drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41
  42 #define BRCMF_SCAN_IE_LEN_MAX           2048
  43 #define BRCMF_PNO_VERSION               2
  44 #define BRCMF_PNO_TIME                  30
  45 #define BRCMF_PNO_REPEAT                4
  46 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  47 #define BRCMF_PNO_MAX_PFN_COUNT         16
  48 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  49 #define BRCMF_PNO_HIDDEN_BIT            2
  50 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  51 #define BRCMF_PNO_SCAN_COMPLETE         1
  52 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  53
  54 #define BRCMF_IFACE_MAX_CNT             3
  55
  56 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  57 #define WPA_OUI_TYPE                    1
  58 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  59 #define WME_OUI_TYPE                    2
  60 #define WPS_OUI_TYPE                    4
  61
  62 #define VS_IE_FIXED_HDR_LEN             6
  63 #define WPA_IE_VERSION_LEN              2
  64 #define WPA_IE_MIN_OUI_LEN              4
  65 #define WPA_IE_SUITE_COUNT_LEN          2
  66
  67 #define WPA_CIPHER_NONE                 0       /* None */
  68 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  69 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  70 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  71 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  72
  73 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  74 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  75 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  76 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  77 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    0x000C
  78
  79 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  80                                                  * string :"add", "del" (+ NUL)
  81                                                  */
  82 #define VNDR_IE_COUNT_OFFSET            4
  83 #define VNDR_IE_PKTFLAG_OFFSET          8
  84 #define VNDR_IE_VSIE_OFFSET             12
  85 #define VNDR_IE_HDR_SIZE                12
  86 #define VNDR_IE_PARSE_LIMIT             5
  87
  88 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  89 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  90
  91 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  92 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  93 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  94
  95 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  96         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  97
  98 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
  99 {
 100         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 101                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 102                           vif->sme_state);
 103                 return false;
 104         }
 105         return true;
 106 }
 107
 108 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 static struct ieee80211_rate __wl_rates[] = {
 117         RATETAB_ENT(BRCM_RATE_1M, 0),
 118         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 119         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_6M, 0),
 122         RATETAB_ENT(BRCM_RATE_9M, 0),
 123         RATETAB_ENT(BRCM_RATE_12M, 0),
 124         RATETAB_ENT(BRCM_RATE_18M, 0),
 125         RATETAB_ENT(BRCM_RATE_24M, 0),
 126         RATETAB_ENT(BRCM_RATE_36M, 0),
 127         RATETAB_ENT(BRCM_RATE_48M, 0),
 128         RATETAB_ENT(BRCM_RATE_54M, 0),
 129 };
 130
 131 #define wl_a_rates              (__wl_rates + 4)
 132 #define wl_a_rates_size 8
 133 #define wl_g_rates              (__wl_rates + 0)
 134 #define wl_g_rates_size 12
 135
 136 /* Band templates duplicated per wiphy. The channel info
 137  * is filled in after querying the device.
 138  */
 139 static const struct ieee80211_supported_band __wl_band_2ghz = {
 140         .band = IEEE80211_BAND_2GHZ,
 141         .bitrates = wl_g_rates,
 142         .n_bitrates = wl_g_rates_size,
 143 };
 144
 145 static const struct ieee80211_supported_band __wl_band_5ghz_a = {
 146         .band = IEEE80211_BAND_5GHZ,
 147         .bitrates = wl_a_rates,
 148         .n_bitrates = wl_a_rates_size,
 149 };
 150
 151 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 152  * By default world regulatory domain defined in reg.c puts the flags
 153  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 154  * With respect to these flags, wpa_supplicant doesn't * start p2p
 155  * operations on 5GHz channels. All the changes in world regulatory
 156  * domain are to be done here.
 157  */
 158 static const struct ieee80211_regdomain brcmf_regdom = {
 159         .n_reg_rules = 4,
 160         .alpha2 =  "99",
 161         .reg_rules = {
 162                 /* IEEE 802.11b/g, channels 1..11 */
 163                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 164                 /* If any */
 165                 /* IEEE 802.11 channel 14 - Only JP enables
 166                  * this and for 802.11b only
 167                  */
 168                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 169                 /* IEEE 802.11a, channel 36..64 */
 170                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 171                 /* IEEE 802.11a, channel 100..165 */
 172                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 173 };
 174
 175 static const u32 __wl_cipher_suites[] = {
 176         WLAN_CIPHER_SUITE_WEP40,
 177         WLAN_CIPHER_SUITE_WEP104,
 178         WLAN_CIPHER_SUITE_TKIP,
 179         WLAN_CIPHER_SUITE_CCMP,
 180         WLAN_CIPHER_SUITE_AES_CMAC,
 181 };
 182
 183 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 184 struct brcmf_vs_tlv {
 185         u8 id;
 186         u8 len;
 187         u8 oui[3];
 188         u8 oui_type;
 189 };
 190
 191 struct parsed_vndr_ie_info {
 192         u8 *ie_ptr;
 193         u32 ie_len;     /* total length including id & length field */
 194         struct brcmf_vs_tlv vndrie;
 195 };
 196
 197 struct parsed_vndr_ies {
 198         u32 count;
 199         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 200 };
 201
 202 static int brcmf_roamoff;
 203 module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
 204 MODULE_PARM_DESC(roamoff, "do not use internal roaming engine");
 205
 206 /* Quarter dBm units to mW
 207  * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
 208  * Table is offset so the last entry is largest mW value that fits in
 209  * a u16.
 210  */
 211
 212 #define QDBM_OFFSET 153         /* Offset for first entry */
 213 #define QDBM_TABLE_LEN 40       /* Table size */
 214
 215 /* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
 216  * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
 217  */
 218 #define QDBM_TABLE_LOW_BOUND 6493       /* Low bound */
 219
 220 /* Largest mW value that will round down to the last table entry,
 221  * QDBM_OFFSET + QDBM_TABLE_LEN-1.
 222  * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) +
 223  * mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
 224  */
 225 #define QDBM_TABLE_HIGH_BOUND 64938     /* High bound */
 226
 227 static const u16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
 228 /* qdBm:        +0      +1      +2      +3      +4      +5      +6      +7 */
 229 /* 153: */ 6683, 7079, 7499, 7943, 8414, 8913, 9441, 10000,
 230 /* 161: */ 10593, 11220, 11885, 12589, 13335, 14125, 14962, 15849,
 231 /* 169: */ 16788, 17783, 18836, 19953, 21135, 22387, 23714, 25119,
 232 /* 177: */ 26607, 28184, 29854, 31623, 33497, 35481, 37584, 39811,
 233 /* 185: */ 42170, 44668, 47315, 50119, 53088, 56234, 59566, 63096
 234 };
 235
 236 static u16 brcmf_qdbm_to_mw(u8 qdbm)
 237 {
 238         uint factor = 1;
 239         int idx = qdbm - QDBM_OFFSET;
 240
 241         if (idx >= QDBM_TABLE_LEN)
 242                 /* clamp to max u16 mW value */
 243                 return 0xFFFF;
 244
 245         /* scale the qdBm index up to the range of the table 0-40
 246          * where an offset of 40 qdBm equals a factor of 10 mW.
 247          */
 248         while (idx < 0) {
 249                 idx += 40;
 250                 factor *= 10;
 251         }
 252
 253         /* return the mW value scaled down to the correct factor of 10,
 254          * adding in factor/2 to get proper rounding.
 255          */
 256         return (nqdBm_to_mW_map[idx] + factor / 2) / factor;
 257 }
 258
 259 static u8 brcmf_mw_to_qdbm(u16 mw)
 260 {
 261         u8 qdbm;
 262         int offset;
 263         uint mw_uint = mw;
 264         uint boundary;
 265
 266         /* handle boundary case */
 267         if (mw_uint <= 1)
 268                 return 0;
 269
 270         offset = QDBM_OFFSET;
 271
 272         /* move mw into the range of the table */
 273         while (mw_uint < QDBM_TABLE_LOW_BOUND) {
 274                 mw_uint *= 10;
 275                 offset -= 40;
 276         }
 277
 278         for (qdbm = 0; qdbm < QDBM_TABLE_LEN - 1; qdbm++) {
 279                 boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm + 1] -
 280                                                     nqdBm_to_mW_map[qdbm]) / 2;
 281                 if (mw_uint < boundary)
 282                         break;
 283         }
 284
 285         qdbm += (u8) offset;
 286
 287         return qdbm;
 288 }
 289
 290 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 291                                struct cfg80211_chan_def *ch)
 292 {
 293         struct brcmu_chan ch_inf;
 294         s32 primary_offset;
 295
 296         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 297                   ch->chan->center_freq, ch->center_freq1, ch->width);
 298         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 299         primary_offset = ch->center_freq1 - ch->chan->center_freq;
 300         switch (ch->width) {
 301         case NL80211_CHAN_WIDTH_20:
 302         case NL80211_CHAN_WIDTH_20_NOHT:
 303                 ch_inf.bw = BRCMU_CHAN_BW_20;
 304                 WARN_ON(primary_offset != 0);
 305                 break;
 306         case NL80211_CHAN_WIDTH_40:
 307                 ch_inf.bw = BRCMU_CHAN_BW_40;
 308                 if (primary_offset < 0)
 309                         ch_inf.sb = BRCMU_CHAN_SB_U;
 310                 else
 311                         ch_inf.sb = BRCMU_CHAN_SB_L;
 312                 break;
 313         case NL80211_CHAN_WIDTH_80:
 314                 ch_inf.bw = BRCMU_CHAN_BW_80;
 315                 if (primary_offset < 0) {
 316                         if (primary_offset < -CH_10MHZ_APART)
 317                                 ch_inf.sb = BRCMU_CHAN_SB_UU;
 318                         else
 319                                 ch_inf.sb = BRCMU_CHAN_SB_UL;
 320                 } else {
 321                         if (primary_offset > CH_10MHZ_APART)
 322                                 ch_inf.sb = BRCMU_CHAN_SB_LL;
 323                         else
 324                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
 325                 }
 326                 break;
 327         case NL80211_CHAN_WIDTH_80P80:
 328         case NL80211_CHAN_WIDTH_160:
 329         case NL80211_CHAN_WIDTH_5:
 330         case NL80211_CHAN_WIDTH_10:
 331         default:
 332                 WARN_ON_ONCE(1);
 333         }
 334         switch (ch->chan->band) {
 335         case IEEE80211_BAND_2GHZ:
 336                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 337                 break;
 338         case IEEE80211_BAND_5GHZ:
 339                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 340                 break;
 341         case IEEE80211_BAND_60GHZ:
 342         default:
 343                 WARN_ON_ONCE(1);
 344         }
 345         d11inf->encchspec(&ch_inf);
 346
 347         return ch_inf.chspec;
 348 }
 349
 350 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 351                         struct ieee80211_channel *ch)
 352 {
 353         struct brcmu_chan ch_inf;
 354
 355         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 356         ch_inf.bw = BRCMU_CHAN_BW_20;
 357         d11inf->encchspec(&ch_inf);
 358
 359         return ch_inf.chspec;
 360 }
 361
 362 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 363  * triples, returning a pointer to the substring whose first element
 364  * matches tag
 365  */
 366 const struct brcmf_tlv *
 367 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 368 {
 369         const struct brcmf_tlv *elt = buf;
 370         int totlen = buflen;
 371
 372         /* find tagged parameter */
 373         while (totlen >= TLV_HDR_LEN) {
 374                 int len = elt->len;
 375
 376                 /* validate remaining totlen */
 377                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 378                         return elt;
 379
 380                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 381                 totlen -= (len + TLV_HDR_LEN);
 382         }
 383
 384         return NULL;
 385 }
 386
 387 /* Is any of the tlvs the expected entry? If
 388  * not update the tlvs buffer pointer/length.
