmf_wsec_key *key;
2464         s32 wsec;
2465
2466         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2467                 key = &ifp->vif->profile.key[key_idx];
2468                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2469                     (key->algo == CRYPTO_ALGO_WEP128))
2470                         break;
2471         }
2472         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2473                 return;
2474
2475         err = send_key_to_dongle(ifp, key);
2476         if (err) {
2477                 brcmf_err("Setting WEP key failed (%d)\n", err);
2478                 return;
2479         }
2480         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2481         if (err) {
2482                 brcmf_err("get wsec error (%d)\n", err);
2483                 return;
2484         }
2485         wsec |= WEP_ENABLED;
2486         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2487         if (err)
2488                 brcmf_err("set wsec error (%d)\n", err);
2489 }
2490
2491 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2492 {
2493         struct nl80211_sta_flag_update *sfu;
2494
2495         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2496         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2497         sfu = &si->sta_flags;
2498         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2499                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2500                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2501                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2502         if (fw_sta_flags & BRCMF_STA_WME)
2503                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2504         if (fw_sta_flags & BRCMF_STA_AUTHE)
2505                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2506         if (fw_sta_flags & BRCMF_STA_ASSOC)
2507                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2508         if (fw_sta_flags & BRCMF_STA_AUTHO)
2509                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2510 }
2511
2512 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2513 {
2514         struct {
2515                 __le32 len;
2516                 struct brcmf_bss_info_le bss_le;
2517         } *buf;
2518         u16 capability;
2519         int err;
2520
2521         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2522         if (!buf)
2523                 return;
2524
2525         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2526         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2527                                      WL_BSS_INFO_MAX);
2528         if (err) {
2529                 brcmf_err("Failed to get bss info (%d)\n", err);
2530                 goto out_kfree;
2531         }
2532         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2533         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2534         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2535         capability = le16_to_cpu(buf->bss_le.capability);
2536         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2537                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2538         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2539                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2540         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2541                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2542
2543 out_kfree:
2544         kfree(buf);
2545 }
2546
2547 static s32
2548 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2549                                 struct station_info *sinfo)
2550 {
2551         struct brcmf_scb_val_le scbval;
2552         struct brcmf_pktcnt_le pktcnt;
2553         s32 err;
2554         u32 rate;
2555         u32 rssi;
2556
2557         /* Get the current tx rate */
2558         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2559         if (err < 0) {
2560                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2561                 return err;
2562         }
2563         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2564         sinfo->txrate.legacy = rate * 5;
2565
2566         memset(&scbval, 0, sizeof(scbval));
2567         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2568                                      sizeof(scbval));
2569         if (err) {
2570                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2571                 return err;
2572         }
2573         rssi = le32_to_cpu(scbval.val);
2574         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2575         sinfo->signal = rssi;
2576
2577         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2578                                      sizeof(pktcnt));
2579         if (err) {
2580                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2581                 return err;
2582         }
2583         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2584                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2585                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2586                          BIT(NL80211_STA_INFO_TX_FAILED);
2587         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2588         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2589         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2590         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2591
2592         return 0;
2593 }
2594
2595 static s32
2596 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2597                            const u8 *mac, struct station_info *sinfo)
2598 {
2599         struct brcmf_if *ifp = netdev_priv(ndev);
2600         struct brcmf_scb_val_le scb_val;
2601         s32 err = 0;
2602         struct brcmf_sta_info_le sta_info_le;
2603         u32 sta_flags;
2604         u32 is_tdls_peer;
2605         s32 total_rssi;
2606         s32 count_rssi;
2607         int rssi;
2608         u32 i;
2609
2610         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2611         if (!check_vif_up(ifp->vif))
2612                 return -EIO;
2613
2614         if (brcmf_is_ibssmode(ifp->vif))
2615                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2616
2617         memset(&sta_info_le, 0, sizeof(sta_info_le));
2618         memcpy(&sta_info_le, mac, ETH_ALEN);
2619         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2620                                        &sta_info_le,
2621                                        sizeof(sta_info_le));
2622         is_tdls_peer = !err;
2623         if (err) {
2624                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2625                                                &sta_info_le,
2626                                                sizeof(sta_info_le));
2627                 if (err < 0) {
2628                         brcmf_err("GET STA INFO failed, %d\n", err);
2629                         goto done;
2630                 }
2631         }
2632         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2633         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2634         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2635         sta_flags = le32_to_cpu(sta_info_le.flags);
2636         brcmf_convert_sta_flags(sta_flags, sinfo);
2637         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2638         if (is_tdls_peer)
2639                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2640         else
2641                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2642         if (sta_flags & BRCMF_STA_ASSOC) {
2643                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2644                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2645                 brcmf_fill_bss_param(ifp, sinfo);
2646         }
2647         if (sta_flags & BRCMF_STA_SCBSTATS) {
2648                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2649                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2650                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2651                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2652                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2653                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2654                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2655                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2656                 if (sinfo->tx_packets) {
2657                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2658                         sinfo->txrate.legacy =
2659                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2660                 }
2661                 if (sinfo->rx_packets) {
2662                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2663                         sinfo->rxrate.legacy =
2664                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2665                 }
2666                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2667                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2668                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2669                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2670                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2671                 }
2672                 total_rssi = 0;
2673                 count_rssi = 0;
2674                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2675                         if (sta_info_le.rssi[i]) {
2676                                 sinfo->chain_signal_avg[count_rssi] =
2677                                         sta_info_le.rssi[i];
2678                                 sinfo->chain_signal[count_rssi] =
2679                                         sta_info_le.rssi[i];
2680                                 total_rssi += sta_info_le.rssi[i];
2681                                 count_rssi++;
2682                         }
2683                 }
2684                 if (count_rssi) {
2685                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2686                         sinfo->chains = count_rssi;
2687
2688                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2689                         total_rssi /= count_rssi;
2690                         sinfo->signal = total_rssi;
2691                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2692                         &ifp->vif->sme_state)) {
2693                         memset(&scb_val, 0, sizeof(scb_val));
2694                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2695                                                      &scb_val, sizeof(scb_val));
2696                         if (err) {
2697                                 brcmf_err("Could not get rssi (%d)\n", err);
2698                                 goto done;
2699                         } else {
2700                                 rssi = le32_to_cpu(scb_val.val);
2701                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2702                                 sinfo->signal = rssi;
2703                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2704                         }
2705                 }
2706         }
2707 done:
2708         brcmf_dbg(TRACE, "Exit\n");
2709         return err;
2710 }
2711
2712 static int
2713 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2714                             int idx, u8 *mac, struct station_info *sinfo)
2715 {
2716         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2717         struct brcmf_if *ifp = netdev_priv(ndev);
2718         s32 err;
2719
2720         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2721
2722         if (idx == 0) {
2723                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2724                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2725                                              &cfg->assoclist,
2726                                              sizeof(cfg->assoclist));
2727                 if (err) {
2728                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2729                                   err);
2730                         cfg->assoclist.count = 0;
2731                         return -EOPNOTSUPP;
2732                 }
2733         }
2734         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2735                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2736                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2737         }
2738         return -ENOENT;
2739 }
2740
2741 static s32
2742 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2743                            bool enabled, s32 timeout)
2744 {
2745         s32 pm;
2746         s32 err = 0;
2747         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2748         struct brcmf_if *ifp = netdev_priv(ndev);
2749
2750         brcmf_dbg(TRACE, "Enter\n");
2751
2752         /*
2753          * Powersave enable/disable request is coming from the
2754          * cfg80211 even before the interface is up. In that
2755          * scenario, driver will be storing the power save
2756          * preference in cfg struct to apply this to
2757          * FW later while initializing the dongle
2758          */
2759         cfg->pwr_save = enabled;
2760         if (!check_vif_up(ifp->vif)) {
2761
2762                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2763                 goto done;
2764         }
2765
2766         pm = enabled ? PM_FAST : PM_OFF;
2767         /* Do not enable the power save after assoc if it is a p2p interface */
2768         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2769                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2770                 pm = PM_OFF;
2771         }
2772         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2773
2774         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2775         if (err) {
2776                 if (err == -ENODEV)
2777                         brcmf_err("net_device is not ready yet\n");
2778                 else
2779                         brcmf_err("error (%d)\n", err);
2780         }
2781 done:
2782         brcmf_dbg(TRACE, "Exit\n");
2783         return err;
2784 }
2785
2786 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2787                                    struct brcmf_bss_info_le *bi)
2788 {
2789         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2790         struct ieee80211_channel *notify_channel;
2791         struct cfg80211_bss *bss;
2792         struct ieee80211_supported_band *band;
2793         struct brcmu_chan ch;
2794         u16 channel;
2795         u32 freq;
2796         u16 notify_capability;
2797         u16 notify_interval;
2798         u8 *notify_ie;
2799         size_t notify_ielen;
2800         s32 notify_signal;
2801
2802         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2803                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2804                 return 0;
2805         }
2806
2807         if (!bi->ctl_ch) {
2808                 ch.chspec = le16_to_cpu(bi->chanspec);
2809                 cfg->d11inf.decchspec(&ch);
2810                 bi->ctl_ch = ch.control_ch_num;
2811         }
2812         channel = bi->ctl_ch;
2813
2814         if (channel <= CH_MAX_2G_CHANNEL)
2815                 band = wiphy->bands[NL80211_BAND_2GHZ];
2816         else
2817                 band = wiphy->bands[NL80211_BAND_5GHZ];
2818
2819         freq = ieee80211_channel_to_frequency(channel, band->band);
2820         notify_channel = ieee80211_get_channel(wiphy, freq);
2821
2822         notify_capability = le16_to_cpu(bi->capability);
2823         notify_interval = le16_to_cpu(bi->beacon_period);
2824         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2825         notify_ielen = le32_to_cpu(bi->ie_length);
2826         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2827
2828         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2829         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2830         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2831         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2832         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2833
2834         bss = cfg80211_inform_bss(wiphy, notify_channel,
2835                                   CFG80211_BSS_FTYPE_UNKNOWN,
2836                                   (const u8 *)bi->BSSID,
2837                                   0, notify_capability,
2838                                   notify_interval, notify_ie,
2839                                   notify_ielen, notify_signal,
2840                                   GFP_KERNEL);
2841
2842         if (!bss)
2843                 return -ENOMEM;
2844
2845         cfg80211_put_bss(wiphy, bss);
2846
2847         return 0;
2848 }
2849
2850 static struct brcmf_bss_info_le *
2851 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2852 {
2853         if (bss == NULL)
2854                 return list->bss_info_le;
2855         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2856                                             le32_to_cpu(bss->length));
2857 }
2858
2859 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2860 {
2861         struct brcmf_scan_results *bss_list;
2862         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2863         s32 err = 0;
2864         int i;
2865
2866         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2867         if (bss_list->count != 0 &&
2868             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2869                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2870                           bss_list->version);
2871                 return -EOPNOTSUPP;
2872         }
2873         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2874         for (i = 0; i < bss_list->count; i++) {
2875                 bi = next_bss_le(bss_list, bi);
2876                 err = brcmf_inform_single_bss(cfg, bi);
2877                 if (err)
2878                         break;
2879         }
2880         return err;
2881 }
2882
2883 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2884                              struct net_device *ndev, const u8 *bssid)
2885 {
2886         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2887         struct ieee80211_channel *notify_channel;
2888         struct brcmf_bss_info_le *bi = NULL;
2889         struct ieee80211_supported_band *band;
2890         struct cfg80211_bss *bss;
2891         struct brcmu_chan ch;
2892         u8 *buf = NULL;
2893         s32 err = 0;
2894         u32 freq;
2895         u16 notify_capability;
2896         u16 notify_interval;
2897         u8 *notify_ie;
2898         size_t notify_ielen;
2899         s32 notify_signal;
2900
2901         brcmf_dbg(TRACE, "Enter\n");
2902
2903         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2904         if (buf == NULL) {
2905                 err = -ENOMEM;
2906                 goto CleanUp;
2907         }
2908
2909         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2910
2911         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2912                                      buf, WL_BSS_INFO_MAX);
2913         if (err) {
2914                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2915                 goto CleanUp;
2916         }
2917
2918         bi = (struct brcmf_bss_info_le *)(buf + 4);
2919
2920         ch.chspec = le16_to_cpu(bi->chanspec);
2921         cfg->d11inf.decchspec(&ch);
2922
2923         if (ch.band == BRCMU_CHAN_BAND_2G)
2924                 band = wiphy->bands[NL80211_BAND_2GHZ];
2925         else
2926                 band = wiphy->bands[NL80211_BAND_5GHZ];
2927
2928         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2929         cfg->channel = freq;
2930         notify_channel = ieee80211_get_channel(wiphy, freq);
2931
2932         notify_capability = le16_to_cpu(bi->capability);
2933         notify_interval = le16_to_cpu(bi->beacon_period);
2934         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2935         notify_ielen = le32_to_cpu(bi->ie_length);
2936         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2937
2938         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2939         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2940         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2941         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2942
2943         bss = cfg80211_inform_bss(wiphy, notify_channel,
2944                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2945                                   notify_capability, notify_interval,
2946                                   notify_ie, notify_ielen, notify_signal,
2947                                   GFP_KERNEL);
2948
2949         if (!bss) {
2950                 err = -ENOMEM;
2951                 goto CleanUp;
2952         }
2953
2954         cfg80211_put_bss(wiphy, bss);
2955
2956 CleanUp:
2957
2958         kfree(buf);
2959
2960         brcmf_dbg(TRACE, "Exit\n");
2961
2962         return err;
2963 }
2964
2965 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2966                                  struct brcmf_if *ifp)
2967 {
2968         struct brcmf_bss_info_le *bi;
2969         const struct brcmf_tlv *tim;
2970         u16 beacon_interval;
2971         u8 dtim_period;
2972         size_t ie_len;
2973         u8 *ie;
2974         s32 err = 0;
2975
2976         brcmf_dbg(TRACE, "Enter\n");
2977         if (brcmf_is_ibssmode(ifp->vif))
2978                 return err;
2979
2980         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2981         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2982                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2983         if (err) {
2984                 brcmf_err("Could not get bss info %d\n", err);
2985                 goto update_bss_info_out;
2986         }
2987
2988         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2989         err = brcmf_inform_single_bss(cfg, bi);
2990         if (err)
2991                 goto update_bss_info_out;
2992
2993         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2994         ie_len = le32_to_cpu(bi->ie_length);
2995         beacon_interval = le16_to_cpu(bi->beacon_period);
2996
2997         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2998         if (tim)
2999                 dtim_period = tim->data[1];
3000         else {
3001                 /*
3002                 * active scan was done so we could not get dtim
3003                 * information out of probe response.
3004                 * so we speficially query dtim information to dongle.