 389  */
 390 static bool
 391 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 392                  const u8 *oui, u32 oui_len, u8 type)
 393 {
 394         /* If the contents match the OUI and the type */
 395         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 396             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 397             type == ie[TLV_BODY_OFF + oui_len]) {
 398                 return true;
 399         }
 400
 401         if (tlvs == NULL)
 402                 return false;
 403         /* point to the next ie */
 404         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 405         /* calculate the length of the rest of the buffer */
 406         *tlvs_len -= (int)(ie - *tlvs);
 407         /* update the pointer to the start of the buffer */
 408         *tlvs = ie;
 409
 410         return false;
 411 }
 412
 413 static struct brcmf_vs_tlv *
 414 brcmf_find_wpaie(const u8 *parse, u32 len)
 415 {
 416         const struct brcmf_tlv *ie;
 417
 418         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 419                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 420                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 421                         return (struct brcmf_vs_tlv *)ie;
 422         }
 423         return NULL;
 424 }
 425
 426 static struct brcmf_vs_tlv *
 427 brcmf_find_wpsie(const u8 *parse, u32 len)
 428 {
 429         const struct brcmf_tlv *ie;
 430
 431         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 432                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 433                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 434                         return (struct brcmf_vs_tlv *)ie;
 435         }
 436         return NULL;
 437 }
 438
 439
 440 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 441                                  struct brcmf_wsec_key_le *key_le)
 442 {
 443         key_le->index = cpu_to_le32(key->index);
 444         key_le->len = cpu_to_le32(key->len);
 445         key_le->algo = cpu_to_le32(key->algo);
 446         key_le->flags = cpu_to_le32(key->flags);
 447         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 448         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 449         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 450         memcpy(key_le->data, key->data, sizeof(key->data));
 451         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 452 }
 453
 454 static int
 455 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 456 {
 457         int err;
 458         struct brcmf_wsec_key_le key_le;
 459
 460         convert_key_from_CPU(key, &key_le);
 461
 462         brcmf_netdev_wait_pend8021x(ifp);
 463
 464         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 465                                         sizeof(key_le));
 466
 467         if (err)
 468                 brcmf_err("wsec_key error (%d)\n", err);
 469         return err;
 470 }
 471
 472 static s32
 473 brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
 474 {
 475         s32 err;
 476         u32 mode;
 477
 478         if (enable)
 479                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 480         else
 481                 mode = 0;
 482
 483         /* Try to set and enable ARP offload feature, this may fail, then it  */
 484         /* is simply not supported and err 0 will be returned                 */
 485         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 486         if (err) {
 487                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 488                           mode, err);
 489                 err = 0;
 490         } else {
 491                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 492                 if (err) {
 493                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 494                                   enable, err);
 495                         err = 0;
 496                 } else
 497                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 498                                   enable, mode);
 499         }
 500
 501         return err;
 502 }
 503
 504 static void
 505 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 506 {
 507         struct brcmf_cfg80211_vif *vif;
 508         struct brcmf_if *ifp;
 509
 510         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 511         ifp = vif->ifp;
 512
 513         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 514             (wdev->iftype == NL80211_IFTYPE_AP) ||
 515             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 516                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 517                                                 ADDR_DIRECT);
 518         else
 519                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 520                                                 ADDR_INDIRECT);
 521 }
 522
 523 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 524 {
 525         struct brcmf_mbss_ssid_le mbss_ssid_le;
 526         int bsscfgidx;
 527         int err;
 528
 529         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 530         bsscfgidx = brcmf_get_next_free_bsscfgidx(ifp->drvr);
 531         if (bsscfgidx < 0)
 532                 return bsscfgidx;
 533
 534         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 535         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 536         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 537
 538         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 539                                         sizeof(mbss_ssid_le));
 540         if (err < 0)
 541                 brcmf_err("setting ssid failed %d\n", err);
 542
 543         return err;
 544 }
 545
 546 /**
 547  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 548  *
 549  * @wiphy: wiphy device of new interface.
 550  * @name: name of the new interface.
 551  * @flags: not used.
 552  * @params: contains mac address for AP device.
 553  */
 554 static
 555 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 556                                       u32 *flags, struct vif_params *params)
 557 {
 558         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 559         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 560         struct brcmf_cfg80211_vif *vif;
 561         int err;
 562
 563         if (brcmf_cfg80211_vif_event_armed(cfg))
 564                 return ERR_PTR(-EBUSY);
 565
 566         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 567
 568         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP, false);
 569         if (IS_ERR(vif))
 570                 return (struct wireless_dev *)vif;
 571
 572         brcmf_cfg80211_arm_vif_event(cfg, vif);
 573
 574         err = brcmf_cfg80211_request_ap_if(ifp);
 575         if (err) {
 576                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 577                 goto fail;
 578         }
 579
 580         /* wait for firmware event */
 581         err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
 582                                                     msecs_to_jiffies(1500));
 583         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 584         if (!err) {
 585                 brcmf_err("timeout occurred\n");
 586                 err = -EIO;
 587                 goto fail;
 588         }
 589
 590         /* interface created in firmware */
 591         ifp = vif->ifp;
 592         if (!ifp) {
 593                 brcmf_err("no if pointer provided\n");
 594                 err = -ENOENT;
 595                 goto fail;
 596         }
 597
 598         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 599         err = brcmf_net_attach(ifp, true);
 600         if (err) {
 601                 brcmf_err("Registering netdevice failed\n");
 602                 goto fail;
 603         }
 604
 605         return &ifp->vif->wdev;
 606
 607 fail:
 608         brcmf_free_vif(vif);
 609         return ERR_PTR(err);
 610 }
 611
 612 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 613 {
 614         enum nl80211_iftype iftype;
 615
 616         iftype = vif->wdev.iftype;
 617         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 618 }
 619
 620 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 621 {
 622         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 623 }
 624
 625 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 626                                                      const char *name,
 627                                                      enum nl80211_iftype type,
 628                                                      u32 *flags,
 629                                                      struct vif_params *params)
 630 {
 631         struct wireless_dev *wdev;
 632
 633         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 634         switch (type) {
 635         case NL80211_IFTYPE_ADHOC:
 636         case NL80211_IFTYPE_STATION:
 637         case NL80211_IFTYPE_AP_VLAN:
 638         case NL80211_IFTYPE_WDS:
 639         case NL80211_IFTYPE_MONITOR:
 640         case NL80211_IFTYPE_MESH_POINT:
 641                 return ERR_PTR(-EOPNOTSUPP);
 642         case NL80211_IFTYPE_AP:
 643                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 644                 if (!IS_ERR(wdev))
 645                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 646                 return wdev;
 647         case NL80211_IFTYPE_P2P_CLIENT:
 648         case NL80211_IFTYPE_P2P_GO:
 649         case NL80211_IFTYPE_P2P_DEVICE:
 650                 wdev = brcmf_p2p_add_vif(wiphy, name, type, flags, params);
 651                 if (!IS_ERR(wdev))
 652                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 653                 return wdev;
 654         case NL80211_IFTYPE_UNSPECIFIED:
 655         default:
 656                 return ERR_PTR(-EINVAL);
 657         }
 658 }
 659
 660 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 661 {
 662         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 663                 brcmf_set_mpc(ifp, mpc);
 664 }
 665
 666 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 667 {
 668         s32 err = 0;
 669
 670         if (check_vif_up(ifp->vif)) {
 671                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 672                 if (err) {
 673                         brcmf_err("fail to set mpc\n");
 674                         return;
 675                 }
 676                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 677         }
 678 }
 679
 680 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 681                                 struct brcmf_if *ifp, bool aborted,
 682                                 bool fw_abort)
 683 {
 684         struct brcmf_scan_params_le params_le;
 685         struct cfg80211_scan_request *scan_request;
 686         s32 err = 0;
 687
 688         brcmf_dbg(SCAN, "Enter\n");
 689
 690         /* clear scan request, because the FW abort can cause a second call */
 691         /* to this functon and might cause a double cfg80211_scan_done      */
 692         scan_request = cfg->scan_request;
 693         cfg->scan_request = NULL;
 694
 695         if (timer_pending(&cfg->escan_timeout))
 696                 del_timer_sync(&cfg->escan_timeout);
 697
 698         if (fw_abort) {
 699                 /* Do a scan abort to stop the driver's scan engine */
 700                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 701                 memset(&params_le, 0, sizeof(params_le));
 702                 memset(params_le.bssid, 0xFF, ETH_ALEN);
 703                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 704                 params_le.scan_type = 0;
 705                 params_le.channel_num = cpu_to_le32(1);
 706                 params_le.nprobes = cpu_to_le32(1);
 707                 params_le.active_time = cpu_to_le32(-1);
 708                 params_le.passive_time = cpu_to_le32(-1);
 709                 params_le.home_time = cpu_to_le32(-1);
 710                 /* Scan is aborted by setting channel_list[0] to -1 */
 711                 params_le.channel_list[0] = cpu_to_le16(-1);
 712                 /* E-Scan (or anyother type) can be aborted by SCAN */
 713                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 714                                              &params_le, sizeof(params_le));
 715                 if (err)
 716                         brcmf_err("Scan abort  failed\n");
 717         }
 718
 719         brcmf_scan_config_mpc(ifp, 1);
 720
 721         /*
 722          * e-scan can be initiated by scheduled scan
 723          * which takes precedence.
 724          */
 725         if (cfg->sched_escan) {
 726                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 727                 cfg->sched_escan = false;
 728                 if (!aborted)
 729                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 730         } else if (scan_request) {
 731                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 732                           aborted ? "Aborted" : "Done");
 733                 cfg80211_scan_done(scan_request, aborted);
 734         }
 735         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 736                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 737
 738         return err;
 739 }
 740
 741 static
 742 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 743 {
 744         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 745         struct net_device *ndev = wdev->netdev;
 746
 747         /* vif event pending in firmware */
 748         if (brcmf_cfg80211_vif_event_armed(cfg))
 749                 return -EBUSY;
 750
 751         if (ndev) {
 752                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 753                     cfg->escan_info.ifp == netdev_priv(ndev))
 754                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 755                                                     true, true);
 756
 757                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 758         }
 759
 760         switch (wdev->iftype) {
 761         case NL80211_IFTYPE_ADHOC:
 762         case NL80211_IFTYPE_STATION:
 763         case NL80211_IFTYPE_AP:
 764         case NL80211_IFTYPE_AP_VLAN:
 765         case NL80211_IFTYPE_WDS:
 766         case NL80211_IFTYPE_MONITOR:
 767         case NL80211_IFTYPE_MESH_POINT:
 768                 return -EOPNOTSUPP;
 769         case NL80211_IFTYPE_P2P_CLIENT:
 770         case NL80211_IFTYPE_P2P_GO:
 771         case NL80211_IFTYPE_P2P_DEVICE:
 772                 return brcmf_p2p_del_vif(wiphy, wdev);
 773         case NL80211_IFTYPE_UNSPECIFIED:
 774         default:
 775                 return -EINVAL;
 776         }
 777         return -EOPNOTSUPP;
 778 }
 779
 780 static s32
 781 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 782                          enum nl80211_iftype type, u32 *flags,
 783                          struct vif_params *params)
 784 {
 785         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 786         struct brcmf_if *ifp = netdev_priv(ndev);
 787         struct brcmf_cfg80211_vif *vif = ifp->vif;
 788         s32 infra = 0;
 789         s32 ap = 0;
 790         s32 err = 0;
 791
 792         brcmf_dbg(TRACE, "Enter, ndev=%p, type=%d\n", ndev, type);
 793
 794         switch (type) {
 795         case NL80211_IFTYPE_MONITOR:
 796         case NL80211_IFTYPE_WDS:
 797                 brcmf_err("type (%d) : currently we do not support this type\n",
 798                           type);
 799                 return -EOPNOTSUPP;
 800         case NL80211_IFTYPE_ADHOC:
 801                 infra = 0;
 802                 break;
 803         case NL80211_IFTYPE_STATION:
 804                 /* Ignore change for p2p IF. Unclear why supplicant does this */
 805                 if ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 806                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO)) {
 807                         brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 808                         /* WAR: It is unexpected to get a change of VIF for P2P
 809                          * IF, but it happens. The request can not be handled
 810                          * but returning EPERM causes a crash. Returning 0
 811                          * without setting ieee80211_ptr->iftype causes trace
 812                          * (WARN_ON) but it works with wpa_supplicant
 813                          */
 814                         return 0;
 815                 }
 816                 infra = 1;
 817                 break;
 818         case NL80211_IFTYPE_AP:
 819         case NL80211_IFTYPE_P2P_GO:
 820                 ap = 1;
 821                 break;
 822         default:
 823                 err = -EINVAL;
 824                 goto done;
 825         }
 826
 827         if (ap) {
 828                 if (type == NL80211_IFTYPE_P2P_GO) {
 829                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 830                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 831                 }
 832                 if (!err) {
 833                         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
 834                         brcmf_dbg(INFO, "IF Type = AP\n");
 835                 }
 836         } else {
 837                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 838                 if (err) {
 839                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 840                         err = -EAGAIN;
 841                         goto done;
 842                 }
 843                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 844                           "Adhoc" : "Infra");
 845         }
 846         ndev->ieee80211_ptr->iftype = type;
 847
 848         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 849
 850 done:
 851         brcmf_dbg(TRACE, "Exit\n");
 852
 853         return err;
 854 }
 855
 856 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 857                              struct brcmf_scan_params_le *params_le,
 858                              struct cfg80211_scan_request *request)
 859 {
 860         u32 n_ssids;
 861         u32 n_channels;
 862         s32 i;
 863         s32 offset;
 864         u16 chanspec;
 865         char *ptr;
 866         struct brcmf_ssid_le ssid_le;
 867
 868         memset(params_le->bssid, 0xFF, ETH_ALEN);
 869         params_le->bss_type = DOT11_BSSTYPE_ANY;
 870         params_le->scan_type = 0;
 871         params_le->channel_num = 0;
 872         params_le->nprobes = cpu_to_le32(-1);
 873         params_le->active_time = cpu_to_le32(-1);
 874         params_le->passive_time = cpu_to_le32(-1);
 875         params_le->home_time = cpu_to_le32(-1);
 876         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 877
 878         /* if request is null exit so it will be all channel broadcast scan */
 879         if (!request)
 880                 return;
 881
 882         n_ssids = request->n_ssids;
 883         n_channels = request->n_channels;
 884         /* Copy channel array if applicable */
 885         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 886                   n_channels);
 887         if (n_channels > 0) {
 888                 for (i = 0; i < n_channels; i++) {
 889                         chanspec = channel_to_chanspec(&cfg->d11inf,
 890                                                        request->channels[i]);
 891                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 892                                   request->channels[i]->hw_value, chanspec);
 893                         params_le->channel_list[i] = cpu_to_le16(chanspec);
 894                 }
 895         } else {
 896                 brcmf_dbg(SCAN, "Scanning all channels\n");
 897         }
 898         /* Copy ssid array if applicable */
 899         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
 900         if (n_ssids > 0) {
 901                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
 902                                 n_channels * sizeof(u16);
 903                 offset = roundup(offset, sizeof(u32));
 904                 ptr = (char *)params_le + offset;
 905                 for (i = 0; i < n_ssids; i++) {
 906                         memset(&ssid_le, 0, sizeof(ssid_le));
 907                         ssid_le.SSID_len =
 908                                         cpu_to_le32(request->ssids[i].ssid_len);
 909                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
 910                                request->ssids[i].ssid_len);
 911                         if (!ssid_le.SSID_len)
 912                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
 913                         else
 914                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
 915                                           i, ssid_le.SSID, ssid_le.SSID_len);
 916                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
 917                         ptr += sizeof(ssid_le);
 918                 }
 919         } else {
 920                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
 921                 if ((request->ssids) && request->ssids->ssid_len) {
 922                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
 923                                   params_le->ssid_le.SSID,
 924                                   request->ssids->ssid_len);
 925                         params_le->ssid_le.SSID_len =
 926                                 cpu_to_le32(request->ssids->ssid_len);
 927                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
 928                                 request->ssids->ssid_len);
 929                 }
 930         }
 931         /* Adding mask to channel numbers */
 932         params_le->channel_num =
 933                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
 934                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
 935 }
 936
 937 static s32
 938 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
 939                 struct cfg80211_scan_request *request, u16 action)
 940 {
 941         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
 942                           offsetof(struct brcmf_escan_params_le, params_le);
 943         struct brcmf_escan_params_le *params;
 944         s32 err = 0;
 945
 946         brcmf_dbg(SCAN, "E-SCAN START\n");
 947
 948         if (request != NULL) {
 949                 /* Allocate space for populating ssids in struct */
 950                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
 951
 952                 /* Allocate space for populating ssids in struct */
 953                 params_size += sizeof(struct brcmf_ssid) * request->n_ssids;
 954         }
 955
 956         params = kzalloc(params_size, GFP_KERNEL);
 957         if (!params) {
 958                 err = -ENOMEM;
 959                 goto exit;
 960         }
 961         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
 962         brcmf_escan_prep(cfg, &params->params_le, request);
 963         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
 964         params->action = cpu_to_le16(action);
 965         params->sync_id = cpu_to_le16(0x1234);
 966
 967         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
 968         if (err) {
 969                 if (err == -EBUSY)
 970                         brcmf_dbg(INFO, "system busy : escan canceled\n");
 971                 else
 972                         brcmf_err("error (%d)\n", err);
 973         }
 974
 975         kfree(params);
 976 exit:
 977         return err;
 978 }
 979
 980 static s32
 981 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
 982                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
 983 {
 984         s32 err;
 985         u32 passive_scan;
 986         struct brcmf_scan_results *results;
 987         struct escan_info *escan = &cfg->escan_info;
 988
 989         brcmf_dbg(SCAN, "Enter\n");
 990         escan->ifp = ifp;
 991         escan->wiphy = wiphy;
 992         escan->escan_state = WL_ESCAN_STATE_SCANNING;
 993         passive_scan = cfg->active_scan ? 0 : 1;
 994         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
 995                                     passive_scan);
 996         if (err) {
 997                 brcmf_err("error (%d)\n", err);
 998                 return err;
 999         }
1000         brcmf_scan_config_mpc(ifp, 0);
1001         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1002         results->version = 0;
1003         results->count = 0;
1004         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1005
1006         err = escan->run(cfg, ifp, request, WL_ESCAN_ACTION_START);
1007         if (err)
1008                 brcmf_scan_config_mpc(ifp, 1);
1009         return err;
1010 }
1011
1012 static s32
1013 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1014                      struct cfg80211_scan_request *request,
1015                      struct cfg80211_ssid *this_ssid)
1016 {
1017         struct brcmf_if *ifp = vif->ifp;
1018         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1019         struct cfg80211_ssid *ssids;
1020         struct brcmf_cfg80211_scan_req *sr = &cfg->scan_req_int;
1021         u32 passive_scan;
1022         bool escan_req;
1023         bool spec_scan;
1024         s32 err;
1025         u32 SSID_len;
1026
1027         brcmf_dbg(SCAN, "START ESCAN\n");