3005                 */
3006                 u32 var;
3007                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3008                 if (err) {
3009                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3010                         goto update_bss_info_out;
3011                 }
3012                 dtim_period = (u8)var;
3013         }
3014
3015 update_bss_info_out:
3016         brcmf_dbg(TRACE, "Exit");
3017         return err;
3018 }
3019
3020 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3021 {
3022         struct escan_info *escan = &cfg->escan_info;
3023
3024         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3025         if (cfg->scan_request) {
3026                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3027                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3028         }
3029         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3030         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3031 }
3032
3033 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3034 {
3035         struct brcmf_cfg80211_info *cfg =
3036                         container_of(work, struct brcmf_cfg80211_info,
3037                                      escan_timeout_work);
3038
3039         brcmf_inform_bss(cfg);
3040         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3041 }
3042
3043 static void brcmf_escan_timeout(unsigned long data)
3044 {
3045         struct brcmf_cfg80211_info *cfg =
3046                         (struct brcmf_cfg80211_info *)data;
3047
3048         if (cfg->scan_request) {
3049                 brcmf_err("timer expired\n");
3050                 schedule_work(&cfg->escan_timeout_work);
3051         }
3052 }
3053
3054 static s32
3055 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3056                               struct brcmf_bss_info_le *bss,
3057                               struct brcmf_bss_info_le *bss_info_le)
3058 {
3059         struct brcmu_chan ch_bss, ch_bss_info_le;
3060
3061         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3062         cfg->d11inf.decchspec(&ch_bss);
3063         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3064         cfg->d11inf.decchspec(&ch_bss_info_le);
3065
3066         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3067                 ch_bss.band == ch_bss_info_le.band &&
3068                 bss_info_le->SSID_len == bss->SSID_len &&
3069                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3070                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3071                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3072                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3073                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3074
3075                         /* preserve max RSSI if the measurements are
3076                         * both on-channel or both off-channel
3077                         */
3078                         if (bss_info_rssi > bss_rssi)
3079                                 bss->RSSI = bss_info_le->RSSI;
3080                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3081                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3082                         /* preserve the on-channel rssi measurement
3083                         * if the new measurement is off channel
3084                         */
3085                         bss->RSSI = bss_info_le->RSSI;
3086                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3087                 }
3088                 return 1;
3089         }
3090         return 0;
3091 }
3092
3093 static s32
3094 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3095                              const struct brcmf_event_msg *e, void *data)
3096 {
3097         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3098         s32 status;
3099         struct brcmf_escan_result_le *escan_result_le;
3100         struct brcmf_bss_info_le *bss_info_le;
3101         struct brcmf_bss_info_le *bss = NULL;
3102         u32 bi_length;
3103         struct brcmf_scan_results *list;
3104         u32 i;
3105         bool aborted;
3106
3107         status = e->status;
3108
3109         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3110                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3111                 return -EPERM;
3112         }
3113
3114         if (status == BRCMF_E_STATUS_PARTIAL) {
3115                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3116                 escan_result_le = (struct brcmf_escan_result_le *) data;
3117                 if (!escan_result_le) {
3118                         brcmf_err("Invalid escan result (NULL pointer)\n");
3119                         goto exit;
3120                 }
3121                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3122                         brcmf_err("Invalid bss_count %d: ignoring\n",
3123                                   escan_result_le->bss_count);
3124                         goto exit;
3125                 }
3126                 bss_info_le = &escan_result_le->bss_info_le;
3127
3128                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3129                         goto exit;
3130
3131                 if (!cfg->scan_request) {
3132                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3133                         goto exit;
3134                 }
3135
3136                 bi_length = le32_to_cpu(bss_info_le->length);
3137                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
3138                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
3139                         brcmf_err("Invalid bss_info length %d: ignoring\n",
3140                                   bi_length);
3141                         goto exit;
3142                 }
3143
3144                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3145                                         BIT(NL80211_IFTYPE_ADHOC))) {
3146                         if (le16_to_cpu(bss_info_le->capability) &
3147                                                 WLAN_CAPABILITY_IBSS) {
3148                                 brcmf_err("Ignoring IBSS result\n");
3149                                 goto exit;
3150                         }
3151                 }
3152
3153                 list = (struct brcmf_scan_results *)
3154                                 cfg->escan_info.escan_buf;
3155                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3156                         brcmf_err("Buffer is too small: ignoring\n");
3157                         goto exit;
3158                 }
3159
3160                 for (i = 0; i < list->count; i++) {
3161                         bss = bss ? (struct brcmf_bss_info_le *)
3162                                 ((unsigned char *)bss +
3163                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3164                         if (brcmf_compare_update_same_bss(cfg, bss,
3165                                                           bss_info_le))
3166                                 goto exit;
3167                 }
3168                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3169                        bi_length);
3170                 list->version = le32_to_cpu(bss_info_le->version);
3171                 list->buflen += bi_length;
3172                 list->count++;
3173         } else {
3174                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3175                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3176                         goto exit;
3177                 if (cfg->scan_request) {
3178                         brcmf_inform_bss(cfg);
3179                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3180                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3181                 } else
3182                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3183                                   status);
3184         }
3185 exit:
3186         return 0;
3187 }
3188
3189 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3190 {
3191         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3192                             brcmf_cfg80211_escan_handler);
3193         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3194         /* Init scan_timeout timer */
3195         init_timer(&cfg->escan_timeout);
3196         cfg->escan_timeout.data = (unsigned long) cfg;
3197         cfg->escan_timeout.function = brcmf_escan_timeout;
3198         INIT_WORK(&cfg->escan_timeout_work,
3199                   brcmf_cfg80211_escan_timeout_worker);
3200 }
3201
3202 /* PFN result doesn't have all the info which are required by the supplicant
3203  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3204  * via wl_inform_single_bss in the required format. Escan does require the
3205  * scan request in the form of cfg80211_scan_request. For timebeing, create
3206  * cfg80211_scan_request one out of the received PNO event.
3207  */
3208 static s32
3209 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3210                                 const struct brcmf_event_msg *e, void *data)
3211 {
3212         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3213         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3214         struct cfg80211_scan_request *request = NULL;
3215         struct cfg80211_ssid *ssid = NULL;
3216         struct ieee80211_channel *channel = NULL;
3217         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3218         int err = 0;
3219         int channel_req = 0;
3220         int band = 0;
3221         struct brcmf_pno_scanresults_le *pfn_result;
3222         u32 result_count;
3223         u32 status;
3224
3225         brcmf_dbg(SCAN, "Enter\n");
3226
3227         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3228                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3229                 return 0;
3230         }
3231
3232         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3233                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3234                 return 0;
3235         }
3236
3237         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3238         result_count = le32_to_cpu(pfn_result->count);
3239         status = le32_to_cpu(pfn_result->status);
3240
3241         /* PFN event is limited to fit 512 bytes so we may get
3242          * multiple NET_FOUND events. For now place a warning here.
3243          */
3244         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3245         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3246         if (result_count > 0) {
3247                 int i;
3248
3249                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3250                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3251                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3252                 if (!request || !ssid || !channel) {
3253                         err = -ENOMEM;
3254                         goto out_err;
3255                 }
3256
3257                 request->wiphy = wiphy;
3258                 data += sizeof(struct brcmf_pno_scanresults_le);
3259                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3260
3261                 for (i = 0; i < result_count; i++) {
3262                         netinfo = &netinfo_start[i];
3263                         if (!netinfo) {
3264                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3265                                           i);
3266                                 err = -EINVAL;
3267                                 goto out_err;
3268                         }
3269
3270                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3271                                   netinfo->SSID, netinfo->channel);
3272                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3273                         ssid[i].ssid_len = netinfo->SSID_len;
3274                         request->n_ssids++;
3275
3276                         channel_req = netinfo->channel;
3277                         if (channel_req <= CH_MAX_2G_CHANNEL)
3278                                 band = NL80211_BAND_2GHZ;
3279                         else
3280                                 band = NL80211_BAND_5GHZ;
3281                         channel[i].center_freq =
3282                                 ieee80211_channel_to_frequency(channel_req,
3283                                                                band);
3284                         channel[i].band = band;
3285                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3286                         request->channels[i] = &channel[i];
3287                         request->n_channels++;
3288                 }
3289
3290                 /* assign parsed ssid array */
3291                 if (request->n_ssids)
3292                         request->ssids = &ssid[0];
3293
3294                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3295                         /* Abort any on-going scan */
3296                         brcmf_abort_scanning(cfg);
3297                 }
3298
3299                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3300                 cfg->escan_info.run = brcmf_run_escan;
3301                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3302                 if (err) {
3303                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3304                         goto out_err;
3305                 }
3306                 cfg->sched_escan = true;
3307                 cfg->scan_request = request;
3308         } else {
3309                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3310                 goto out_err;
3311         }
3312
3313         kfree(ssid);
3314         kfree(channel);
3315         kfree(request);
3316         return 0;
3317
3318 out_err:
3319         kfree(ssid);
3320         kfree(channel);
3321         kfree(request);
3322         cfg80211_sched_scan_stopped(wiphy);
3323         return err;
3324 }
3325
3326 static int brcmf_dev_pno_clean(struct net_device *ndev)
3327 {
3328         int ret;
3329
3330         /* Disable pfn */
3331         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3332         if (ret == 0) {
3333                 /* clear pfn */
3334                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3335                                                NULL, 0);
3336         }
3337         if (ret < 0)
3338                 brcmf_err("failed code %d\n", ret);
3339
3340         return ret;
3341 }
3342
3343 static int brcmf_dev_pno_config(struct brcmf_if *ifp,
3344                                 struct cfg80211_sched_scan_request *request)
3345 {
3346         struct brcmf_pno_param_le pfn_param;
3347         struct brcmf_pno_macaddr_le pfn_mac;
3348         s32 err;
3349         u8 *mac_mask;
3350         int i;
3351
3352         memset(&pfn_param, 0, sizeof(pfn_param));
3353         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3354
3355         /* set extra pno params */
3356         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3357         pfn_param.repeat = BRCMF_PNO_REPEAT;
3358         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3359
3360         /* set up pno scan fr */
3361         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3362
3363         err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
3364                                        sizeof(pfn_param));
3365         if (err) {
3366                 brcmf_err("pfn_set failed, err=%d\n", err);
3367                 return err;
3368         }
3369
3370         /* Find out if mac randomization should be turned on */
3371         if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
3372                 return 0;
3373
3374         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
3375         pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
3376
3377         memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
3378         mac_mask = request->mac_addr_mask;
3379         for (i = 0; i < ETH_ALEN; i++) {
3380                 pfn_mac.mac[i] &= mac_mask[i];
3381                 pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
3382         }
3383         /* Clear multi bit */
3384         pfn_mac.mac[0] &= 0xFE;
3385         /* Set locally administered */
3386         pfn_mac.mac[0] |= 0x02;
3387
3388         err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
3389                                        sizeof(pfn_mac));
3390         if (err)
3391                 brcmf_err("pfn_macaddr failed, err=%d\n", err);
3392
3393         return err;
3394 }
3395
3396 static int
3397 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3398                                 struct net_device *ndev,
3399                                 struct cfg80211_sched_scan_request *request)
3400 {
3401         struct brcmf_if *ifp = netdev_priv(ndev);
3402         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3403         struct brcmf_pno_net_param_le pfn;
3404         int i;
3405         int ret = 0;
3406
3407         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3408                   request->n_match_sets, request->n_ssids);
3409         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3410                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3411                 return -EAGAIN;
3412         }
3413         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3414                 brcmf_err("Scanning suppressed: status (%lu)\n",
3415                           cfg->scan_status);
3416                 return -EAGAIN;
3417         }
3418
3419         if (!request->n_ssids || !request->n_match_sets) {
3420                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3421                           request->n_ssids);
3422                 return -EINVAL;
3423         }
3424
3425         if (request->n_ssids > 0) {
3426                 for (i = 0; i < request->n_ssids; i++) {
3427                         /* Active scan req for ssids */
3428                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3429                                   request->ssids[i].ssid);
3430
3431                         /* match_set ssids is a supert set of n_ssid list,
3432                          * so we need not add these set separately.
3433                          */
3434                 }
3435         }
3436
3437         if (request->n_match_sets > 0) {
3438                 /* clean up everything */
3439                 ret = brcmf_dev_pno_clean(ndev);
3440                 if  (ret < 0) {
3441                         brcmf_err("failed error=%d\n", ret);
3442                         return ret;
3443                 }
3444
3445                 /* configure pno */
3446                 if (brcmf_dev_pno_config(ifp, request))
3447                         return -EINVAL;
3448
3449                 /* configure each match set */
3450                 for (i = 0; i < request->n_match_sets; i++) {
3451                         struct cfg80211_ssid *ssid;
3452                         u32 ssid_len;
3453
3454                         ssid = &request->match_sets[i].ssid;
3455                         ssid_len = ssid->ssid_len;
3456
3457                         if (!ssid_len) {
3458                                 brcmf_err("skip broadcast ssid\n");
3459                                 continue;
3460                         }
3461                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3462                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3463                         pfn.wsec = cpu_to_le32(0);
3464                         pfn.infra = cpu_to_le32(1);
3465                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3466                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3467                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3468                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3469                                                        sizeof(pfn));
3470                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3471                                   ret == 0 ? "set" : "failed", ssid->ssid);
3472                 }
3473                 /* Enable the PNO */
3474                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3475                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3476                         return -EINVAL;
3477                 }
3478         } else {
3479                 return -EINVAL;
3480         }
3481
3482         return 0;
3483 }
3484
3485 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3486                                           struct net_device *ndev)
3487 {
3488         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3489
3490         brcmf_dbg(SCAN, "enter\n");
3491         brcmf_dev_pno_clean(ndev);
3492         if (cfg->sched_escan)
3493                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3494         return 0;
3495 }
3496
3497 static __always_inline void brcmf_delay(u32 ms)
3498 {
3499         if (ms < 1000 / HZ) {
3500                 cond_resched();
3501                 mdelay(ms);
3502         } else {
3503                 msleep(ms);
3504         }
3505 }
3506
3507 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3508                                      u8 *pattern, u32 patternsize, u8 *mask,
3509                                      u32 packet_offset)
3510 {
3511         struct brcmf_fil_wowl_pattern_le *filter;
3512         u32 masksize;
3513         u32 patternoffset;
3514         u8 *buf;
3515         u32 bufsize;
3516         s32 ret;
3517
3518         masksize = (patternsize + 7) / 8;
3519         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3520
3521         bufsize = sizeof(*filter) + patternsize + masksize;
3522         buf = kzalloc(bufsize, GFP_KERNEL);
3523         if (!buf)
3524                 return -ENOMEM;
3525         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3526
3527         memcpy(filter->cmd, cmd, 4);
3528         filter->masksize = cpu_to_le32(masksize);
3529         filter->offset = cpu_to_le32(packet_offset);
3530         filter->patternoffset = cpu_to_le32(patternoffset);
3531         filter->patternsize = cpu_to_le32(patternsize);
3532         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3533
3534         if ((mask) && (masksize))
3535                 memcpy(buf + sizeof(*filter), mask, masksize);
3536         if ((pattern) && (patternsize))
3537                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3538
3539         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3540
3541         kfree(buf);
3542         return ret;
3543 }
3544
3545 static s32
3546 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3547                       void *data)
3548 {
3549         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3550         struct brcmf_pno_scanresults_le *pfn_result;
3551         struct brcmf_pno_net_info_le *netinfo;
3552
3553         brcmf_dbg(SCAN, "Enter\n");
3554
3555         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3556                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3557                 return 0;
3558         }
3559
3560         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3561
3562         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3563                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3564                 return 0;
3565         }
3566
3567         if (le32_to_cpu(pfn_result->count) < 1) {
3568                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3569                           le32_to_cpu(pfn_result->count));
3570                 return -EINVAL;
3571         }
3572
3573         data += sizeof(struct brcmf_pno_scanresults_le);
3574         netinfo = (struct brcmf_pno_net_info_le *)data;
3575         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3576         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3577         cfg->wowl.nd->n_channels = 1;
3578         cfg->wowl.nd->channels[0] =
3579                 ieee80211_channel_to_frequency(netinfo->channel,
3580                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3581                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3582         cfg->wowl.nd_info->n_matches = 1;
3583         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3584
3585         /* Inform (the resume task) that the net detect information was recvd */
3586         cfg->wowl.nd_data_completed = true;
3587         wake_up(&cfg->wowl.nd_data_wait);
3588
3589         return 0;
3590 }
3591
3592 #ifdef CONFIG_PM
3593
3594 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3595 {
3596         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3597         struct brcmf_wowl_wakeind_le wake_ind_le;
3598         struct cfg80211_wowlan_wakeup wakeup_data;
3599         struct cfg80211_wowlan_wakeup *wakeup;
3600         u32 wakeind;
3601         s32 err;
3602         int timeout;
3603
3604         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3605                                        sizeof(wake_ind_le));
3606         if (err) {
3607                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3608                 return;
3609         }
3610
3611         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3612         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3613                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3614                        BRCMF_WOWL_PFN_FOUND)) {
3615                 wakeup = &wakeup_data;
3616                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3617                 wakeup_data.pattern_idx = -1;
3618
3619                 if (wakeind & BRCMF_WOWL_MAGIC) {
3620                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3621                         wakeup_data.magic_pkt = true;
3622                 }
3623                 if (wakeind & BRCMF_WOWL_DIS) {
3624                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3625                         wakeup_data.disconnect = true;
3626                 }
3627                 if (wakeind & BRCMF_WOWL_BCN) {
3628                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3629                         wakeup_data.disconnect = true;
3630                 }
3631                 if (wakeind & BRCMF_WOWL_RETR) {
3632                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3633                         wakeup_data.disconnect = true;
3634                 }
3635                 if (wakeind & BRCMF_WOWL_NET) {
3636                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3637                         /* For now always map to pattern 0, no API to get
3638                          * correct information available at the moment.