1028
1029         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1030                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1031                 return -EAGAIN;
1032         }
1033         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1034                 brcmf_err("Scanning being aborted: status (%lu)\n",
1035                           cfg->scan_status);
1036                 return -EAGAIN;
1037         }
1038         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1039                 brcmf_err("Scanning suppressed: status (%lu)\n",
1040                           cfg->scan_status);
1041                 return -EAGAIN;
1042         }
1043         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1044                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1045                 return -EAGAIN;
1046         }
1047
1048         /* If scan req comes for p2p0, send it over primary I/F */
1049         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1050                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1051
1052         /* Arm scan timeout timer */
1053         mod_timer(&cfg->escan_timeout, jiffies +
1054                         WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1055
1056         escan_req = false;
1057         if (request) {
1058                 /* scan bss */
1059                 ssids = request->ssids;
1060                 escan_req = true;
1061         } else {
1062                 /* scan in ibss */
1063                 /* we don't do escan in ibss */
1064                 ssids = this_ssid;
1065         }
1066
1067         cfg->scan_request = request;
1068         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1069         if (escan_req) {
1070                 cfg->escan_info.run = brcmf_run_escan;
1071                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1072                 if (err)
1073                         goto scan_out;
1074
1075                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1076                 if (err)
1077                         goto scan_out;
1078         } else {
1079                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1080                           ssids->ssid, ssids->ssid_len);
1081                 memset(&sr->ssid_le, 0, sizeof(sr->ssid_le));
1082                 SSID_len = min_t(u8, sizeof(sr->ssid_le.SSID), ssids->ssid_len);
1083                 sr->ssid_le.SSID_len = cpu_to_le32(0);
1084                 spec_scan = false;
1085                 if (SSID_len) {
1086                         memcpy(sr->ssid_le.SSID, ssids->ssid, SSID_len);
1087                         sr->ssid_le.SSID_len = cpu_to_le32(SSID_len);
1088                         spec_scan = true;
1089                 } else
1090                         brcmf_dbg(SCAN, "Broadcast scan\n");
1091
1092                 passive_scan = cfg->active_scan ? 0 : 1;
1093                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1094                                             passive_scan);
1095                 if (err) {
1096                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1097                         goto scan_out;
1098                 }
1099                 brcmf_scan_config_mpc(ifp, 0);
1100                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1101                                              &sr->ssid_le, sizeof(sr->ssid_le));
1102                 if (err) {
1103                         if (err == -EBUSY)
1104                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1105                                           sr->ssid_le.SSID);
1106                         else
1107                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1108
1109                         brcmf_scan_config_mpc(ifp, 1);
1110                         goto scan_out;
1111                 }
1112         }
1113
1114         return 0;
1115
1116 scan_out:
1117         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1118         if (timer_pending(&cfg->escan_timeout))
1119                 del_timer_sync(&cfg->escan_timeout);
1120         cfg->scan_request = NULL;
1121         return err;
1122 }
1123
1124 static s32
1125 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1126 {
1127         struct brcmf_cfg80211_vif *vif;
1128         s32 err = 0;
1129
1130         brcmf_dbg(TRACE, "Enter\n");
1131         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1132         if (!check_vif_up(vif))
1133                 return -EIO;
1134
1135         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1136
1137         if (err)
1138                 brcmf_err("scan error (%d)\n", err);
1139
1140         brcmf_dbg(TRACE, "Exit\n");
1141         return err;
1142 }
1143
1144 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1145 {
1146         s32 err = 0;
1147
1148         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1149                                       rts_threshold);
1150         if (err)
1151                 brcmf_err("Error (%d)\n", err);
1152
1153         return err;
1154 }
1155
1156 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1157 {
1158         s32 err = 0;
1159
1160         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1161                                       frag_threshold);
1162         if (err)
1163                 brcmf_err("Error (%d)\n", err);
1164
1165         return err;
1166 }
1167
1168 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1169 {
1170         s32 err = 0;
1171         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1172
1173         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1174         if (err) {
1175                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1176                 return err;
1177         }
1178         return err;
1179 }
1180
1181 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1182 {
1183         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1184         struct net_device *ndev = cfg_to_ndev(cfg);
1185         struct brcmf_if *ifp = netdev_priv(ndev);
1186         s32 err = 0;
1187
1188         brcmf_dbg(TRACE, "Enter\n");
1189         if (!check_vif_up(ifp->vif))
1190                 return -EIO;
1191
1192         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1193             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1194                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1195                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1196                 if (!err)
1197                         goto done;
1198         }
1199         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1200             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1201                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1202                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1203                 if (!err)
1204                         goto done;
1205         }
1206         if (changed & WIPHY_PARAM_RETRY_LONG
1207             && (cfg->conf->retry_long != wiphy->retry_long)) {
1208                 cfg->conf->retry_long = wiphy->retry_long;
1209                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1210                 if (!err)
1211                         goto done;
1212         }
1213         if (changed & WIPHY_PARAM_RETRY_SHORT
1214             && (cfg->conf->retry_short != wiphy->retry_short)) {
1215                 cfg->conf->retry_short = wiphy->retry_short;
1216                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1217                 if (!err)
1218                         goto done;
1219         }
1220
1221 done:
1222         brcmf_dbg(TRACE, "Exit\n");
1223         return err;
1224 }
1225
1226 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1227 {
1228         memset(prof, 0, sizeof(*prof));
1229 }
1230
1231 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
1232 {
1233         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1234         s32 err = 0;
1235
1236         brcmf_dbg(TRACE, "Enter\n");
1237
1238         if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1239                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1240                 err = brcmf_fil_cmd_data_set(vif->ifp,
1241                                              BRCMF_C_DISASSOC, NULL, 0);
1242                 if (err) {
1243                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1244                 }
1245                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
1246                 cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
1247
1248         }
1249         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1250         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1251         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1252         brcmf_dbg(TRACE, "Exit\n");
1253 }
1254
1255 static s32
1256 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1257                       struct cfg80211_ibss_params *params)
1258 {
1259         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1260         struct brcmf_if *ifp = netdev_priv(ndev);
1261         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1262         struct brcmf_join_params join_params;
1263         size_t join_params_size = 0;
1264         s32 err = 0;
1265         s32 wsec = 0;
1266         s32 bcnprd;
1267         u16 chanspec;
1268
1269         brcmf_dbg(TRACE, "Enter\n");
1270         if (!check_vif_up(ifp->vif))
1271                 return -EIO;
1272
1273         if (params->ssid)
1274                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1275         else {
1276                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1277                 return -EOPNOTSUPP;
1278         }
1279
1280         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1281
1282         if (params->bssid)
1283                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1284         else
1285                 brcmf_dbg(CONN, "No BSSID specified\n");
1286
1287         if (params->chandef.chan)
1288                 brcmf_dbg(CONN, "channel: %d\n",
1289                           params->chandef.chan->center_freq);
1290         else
1291                 brcmf_dbg(CONN, "no channel specified\n");
1292
1293         if (params->channel_fixed)
1294                 brcmf_dbg(CONN, "fixed channel required\n");
1295         else
1296                 brcmf_dbg(CONN, "no fixed channel required\n");
1297
1298         if (params->ie && params->ie_len)
1299                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1300         else
1301                 brcmf_dbg(CONN, "no ie specified\n");
1302
1303         if (params->beacon_interval)
1304                 brcmf_dbg(CONN, "beacon interval: %d\n",
1305                           params->beacon_interval);
1306         else
1307                 brcmf_dbg(CONN, "no beacon interval specified\n");
1308
1309         if (params->basic_rates)
1310                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1311         else
1312                 brcmf_dbg(CONN, "no basic rates specified\n");
1313
1314         if (params->privacy)
1315                 brcmf_dbg(CONN, "privacy required\n");
1316         else
1317                 brcmf_dbg(CONN, "no privacy required\n");
1318
1319         /* Configure Privacy for starter */
1320         if (params->privacy)
1321                 wsec |= WEP_ENABLED;
1322
1323         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1324         if (err) {
1325                 brcmf_err("wsec failed (%d)\n", err);
1326                 goto done;
1327         }
1328
1329         /* Configure Beacon Interval for starter */
1330         if (params->beacon_interval)
1331                 bcnprd = params->beacon_interval;
1332         else
1333                 bcnprd = 100;
1334
1335         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1336         if (err) {
1337                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1338                 goto done;
1339         }
1340
1341         /* Configure required join parameter */
1342         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1343
1344         /* SSID */
1345         profile->ssid.SSID_len = min_t(u32, params->ssid_len, 32);
1346         memcpy(profile->ssid.SSID, params->ssid, profile->ssid.SSID_len);
1347         memcpy(join_params.ssid_le.SSID, params->ssid, profile->ssid.SSID_len);
1348         join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1349         join_params_size = sizeof(join_params.ssid_le);
1350
1351         /* BSSID */
1352         if (params->bssid) {
1353                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1354                 join_params_size = sizeof(join_params.ssid_le) +