3639                          */
3640                         wakeup_data.pattern_idx = 0;
3641                 }
3642                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3643                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3644                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3645                                 cfg->wowl.nd_data_completed,
3646                                 BRCMF_ND_INFO_TIMEOUT);
3647                         if (!timeout)
3648                                 brcmf_err("No result for wowl net detect\n");
3649                         else
3650                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3651                 }
3652                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3653                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3654                         wakeup_data.gtk_rekey_failure = true;
3655                 }
3656         } else {
3657                 wakeup = NULL;
3658         }
3659         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3660 }
3661
3662 #else
3663
3664 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3665 {
3666 }
3667
3668 #endif /* CONFIG_PM */
3669
3670 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3671 {
3672         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3673         struct net_device *ndev = cfg_to_ndev(cfg);
3674         struct brcmf_if *ifp = netdev_priv(ndev);
3675
3676         brcmf_dbg(TRACE, "Enter\n");
3677
3678         if (cfg->wowl.active) {
3679                 brcmf_report_wowl_wakeind(wiphy, ifp);
3680                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3681                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3682                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3683                         brcmf_configure_arp_nd_offload(ifp, true);
3684                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3685                                       cfg->wowl.pre_pmmode);
3686                 cfg->wowl.active = false;
3687                 if (cfg->wowl.nd_enabled) {
3688                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
3689                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3690                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3691                                             brcmf_notify_sched_scan_results);
3692                         cfg->wowl.nd_enabled = false;
3693                 }
3694         }
3695         return 0;
3696 }
3697
3698 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3699                                  struct brcmf_if *ifp,
3700                                  struct cfg80211_wowlan *wowl)
3701 {
3702         u32 wowl_config;
3703         struct brcmf_wowl_wakeind_le wowl_wakeind;
3704         u32 i;
3705
3706         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3707
3708         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3709                 brcmf_configure_arp_nd_offload(ifp, false);
3710         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3711         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3712
3713         wowl_config = 0;
3714         if (wowl->disconnect)
3715                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3716         if (wowl->magic_pkt)
3717                 wowl_config |= BRCMF_WOWL_MAGIC;
3718         if ((wowl->patterns) && (wowl->n_patterns)) {
3719                 wowl_config |= BRCMF_WOWL_NET;
3720                 for (i = 0; i < wowl->n_patterns; i++) {
3721                         brcmf_config_wowl_pattern(ifp, "add",
3722                                 (u8 *)wowl->patterns[i].pattern,
3723                                 wowl->patterns[i].pattern_len,
3724                                 (u8 *)wowl->patterns[i].mask,
3725                                 wowl->patterns[i].pkt_offset);
3726                 }
3727         }
3728         if (wowl->nd_config) {
3729                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3730                                                 wowl->nd_config);
3731                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3732
3733                 cfg->wowl.nd_data_completed = false;
3734                 cfg->wowl.nd_enabled = true;
3735                 /* Now reroute the event for PFN to the wowl function. */
3736                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3737                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3738                                     brcmf_wowl_nd_results);
3739         }
3740         if (wowl->gtk_rekey_failure)
3741                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3742         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3743                 wowl_config |= BRCMF_WOWL_UNASSOC;
3744
3745         memcpy(&wowl_wakeind, "clear", 6);
3746         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3747                                  sizeof(wowl_wakeind));
3748         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3749         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3750         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3751         cfg->wowl.active = true;
3752 }
3753
3754 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3755                                   struct cfg80211_wowlan *wowl)
3756 {
3757         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3758         struct net_device *ndev = cfg_to_ndev(cfg);
3759         struct brcmf_if *ifp = netdev_priv(ndev);
3760         struct brcmf_cfg80211_vif *vif;
3761
3762         brcmf_dbg(TRACE, "Enter\n");
3763
3764         /* if the primary net_device is not READY there is nothing
3765          * we can do but pray resume goes smoothly.
3766          */
3767         if (!check_vif_up(ifp->vif))
3768                 goto exit;
3769
3770         /* Stop scheduled scan */
3771         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3772                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
3773
3774         /* end any scanning */
3775         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3776                 brcmf_abort_scanning(cfg);
3777
3778         if (wowl == NULL) {
3779                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3780                 list_for_each_entry(vif, &cfg->vif_list, list) {
3781                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3782                                 continue;
3783                         /* While going to suspend if associated with AP
3784                          * disassociate from AP to save power while system is
3785                          * in suspended state
3786                          */
3787                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3788                         /* Make sure WPA_Supplicant receives all the event
3789                          * generated due to DISASSOC call to the fw to keep
3790                          * the state fw and WPA_Supplicant state consistent
3791                          */
3792                         brcmf_delay(500);
3793                 }
3794                 /* Configure MPC */
3795                 brcmf_set_mpc(ifp, 1);
3796
3797         } else {
3798                 /* Configure WOWL paramaters */
3799                 brcmf_configure_wowl(cfg, ifp, wowl);
3800         }
3801
3802 exit:
3803         brcmf_dbg(TRACE, "Exit\n");
3804         /* clear any scanning activity */
3805         cfg->scan_status = 0;
3806         return 0;
3807 }
3808
3809 static __used s32
3810 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3811 {
3812         struct brcmf_pmk_list_le *pmk_list;
3813         int i;
3814         u32 npmk;
3815         s32 err;
3816
3817         pmk_list = &cfg->pmk_list;
3818         npmk = le32_to_cpu(pmk_list->npmk);
3819
3820         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3821         for (i = 0; i < npmk; i++)
3822                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3823
3824         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3825                                        sizeof(*pmk_list));
3826
3827         return err;
3828 }
3829
3830 static s32
3831 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3832                          struct cfg80211_pmksa *pmksa)
3833 {
3834         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3835         struct brcmf_if *ifp = netdev_priv(ndev);
3836         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3837         s32 err;
3838         u32 npmk, i;
3839
3840         brcmf_dbg(TRACE, "Enter\n");
3841         if (!check_vif_up(ifp->vif))
3842                 return -EIO;
3843
3844         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3845         for (i = 0; i < npmk; i++)
3846                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3847                         break;
3848         if (i < BRCMF_MAXPMKID) {
3849                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3850                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3851                 if (i == npmk) {
3852                         npmk++;
3853                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3854                 }
3855         } else {
3856                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3857                 return -EINVAL;
3858         }
3859
3860         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3861         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3862                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3863                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3864                           pmk[npmk].pmkid[i + 3]);
3865
3866         err = brcmf_update_pmklist(cfg, ifp);
3867
3868         brcmf_dbg(TRACE, "Exit\n");
3869         return err;
3870 }
3871
3872 static s32
3873 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3874                          struct cfg80211_pmksa *pmksa)
3875 {
3876         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3877         struct brcmf_if *ifp = netdev_priv(ndev);
3878         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3879         s32 err;
3880         u32 npmk, i;
3881
3882         brcmf_dbg(TRACE, "Enter\n");
3883         if (!check_vif_up(ifp->vif))
3884                 return -EIO;
3885
3886         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3887
3888         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3889         for (i = 0; i < npmk; i++)
3890                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3891                         break;
3892
3893         if ((npmk > 0) && (i < npmk)) {
3894                 for (; i < (npmk - 1); i++) {
3895                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3896                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3897                                WLAN_PMKID_LEN);
3898                 }
3899                 memset(&pmk[i], 0, sizeof(*pmk));
3900                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3901         } else {
3902                 brcmf_err("Cache entry not found\n");
3903                 return -EINVAL;
3904         }
3905
3906         err = brcmf_update_pmklist(cfg, ifp);
3907
3908         brcmf_dbg(TRACE, "Exit\n");
3909         return err;
3910
3911 }
3912
3913 static s32
3914 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3915 {
3916         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3917         struct brcmf_if *ifp = netdev_priv(ndev);
3918         s32 err;
3919
3920         brcmf_dbg(TRACE, "Enter\n");
3921         if (!check_vif_up(ifp->vif))
3922                 return -EIO;
3923
3924         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3925         err = brcmf_update_pmklist(cfg, ifp);
3926
3927         brcmf_dbg(TRACE, "Exit\n");
3928         return err;
3929
3930 }
3931
3932 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3933 {
3934         s32 err;
3935
3936         /* set auth */
3937         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3938         if (err < 0) {
3939                 brcmf_err("auth error %d\n", err);
3940                 return err;
3941         }
3942         /* set wsec */
3943         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3944         if (err < 0) {
3945                 brcmf_err("wsec error %d\n", err);
3946                 return err;
3947         }
3948         /* set upper-layer auth */
3949         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3950         if (err < 0) {
3951                 brcmf_err("wpa_auth error %d\n", err);
3952                 return err;
3953         }
3954
3955         return 0;
3956 }
3957
3958 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3959 {
3960         if (is_rsn_ie)
3961                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3962
3963         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3964 }
3965
3966 static s32
3967 brcmf_configure_wpaie(struct brcmf_if *ifp,
3968                       const struct brcmf_vs_tlv *wpa_ie,
3969                       bool is_rsn_ie)
3970 {
3971         u32 auth = 0; /* d11 open authentication */
3972         u16 count;
3973         s32 err = 0;
3974         s32 len;
3975         u32 i;
3976         u32 wsec;
3977         u32 pval = 0;
3978         u32 gval = 0;
3979         u32 wpa_auth = 0;
3980         u32 offset;
3981         u8 *data;
3982         u16 rsn_cap;
3983         u32 wme_bss_disable;
3984         u32 mfp;
3985
3986         brcmf_dbg(TRACE, "Enter\n");
3987         if (wpa_ie == NULL)
3988                 goto exit;
3989
3990         len = wpa_ie->len + TLV_HDR_LEN;
3991         data = (u8 *)wpa_ie;
3992         offset = TLV_HDR_LEN;
3993         if (!is_rsn_ie)
3994                 offset += VS_IE_FIXED_HDR_LEN;
3995         else
3996                 offset += WPA_IE_VERSION_LEN;
3997
3998         /* check for multicast cipher suite */
3999         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4000                 err = -EINVAL;
4001                 brcmf_err("no multicast cipher suite\n");
4002                 goto exit;
4003         }
4004
4005         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4006                 err = -EINVAL;
4007                 brcmf_err("ivalid OUI\n");
4008                 goto exit;
4009         }
4010         offset += TLV_OUI_LEN;
4011
4012         /* pick up multicast cipher */
4013         switch (data[offset]) {
4014         case WPA_CIPHER_NONE:
4015                 gval = 0;
4016                 break;
4017         case WPA_CIPHER_WEP_40:
4018         case WPA_CIPHER_WEP_104:
4019                 gval = WEP_ENABLED;
4020                 break;
4021         case WPA_CIPHER_TKIP:
4022                 gval = TKIP_ENABLED;
4023                 break;
4024         case WPA_CIPHER_AES_CCM:
4025                 gval = AES_ENABLED;
4026                 break;
4027         default:
4028                 err = -EINVAL;
4029                 brcmf_err("Invalid multi cast cipher info\n");
4030                 goto exit;
4031         }
4032
4033         offset++;
4034         /* walk thru unicast cipher list and pick up what we recognize */
4035         count = data[offset] + (data[offset + 1] << 8);
4036         offset += WPA_IE_SUITE_COUNT_LEN;
4037         /* Check for unicast suite(s) */
4038         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4039                 err = -EINVAL;
4040                 brcmf_err("no unicast cipher suite\n");
4041                 goto exit;
4042         }
4043         for (i = 0; i < count; i++) {
4044                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4045                         err = -EINVAL;
4046                         brcmf_err("ivalid OUI\n");
4047                         goto exit;
4048                 }
4049                 offset += TLV_OUI_LEN;
4050                 switch (data[offset]) {
4051                 case WPA_CIPHER_NONE:
4052                         break;
4053                 case WPA_CIPHER_WEP_40:
4054                 case WPA_CIPHER_WEP_104:
4055                         pval |= WEP_ENABLED;
4056                         break;
4057                 case WPA_CIPHER_TKIP:
4058                         pval |= TKIP_ENABLED;
4059                         break;
4060                 case WPA_CIPHER_AES_CCM:
4061                         pval |= AES_ENABLED;
4062                         break;
4063                 default:
4064                         brcmf_err("Ivalid unicast security info\n");
4065                 }
4066                 offset++;
4067         }
4068         /* walk thru auth management suite list and pick up what we recognize */
4069         count = data[offset] + (data[offset + 1] << 8);
4070         offset += WPA_IE_SUITE_COUNT_LEN;
4071         /* Check for auth key management suite(s) */
4072         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4073                 err = -EINVAL;
4074                 brcmf_err("no auth key mgmt suite\n");
4075                 goto exit;
4076         }
4077         for (i = 0; i < count; i++) {
4078                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4079                         err = -EINVAL;
4080                         brcmf_err("ivalid OUI\n");
4081                         goto exit;
4082                 }
4083                 offset += TLV_OUI_LEN;
4084                 switch (data[offset]) {
4085                 case RSN_AKM_NONE:
4086                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4087                         wpa_auth |= WPA_AUTH_NONE;
4088                         break;
4089                 case RSN_AKM_UNSPECIFIED:
4090                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4091                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4092                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4093                         break;
4094                 case RSN_AKM_PSK:
4095                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4096                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4097                                     (wpa_auth |= WPA_AUTH_PSK);
4098                         break;
4099                 case RSN_AKM_SHA256_PSK:
4100                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4101                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4102                         break;
4103                 case RSN_AKM_SHA256_1X:
4104                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4105                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4106                         break;
4107                 default:
4108                         brcmf_err("Ivalid key mgmt info\n");
4109                 }
4110                 offset++;
4111         }
4112
4113         mfp = BRCMF_MFP_NONE;
4114         if (is_rsn_ie) {
4115                 wme_bss_disable = 1;
4116                 if ((offset + RSN_CAP_LEN) <= len) {
4117                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4118                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4119                                 wme_bss_disable = 0;
4120                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4121                                 brcmf_dbg(TRACE, "MFP Required\n");
4122                                 mfp = BRCMF_MFP_REQUIRED;
4123                                 /* Firmware only supports mfp required in
4124                                  * combination with WPA2_AUTH_PSK_SHA256 or
4125                                  * WPA2_AUTH_1X_SHA256.
4126                                  */
4127                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4128                                                   WPA2_AUTH_1X_SHA256))) {
4129                                         err = -EINVAL;
4130                                         goto exit;
4131                                 }
4132                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4133                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4134                                  * is to be included in the rsn ie.
4135                                  */
4136                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4137                                         wpa_auth |= WPA2_AUTH_PSK;
4138                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4139                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4140                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4141                                 brcmf_dbg(TRACE, "MFP Capable\n");
4142                                 mfp = BRCMF_MFP_CAPABLE;
4143                         }
4144                 }
4145                 offset += RSN_CAP_LEN;
4146                 /* set wme_bss_disable to sync RSN Capabilities */
4147                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4148                                                wme_bss_disable);
4149                 if (err < 0) {
4150                         brcmf_err("wme_bss_disable error %d\n", err);
4151                         goto exit;
4152                 }
4153
4154                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4155                 offset += RSN_PMKID_COUNT_LEN;
4156
4157                 /* See if there is BIP wpa suite left for MFP */
4158                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4159                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4160                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4161                                                         &data[offset],
4162                                                         WPA_IE_MIN_OUI_LEN);
4163                         if (err < 0) {
4164                                 brcmf_err("bip error %d\n", err);
4165                                 goto exit;
4166                         }
4167                 }
4168         }
4169         /* FOR WPS , set SES_OW_ENABLED */
4170         wsec = (pval | gval | SES_OW_ENABLED);
4171
4172         /* set auth */
4173         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4174         if (err < 0) {
4175                 brcmf_err("auth error %d\n", err);
4176                 goto exit;
4177         }
4178         /* set wsec */
4179         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4180         if (err < 0) {
4181                 brcmf_err("wsec error %d\n", err);
4182                 goto exit;
4183         }
4184         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4185          * will overwrite the values set by MFP
4186          */
4187         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4188                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4189                 if (err < 0) {
4190                         brcmf_err("mfp error %d\n", err);
4191                         goto exit;
4192                 }
4193         }
4194         /* set upper-layer auth */
4195         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4196         if (err < 0) {
4197                 brcmf_err("wpa_auth error %d\n", err);
4198                 goto exit;
4199         }
4200
4201 exit:
4202         return err;
4203 }
4204
4205 static s32
4206 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4207                      struct parsed_vndr_ies *vndr_ies)
4208 {
4209         struct brcmf_vs_tlv *vndrie;
4210         struct brcmf_tlv *ie;
4211         struct parsed_vndr_ie_info *parsed_info;
4212         s32 remaining_len;
4213
4214         remaining_len = (s32)vndr_ie_len;
4215         memset(vndr_ies, 0, sizeof(*vndr_ies));
4216
4217         ie = (struct brcmf_tlv *)vndr_ie_buf;
4218         while (ie) {
4219                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4220                         goto next;
4221                 vndrie = (struct brcmf_vs_tlv *)ie;
4222                 /* len should be bigger than OUI length + one */
4223                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4224                         brcmf_err("invalid vndr ie. length is too small %d\n",
4225                                   vndrie->len);
4226                         goto next;
4227                 }
4228                 /* if wpa or wme ie, do not add ie */
4229                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4230                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4231                     (vndrie->oui_type == WME_OUI_TYPE))) {
4232                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4233                         goto next;
4234                 }
4235
4236                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4237
4238                 /* save vndr ie information */
4239                 parsed_info->ie_ptr = (char *)vndrie;
4240                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4241                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4242
4243                 vndr_ies->count++;
4244
4245                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4246                           parsed_info->vndrie.oui[0],
4247                           parsed_info->vndrie.oui[1],
4248                           parsed_info->vndrie.oui[2],
4249                           parsed_info->vndrie.oui_type);
4250
4251                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4252                         break;
4253 next:
4254                 remaining_len -= (ie->len + TLV_HDR_LEN);
4255                 if (remaining_len <= TLV_HDR_LEN)
4256                         ie = NULL;
4257                 else
4258                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4259                                 TLV_HDR_LEN);
4260         }
4261         return 0;
4262 }
4263
4264 static u32
4265 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4266 {
4267
4268         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4269         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4270
4271         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4272
4273         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4274
4275         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4276
4277         return ie_len + VNDR_IE_HDR_SIZE;
4278 }
4279
4280 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4281                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4282 {
4283         struct brcmf_if *ifp;
4284         struct vif_saved_ie *saved_ie;
4285         s32 err = 0;
4286         u8  *iovar_ie_buf;
4287         u8  *curr_ie_buf;
4288         u8  *mgmt_ie_buf = NULL;
4289         int mgmt_ie_buf_len;
4290         u32 *mgmt_ie_len;
4291         u32 del_add_ie_buf_len = 0;
4292         u32 total_ie_buf_len = 0;
4293         u32 parsed_ie_buf_len = 0;
4294         struct parsed_vndr_ies old_vndr_ies;
4295         struct parsed_vndr_ies new_vndr_ies;
4296         struct parsed_vndr_ie_info *vndrie_info;
4297         s32 i;
4298         u8 *ptr;
4299         int remained_buf_len;
4300
4301         if (!vif)
4302                 return -ENODEV;
4303         ifp = vif->ifp;
4304         saved_ie = &vif->saved_ie;
4305
4306         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4307                   pktflag);
4308         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4309         if (!iovar_ie_buf)
4310                 return -ENOMEM;
4311         curr_ie_buf = iovar_ie_buf;
4312         switch (pktflag) {
4313         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4314                 mgmt_ie_buf = saved_ie->probe_req_ie;
4315                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4316                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4317                 break;
4318         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4319                 mgmt_ie_buf = saved_ie->probe_res_ie;
4320                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4321                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4322                 break;
4323         case BRCMF_VNDR_IE_BEACON_FLAG:
4324                 mgmt_ie_buf = saved_ie->beacon_ie;
4325                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4326                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4327                 break;
4328         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4329                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4330                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4331                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4332                 break;
4333         default:
4334                 err = -EPERM;
4335                 brcmf_err("not suitable type\n");
4336                 goto exit;
4337         }
4338
4339         if (vndr_ie_len > mgmt_ie_buf_len) {
4340                 err = -ENOMEM;
4341                 brcmf_err("extra IE size too big\n");
4342                 goto exit;
4343         }
4344
4345         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4346         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4347                 ptr = curr_ie_buf;
4348                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4349                 for (i = 0; i < new_vndr_ies.count; i++) {
4350                         vndrie_info = &new_vndr_ies.ie_info[i];
4351                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4352                                vndrie_info->ie_len);
4353                         parsed_ie_buf_len += vndrie_info->ie_len;
4354                 }
4355         }
4356
4357         if (mgmt_ie_buf && *mgmt_ie_len) {
4358                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4359                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4360                             parsed_ie_buf_len) == 0)) {
4361                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4362                         goto exit;
4363                 }
4364
4365                 /* parse old vndr_ie */
4366                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4367
4368                 /* make a command to delete old ie */
4369                 for (i = 0; i < old_vndr_ies.count; i++) {
4370                         vndrie_info = &old_vndr_ies.ie_info[i];
4371
4372                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4373                                   vndrie_info->vndrie.id,
4374                                   vndrie_info->vndrie.len,
4375                                   vndrie_info->vndrie.oui[0],
4376                                   vndrie_info->vndrie.oui[1],
4377                                   vndrie_info->vndrie.oui[2]);
4378
4379                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4380                                                            vndrie_info->ie_ptr,
4381                                                            vndrie_info->ie_len,
4382                                                            "del");
4383                         curr_ie_buf += del_add_ie_buf_len;
4384                         total_ie_buf_len += del_add_ie_buf_len;
4385                 }
4386         }
4387
4388         *mgmt_ie_len = 0;
4389         /* Add if there is any extra IE */
4390         if (mgmt_ie_buf && parsed_ie_buf_len) {
4391                 ptr = mgmt_ie_buf;
4392
4393                 remained_buf_len = mgmt_ie_buf_len;
4394
4395                 /* make a command to add new ie */
4396                 for (i = 0; i < new_vndr_ies.count; i++) {
4397                         vndrie_info = &new_vndr_ies.ie_info[i];
4398
4399                         /* verify remained buf size before copy data */
4400                         if (remained_buf_len < (vndrie_info->vndrie.len +
4401                                                         VNDR_IE_VSIE_OFFSET)) {
4402                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4403                                           remained_buf_len);
4404                                 break;
4405                         }
4406                         remained_buf_len -= (vndrie_info->ie_len +
4407                                              VNDR_IE_VSIE_OFFSET);
4408
4409                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4410                                   vndrie_info->vndrie.id,
4411                                   vndrie_info->vndrie.len,
4412                                   vndrie_info->vndrie.oui[0],
4413                                   vndrie_info->vndrie.oui[1],
4414                                   vndrie_info->vndrie.oui[2]);
4415
4416                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4417                                                            vndrie_info->ie_ptr,
4418                                                            vndrie_info->ie_len,
4419                                                            "add");
4420
4421                         /* save the parsed IE in wl struct */
4422                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4423                                vndrie_info->ie_len);
4424                         *mgmt_ie_len += vndrie_info->ie_len;
4425
4426                         curr_ie_buf += del_add_ie_buf_len;
4427                         total_ie_buf_len += del_add_ie_buf_len;
4428                 }
4429         }
4430         if (total_ie_buf_len) {
4431                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4432                                                  total_ie_buf_len);
4433                 if (err)
4434                         brcmf_err("vndr ie set error : %d\n", err);
4435         }
4436
4437 exit:
4438         kfree(iovar_ie_buf);
4439         return err;
4440 }
4441
4442 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4443 {
4444         s32 pktflags[] = {
4445                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4446                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4447                 BRCMF_VNDR_IE_BEACON_FLAG
4448         };
4449         int i;
4450
4451         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4452                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4453
4454         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4455         return 0;
4456 }
4457
4458 static s32
4459 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4460                         struct cfg80211_beacon_data *beacon)
4461 {
4462         s32 err;
4463
4464         /* Set Beacon IEs to FW */
4465         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4466                                     beacon->tail, beacon->tail_len);
4467         if (err) {
4468                 brcmf_err("Set Beacon IE Failed\n");
4469                 return err;
4470         }
4471         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4472
4473         /* Set Probe Response IEs to FW */
4474         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4475                                     beacon->proberesp_ies,
4476                                     beacon->proberesp_ies_len);
4477         if (err)
4478                 brcmf_err("Set Probe Resp IE Failed\n");
4479         else
4480                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4481
4482         return err;
4483 }
4484
4485 static s32
4486 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4487                         struct cfg80211_ap_settings *settings)
4488 {
4489         s32 ie_offset;
4490         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4491         struct brcmf_if *ifp = netdev_priv(ndev);
4492         const struct brcmf_tlv *ssid_ie;
4493         const struct brcmf_tlv *country_ie;
4494         struct brcmf_ssid_le ssid_le;
4495         s32 err = -EPERM;
4496         const struct brcmf_tlv *rsn_ie;
4497         const struct brcmf_vs_tlv *wpa_ie;
4498         struct brcmf_join_params join_params;
4499         enum nl80211_iftype dev_role;
4500         struct brcmf_fil_bss_enable_le bss_enable;
4501         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4502         bool mbss;
4503         int is_11d;
4504         bool supports_11d;
4505
4506         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4507                   settings->chandef.chan->hw_value,
4508                   settings->chandef.center_freq1, settings->chandef.width,
4509                   settings->beacon_interval, settings->dtim_period);
4510         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4511                   settings->ssid, settings->ssid_len, settings->auth_type,
4512                   settings->inactivity_timeout);
4513         dev_role = ifp->vif->wdev.iftype;
4514         mbss = ifp->vif->mbss;
4515
4516         /* store current 11d setting */
4517         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4518                                   &ifp->vif->is_11d)) {
4519                 is_11d = supports_11d = false;
4520         } else {
4521                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4522                                               settings->beacon.tail_len,
4523                                               WLAN_EID_COUNTRY);
4524                 is_11d = country_ie ? 1 : 0;
4525                 supports_11d = true;
4526         }
4527
4528         memset(&ssid_le, 0, sizeof(ssid_le));
4529         if (settings->ssid == NULL || settings->ssid_len == 0) {
4530                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4531                 ssid_ie = brcmf_parse_tlvs(
4532                                 (u8 *)&settings->beacon.head[ie_offset],
4533                                 settings->beacon.head_len - ie_offset,
4534                                 WLAN_EID_SSID);
4535                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4536                         return -EINVAL;
4537
4538                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4539                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4540                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4541         } else {
4542                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4543                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4544         }
4545
4546         if (!mbss) {
4547                 brcmf_set_mpc(ifp, 0);
4548                 brcmf_configure_arp_nd_offload(ifp, false);
4549         }
4550
4551         /* find the RSN_IE */
4552         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4553                                   settings->beacon.tail_len, WLAN_EID_RSN);
4554
4555         /* find the WPA_IE */
4556         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4557                                   settings->beacon.tail_len);
4558
4559         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4560                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4561                 if (wpa_ie != NULL) {
4562                         /* WPA IE */
4563                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4564                         if (err < 0)
4565                                 goto exit;
4566                 } else {
4567                         struct brcmf_vs_tlv *tmp_ie;
4568
4569                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4570
4571                         /* RSN IE */
4572                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4573                         if (err < 0)
4574                                 goto exit;
4575                 }
4576         } else {
4577                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4578                 brcmf_configure_opensecurity(ifp);
4579         }
4580
4581         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4582
4583         /* Parameters shared by all radio interfaces */
4584         if (!mbss) {
4585                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4586                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4587                                                     is_11d);
4588                         if (err < 0) {
4589                                 brcmf_err("Regulatory Set Error, %d\n", err);
4590                                 goto exit;
4591                         }
4592                 }
4593                 if (settings->beacon_interval) {
4594                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4595                                                     settings->beacon_interval);
4596                         if (err < 0) {
4597                                 brcmf_err("Beacon Interval Set Error, %d\n",
4598                                           err);
4599                                 goto exit;
4600                         }
4601                 }
4602                 if (settings->dtim_period) {
4603                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4604                                                     settings->dtim_period);
4605                         if (err < 0) {
4606                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4607                                 goto exit;
4608                         }
4609                 }
4610
4611                 if ((dev_role == NL80211_IFTYPE_AP) &&
4612                     ((ifp->ifidx == 0) ||
4613                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4614                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4615                         if (err < 0) {
4616                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4617                                 goto exit;
4618                         }
4619                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4620                 }
4621
4622                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4623                 if (err < 0) {
4624                         brcmf_err("SET INFRA error %d\n", err);
4625                         goto exit;
4626                 }
4627         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4628                 /* Multiple-BSS should use same 11d configuration */
4629                 err = -EINVAL;
4630                 goto exit;
4631         }
4632
4633         /* Interface specific setup */
4634         if (dev_role == NL80211_IFTYPE_AP) {
4635                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4636                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4637
4638                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4639                 if (err < 0) {
4640                         brcmf_err("setting AP mode failed %d\n", err);
4641                         goto exit;
4642                 }
4643                 if (!mbss) {
4644                         /* Firmware 10.x requires setting channel after enabling
4645                          * AP and before bringing interface up.
4646                          */
4647                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4648                         if (err < 0) {
4649                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4650                                           chanspec, err);
4651                                 goto exit;
4652                         }
4653                 }
4654                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4655                 if (err < 0) {
4656                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4657                         goto exit;
4658                 }
4659                 /* On DOWN the firmware removes the WEP keys, reconfigure
4660                  * them if they were set.