1355                                    BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1356                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1357         } else {
1358                 memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
1359                 memset(profile->bssid, 0, ETH_ALEN);
1360         }
1361
1362         /* Channel */
1363         if (params->chandef.chan) {
1364                 u32 target_channel;
1365
1366                 cfg->channel =
1367                         ieee80211_frequency_to_channel(
1368                                 params->chandef.chan->center_freq);
1369                 if (params->channel_fixed) {
1370                         /* adding chanspec */
1371                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1372                                                        &params->chandef);
1373                         join_params.params_le.chanspec_list[0] =
1374                                 cpu_to_le16(chanspec);
1375                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1376                         join_params_size += sizeof(join_params.params_le);
1377                 }
1378
1379                 /* set channel for starter */
1380                 target_channel = cfg->channel;
1381                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1382                                             target_channel);
1383                 if (err) {
1384                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1385                         goto done;
1386                 }
1387         } else
1388                 cfg->channel = 0;
1389
1390         cfg->ibss_starter = false;
1391
1392
1393         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1394                                      &join_params, join_params_size);
1395         if (err) {
1396                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1397                 goto done;
1398         }
1399
1400 done:
1401         if (err)
1402                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1403         brcmf_dbg(TRACE, "Exit\n");
1404         return err;
1405 }
1406
1407 static s32
1408 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1409 {
1410         struct brcmf_if *ifp = netdev_priv(ndev);
1411
1412         brcmf_dbg(TRACE, "Enter\n");
1413         if (!check_vif_up(ifp->vif))
1414                 return -EIO;
1415
1416         brcmf_link_down(ifp->vif);
1417
1418         brcmf_dbg(TRACE, "Exit\n");
1419
1420         return 0;
1421 }
1422
1423 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1424                                  struct cfg80211_connect_params *sme)
1425 {
1426         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1427         struct brcmf_cfg80211_security *sec;
1428         s32 val = 0;
1429         s32 err = 0;
1430
1431         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1432                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1433         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1434                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1435         else
1436                 val = WPA_AUTH_DISABLED;
1437         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1438         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1439         if (err) {
1440                 brcmf_err("set wpa_auth failed (%d)\n", err);
1441                 return err;
1442         }
1443         sec = &profile->sec;
1444         sec->wpa_versions = sme->crypto.wpa_versions;
1445         return err;
1446 }
1447
1448 static s32 brcmf_set_auth_type(struct net_device *ndev,
1449                                struct cfg80211_connect_params *sme)
1450 {
1451         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1452         struct brcmf_cfg80211_security *sec;
1453         s32 val = 0;
1454         s32 err = 0;
1455
1456         switch (sme->auth_type) {
1457         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1458                 val = 0;
1459                 brcmf_dbg(CONN, "open system\n");
1460                 break;
1461         case NL80211_AUTHTYPE_SHARED_KEY:
1462                 val = 1;
1463                 brcmf_dbg(CONN, "shared key\n");
1464                 break;
1465         case NL80211_AUTHTYPE_AUTOMATIC:
1466                 val = 2;
1467                 brcmf_dbg(CONN, "automatic\n");
1468                 break;
1469         case NL80211_AUTHTYPE_NETWORK_EAP:
1470                 brcmf_dbg(CONN, "network eap\n");
1471         default:
1472                 val = 2;
1473                 brcmf_err("invalid auth type (%d)\n", sme->auth_type);
1474                 break;
1475         }
1476
1477         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1478         if (err) {
1479                 brcmf_err("set auth failed (%d)\n", err);
1480                 return err;
1481         }
1482         sec = &profile->sec;
1483         sec->auth_type = sme->auth_type;
1484         return err;
1485 }
1486
1487 static s32
1488 brcmf_set_wsec_mode(struct net_device *ndev,
1489                      struct cfg80211_connect_params *sme, bool mfp)
1490 {
1491         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1492         struct brcmf_cfg80211_security *sec;
1493         s32 pval = 0;
1494         s32 gval = 0;
1495         s32 wsec;
1496         s32 err = 0;
1497
1498         if (sme->crypto.n_ciphers_pairwise) {
1499                 switch (sme->crypto.ciphers_pairwise[0]) {
1500                 case WLAN_CIPHER_SUITE_WEP40:
1501                 case WLAN_CIPHER_SUITE_WEP104:
1502                         pval = WEP_ENABLED;
1503                         break;
1504                 case WLAN_CIPHER_SUITE_TKIP:
1505                         pval = TKIP_ENABLED;
1506                         break;
1507                 case WLAN_CIPHER_SUITE_CCMP:
1508                         pval = AES_ENABLED;
1509                         break;
1510                 case WLAN_CIPHER_SUITE_AES_CMAC:
1511                         pval = AES_ENABLED;
1512                         break;
1513                 default:
1514                         brcmf_err("invalid cipher pairwise (%d)\n",
1515                                   sme->crypto.ciphers_pairwise[0]);
1516                         return -EINVAL;
1517                 }
1518         }
1519         if (sme->crypto.cipher_group) {
1520                 switch (sme->crypto.cipher_group) {
1521                 case WLAN_CIPHER_SUITE_WEP40:
1522                 case WLAN_CIPHER_SUITE_WEP104:
1523                         gval = WEP_ENABLED;
1524                         break;
1525                 case WLAN_CIPHER_SUITE_TKIP:
1526                         gval = TKIP_ENABLED;
1527                         break;
1528                 case WLAN_CIPHER_SUITE_CCMP:
1529                         gval = AES_ENABLED;
1530                         break;
1531                 case WLAN_CIPHER_SUITE_AES_CMAC:
1532                         gval = AES_ENABLED;
1533                         break;
1534                 default:
1535                         brcmf_err("invalid cipher group (%d)\n",
1536                                   sme->crypto.cipher_group);
1537                         return -EINVAL;
1538                 }
1539         }
1540
1541         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1542         /* In case of privacy, but no security and WPS then simulate */
1543         /* setting AES. WPS-2.0 allows no security                   */
1544         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1545             sme->privacy)
1546                 pval = AES_ENABLED;
1547
1548         if (mfp)
1549                 wsec = pval | gval | MFP_CAPABLE;
1550         else
1551                 wsec = pval | gval;
1552         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1553         if (err) {
1554                 brcmf_err("error (%d)\n", err);
1555                 return err;
1556         }
1557
1558         sec = &profile->sec;
1559         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1560         sec->cipher_group = sme->crypto.cipher_group;
1561
1562         return err;
1563 }
1564
1565 static s32
1566 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1567 {
1568         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1569         struct brcmf_cfg80211_security *sec;
1570         s32 val = 0;
1571         s32 err = 0;
1572
1573         if (sme->crypto.n_akm_suites) {
1574                 err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
1575                                                "wpa_auth", &val);
1576                 if (err) {
1577                         brcmf_err("could not get wpa_auth (%d)\n", err);
1578                         return err;
1579                 }
1580                 if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1581                         switch (sme->crypto.akm_suites[0]) {
1582                         case WLAN_AKM_SUITE_8021X:
1583                                 val = WPA_AUTH_UNSPECIFIED;
1584                                 break;
1585                         case WLAN_AKM_SUITE_PSK:
1586                                 val = WPA_AUTH_PSK;
1587                                 break;
1588                         default:
1589                                 brcmf_err("invalid cipher group (%d)\n",
1590                                           sme->crypto.cipher_group);
1591                                 return -EINVAL;
1592                         }
1593                 } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1594                         switch (sme->crypto.akm_suites[0]) {
1595                         case WLAN_AKM_SUITE_8021X:
1596                                 val = WPA2_AUTH_UNSPECIFIED;
1597                                 break;
1598                         case WLAN_AKM_SUITE_PSK:
1599                                 val = WPA2_AUTH_PSK;
1600                                 break;
1601                         default:
1602                                 brcmf_err("invalid cipher group (%d)\n",
1603                                           sme->crypto.cipher_group);
1604                                 return -EINVAL;
1605                         }
1606                 }
1607
1608                 brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1609                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
1610                                                "wpa_auth", val);
1611                 if (err) {
1612                         brcmf_err("could not set wpa_auth (%d)\n", err);
1613                         return err;
1614                 }
1615         }
1616         sec = &profile->sec;
1617         sec->wpa_auth = sme->crypto.akm_suites[0];
1618
1619         return err;
1620 }
1621
1622 static s32
1623 brcmf_set_sharedkey(struct net_device *ndev,
1624                     struct cfg80211_connect_params *sme)
1625 {
1626         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1627         struct brcmf_cfg80211_security *sec;
1628         struct brcmf_wsec_key key;
1629         s32 val;
1630         s32 err = 0;
1631
1632         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1633
1634         if (sme->key_len == 0)
1635                 return 0;
1636
1637         sec = &profile->sec;
1638         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1639                   sec->wpa_versions, sec->cipher_pairwise);
1640
1641         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1642                 return 0;
1643
1644         if (!(sec->cipher_pairwise &
1645             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1646                 return 0;
1647
1648         memset(&key, 0, sizeof(key));
1649         key.len = (u32) sme->key_len;
1650         key.index = (u32) sme->key_idx;
1651         if (key.len > sizeof(key.data)) {
1652                 brcmf_err("Too long key length (%u)\n", key.len);
1653                 return -EINVAL;
1654         }
1655         memcpy(key.data, sme->key, key.len);
1656         key.flags = BRCMF_PRIMARY_KEY;
1657         switch (sec->cipher_pairwise) {
1658         case WLAN_CIPHER_SUITE_WEP40:
1659                 key.algo = CRYPTO_ALGO_WEP1;
1660                 break;
1661         case WLAN_CIPHER_SUITE_WEP104:
1662                 key.algo = CRYPTO_ALGO_WEP128;
1663                 break;
1664         default:
1665                 brcmf_err("Invalid algorithm (%d)\n",
1666                           sme->crypto.ciphers_pairwise[0]);
1667                 return -EINVAL;
1668         }
1669         /* Set the new key/index */
1670         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1671                   key.len, key.index, key.algo);
1672         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1673         err = send_key_to_dongle(netdev_priv(ndev), &key);
1674         if (err)
1675                 return err;
1676
1677         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1678                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1679                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1680                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1681                 if (err)
1682                         brcmf_err("set auth failed (%d)\n", err);
1683         }
1684         return err;
1685 }
1686
1687 static
1688 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1689                                            enum nl80211_auth_type type)
1690 {
1691         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1692             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1693                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1694                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1695         }
1696         return type;
1697 }
1698
1699 static s32
1700 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1701                        struct cfg80211_connect_params *sme)
1702 {
1703         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1704         struct brcmf_if *ifp = netdev_priv(ndev);
1705         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1706         struct ieee80211_channel *chan = sme->channel;
1707         struct brcmf_join_params join_params;
1708         size_t join_params_size;
1709         const struct brcmf_tlv *rsn_ie;
1710         const struct brcmf_vs_tlv *wpa_ie;
1711         const void *ie;
1712         u32 ie_len;
1713         struct brcmf_ext_join_params_le *ext_join_params;
1714         u16 chanspec;
1715         s32 err = 0;
1716
1717         brcmf_dbg(TRACE, "Enter\n");
1718         if (!check_vif_up(ifp->vif))
1719                 return -EIO;
1720
1721         if (!sme->ssid) {
1722                 brcmf_err("Invalid ssid\n");
1723                 return -EOPNOTSUPP;
1724         }
1725
1726         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1727                 /* A normal (non P2P) connection request setup. */
1728                 ie = NULL;
1729                 ie_len = 0;
1730                 /* find the WPA_IE */
1731                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1732                 if (wpa_ie) {
1733                         ie = wpa_ie;
1734                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1735                 } else {
1736                         /* find the RSN_IE */
1737                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1738                                                   sme->ie_len,
1739                                                   WLAN_EID_RSN);
1740                         if (rsn_ie) {
1741                                 ie = rsn_ie;
1742                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1743                         }
1744                 }
1745                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1746         }
1747
1748         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1749                                     sme->ie, sme->ie_len);
1750         if (err)
1751                 brcmf_err("Set Assoc REQ IE Failed\n");
1752         else
1753                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1754
1755         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1756
1757         if (chan) {
1758                 cfg->channel =
1759                         ieee80211_frequency_to_channel(chan->center_freq);
1760                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1761                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1762                           cfg->channel, chan->center_freq, chanspec);
1763         } else {
1764                 cfg->channel = 0;
1765                 chanspec = 0;
1766         }
1767
1768         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1769
1770         err = brcmf_set_wpa_version(ndev, sme);
1771         if (err) {
1772                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1773                 goto done;
1774         }
1775
1776         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1777         err = brcmf_set_auth_type(ndev, sme);
1778         if (err) {
1779                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1780                 goto done;
1781         }
1782
1783         err = brcmf_set_wsec_mode(ndev, sme, sme->mfp == NL80211_MFP_REQUIRED);
1784         if (err) {
1785                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1786                 goto done;
1787         }
1788
1789         err = brcmf_set_key_mgmt(ndev, sme);
1790         if (err) {
1791                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1792                 goto done;
1793         }
1794
1795         err = brcmf_set_sharedkey(ndev, sme);
1796         if (err) {
1797                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1798                 goto done;
1799         }
1800
1801         profile->ssid.SSID_len = min_t(u32, (u32)sizeof(profile->ssid.SSID),
1802                                        (u32)sme->ssid_len);
1803         memcpy(&profile->ssid.SSID, sme->ssid, profile->ssid.SSID_len);
1804         if (profile->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
1805                 profile->ssid.SSID[profile->ssid.SSID_len] = 0;
1806                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n", profile->ssid.SSID,
1807                           profile->ssid.SSID_len);
1808         }
1809
1810         /* Join with specific BSSID and cached SSID
1811          * If SSID is zero join based on BSSID only
1812          */
1813         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
1814                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
1815         if (cfg->channel)
1816                 join_params_size += sizeof(u16);
1817         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
1818         if (ext_join_params == NULL) {
1819                 err = -ENOMEM;
1820                 goto done;
1821         }
1822         ext_join_params->ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1823         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid,
1824                profile->ssid.SSID_len);
1825
1826         /* Set up join scan parameters */
1827         ext_join_params->scan_le.scan_type = -1;
1828         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
1829
1830         if (sme->bssid)
1831                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
1832         else
1833                 memset(&ext_join_params->assoc_le.bssid, 0xFF, ETH_ALEN);
1834
1835         if (cfg->channel) {
1836                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
1837
1838                 ext_join_params->assoc_le.chanspec_list[0] =
1839                         cpu_to_le16(chanspec);
1840                 /* Increase dwell time to receive probe response or detect
1841                  * beacon from target AP at a noisy air only during connect
1842                  * command.
1843                  */
1844                 ext_join_params->scan_le.active_time =
1845                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
1846                 ext_join_params->scan_le.passive_time =
1847                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
1848                 /* To sync with presence period of VSDB GO send probe request
1849                  * more frequently. Probe request will be stopped when it gets
1850                  * probe response from target AP/GO.
1851                  */
1852                 ext_join_params->scan_le.nprobes =
1853                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
1854                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
1855         } else {
1856                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
1857                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
1858                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
1859         }
1860
1861         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
1862                                          join_params_size);
1863         kfree(ext_join_params);
1864         if (!err)
1865                 /* This is it. join command worked, we are done */
1866                 goto done;
1867
1868         /* join command failed, fallback to set ssid */
1869         memset(&join_params, 0, sizeof(join_params));
1870         join_params_size = sizeof(join_params.ssid_le);
1871
1872         memcpy(&join_params.ssid_le.SSID, sme->ssid, profile->ssid.SSID_len);
1873         join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1874
1875         if (sme->bssid)
1876                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
1877         else
1878                 memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
1879
1880         if (cfg->channel) {
1881                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
1882                 join_params.params_le.chanspec_num = cpu_to_le32(1);
1883                 join_params_size += sizeof(join_params.params_le);
1884         }
1885         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1886                                      &join_params, join_params_size);
1887         if (err)
1888                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
1889
1890 done:
1891         if (err)
1892                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1893         brcmf_dbg(TRACE, "Exit\n");
1894         return err;
1895 }
1896
1897 static s32
1898 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
1899                        u16 reason_code)
1900 {
1901         struct brcmf_if *ifp = netdev_priv(ndev);
1902         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1903         struct brcmf_scb_val_le scbval;
1904         s32 err = 0;
1905
1906         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
1907         if (!check_vif_up(ifp->vif))
1908                 return -EIO;
1909
1910         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
1911         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1912         cfg80211_disconnected(ndev, reason_code, NULL, 0, GFP_KERNEL);
1913
1914         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
1915         scbval.val = cpu_to_le32(reason_code);
1916         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
1917                                      &scbval, sizeof(scbval));
1918         if (err)
1919                 brcmf_err("error (%d)\n", err);
1920
1921         brcmf_dbg(TRACE, "Exit\n");
1922         return err;
1923 }
1924
1925 static s32
1926 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
1927                             enum nl80211_tx_power_setting type, s32 mbm)
1928 {
1929
1930         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1931         struct net_device *ndev = cfg_to_ndev(cfg);
1932         struct brcmf_if *ifp = netdev_priv(ndev);
1933         u16 txpwrmw;
1934         s32 err = 0;
1935         s32 disable = 0;
1936         s32 dbm = MBM_TO_DBM(mbm);
1937
1938         brcmf_dbg(TRACE, "Enter\n");
1939         if (!check_vif_up(ifp->vif))
1940                 return -EIO;
1941
1942         switch (type) {
1943         case NL80211_TX_POWER_AUTOMATIC:
1944                 break;
1945         case NL80211_TX_POWER_LIMITED:
1946         case NL80211_TX_POWER_FIXED:
1947                 if (dbm < 0) {
1948                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
1949                         err = -EINVAL;
1950                         goto done;
1951                 }
1952                 break;
1953         }
1954         /* Make sure radio is off or on as far as software is concerned */
1955         disable = WL_RADIO_SW_DISABLE << 16;
1956         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
1957         if (err)
1958                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
1959
1960         if (dbm > 0xffff)
1961                 txpwrmw = 0xffff;
1962         else
1963                 txpwrmw = (u16) dbm;
1964         err = brcmf_fil_iovar_int_set(ifp, "qtxpower",
1965                                       (s32)brcmf_mw_to_qdbm(txpwrmw));
1966         if (err)
1967                 brcmf_err("qtxpower error (%d)\n", err);
1968         cfg->conf->tx_power = dbm;
1969
1970 done:
1971         brcmf_dbg(TRACE, "Exit\n");
1972         return err;
1973 }
1974
1975 static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy,
1976                                        struct wireless_dev *wdev,
1977                                        s32 *dbm)
1978 {
1979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1980         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