4661                  */
4662                 brcmf_cfg80211_reconfigure_wep(ifp);
4663
4664                 memset(&join_params, 0, sizeof(join_params));
4665                 /* join parameters starts with ssid */
4666                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4667                 /* create softap */
4668                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4669                                              &join_params, sizeof(join_params));
4670                 if (err < 0) {
4671                         brcmf_err("SET SSID error (%d)\n", err);
4672                         goto exit;
4673                 }
4674
4675                 if (settings->hidden_ssid) {
4676                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4677                         if (err) {
4678                                 brcmf_err("closednet error (%d)\n", err);
4679                                 goto exit;
4680                         }
4681                 }
4682
4683                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4684         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4685                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4686                 if (err < 0) {
4687                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4688                                   chanspec, err);
4689                         goto exit;
4690                 }
4691                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4692                                                 sizeof(ssid_le));
4693                 if (err < 0) {
4694                         brcmf_err("setting ssid failed %d\n", err);
4695                         goto exit;
4696                 }
4697                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4698                 bss_enable.enable = cpu_to_le32(1);
4699                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4700                                                sizeof(bss_enable));
4701                 if (err < 0) {
4702                         brcmf_err("bss_enable config failed %d\n", err);
4703                         goto exit;
4704                 }
4705
4706                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4707         } else {
4708                 WARN_ON(1);
4709         }
4710
4711         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4712         brcmf_net_setcarrier(ifp, true);
4713
4714 exit:
4715         if ((err) && (!mbss)) {
4716                 brcmf_set_mpc(ifp, 1);
4717                 brcmf_configure_arp_nd_offload(ifp, true);
4718         }
4719         return err;
4720 }
4721
4722 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4723 {
4724         struct brcmf_if *ifp = netdev_priv(ndev);
4725         s32 err;
4726         struct brcmf_fil_bss_enable_le bss_enable;
4727         struct brcmf_join_params join_params;
4728
4729         brcmf_dbg(TRACE, "Enter\n");
4730
4731         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4732                 /* Due to most likely deauths outstanding we sleep */
4733                 /* first to make sure they get processed by fw. */
4734                 msleep(400);
4735
4736                 if (ifp->vif->mbss) {
4737                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4738                         return err;
4739                 }
4740
4741                 /* First BSS doesn't get a full reset */
4742                 if (ifp->bsscfgidx == 0)
4743                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4744
4745                 memset(&join_params, 0, sizeof(join_params));
4746                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4747                                              &join_params, sizeof(join_params));
4748                 if (err < 0)
4749                         brcmf_err("SET SSID error (%d)\n", err);
4750                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4751                 if (err < 0)
4752                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4753                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4754                 if (err < 0)
4755                         brcmf_err("setting AP mode failed %d\n", err);
4756                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4757                 if (err < 0)
4758                         brcmf_err("setting INFRA mode failed %d\n", err);
4759                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4760                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4761                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4762                                       ifp->vif->is_11d);
4763                 /* Bring device back up so it can be used again */
4764                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4765                 if (err < 0)
4766                         brcmf_err("BRCMF_C_UP error %d\n", err);
4767         } else {
4768                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4769                 bss_enable.enable = cpu_to_le32(0);
4770                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4771                                                sizeof(bss_enable));
4772                 if (err < 0)
4773                         brcmf_err("bss_enable config failed %d\n", err);
4774         }
4775         brcmf_set_mpc(ifp, 1);
4776         brcmf_configure_arp_nd_offload(ifp, true);
4777         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4778         brcmf_net_setcarrier(ifp, false);
4779
4780         return err;
4781 }
4782
4783 static s32
4784 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4785                              struct cfg80211_beacon_data *info)
4786 {
4787         struct brcmf_if *ifp = netdev_priv(ndev);
4788         s32 err;
4789
4790         brcmf_dbg(TRACE, "Enter\n");
4791
4792         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4793
4794         return err;
4795 }
4796
4797 static int
4798 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4799                            struct station_del_parameters *params)
4800 {
4801         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4802         struct brcmf_scb_val_le scbval;
4803         struct brcmf_if *ifp = netdev_priv(ndev);
4804         s32 err;
4805
4806         if (!params->mac)
4807                 return -EFAULT;
4808
4809         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4810
4811         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4812                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4813         if (!check_vif_up(ifp->vif))
4814                 return -EIO;
4815
4816         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4817         scbval.val = cpu_to_le32(params->reason_code);
4818         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4819                                      &scbval, sizeof(scbval));
4820         if (err)
4821                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4822
4823         brcmf_dbg(TRACE, "Exit\n");
4824         return err;
4825 }
4826
4827 static int
4828 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4829                               const u8 *mac, struct station_parameters *params)
4830 {
4831         struct brcmf_if *ifp = netdev_priv(ndev);
4832         s32 err;
4833
4834         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4835                   params->sta_flags_mask, params->sta_flags_set);
4836
4837         /* Ignore all 00 MAC */
4838         if (is_zero_ether_addr(mac))
4839                 return 0;
4840
4841         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4842                 return 0;
4843
4844         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4845                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4846                                              (void *)mac, ETH_ALEN);
4847         else
4848                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4849                                              (void *)mac, ETH_ALEN);
4850         if (err < 0)
4851                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4852
4853         return err;
4854 }
4855
4856 static void
4857 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4858                                    struct wireless_dev *wdev,
4859                                    u16 frame_type, bool reg)
4860 {
4861         struct brcmf_cfg80211_vif *vif;
4862         u16 mgmt_type;
4863
4864         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4865
4866         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4867         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4868         if (reg)
4869                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4870         else
4871                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4872 }
4873
4874
4875 static int
4876 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4877                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4878 {
4879         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4880         struct ieee80211_channel *chan = params->chan;
4881         const u8 *buf = params->buf;
4882         size_t len = params->len;
4883         const struct ieee80211_mgmt *mgmt;
4884         struct brcmf_cfg80211_vif *vif;
4885         s32 err = 0;
4886         s32 ie_offset;
4887         s32 ie_len;
4888         struct brcmf_fil_action_frame_le *action_frame;
4889         struct brcmf_fil_af_params_le *af_params;
4890         bool ack;
4891         s32 chan_nr;
4892         u32 freq;
4893
4894         brcmf_dbg(TRACE, "Enter\n");
4895
4896         *cookie = 0;
4897
4898         mgmt = (const struct ieee80211_mgmt *)buf;
4899
4900         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4901                 brcmf_err("Driver only allows MGMT packet type\n");
4902                 return -EPERM;
4903         }
4904
4905         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4906
4907         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4908                 /* Right now the only reason to get a probe response */
4909                 /* is for p2p listen response or for p2p GO from     */
4910                 /* wpa_supplicant. Unfortunately the probe is send   */
4911                 /* on primary ndev, while dongle wants it on the p2p */
4912                 /* vif. Since this is only reason for a probe        */
4913                 /* response to be sent, the vif is taken from cfg.   */
4914                 /* If ever desired to send proberesp for non p2p     */
4915                 /* response then data should be checked for          */
4916                 /* "DIRECT-". Note in future supplicant will take    */
4917                 /* dedicated p2p wdev to do this and then this 'hack'*/
4918                 /* is not needed anymore.                            */
4919                 ie_offset =  DOT11_MGMT_HDR_LEN +
4920                              DOT11_BCN_PRB_FIXED_LEN;
4921                 ie_len = len - ie_offset;
4922                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4923                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4924                 err = brcmf_vif_set_mgmt_ie(vif,
4925                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4926                                             &buf[ie_offset],
4927                                             ie_len);
4928                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4929                                         GFP_KERNEL);
4930         } else if (ieee80211_is_action(mgmt->frame_control)) {
4931                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4932                 if (af_params == NULL) {
4933                         brcmf_err("unable to allocate frame\n");
4934                         err = -ENOMEM;
4935                         goto exit;
4936                 }
4937                 action_frame = &af_params->action_frame;
4938                 /* Add the packet Id */
4939                 action_frame->packet_id = cpu_to_le32(*cookie);
4940                 /* Add BSSID */
4941                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4942                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4943                 /* Add the length exepted for 802.11 header  */
4944                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4945                 /* Add the channel. Use the one specified as parameter if any or
4946                  * the current one (got from the firmware) otherwise
4947                  */
4948                 if (chan)
4949                         freq = chan->center_freq;
4950                 else
4951                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4952                                               &freq);
4953                 chan_nr = ieee80211_frequency_to_channel(freq);
4954                 af_params->channel = cpu_to_le32(chan_nr);
4955
4956                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4957                        le16_to_cpu(action_frame->len));
4958
4959                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4960                           *cookie, le16_to_cpu(action_frame->len), freq);
4961
4962                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4963                                                   af_params);
4964
4965                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4966                                         GFP_KERNEL);
4967                 kfree(af_params);
4968         } else {
4969                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4970                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4971         }
4972
4973 exit:
4974         return err;
4975 }
4976
4977
4978 static int
4979 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4980                                         struct wireless_dev *wdev,
4981                                         u64 cookie)
4982 {
4983         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4984         struct brcmf_cfg80211_vif *vif;
4985         int err = 0;
4986
4987         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4988
4989         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4990         if (vif == NULL) {
4991                 brcmf_err("No p2p device available for probe response\n");
4992                 err = -ENODEV;
4993                 goto exit;
4994         }
4995         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4996 exit:
4997         return err;
4998 }
4999
5000 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5001                                       struct wireless_dev *wdev,
5002                                       struct cfg80211_chan_def *chandef)
5003 {
5004         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5005         struct net_device *ndev = wdev->netdev;
5006         struct brcmf_if *ifp;
5007         struct brcmu_chan ch;
5008         enum nl80211_band band = 0;
5009         enum nl80211_chan_width width = 0;
5010         u32 chanspec;
5011         int freq, err;
5012
5013         if (!ndev)
5014                 return -ENODEV;
5015         ifp = netdev_priv(ndev);
5016
5017         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5018         if (err) {
5019                 brcmf_err("chanspec failed (%d)\n", err);
5020                 return err;
5021         }
5022
5023         ch.chspec = chanspec;
5024         cfg->d11inf.decchspec(&ch);
5025
5026         switch (ch.band) {
5027         case BRCMU_CHAN_BAND_2G:
5028                 band = NL80211_BAND_2GHZ;
5029                 break;
5030         case BRCMU_CHAN_BAND_5G:
5031                 band = NL80211_BAND_5GHZ;
5032                 break;
5033         }
5034
5035         switch (ch.bw) {
5036         case BRCMU_CHAN_BW_80:
5037                 width = NL80211_CHAN_WIDTH_80;
5038                 break;
5039         case BRCMU_CHAN_BW_40:
5040                 width = NL80211_CHAN_WIDTH_40;
5041                 break;
5042         case BRCMU_CHAN_BW_20:
5043                 width = NL80211_CHAN_WIDTH_20;
5044                 break;
5045         case BRCMU_CHAN_BW_80P80:
5046                 width = NL80211_CHAN_WIDTH_80P80;
5047                 break;
5048         case BRCMU_CHAN_BW_160:
5049                 width = NL80211_CHAN_WIDTH_160;
5050                 break;
5051         }
5052
5053         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5054         chandef->chan = ieee80211_get_channel(wiphy, freq);
5055         chandef->width = width;
5056         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5057         chandef->center_freq2 = 0;
5058
5059         return 0;
5060 }
5061
5062 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5063                                            struct wireless_dev *wdev,
5064                                            enum nl80211_crit_proto_id proto,
5065                                            u16 duration)
5066 {
5067         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5068         struct brcmf_cfg80211_vif *vif;
5069
5070         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5071
5072         /* only DHCP support for now */
5073         if (proto != NL80211_CRIT_PROTO_DHCP)
5074                 return -EINVAL;
5075
5076         /* suppress and abort scanning */
5077         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5078         brcmf_abort_scanning(cfg);
5079
5080         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5081 }
5082
5083 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5084                                            struct wireless_dev *wdev)
5085 {
5086         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5087         struct brcmf_cfg80211_vif *vif;
5088
5089         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5090
5091         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5092         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5093 }
5094
5095 static s32
5096 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5097                              const struct brcmf_event_msg *e, void *data)
5098 {
5099         switch (e->reason) {
5100         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5101                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5102                 break;
5103         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5104                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5105                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5106                 break;
5107         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5108                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5109                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5110                 break;
5111         }
5112
5113         return 0;
5114 }
5115
5116 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5117 {
5118         int ret;
5119
5120         switch (oper) {
5121         case NL80211_TDLS_DISCOVERY_REQ:
5122                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5123                 break;
5124         case NL80211_TDLS_SETUP:
5125                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5126                 break;
5127         case NL80211_TDLS_TEARDOWN:
5128                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5129                 break;
5130         default:
5131                 brcmf_err("unsupported operation: %d\n", oper);
5132                 ret = -EOPNOTSUPP;
5133         }
5134         return ret;
5135 }
5136
5137 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5138                                     struct net_device *ndev, const u8 *peer,
5139                                     enum nl80211_tdls_operation oper)
5140 {
5141         struct brcmf_if *ifp;
5142         struct brcmf_tdls_iovar_le info;
5143         int ret = 0;
5144
5145         ret = brcmf_convert_nl80211_tdls_oper(oper);
5146         if (ret < 0)
5147                 return ret;
5148
5149         ifp = netdev_priv(ndev);
5150         memset(&info, 0, sizeof(info));
5151         info.mode = (u8)ret;
5152         if (peer)
5153                 memcpy(info.ea, peer, ETH_ALEN);
5154
5155         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5156                                        &info, sizeof(info));
5157         if (ret < 0)
5158                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5159
5160         return ret;
5161 }
5162
5163 #ifdef CONFIG_PM
5164 static int
5165 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5166                               struct cfg80211_gtk_rekey_data *gtk)
5167 {
5168         struct brcmf_if *ifp = netdev_priv(ndev);
5169         struct brcmf_gtk_keyinfo_le gtk_le;
5170         int ret;
5171
5172         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5173
5174         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5175         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5176         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5177                sizeof(gtk_le.replay_counter));
5178
5179         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5180                                        sizeof(gtk_le));
5181         if (ret < 0)
5182                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5183
5184         return ret;
5185 }
5186 #endif
5187
5188 static struct cfg80211_ops brcmf_cfg80211_ops = {
5189         .add_virtual_intf = brcmf_cfg80211_add_iface,
5190         .del_virtual_intf = brcmf_cfg80211_del_iface,
5191         .change_virtual_intf = brcmf_cfg80211_change_iface,
5192         .scan = brcmf_cfg80211_scan,
5193         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5194         .join_ibss = brcmf_cfg80211_join_ibss,
5195         .leave_ibss = brcmf_cfg80211_leave_ibss,
5196         .get_station = brcmf_cfg80211_get_station,
5197         .dump_station = brcmf_cfg80211_dump_station,
5198         .set_tx_power = brcmf_cfg80211_set_tx_power,
5199         .get_tx_power = brcmf_cfg80211_get_tx_power,
5200         .add_key = brcmf_cfg80211_add_key,
5201         .del_key = brcmf_cfg80211_del_key,
5202         .get_key = brcmf_cfg80211_get_key,
5203         .set_default_key = brcmf_cfg80211_config_default_key,
5204         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5205         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5206         .connect = brcmf_cfg80211_connect,
5207         .disconnect = brcmf_cfg80211_disconnect,
5208         .suspend = brcmf_cfg80211_suspend,
5209         .resume = brcmf_cfg80211_resume,
5210         .set_pmksa = brcmf_cfg80211_set_pmksa,
5211         .del_pmksa = brcmf_cfg80211_del_pmksa,
5212         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5213         .start_ap = brcmf_cfg80211_start_ap,
5214         .stop_ap = brcmf_cfg80211_stop_ap,
5215         .change_beacon = brcmf_cfg80211_change_beacon,
5216         .del_station = brcmf_cfg80211_del_station,
5217         .change_station = brcmf_cfg80211_change_station,
5218         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5219         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5220         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5221         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5222         .remain_on_channel = brcmf_p2p_remain_on_channel,
5223         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5224         .get_channel = brcmf_cfg80211_get_channel,
5225         .start_p2p_device = brcmf_p2p_start_device,
5226         .stop_p2p_device = brcmf_p2p_stop_device,