1981         s32 txpwrdbm;
1982         u8 result;
1983         s32 err = 0;
1984
1985         brcmf_dbg(TRACE, "Enter\n");
1986         if (!check_vif_up(ifp->vif))
1987                 return -EIO;
1988
1989         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &txpwrdbm);
1990         if (err) {
1991                 brcmf_err("error (%d)\n", err);
1992                 goto done;
1993         }
1994
1995         result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
1996         *dbm = (s32) brcmf_qdbm_to_mw(result);
1997
1998 done:
1999         brcmf_dbg(TRACE, "Exit\n");
2000         return err;
2001 }
2002
2003 static s32
2004 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2005                                u8 key_idx, bool unicast, bool multicast)
2006 {
2007         struct brcmf_if *ifp = netdev_priv(ndev);
2008         u32 index;
2009         u32 wsec;
2010         s32 err = 0;
2011
2012         brcmf_dbg(TRACE, "Enter\n");
2013         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2014         if (!check_vif_up(ifp->vif))
2015                 return -EIO;
2016
2017         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2018         if (err) {
2019                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2020                 goto done;
2021         }
2022
2023         if (wsec & WEP_ENABLED) {
2024                 /* Just select a new current key */
2025                 index = key_idx;
2026                 err = brcmf_fil_cmd_int_set(ifp,
2027                                             BRCMF_C_SET_KEY_PRIMARY, index);
2028                 if (err)
2029                         brcmf_err("error (%d)\n", err);
2030         }
2031 done:
2032         brcmf_dbg(TRACE, "Exit\n");
2033         return err;
2034 }
2035
2036 static s32
2037 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
2038               u8 key_idx, const u8 *mac_addr, struct key_params *params)
2039 {
2040         struct brcmf_if *ifp = netdev_priv(ndev);
2041         struct brcmf_wsec_key key;
2042         s32 err = 0;
2043         u8 keybuf[8];
2044
2045         memset(&key, 0, sizeof(key));
2046         key.index = (u32) key_idx;
2047         /* Instead of bcast for ea address for default wep keys,
2048                  driver needs it to be Null */
2049         if (!is_multicast_ether_addr(mac_addr))
2050                 memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
2051         key.len = (u32) params->key_len;
2052         /* check for key index change */
2053         if (key.len == 0) {
2054                 /* key delete */
2055                 err = send_key_to_dongle(ifp, &key);
2056                 if (err)
2057                         brcmf_err("key delete error (%d)\n", err);
2058         } else {
2059                 if (key.len > sizeof(key.data)) {
2060                         brcmf_err("Invalid key length (%d)\n", key.len);
2061                         return -EINVAL;
2062                 }
2063
2064                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
2065                 memcpy(key.data, params->key, key.len);
2066
2067                 if (!brcmf_is_apmode(ifp->vif) &&
2068                     (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
2069                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2070                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
2071                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
2072                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
2073                 }
2074
2075                 /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
2076                 if (params->seq && params->seq_len == 6) {
2077                         /* rx iv */
2078                         u8 *ivptr;
2079                         ivptr = (u8 *) params->seq;
2080                         key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2081                             (ivptr[3] << 8) | ivptr[2];
2082                         key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2083                         key.iv_initialized = true;
2084                 }
2085
2086                 switch (params->cipher) {
2087                 case WLAN_CIPHER_SUITE_WEP40:
2088                         key.algo = CRYPTO_ALGO_WEP1;
2089                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2090                         break;
2091                 case WLAN_CIPHER_SUITE_WEP104:
2092                         key.algo = CRYPTO_ALGO_WEP128;
2093                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2094                         break;
2095                 case WLAN_CIPHER_SUITE_TKIP:
2096                         key.algo = CRYPTO_ALGO_TKIP;
2097                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2098                         break;
2099                 case WLAN_CIPHER_SUITE_AES_CMAC:
2100                         key.algo = CRYPTO_ALGO_AES_CCM;
2101                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2102                         break;
2103                 case WLAN_CIPHER_SUITE_CCMP:
2104                         key.algo = CRYPTO_ALGO_AES_CCM;
2105                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2106                         break;
2107                 default:
2108                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2109                         return -EINVAL;
2110                 }
2111                 err = send_key_to_dongle(ifp, &key);
2112                 if (err)
2113                         brcmf_err("wsec_key error (%d)\n", err);
2114         }
2115         return err;
2116 }
2117
2118 static s32
2119 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2120                     u8 key_idx, bool pairwise, const u8 *mac_addr,
2121                     struct key_params *params)
2122 {
2123         struct brcmf_if *ifp = netdev_priv(ndev);
2124         struct brcmf_wsec_key *key;
2125         s32 val;
2126         s32 wsec;
2127         s32 err = 0;
2128         u8 keybuf[8];
2129
2130         brcmf_dbg(TRACE, "Enter\n");
2131         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2132         if (!check_vif_up(ifp->vif))
2133                 return -EIO;
2134
2135         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2136                 /* we ignore this key index in this case */
2137                 brcmf_err("invalid key index (%d)\n", key_idx);
2138                 return -EINVAL;
2139         }
2140
2141         if (mac_addr &&
2142                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2143                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2144                 brcmf_dbg(TRACE, "Exit");
2145                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
2146         }
2147
2148         key = &ifp->vif->profile.key[key_idx];
2149         memset(key, 0, sizeof(*key));
2150
2151         if (params->key_len > sizeof(key->data)) {
2152                 brcmf_err("Too long key length (%u)\n", params->key_len);
2153                 err = -EINVAL;
2154                 goto done;
2155         }
2156         key->len = params->key_len;
2157         key->index = key_idx;
2158
2159         memcpy(key->data, params->key, key->len);
2160
2161         key->flags = BRCMF_PRIMARY_KEY;
2162         switch (params->cipher) {
2163         case WLAN_CIPHER_SUITE_WEP40:
2164                 key->algo = CRYPTO_ALGO_WEP1;
2165                 val = WEP_ENABLED;
2166                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2167                 break;
2168         case WLAN_CIPHER_SUITE_WEP104:
2169                 key->algo = CRYPTO_ALGO_WEP128;
2170                 val = WEP_ENABLED;
2171                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2172                 break;
2173         case WLAN_CIPHER_SUITE_TKIP:
2174                 if (!brcmf_is_apmode(ifp->vif)) {
2175                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2176                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2177                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2178                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2179                 }
2180                 key->algo = CRYPTO_ALGO_TKIP;
2181                 val = TKIP_ENABLED;
2182                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2183                 break;
2184         case WLAN_CIPHER_SUITE_AES_CMAC:
2185                 key->algo = CRYPTO_ALGO_AES_CCM;
2186                 val = AES_ENABLED;
2187                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2188                 break;
2189         case WLAN_CIPHER_SUITE_CCMP:
2190                 key->algo = CRYPTO_ALGO_AES_CCM;
2191                 val = AES_ENABLED;
2192                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2193                 break;
2194         default:
2195                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2196                 err = -EINVAL;
2197                 goto done;
2198         }
2199
2200         err = send_key_to_dongle(ifp, key);
2201         if (err)
2202                 goto done;
2203
2204         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2205         if (err) {
2206                 brcmf_err("get wsec error (%d)\n", err);
2207                 goto done;
2208         }
2209         wsec |= val;
2210         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2211         if (err) {
2212                 brcmf_err("set wsec error (%d)\n", err);
2213                 goto done;
2214         }
2215
2216 done:
2217         brcmf_dbg(TRACE, "Exit\n");
2218         return err;
2219 }
2220
2221 static s32
2222 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2223                     u8 key_idx, bool pairwise, const u8 *mac_addr)
2224 {
2225         struct brcmf_if *ifp = netdev_priv(ndev);
2226         struct brcmf_wsec_key key;
2227         s32 err = 0;
2228
2229         brcmf_dbg(TRACE, "Enter\n");
2230         if (!check_vif_up(ifp->vif))
2231                 return -EIO;
2232
2233         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2234                 /* we ignore this key index in this case */
2235                 brcmf_err("invalid key index (%d)\n", key_idx);
2236                 return -EINVAL;
2237         }
2238
2239         memset(&key, 0, sizeof(key));
2240
2241         key.index = (u32) key_idx;
2242         key.flags = BRCMF_PRIMARY_KEY;
2243         key.algo = CRYPTO_ALGO_OFF;
2244
2245         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2246
2247         /* Set the new key/index */
2248         err = send_key_to_dongle(ifp, &key);
2249
2250         brcmf_dbg(TRACE, "Exit\n");
2251         return err;
2252 }
2253
2254 static s32
2255 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2256                     u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
2257                     void (*callback) (void *cookie, struct key_params * params))
2258 {
2259         struct key_params params;
2260         struct brcmf_if *ifp = netdev_priv(ndev);
2261         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2262         struct brcmf_cfg80211_security *sec;
2263         s32 wsec;
2264         s32 err = 0;
2265
2266         brcmf_dbg(TRACE, "Enter\n");
2267         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2268         if (!check_vif_up(ifp->vif))
2269                 return -EIO;
2270
2271         memset(&params, 0, sizeof(params));
2272
2273         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2274         if (err) {
2275                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2276                 /* Ignore this error, may happen during DISASSOC */
2277                 err = -EAGAIN;
2278                 goto done;
2279         }
2280         if (wsec & WEP_ENABLED) {
2281                 sec = &profile->sec;
2282                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2283                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2284                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2285                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2286                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2287                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2288                 }
2289         } else if (wsec & TKIP_ENABLED) {
2290                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2291                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2292         } else if (wsec & AES_ENABLED) {
2293                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2294                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2295         } else  {