5227         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5228         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5229         .tdls_oper = brcmf_cfg80211_tdls_oper,
5230 };
5231
5232 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5233                                            enum nl80211_iftype type)
5234 {
5235         struct brcmf_cfg80211_vif *vif_walk;
5236         struct brcmf_cfg80211_vif *vif;
5237         bool mbss;
5238
5239         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5240                   sizeof(*vif));
5241         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5242         if (!vif)
5243                 return ERR_PTR(-ENOMEM);
5244
5245         vif->wdev.wiphy = cfg->wiphy;
5246         vif->wdev.iftype = type;
5247
5248         brcmf_init_prof(&vif->profile);
5249
5250         if (type == NL80211_IFTYPE_AP) {
5251                 mbss = false;
5252                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5253                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5254                                 mbss = true;
5255                                 break;
5256                         }
5257                 }
5258                 vif->mbss = mbss;
5259         }
5260
5261         list_add_tail(&vif->list, &cfg->vif_list);
5262         return vif;
5263 }
5264
5265 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5266 {
5267         list_del(&vif->list);
5268         kfree(vif);
5269 }
5270
5271 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5272 {
5273         struct brcmf_cfg80211_vif *vif;
5274         struct brcmf_if *ifp;
5275
5276         ifp = netdev_priv(ndev);
5277         vif = ifp->vif;
5278
5279         if (vif)
5280                 brcmf_free_vif(vif);
5281         free_netdev(ndev);
5282 }
5283
5284 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
5285 {
5286         u32 event = e->event_code;
5287         u32 status = e->status;
5288
5289         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5290                 brcmf_dbg(CONN, "Processing set ssid\n");
5291                 return true;
5292         }
5293
5294         return false;
5295 }
5296
5297 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5298 {
5299         u32 event = e->event_code;
5300         u16 flags = e->flags;
5301
5302         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5303             (event == BRCMF_E_DISASSOC_IND) ||
5304             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5305                 brcmf_dbg(CONN, "Processing link down\n");
5306                 return true;
5307         }
5308         return false;
5309 }
5310
5311 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5312                                const struct brcmf_event_msg *e)
5313 {
5314         u32 event = e->event_code;
5315         u32 status = e->status;
5316
5317         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5318                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5319                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5320                 return true;
5321         }
5322
5323         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5324                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5325                 return true;
5326         }
5327
5328         return false;
5329 }
5330
5331 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5332 {
5333         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5334
5335         kfree(conn_info->req_ie);
5336         conn_info->req_ie = NULL;
5337         conn_info->req_ie_len = 0;
5338         kfree(conn_info->resp_ie);
5339         conn_info->resp_ie = NULL;
5340         conn_info->resp_ie_len = 0;
5341 }
5342
5343 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5344                                struct brcmf_if *ifp)
5345 {
5346         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5347         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5348         u32 req_len;
5349         u32 resp_len;
5350         s32 err = 0;
5351
5352         brcmf_clear_assoc_ies(cfg);
5353
5354         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5355                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5356         if (err) {
5357                 brcmf_err("could not get assoc info (%d)\n", err);
5358                 return err;
5359         }
5360         assoc_info =
5361                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5362         req_len = le32_to_cpu(assoc_info->req_len);
5363         resp_len = le32_to_cpu(assoc_info->resp_len);
5364         if (req_len) {
5365                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5366                                                cfg->extra_buf,
5367                                                WL_ASSOC_INFO_MAX);
5368                 if (err) {
5369                         brcmf_err("could not get assoc req (%d)\n", err);
5370                         return err;
5371                 }
5372                 conn_info->req_ie_len = req_len;
5373                 conn_info->req_ie =
5374                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5375                             GFP_KERNEL);
5376         } else {
5377                 conn_info->req_ie_len = 0;
5378                 conn_info->req_ie = NULL;
5379         }
5380         if (resp_len) {
5381                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5382                                                cfg->extra_buf,
5383                                                WL_ASSOC_INFO_MAX);
5384                 if (err) {
5385                         brcmf_err("could not get assoc resp (%d)\n", err);
5386                         return err;
5387                 }
5388                 conn_info->resp_ie_len = resp_len;
5389                 conn_info->resp_ie =
5390                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5391                             GFP_KERNEL);
5392         } else {
5393                 conn_info->resp_ie_len = 0;
5394                 conn_info->resp_ie = NULL;
5395         }
5396         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5397                   conn_info->req_ie_len, conn_info->resp_ie_len);
5398
5399         return err;
5400 }
5401
5402 static s32
5403 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5404                        struct net_device *ndev,
5405                        const struct brcmf_event_msg *e)
5406 {
5407         struct brcmf_if *ifp = netdev_priv(ndev);
5408         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5409         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5410         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5411         struct ieee80211_channel *notify_channel = NULL;
5412         struct ieee80211_supported_band *band;
5413         struct brcmf_bss_info_le *bi;
5414         struct brcmu_chan ch;
5415         u32 freq;
5416         s32 err = 0;
5417         u8 *buf;
5418
5419         brcmf_dbg(TRACE, "Enter\n");
5420
5421         brcmf_get_assoc_ies(cfg, ifp);
5422         memcpy(profile->bssid, e->addr, ETH_ALEN);
5423         brcmf_update_bss_info(cfg, ifp);
5424
5425         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5426         if (buf == NULL) {
5427                 err = -ENOMEM;
5428                 goto done;
5429         }
5430
5431         /* data sent to dongle has to be little endian */
5432         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5433         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5434                                      buf, WL_BSS_INFO_MAX);
5435
5436         if (err)
5437                 goto done;
5438
5439         bi = (struct brcmf_bss_info_le *)(buf + 4);
5440         ch.chspec = le16_to_cpu(bi->chanspec);
5441         cfg->d11inf.decchspec(&ch);
5442
5443         if (ch.band == BRCMU_CHAN_BAND_2G)
5444                 band = wiphy->bands[NL80211_BAND_2GHZ];
5445         else
5446                 band = wiphy->bands[NL80211_BAND_5GHZ];
5447
5448         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5449         notify_channel = ieee80211_get_channel(wiphy, freq);
5450
5451 done:
5452         kfree(buf);
5453         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
5454                         conn_info->req_ie, conn_info->req_ie_len,
5455                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
5456         brcmf_dbg(CONN, "Report roaming result\n");
5457
5458         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5459         brcmf_dbg(TRACE, "Exit\n");
5460         return err;
5461 }
5462
5463 static s32
5464 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5465                        struct net_device *ndev, const struct brcmf_event_msg *e,
5466                        bool completed)
5467 {
5468         struct brcmf_if *ifp = netdev_priv(ndev);
5469         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5470         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5471
5472         brcmf_dbg(TRACE, "Enter\n");
5473
5474         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5475                                &ifp->vif->sme_state)) {
5476                 if (completed) {
5477                         brcmf_get_assoc_ies(cfg, ifp);
5478                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5479                         brcmf_update_bss_info(cfg, ifp);
5480                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5481                                 &ifp->vif->sme_state);
5482                 }
5483                 cfg80211_connect_result(ndev,
5484                                         (u8 *)profile->bssid,
5485                                         conn_info->req_ie,
5486                                         conn_info->req_ie_len,
5487                                         conn_info->resp_ie,
5488                                         conn_info->resp_ie_len,
5489                                         completed ? WLAN_STATUS_SUCCESS :
5490                                                     WLAN_STATUS_AUTH_TIMEOUT,
5491                                         GFP_KERNEL);
5492                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5493                           completed ? "succeeded" : "failed");
5494         }
5495         brcmf_dbg(TRACE, "Exit\n");
5496         return 0;
5497 }
5498
5499 static s32
5500 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5501                                struct net_device *ndev,
5502                                const struct brcmf_event_msg *e, void *data)
5503 {
5504         static int generation;
5505         u32 event = e->event_code;
5506         u32 reason = e->reason;
5507         struct station_info sinfo;
5508
5509         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
5510         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5511             ndev != cfg_to_ndev(cfg)) {
5512                 brcmf_dbg(CONN, "AP mode link down\n");
5513                 complete(&cfg->vif_disabled);
5514                 return 0;
5515         }
5516
5517         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5518             (reason == BRCMF_E_STATUS_SUCCESS)) {
5519                 memset(&sinfo, 0, sizeof(sinfo));
5520                 if (!data) {
5521                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5522                         return -EINVAL;
5523                 }
5524                 sinfo.assoc_req_ies = data;
5525                 sinfo.assoc_req_ies_len = e->datalen;
5526                 generation++;
5527                 sinfo.generation = generation;
5528                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5529         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5530                    (event == BRCMF_E_DEAUTH_IND) ||
5531                    (event == BRCMF_E_DEAUTH)) {
5532                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5533         }
5534         return 0;
5535 }
5536
5537 static s32
5538 brcmf_notify_connect_status(struct brcmf_if *ifp,
5539                             const struct brcmf_event_msg *e, void *data)
5540 {
5541         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5542         struct net_device *ndev = ifp->ndev;
5543         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5544         struct ieee80211_channel *chan;
5545         s32 err = 0;
5546
5547         if ((e->event_code == BRCMF_E_DEAUTH) ||
5548             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5549             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5550             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5551                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5552         }
5553
5554         if (brcmf_is_apmode(ifp->vif)) {
5555                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5556         } else if (brcmf_is_linkup(e)) {
5557                 brcmf_dbg(CONN, "Linkup\n");
5558                 if (brcmf_is_ibssmode(ifp->vif)) {
5559                         brcmf_inform_ibss(cfg, ndev, e->addr);
5560                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5561                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5562                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5563                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5564                                   &ifp->vif->sme_state);
5565                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5566                                 &ifp->vif->sme_state);
5567                 } else
5568                         brcmf_bss_connect_done(cfg, ndev, e, true);
5569                 brcmf_net_setcarrier(ifp, true);
5570         } else if (brcmf_is_linkdown(e)) {
5571                 brcmf_dbg(CONN, "Linkdown\n");
5572                 if (!brcmf_is_ibssmode(ifp->vif)) {
5573                         brcmf_bss_connect_done(cfg, ndev, e, false);
5574                         brcmf_link_down(ifp->vif,
5575                                         brcmf_map_fw_linkdown_reason(e));
5576                         brcmf_init_prof(ndev_to_prof(ndev));
5577                         if (ndev != cfg_to_ndev(cfg))
5578                                 complete(&cfg->vif_disabled);
5579                         brcmf_net_setcarrier(ifp, false);
5580                 }
5581         } else if (brcmf_is_nonetwork(cfg, e)) {
5582                 if (brcmf_is_ibssmode(ifp->vif))
5583                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5584                                   &ifp->vif->sme_state);
5585                 else
5586                         brcmf_bss_connect_done(cfg, ndev, e, false);
5587         }
5588
5589         return err;
5590 }
5591
5592 static s32
5593 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5594                             const struct brcmf_event_msg *e, void *data)
5595 {
5596         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5597         u32 event = e->event_code;
5598         u32 status = e->status;
5599
5600         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5601                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5602                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5603                 else
5604                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5605         }
5606
5607         return 0;
5608 }
5609
5610 static s32
5611 brcmf_notify_mic_status(struct brcmf_if *ifp,
5612                         const struct brcmf_event_msg *e, void *data)
5613 {
5614         u16 flags = e->flags;
5615         enum nl80211_key_type key_type;
5616
5617         if (flags & BRCMF_EVENT_MSG_GROUP)
5618                 key_type = NL80211_KEYTYPE_GROUP;
5619         else
5620                 key_type = NL80211_KEYTYPE_PAIRWISE;
5621
5622         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5623                                      NULL, GFP_KERNEL);
5624
5625         return 0;
5626 }
5627
5628 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5629                                   const struct brcmf_event_msg *e, void *data)
5630 {
5631         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5632         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5633         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5634         struct brcmf_cfg80211_vif *vif;
5635
5636         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5637                   ifevent->action, ifevent->flags, ifevent->ifidx,
5638                   ifevent->bsscfgidx);
5639
5640         spin_lock(&event->vif_event_lock);
5641         event->action = ifevent->action;
5642         vif = event->vif;
5643
5644         switch (ifevent->action) {
5645         case BRCMF_E_IF_ADD:
5646                 /* waiting process may have timed out */
5647                 if (!cfg->vif_event.vif) {
5648                         spin_unlock(&event->vif_event_lock);
5649                         return -EBADF;
5650                 }
5651
5652                 ifp->vif = vif;
5653                 vif->ifp = ifp;
5654                 if (ifp->ndev) {
5655                         vif->wdev.netdev = ifp->ndev;
5656                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5657                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5658                 }
5659                 spin_unlock(&event->vif_event_lock);
5660                 wake_up(&event->vif_wq);
5661                 return 0;
5662
5663         case BRCMF_E_IF_DEL:
5664                 spin_unlock(&event->vif_event_lock);
5665                 /* event may not be upon user request */
5666                 if (brcmf_cfg80211_vif_event_armed(cfg))
5667                         wake_up(&event->vif_wq);
5668                 return 0;
5669
5670         case BRCMF_E_IF_CHANGE:
5671                 spin_unlock(&event->vif_event_lock);
5672                 wake_up(&event->vif_wq);
5673                 return 0;
5674
5675         default:
5676                 spin_unlock(&event->vif_event_lock);
5677                 break;
5678         }
5679         return -EINVAL;
5680 }
5681
5682 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5683 {
5684         conf->frag_threshold = (u32)-1;
5685         conf->rts_threshold = (u32)-1;
5686         conf->retry_short = (u32)-1;
5687         conf->retry_long = (u32)-1;
5688 }
5689
5690 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5691 {
5692         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5693                             brcmf_notify_connect_status);
5694         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5695                             brcmf_notify_connect_status);
5696         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5697                             brcmf_notify_connect_status);
5698         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5699                             brcmf_notify_connect_status);
5700         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5701                             brcmf_notify_connect_status);
5702         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5703                             brcmf_notify_connect_status);
5704         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5705                             brcmf_notify_roaming_status);
5706         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5707                             brcmf_notify_mic_status);
5708         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5709                             brcmf_notify_connect_status);
5710         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5711                             brcmf_notify_sched_scan_results);
5712         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5713                             brcmf_notify_vif_event);
5714         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5715                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5716         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5717                             brcmf_p2p_notify_listen_complete);
5718         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5719                             brcmf_p2p_notify_action_frame_rx);
5720         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5721                             brcmf_p2p_notify_action_tx_complete);
5722         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5723                             brcmf_p2p_notify_action_tx_complete);
5724 }
5725
5726 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5727 {
5728         kfree(cfg->conf);
5729         cfg->conf = NULL;
5730         kfree(cfg->extra_buf);
5731         cfg->extra_buf = NULL;
5732         kfree(cfg->wowl.nd);
5733         cfg->wowl.nd = NULL;
5734         kfree(cfg->wowl.nd_info);
5735         cfg->wowl.nd_info = NULL;
5736         kfree(cfg->escan_info.escan_buf);
5737         cfg->escan_info.escan_buf = NULL;
5738 }
5739
5740 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5741 {
5742         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5743         if (!cfg->conf)
5744                 goto init_priv_mem_out;
5745         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5746         if (!cfg->extra_buf)
5747                 goto init_priv_mem_out;
5748         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5749         if (!cfg->wowl.nd)
5750                 goto init_priv_mem_out;
5751         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5752                                     sizeof(struct cfg80211_wowlan_nd_match *),
5753                                     GFP_KERNEL);
5754         if (!cfg->wowl.nd_info)
5755                 goto init_priv_mem_out;
5756         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5757         if (!cfg->escan_info.escan_buf)
5758                 goto init_priv_mem_out;
5759
5760         return 0;
5761
5762 init_priv_mem_out:
5763         brcmf_deinit_priv_mem(cfg);
5764
5765         return -ENOMEM;
5766 }
5767
5768 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5769 {
5770         s32 err = 0;
5771
5772         cfg->scan_request = NULL;
5773         cfg->pwr_save = true;
5774         cfg->active_scan = true;        /* we do active scan per default */
5775         cfg->dongle_up = false;         /* dongle is not up yet */
5776         err = brcmf_init_priv_mem(cfg);
5777         if (err)
5778                 return err;
5779         brcmf_register_event_handlers(cfg);
5780         mutex_init(&cfg->usr_sync);
5781         brcmf_init_escan(cfg);
5782         brcmf_init_conf(cfg->conf);
5783         init_completion(&cfg->vif_disabled);
5784         return err;
5785 }
5786
5787 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5788 {
5789         cfg->dongle_up = false; /* dongle down */
5790         brcmf_abort_scanning(cfg);
5791         brcmf_deinit_priv_mem(cfg);
5792 }
5793
5794 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5795 {
5796         init_waitqueue_head(&event->vif_wq);
5797         spin_lock_init(&event->vif_event_lock);
5798 }
5799
5800 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5801 {
5802         s32 err;
5803         u32 bcn_timeout;
5804         __le32 roamtrigger[2];
5805         __le32 roam_delta[2];
5806
5807         /* Configure beacon timeout value based upon roaming setting */
5808         if (ifp->drvr->settings->roamoff)
5809                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5810         else
5811                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5812         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5813         if (err) {
5814                 brcmf_err("bcn_timeout error (%d)\n", err);
5815                 goto roam_setup_done;
5816         }
5817
5818         /* Enable/Disable built-in roaming to allow supplicant to take care of
5819          * roaming.
5820          */
5821         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5822                   ifp->drvr->settings->roamoff ? "Off" : "On");
5823         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5824                                       ifp->drvr->settings->roamoff);
5825         if (err) {
5826                 brcmf_err("roam_off error (%d)\n", err);
5827                 goto roam_setup_done;
5828         }
5829
5830         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5831         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5832         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5833                                      (void *)roamtrigger, sizeof(roamtrigger));
5834         if (err) {
5835                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5836                 goto roam_setup_done;
5837         }
5838
5839         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5840         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5841         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5842                                      (void *)roam_delta, sizeof(roam_delta));
5843         if (err) {
5844                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5845                 goto roam_setup_done;
5846         }
5847
5848 roam_setup_done:
5849         return err;
5850 }
5851
5852 static s32
5853 brcmf_dongle_scantime(struct brcmf_if *ifp)
5854 {
5855         s32 err = 0;
5856
5857         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5858                                     BRCMF_SCAN_CHANNEL_TIME);
5859         if (err) {
5860                 brcmf_err("Scan assoc time error (%d)\n", err);
5861                 goto dongle_scantime_out;
5862         }
5863         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5864                                     BRCMF_SCAN_UNASSOC_TIME);
5865         if (err) {
5866                 brcmf_err("Scan unassoc time error (%d)\n", err);
5867                 goto dongle_scantime_out;
5868         }
5869
5870         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5871                                     BRCMF_SCAN_PASSIVE_TIME);
5872         if (err) {
5873                 brcmf_err("Scan passive time error (%d)\n", err);
5874                 goto dongle_scantime_out;
5875         }
5876
5877 dongle_scantime_out:
5878         return err;
5879 }
5880
5881 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5882                                            struct brcmu_chan *ch)
5883 {
5884         u32 ht40_flag;
5885
5886         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5887         if (ch->sb == BRCMU_CHAN_SB_U) {
5888                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5889                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5890                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5891         } else {
5892                 /* It should be one of
5893                  * IEEE80211_CHAN_NO_HT40 or
5894                  * IEEE80211_CHAN_NO_HT40PLUS
5895                  */
5896                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5897                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5898                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5899         }
5900 }
5901
5902 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5903                                     u32 bw_cap[])
5904 {
5905         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5906         struct ieee80211_supported_band *band;
5907         struct ieee80211_channel *channel;
5908         struct wiphy *wiphy;
5909         struct brcmf_chanspec_list *list;
5910         struct brcmu_chan ch;
5911         int err;
5912         u8 *pbuf;
5913         u32 i, j;
5914         u32 total;
5915         u32 chaninfo;
5916         u32 index;
5917
5918         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5919
5920         if (pbuf == NULL)
5921                 return -ENOMEM;
5922
5923         list = (struct brcmf_chanspec_list *)pbuf;
5924
5925         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5926                                        BRCMF_DCMD_MEDLEN);
5927         if (err) {
5928                 brcmf_err("get chanspecs error (%d)\n", err);
5929                 goto fail_pbuf;
5930         }
5931
5932         wiphy = cfg_to_wiphy(cfg);
5933         band = wiphy->bands[NL80211_BAND_2GHZ];
5934         if (band)
5935                 for (i = 0; i < band->n_channels; i++)
5936                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5937         band = wiphy->bands[NL80211_BAND_5GHZ];
5938         if (band)
5939                 for (i = 0; i < band->n_channels; i++)
5940                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5941
5942         total = le32_to_cpu(list->count);
5943         for (i = 0; i < total; i++) {
5944                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5945                 cfg->d11inf.decchspec(&ch);
5946
5947                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5948                         band = wiphy->bands[NL80211_BAND_2GHZ];
5949                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5950                         band = wiphy->bands[NL80211_BAND_5GHZ];
5951                 } else {
5952                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5953                         continue;
5954                 }
5955                 if (!band)
5956                         continue;
5957                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5958                     ch.bw == BRCMU_CHAN_BW_40)
5959                         continue;
5960                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5961                     ch.bw == BRCMU_CHAN_BW_80)
5962                         continue;
5963
5964                 channel = band->channels;
5965                 index = band->n_channels;
5966                 for (j = 0; j < band->n_channels; j++) {
5967                         if (channel[j].hw_value == ch.control_ch_num) {
5968                                 index = j;
5969                                 break;
5970                         }
5971                 }
5972                 channel[index].center_freq =
5973                         ieee80211_channel_to_frequency(ch.control_ch_num,
5974                                                        band->band);
5975                 channel[index].hw_value = ch.control_ch_num;
5976
5977                 /* assuming the chanspecs order is HT20,
5978                  * HT40 upper, HT40 lower, and VHT80.
5979                  */
5980                 if (ch.bw == BRCMU_CHAN_BW_80) {
5981                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5982                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5983                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5984                 } else {
5985                         /* enable the channel and disable other bandwidths
5986                          * for now as mentioned order assure they are enabled
5987                          * for subsequent chanspecs.
5988                          */
5989                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5990                                                IEEE80211_CHAN_NO_80MHZ;
5991                         ch.bw = BRCMU_CHAN_BW_20;
5992                         cfg->d11inf.encchspec(&ch);
5993                         chaninfo = ch.chspec;
5994                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5995                                                        &chaninfo);
5996                         if (!err) {
5997                                 if (chaninfo & WL_CHAN_RADAR)
5998                                         channel[index].flags |=
5999                                                 (IEEE80211_CHAN_RADAR |
6000                                                  IEEE80211_CHAN_NO_IR);
6001                                 if (chaninfo & WL_CHAN_PASSIVE)
6002                                         channel[index].flags |=
6003                                                 IEEE80211_CHAN_NO_IR;
6004                         }
6005                 }
6006         }
6007
6008 fail_pbuf:
6009         kfree(pbuf);
6010         return err;
6011 }
6012
6013 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6014 {
6015         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6016         struct ieee80211_supported_band *band;
6017         struct brcmf_fil_bwcap_le band_bwcap;
6018         struct brcmf_chanspec_list *list;
6019         u8 *pbuf;
6020         u32 val;
6021         int err;
6022         struct brcmu_chan ch;
6023         u32 num_chan;
6024         int i, j;
6025
6026         /* verify support for bw_cap command */
6027         val = WLC_BAND_5G;
6028         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6029
6030         if (!err) {
6031                 /* only set 2G bandwidth using bw_cap command */
6032                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6033                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6034                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6035                                                sizeof(band_bwcap));
6036         } else {
6037                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6038                 val = WLC_N_BW_40ALL;
6039                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6040         }
6041
6042         if (!err) {
6043                 /* update channel info in 2G band */
6044                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6045
6046                 if (pbuf == NULL)
6047                         return -ENOMEM;
6048
6049                 ch.band = BRCMU_CHAN_BAND_2G;
6050                 ch.bw = BRCMU_CHAN_BW_40;
6051                 ch.sb = BRCMU_CHAN_SB_NONE;
6052                 ch.chnum = 0;
6053                 cfg->d11inf.encchspec(&ch);
6054
6055                 /* pass encoded chanspec in query */
6056                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6057
6058                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6059                                                BRCMF_DCMD_MEDLEN);
6060                 if (err) {
6061                         brcmf_err("get chanspecs error (%d)\n", err);
6062                         kfree(pbuf);
6063                         return err;
6064                 }
6065
6066                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6067                 list = (struct brcmf_chanspec_list *)pbuf;
6068                 num_chan = le32_to_cpu(list->count);
6069                 for (i = 0; i < num_chan; i++) {
6070                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6071                         cfg->d11inf.decchspec(&ch);
6072                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6073                                 continue;
6074                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6075                                 continue;
6076                         for (j = 0; j < band->n_channels; j++) {
6077                                 if (band->channels[j].hw_value == ch.control_ch_num)
6078                                         break;
6079                         }
6080                         if (WARN_ON(j == band->n_channels))
6081                                 continue;
6082
6083                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6084                 }
6085                 kfree(pbuf);
6086         }
6087         return err;
6088 }
6089
6090 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6091 {
6092         u32 band, mimo_bwcap;
6093         int err;
6094
6095         band = WLC_BAND_2G;
6096         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6097         if (!err) {
6098                 bw_cap[NL80211_BAND_2GHZ] = band;
6099                 band = WLC_BAND_5G;
6100                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6101                 if (!err) {
6102                         bw_cap[NL80211_BAND_5GHZ] = band;
6103                         return;
6104                 }
6105                 WARN_ON(1);
6106                 return;
6107         }
6108         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6109         mimo_bwcap = 0;
6110         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6111         if (err)
6112                 /* assume 20MHz if firmware does not give a clue */
6113                 mimo_bwcap = WLC_N_BW_20ALL;
6114
6115         switch (mimo_bwcap) {
6116         case WLC_N_BW_40ALL:
6117                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6118                 /* fall-thru */
6119         case WLC_N_BW_20IN2G_40IN5G:
6120                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6121                 /* fall-thru */
6122         case WLC_N_BW_20ALL:
6123                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6124                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6125                 break;
6126         default:
6127                 brcmf_err("invalid mimo_bw_cap value\n");
6128         }
6129 }
6130
6131 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6132                                 u32 bw_cap[2], u32 nchain)
6133 {
6134         band->ht_cap.ht_supported = true;
6135         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6136                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6137                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6138         }
6139         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6140         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6141         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6142         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6143         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6144         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6145 }
6146
6147 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6148 {
6149         u16 mcs_map;
6150         int i;
6151
6152         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6153                 mcs_map = (mcs_map << 2) | supp;
6154
6155         return cpu_to_le16(mcs_map);
6156 }
6157
6158 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6159                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6160                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6161 {
6162         __le16 mcs_map;
6163
6164         /* not allowed in 2.4G band */
6165         if (band->band == NL80211_BAND_2GHZ)
6166                 return;
6167
6168         band->vht_cap.vht_supported = true;
6169         /* 80MHz is mandatory */
6170         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6171         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6172                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6173                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6174         }
6175         /* all support 256-QAM */
6176         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6177         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6178         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6179
6180         /* Beamforming support information */
6181         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6182                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6183         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6184                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6185         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6186                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6187         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6188                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6189
6190         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6191                 band->vht_cap.cap |=
6192                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6193                 band->vht_cap.cap |= ((txstreams - 1) <<
6194                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6195                 band->vht_cap.cap |=
6196                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6197         }
6198 }
6199
6200 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6201 {
6202         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6203         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6204         u32 nmode = 0;
6205         u32 vhtmode = 0;
6206         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6207         u32 rxchain;
6208         u32 nchain;
6209         int err;
6210         s32 i;
6211         struct ieee80211_supported_band *band;
6212         u32 txstreams = 0;
6213         u32 txbf_bfe_cap = 0;
6214         u32 txbf_bfr_cap = 0;
6215
6216         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6217         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6218         if (err) {
6219                 brcmf_err("nmode error (%d)\n", err);
6220         } else {
6221                 brcmf_get_bwcap(ifp, bw_cap);
6222         }
6223         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6224                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6225                   bw_cap[NL80211_BAND_5GHZ]);
6226
6227         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6228         if (err) {
6229                 brcmf_err("rxchain error (%d)\n", err);
6230                 nchain = 1;
6231         } else {
6232                 for (nchain = 0; rxchain; nchain++)
6233                         rxchain = rxchain & (rxchain - 1);
6234         }
6235         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6236
6237         err = brcmf_construct_chaninfo(cfg, bw_cap);
6238         if (err) {
6239                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6240                 return err;
6241         }
6242
6243         if (vhtmode) {
6244                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6245                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6246                                               &txbf_bfe_cap);
6247                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6248                                               &txbf_bfr_cap);
6249         }
6250
6251         wiphy = cfg_to_wiphy(cfg);
6252         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6253                 band = wiphy->bands[i];
6254                 if (band == NULL)
6255                         continue;
6256
6257                 if (nmode)
6258                         brcmf_update_ht_cap(band, bw_cap, nchain);
6259                 if (vhtmode)
6260                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6261                                              txbf_bfe_cap, txbf_bfr_cap);
6262         }
6263
6264         return 0;
6265 }
6266
6267 static const struct ieee80211_txrx_stypes
6268 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6269         [NL80211_IFTYPE_STATION] = {
6270                 .tx = 0xffff,
6271                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6272                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6273         },
6274         [NL80211_IFTYPE_P2P_CLIENT] = {
6275                 .tx = 0xffff,
6276                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6277                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6278         },
6279         [NL80211_IFTYPE_P2P_GO] = {
6280                 .tx = 0xffff,
6281                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6282                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6283                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6284                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6285                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6286                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6287                       BIT(IEEE80211_STYPE_ACTION >> 4)
6288         },
6289         [NL80211_IFTYPE_P2P_DEVICE] = {
6290                 .tx = 0xffff,
6291                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6292                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6293         }
6294 };
6295
6296 /**
6297  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6298  *
6299  * @wiphy: wiphy object.
6300  * @ifp: interface object needed for feat module api.
6301  *
6302  * The interface modes and combinations are determined dynamically here
6303  * based on firmware functionality.
6304  *
6305  * no p2p and no mbss:
6306  *
6307  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6308  *
6309  * no p2p and mbss:
6310  *
6311  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6312  *      #AP <= 4, matching BI, channels = 1, 4 total
6313  *
6314  * p2p, no mchan, and mbss:
6315  *
6316  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6317  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6318  *      #AP <= 4, matching BI, channels = 1, 4 total
6319  *
6320  * p2p, mchan, and mbss:
6321  *
6322  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6323  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6324  *      #AP <= 4, matching BI, channels = 1, 4 total
6325  */
6326 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6327 {
6328         struct ieee80211_iface_combination *combo = NULL;
6329         struct ieee80211_iface_limit *c0_limits = NULL;
6330         struct ieee80211_iface_limit *p2p_limits = NULL;
6331         struct ieee80211_iface_limit *mbss_limits = NULL;
6332         bool mbss, p2p;
6333         int i, c, n_combos;
6334
6335         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6336         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6337
6338         n_combos = 1 + !!p2p + !!mbss;
6339         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6340         if (!combo)
6341                 goto err;
6342
6343         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6344                                  BIT(NL80211_IFTYPE_ADHOC) |
6345                                  BIT(NL80211_IFTYPE_AP);
6346
6347         c = 0;
6348         i = 0;
6349         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6350         if (!c0_limits)
6351                 goto err;
6352         c0_limits[i].max = 1;
6353         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6354         if (p2p) {
6355                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6356                         combo[c].num_different_channels = 2;
6357                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6358                                           BIT(NL80211_IFTYPE_P2P_GO) |
6359                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6360                 c0_limits[i].max = 1;
6361                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6362                 c0_limits[i].max = 1;
6363                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6364                                        BIT(NL80211_IFTYPE_P2P_GO);
6365         } else {
6366                 c0_limits[i].max = 1;
6367                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6368         }
6369         combo[c].num_different_channels = 1;
6370         combo[c].max_interfaces = i;
6371         combo[c].n_limits = i;
6372         combo[c].limits = c0_limits;
6373
6374         if (p2p) {
6375                 c++;
6376                 i = 0;
6377                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6378                 if (!p2p_limits)
6379                         goto err;
6380                 p2p_limits[i].max = 1;
6381                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6382                 p2p_limits[i].max = 1;
6383                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6384                 p2p_limits[i].max = 1;
6385                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6386                 p2p_limits[i].max = 1;
6387                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6388                 combo[c].num_different_channels = 1;
6389                 combo[c].max_interfaces = i;
6390                 combo[c].n_limits = i;
6391                 combo[c].limits = p2p_limits;
6392         }
6393
6394         if (mbss) {
6395                 c++;
6396                 i = 0;
6397                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6398                 if (!mbss_limits)
6399                         goto err;
6400                 mbss_limits[i].max = 4;
6401                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6402                 combo[c].beacon_int_infra_match = true;
6403                 combo[c].num_different_channels = 1;
6404                 combo[c].max_interfaces = 4;
6405                 combo[c].n_limits = i;
6406                 combo[c].limits = mbss_limits;
6407         }
6408
6409         wiphy->n_iface_combinations = n_combos;
6410         wiphy->iface_combinations = combo;
6411         return 0;
6412
6413 err:
6414         kfree(c0_limits);
6415         kfree(p2p_limits);
6416         kfree(mbss_limits);
6417         kfree(combo);
6418         return -ENOMEM;
6419 }
6420
6421 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
6422 {
6423         /* scheduled scan settings */
6424         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
6425         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6426         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6427         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
6428 }
6429
6430 #ifdef CONFIG_PM
6431 static struct wiphy_wowlan_support brcmf_wowlan_support = {
6432         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6433         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6434         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6435         .pattern_min_len = 1,
6436         .max_pkt_offset = 1500,
6437 };
6438 #endif
6439
6440 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6441 {
6442 #ifdef CONFIG_PM
6443         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6444
6445         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6446                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6447                         brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
6448                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6449                 }
6450         }
6451         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6452                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6453                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6454         }
6455
6456         wiphy->wowlan = &brcmf_wowlan_support;
6457 #endif
6458 }
6459
6460 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6461 {
6462         struct brcmf_pub *drvr = ifp->drvr;
6463         const struct ieee80211_iface_combination *combo;
6464         struct ieee80211_supported_band *band;
6465         u16 max_interfaces = 0;
6466         __le32 bandlist[3];
6467         u32 n_bands;
6468         int err, i;
6469
6470         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6471         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6472         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6473
6474         err = brcmf_setup_ifmodes(wiphy, ifp);
6475         if (err)
6476                 return err;
6477
6478         for (i = 0, combo = wiphy->iface_combinations;
6479              i < wiphy->n_iface_combinations; i++, combo++) {
6480                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6481         }
6482
6483         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6484              i++) {
6485                 u8 *addr = drvr->addresses[i].addr;
6486
6487                 memcpy(addr, drvr->mac, ETH_ALEN);
6488                 if (i) {
6489                         addr[0] |= BIT(1);
6490                         addr[ETH_ALEN - 1] ^= i;
6491                 }
6492         }
6493         wiphy->addresses = drvr->addresses;
6494         wiphy->n_addresses = i;
6495
6496         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6497         wiphy->cipher_suites = brcmf_cipher_suites;
6498         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6499         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6500                 wiphy->n_cipher_suites--;
6501         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6502                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6503                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6504
6505         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
6506                         WIPHY_FLAG_OFFCHAN_TX |
6507                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6508         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6509                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6510         if (!ifp->drvr->settings->roamoff)
6511                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6512         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6513         wiphy->max_remain_on_channel_duration = 5000;
6514         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
6515                 brcmf_wiphy_pno_params(wiphy);
6516
6517         /* vendor commands/events support */
6518         wiphy->vendor_commands = brcmf_vendor_cmds;
6519         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6520
6521         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6522                 brcmf_wiphy_wowl_params(wiphy, ifp);
6523         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6524                                      sizeof(bandlist));
6525         if (err) {
6526                 brcmf_err("could not obtain band info: err=%d\n", err);
6527                 return err;
6528         }
6529         /* first entry in bandlist is number of bands */
6530         n_bands = le32_to_cpu(bandlist[0]);
6531         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6532                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6533                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6534                                        GFP_KERNEL);
6535                         if (!band)
6536                                 return -ENOMEM;
6537
6538                         band->channels = kmemdup(&__wl_2ghz_channels,
6539                                                  sizeof(__wl_2ghz_channels),
6540                                                  GFP_KERNEL);
6541                         if (!band->channels) {
6542                                 kfree(band);
6543                                 return -ENOMEM;
6544                         }
6545
6546                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6547                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6548                 }
6549                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6550                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6551                                        GFP_KERNEL);
6552                         if (!band)
6553                                 return -ENOMEM;
6554
6555                         band->channels = kmemdup(&__wl_5ghz_channels,
6556                                                  sizeof(__wl_5ghz_channels),
6557                                                  GFP_KERNEL);
6558                         if (!band->channels) {
6559                                 kfree(band);
6560                                 return -ENOMEM;
6561                         }
6562
6563                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6564                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6565                 }
6566         }
6567         err = brcmf_setup_wiphybands(wiphy);
6568         return err;
6569 }
6570
6571 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6572 {
6573         struct net_device *ndev;
6574         struct wireless_dev *wdev;
6575         struct brcmf_if *ifp;
6576         s32 power_mode;
6577         s32 err = 0;
6578
6579         if (cfg->dongle_up)
6580                 return err;
6581
6582         ndev = cfg_to_ndev(cfg);
6583         wdev = ndev->ieee80211_ptr;
6584         ifp = netdev_priv(ndev);
6585
6586         /* make sure RF is ready for work */
6587         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6588
6589         brcmf_dongle_scantime(ifp);
6590
6591         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6592         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6593         if (err)
6594                 goto default_conf_out;
6595         brcmf_dbg(INFO, "power save set to %s\n",
6596                   (power_mode ? "enabled" : "disabled"));
6597
6598         err = brcmf_dongle_roam(ifp);
6599         if (err)
6600                 goto default_conf_out;
6601         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6602                                           NULL, NULL);
6603         if (err)
6604                 goto default_conf_out;
6605
6606         brcmf_configure_arp_nd_offload(ifp, true);
6607
6608         cfg->dongle_up = true;
6609 default_conf_out:
6610
6611         return err;
6612
6613 }
6614
6615 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6616 {
6617         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6618
6619         return brcmf_config_dongle(ifp->drvr->config);
6620 }
6621
6622 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6623 {
6624         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6625
6626         /*
6627          * While going down, if associated with AP disassociate
6628          * from AP to save power
6629          */
6630         if (check_vif_up(ifp->vif)) {
6631                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6632
6633                 /* Make sure WPA_Supplicant receives all the event
6634                    generated due to DISASSOC call to the fw to keep
6635                    the state fw and WPA_Supplicant state consistent
6636                  */
6637                 brcmf_delay(500);
6638         }
6639
6640         brcmf_abort_scanning(cfg);
6641         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6642
6643         return 0;
6644 }
6645
6646 s32 brcmf_cfg80211_up(struct net_device *ndev)
6647 {
6648         struct brcmf_if *ifp = netdev_priv(ndev);
6649         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6650         s32 err = 0;
6651
6652         mutex_lock(&cfg->usr_sync);
6653         err = __brcmf_cfg80211_up(ifp);
6654         mutex_unlock(&cfg->usr_sync);
6655
6656         return err;
6657 }
6658
6659 s32 brcmf_cfg80211_down(struct net_device *ndev)
6660 {
6661         struct brcmf_if *ifp = netdev_priv(ndev);
6662         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6663         s32 err = 0;
6664
6665         mutex_lock(&cfg->usr_sync);
6666         err = __brcmf_cfg80211_down(ifp);
6667         mutex_unlock(&cfg->usr_sync);
6668
6669         return err;
6670 }
6671
6672 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6673 {
6674         struct wireless_dev *wdev = &ifp->vif->wdev;
6675
6676         return wdev->iftype;
6677 }
6678
6679 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6680                              unsigned long state)
6681 {
6682         struct brcmf_cfg80211_vif *vif;
6683
6684         list_for_each_entry(vif, &cfg->vif_list, list) {
6685                 if (test_bit(state, &vif->sme_state))
6686                         return true;
6687         }
6688         return false;
6689 }
6690
6691 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6692                                     u8 action)
6693 {
6694         u8 evt_action;
6695
6696         spin_lock(&event->vif_event_lock);
6697         evt_action = event->action;
6698         spin_unlock(&event->vif_event_lock);
6699         return evt_action == action;
6700 }
6701
6702 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6703                                   struct brcmf_cfg80211_vif *vif)
6704 {
6705         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6706
6707         spin_lock(&event->vif_event_lock);
6708         event->vif = vif;
6709         event->action = 0;
6710         spin_unlock(&event->vif_event_lock);
6711 }
6712
6713 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6714 {
6715         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6716         bool armed;
6717
6718         spin_lock(&event->vif_event_lock);
6719         armed = event->vif != NULL;
6720         spin_unlock(&event->vif_event_lock);
6721
6722         return armed;
6723 }
6724
6725 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6726                                   u8 action, ulong timeout)
6727 {
6728         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6729
6730         return wait_event_timeout(event->vif_wq,
6731                                   vif_event_equals(event, action), timeout);
6732 }
6733
6734 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6735                                         struct brcmf_fil_country_le *ccreq)
6736 {
6737         struct brcmfmac_pd_cc *country_codes;
6738         struct brcmfmac_pd_cc_entry *cc;
6739         s32 found_index;
6740         int i;
6741
6742         country_codes = drvr->settings->country_codes;
6743         if (!country_codes) {
6744                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6745                 return -EINVAL;
6746         }
6747
6748         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6749             (alpha2[1] == ccreq->country_abbrev[1])) {
6750                 brcmf_dbg(TRACE, "Country code already set\n");
6751                 return -EAGAIN;
6752         }
6753
6754         found_index = -1;
6755         for (i = 0; i < country_codes->table_size; i++) {
6756                 cc = &country_codes->table[i];
6757                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6758                         found_index = i;
6759                 if ((cc->iso3166[0] == alpha2[0]) &&
6760                     (cc->iso3166[1] == alpha2[1])) {
6761                         found_index = i;
6762                         break;
6763                 }
6764         }
6765         if (found_index == -1) {
6766                 brcmf_dbg(TRACE, "No country code match found\n");
6767                 return -EINVAL;
6768         }
6769         memset(ccreq, 0, sizeof(*ccreq));
6770         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6771         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6772                BRCMF_COUNTRY_BUF_SZ);
6773         ccreq->country_abbrev[0] = alpha2[0];
6774         ccreq->country_abbrev[1] = alpha2[1];
6775         ccreq->country_abbrev[2] = 0;
6776
6777         return 0;
6778 }
6779
6780 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6781                                         struct regulatory_request *req)
6782 {
6783         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6784         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6785         struct brcmf_fil_country_le ccreq;
6786         s32 err;
6787         int i;
6788
6789         /* ignore non-ISO3166 country codes */
6790         for (i = 0; i < sizeof(req->alpha2); i++)
6791                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6792                         brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
6793                                   req->alpha2[0], req->alpha2[1]);
6794                         return;
6795                 }
6796
6797         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6798                   req->alpha2[0], req->alpha2[1]);
6799
6800         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6801         if (err) {
6802                 brcmf_err("Country code iovar returned err = %d\n", err);
6803                 return;
6804         }
6805
6806         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6807         if (err)
6808                 return;
6809
6810         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6811         if (err) {
6812                 brcmf_err("Firmware rejected country setting\n");
6813                 return;
6814         }
6815         brcmf_setup_wiphybands(wiphy);
6816 }
6817
6818 static void brcmf_free_wiphy(struct wiphy *wiphy)
6819 {
6820         int i;
6821
6822         if (!wiphy)
6823                 return;
6824
6825         if (wiphy->iface_combinations) {
6826                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6827                         kfree(wiphy->iface_combinations[i].limits);
6828         }
6829         kfree(wiphy->iface_combinations);
6830         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6831                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6832                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6833         }
6834         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6835                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6836                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6837         }
6838         wiphy_free(wiphy);
6839 }
6840
6841 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6842                                                   struct device *busdev,
6843                                                   bool p2pdev_forced)
6844 {
6845         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6846         struct brcmf_cfg80211_info *cfg;
6847         struct wiphy *wiphy;
6848         struct cfg80211_ops *ops;
6849         struct brcmf_cfg80211_vif *vif;
6850         struct brcmf_if *ifp;
6851         s32 err = 0;
6852         s32 io_type;
6853         u16 *cap = NULL;
6854
6855         if (!ndev) {
6856                 brcmf_err("ndev is invalid\n");
6857                 return NULL;
6858         }
6859
6860         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6861         if (!ops)
6862                 return NULL;
6863
6864         ifp = netdev_priv(ndev);
6865 #ifdef CONFIG_PM
6866         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6867                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6868 #endif
6869         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
6870         if (!wiphy) {
6871                 brcmf_err("Could not allocate wiphy device\n");
6872                 return NULL;
6873         }
6874         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6875         set_wiphy_dev(wiphy, busdev);
6876
6877         cfg = wiphy_priv(wiphy);
6878         cfg->wiphy = wiphy;
6879         cfg->ops = ops;
6880         cfg->pub = drvr;
6881         init_vif_event(&cfg->vif_event);
6882         INIT_LIST_HEAD(&cfg->vif_list);
6883
6884         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
6885         if (IS_ERR(vif))
6886                 goto wiphy_out;
6887
6888         vif->ifp = ifp;
6889         vif->wdev.netdev = ndev;
6890         ndev->ieee80211_ptr = &vif->wdev;
6891         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6892
6893         err = wl_init_priv(cfg);
6894         if (err) {
6895                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6896                 brcmf_free_vif(vif);
6897                 goto wiphy_out;
6898         }
6899         ifp->vif = vif;
6900
6901         /* determine d11 io type before wiphy setup */
6902         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6903         if (err) {
6904                 brcmf_err("Failed to get D11 version (%d)\n", err);
6905                 goto priv_out;
6906         }
6907         cfg->d11inf.io_type = (u8)io_type;
6908         brcmu_d11_attach(&cfg->d11inf);
6909
6910         err = brcmf_setup_wiphy(wiphy, ifp);
6911         if (err < 0)
6912                 goto priv_out;
6913
6914         brcmf_dbg(INFO, "Registering custom regulatory\n");
6915         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6916         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6917         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6918
6919         /* firmware defaults to 40MHz disabled in 2G band. We signal
6920          * cfg80211 here that we do and have it decide we can enable
6921          * it. But first check if device does support 2G operation.
6922          */
6923         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6924                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6925                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6926         }
6927         err = wiphy_register(wiphy);
6928         if (err < 0) {
6929                 brcmf_err("Could not register wiphy device (%d)\n", err);
6930                 goto priv_out;
6931         }
6932
6933         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6934          * setup 40MHz in 2GHz band and enable OBSS scanning.
6935          */
6936         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6937                 err = brcmf_enable_bw40_2g(cfg);
6938                 if (!err)
6939                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6940                                                       BRCMF_OBSS_COEX_AUTO);
6941                 else
6942                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6943         }
6944         /* p2p might require that "if-events" get processed by fweh. So
6945          * activate the already registered event handlers now and activate
6946          * the rest when initialization has completed. drvr->config needs to
6947          * be assigned before activating events.
6948          */
6949         drvr->config = cfg;
6950         err = brcmf_fweh_activate_events(ifp);
6951         if (err) {
6952                 brcmf_err("FWEH activation failed (%d)\n", err);
6953                 goto wiphy_unreg_out;
6954         }
6955
6956         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6957         if (err) {
6958                 brcmf_err("P2P initilisation failed (%d)\n", err);
6959                 goto wiphy_unreg_out;
6960         }
6961         err = brcmf_btcoex_attach(cfg);
6962         if (err) {
6963                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6964                 brcmf_p2p_detach(&cfg->p2p);
6965                 goto wiphy_unreg_out;
6966         }
6967
6968         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6969                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6970                 if (err) {
6971                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6972                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6973                 } else {
6974                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6975                                             brcmf_notify_tdls_peer_event);
6976                 }
6977         }
6978
6979         /* (re-) activate FWEH event handling */
6980         err = brcmf_fweh_activate_events(ifp);
6981         if (err) {
6982                 brcmf_err("FWEH activation failed (%d)\n", err);
6983                 goto wiphy_unreg_out;
6984         }
6985
6986         /* Fill in some of the advertised nl80211 supported features */
6987         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
6988                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6989 #ifdef CONFIG_PM
6990                 if (wiphy->wowlan &&
6991                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
6992                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6993 #endif
6994         }
6995
6996         return cfg;
6997
6998 wiphy_unreg_out:
6999         wiphy_unregister(cfg->wiphy);
7000 priv_out:
7001         wl_deinit_priv(cfg);
7002         brcmf_free_vif(vif);
7003         ifp->vif = NULL;
7004 wiphy_out:
7005         brcmf_free_wiphy(wiphy);
7006         kfree(ops);
7007         return NULL;
7008 }
7009
7010 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7011 {
7012         if (!cfg)
7013                 return;
7014
7015         brcmf_btcoex_detach(cfg);
7016         wiphy_unregister(cfg->wiphy);
7017         kfree(cfg->ops);
7018         wl_deinit_priv(cfg);
7019         brcmf_free_wiphy(cfg->wiphy);
7020 }