2296                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2297                 err = -EINVAL;
2298                 goto done;
2299         }
2300         callback(cookie, &params);
2301
2302 done:
2303         brcmf_dbg(TRACE, "Exit\n");
2304         return err;
2305 }
2306
2307 static s32
2308 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2309                                     struct net_device *ndev, u8 key_idx)
2310 {
2311         brcmf_dbg(INFO, "Not supported\n");
2312
2313         return -EOPNOTSUPP;
2314 }
2315
2316 static void
2317 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2318 {
2319         s32 err;
2320         u8 key_idx;
2321         struct brcmf_wsec_key *key;
2322         s32 wsec;
2323
2324         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2325                 key = &ifp->vif->profile.key[key_idx];
2326                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2327                     (key->algo == CRYPTO_ALGO_WEP128))
2328                         break;
2329         }
2330         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2331                 return;
2332
2333         err = send_key_to_dongle(ifp, key);
2334         if (err) {
2335                 brcmf_err("Setting WEP key failed (%d)\n", err);
2336                 return;
2337         }
2338         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2339         if (err) {
2340                 brcmf_err("get wsec error (%d)\n", err);
2341                 return;
2342         }
2343         wsec |= WEP_ENABLED;
2344         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2345         if (err)
2346                 brcmf_err("set wsec error (%d)\n", err);
2347 }
2348
2349 static s32
2350 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2351                            const u8 *mac, struct station_info *sinfo)
2352 {
2353         struct brcmf_if *ifp = netdev_priv(ndev);
2354         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2355         struct brcmf_scb_val_le scb_val;
2356         int rssi;
2357         s32 rate;
2358         s32 err = 0;
2359         u8 *bssid = profile->bssid;
2360         struct brcmf_sta_info_le sta_info_le;
2361         u32 beacon_period;
2362         u32 dtim_period;
2363
2364         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2365         if (!check_vif_up(ifp->vif))
2366                 return -EIO;
2367
2368         if (brcmf_is_apmode(ifp->vif)) {
2369                 memcpy(&sta_info_le, mac, ETH_ALEN);
2370                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2371                                                &sta_info_le,
2372                                                sizeof(sta_info_le));
2373                 if (err < 0) {
2374                         brcmf_err("GET STA INFO failed, %d\n", err);
2375                         goto done;
2376                 }
2377                 sinfo->filled = STATION_INFO_INACTIVE_TIME;
2378                 sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2379                 if (le32_to_cpu(sta_info_le.flags) & BRCMF_STA_ASSOC) {
2380                         sinfo->filled |= STATION_INFO_CONNECTED_TIME;
2381                         sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2382                 }
2383                 brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
2384                           sinfo->inactive_time, sinfo->connected_time);
2385         } else if (ifp->vif->wdev.iftype == NL80211_IFTYPE_STATION) {
2386                 if (memcmp(mac, bssid, ETH_ALEN)) {
2387                         brcmf_err("Wrong Mac address cfg_mac-%pM wl_bssid-%pM\n",
2388                                   mac, bssid);
2389                         err = -ENOENT;
2390                         goto done;
2391                 }
2392                 /* Report the current tx rate */
2393                 err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2394                 if (err) {
2395                         brcmf_err("Could not get rate (%d)\n", err);
2396                         goto done;
2397                 } else {
2398                         sinfo->filled |= STATION_INFO_TX_BITRATE;
2399                         sinfo->txrate.legacy = rate * 5;
2400                         brcmf_dbg(CONN, "Rate %d Mbps\n", rate / 2);
2401                 }
2402
2403                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2404                              &ifp->vif->sme_state)) {
2405                         memset(&scb_val, 0, sizeof(scb_val));
2406                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2407                                                      &scb_val, sizeof(scb_val));
2408                         if (err) {
2409                                 brcmf_err("Could not get rssi (%d)\n", err);
2410                                 goto done;
2411                         } else {
2412                                 rssi = le32_to_cpu(scb_val.val);
2413                                 sinfo->filled |= STATION_INFO_SIGNAL;
2414                                 sinfo->signal = rssi;
2415                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2416                         }
2417                         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_BCNPRD,
2418                                                     &beacon_period);
2419                         if (err) {
2420                                 brcmf_err("Could not get beacon period (%d)\n",
2421                                           err);
2422                                 goto done;
2423                         } else {
2424                                 sinfo->bss_param.beacon_interval =
2425                                         beacon_period;
2426                                 brcmf_dbg(CONN, "Beacon peroid %d\n",
2427                                           beacon_period);
2428                         }
2429                         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_DTIMPRD,
2430                                                     &dtim_period);
2431                         if (err) {
2432                                 brcmf_err("Could not get DTIM period (%d)\n",
2433                                           err);
2434                                 goto done;
2435                         } else {
2436                                 sinfo->bss_param.dtim_period = dtim_period;
2437                                 brcmf_dbg(CONN, "DTIM peroid %d\n",
2438                                           dtim_period);
2439                         }
2440                         sinfo->filled |= STATION_INFO_BSS_PARAM;
2441                 }
2442         } else
2443                 err = -EPERM;
2444 done:
2445         brcmf_dbg(TRACE, "Exit\n");
2446         return err;
2447 }
2448
2449 static s32
2450 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2451                            bool enabled, s32 timeout)
2452 {
2453         s32 pm;
2454         s32 err = 0;
2455         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2456         struct brcmf_if *ifp = netdev_priv(ndev);
2457
2458         brcmf_dbg(TRACE, "Enter\n");
2459
2460         /*
2461          * Powersave enable/disable request is coming from the
2462          * cfg80211 even before the interface is up. In that
2463          * scenario, driver will be storing the power save
2464          * preference in cfg struct to apply this to
2465          * FW later while initializing the dongle
2466          */
2467         cfg->pwr_save = enabled;
2468         if (!check_vif_up(ifp->vif)) {
2469
2470                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2471                 goto done;
2472         }
2473
2474         pm = enabled ? PM_FAST : PM_OFF;
2475         /* Do not enable the power save after assoc if it is a p2p interface */
2476         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2477                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2478                 pm = PM_OFF;
2479         }
2480         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2481
2482         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2483         if (err) {
2484                 if (err == -ENODEV)
2485                         brcmf_err("net_device is not ready yet\n");
2486                 else
2487                         brcmf_err("error (%d)\n", err);
2488         }
2489 done:
2490         brcmf_dbg(TRACE, "Exit\n");
2491         return err;
2492 }
2493
2494 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2495                                    struct brcmf_bss_info_le *bi)
2496 {
2497         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2498         struct ieee80211_channel *notify_channel;
2499         struct cfg80211_bss *bss;
2500         struct ieee80211_supported_band *band;
2501         struct brcmu_chan ch;
2502         u16 channel;
2503         u32 freq;
2504         u16 notify_capability;
2505         u16 notify_interval;
2506         u8 *notify_ie;
2507         size_t notify_ielen;
2508         s32 notify_signal;
2509
2510         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2511                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2512                 return 0;
2513         }
2514
2515         if (!bi->ctl_ch) {
2516                 ch.chspec = le16_to_cpu(bi->chanspec);
2517                 cfg->d11inf.decchspec(&ch);
2518                 bi->ctl_ch = ch.chnum;
2519         }
2520         channel = bi->ctl_ch;
2521
2522         if (channel <= CH_MAX_2G_CHANNEL)
2523                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2524         else
2525                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2526
2527         freq = ieee80211_channel_to_frequency(channel, band->band);
2528         notify_channel = ieee80211_get_channel(wiphy, freq);
2529
2530         notify_capability = le16_to_cpu(bi->capability);
2531         notify_interval = le16_to_cpu(bi->beacon_period);
2532         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2533         notify_ielen = le32_to_cpu(bi->ie_length);
2534         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2535
2536         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2537         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2538         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2539         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2540         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2541
2542         bss = cfg80211_inform_bss(wiphy, notify_channel,
2543                                   CFG80211_BSS_FTYPE_UNKNOWN,
2544                                   (const u8 *)bi->BSSID,
2545                                   0, notify_capability,
2546                                   notify_interval, notify_ie,
2547                                   notify_ielen, notify_signal,
2548                                   GFP_KERNEL);
2549
2550         if (!bss)
2551                 return -ENOMEM;
2552
2553         cfg80211_put_bss(wiphy, bss);
2554
2555         return 0;
2556 }
2557
2558 static struct brcmf_bss_info_le *
2559 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2560 {
2561         if (bss == NULL)
2562                 return list->bss_info_le;
2563         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2564                                             le32_to_cpu(bss->length));
2565 }
2566
2567 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2568 {
2569         struct brcmf_scan_results *bss_list;
2570         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2571         s32 err = 0;
2572         int i;
2573
2574         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2575         if (bss_list->count != 0 &&
2576             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2577                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2578                           bss_list->version);
2579                 return -EOPNOTSUPP;
2580         }
2581         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2582         for (i = 0; i < bss_list->count; i++) {
2583                 bi = next_bss_le(bss_list, bi);
2584                 err = brcmf_inform_single_bss(cfg, bi);
2585                 if (err)
2586                         break;
2587         }
2588         return err;
2589 }
2590
2591 static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
2592                           struct net_device *ndev, const u8 *bssid)
2593 {
2594         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2595         struct ieee80211_channel *notify_channel;
2596         struct brcmf_bss_info_le *bi = NULL;
2597         struct ieee80211_supported_band *band;
2598         struct cfg80211_bss *bss;
2599         struct brcmu_chan ch;
2600         u8 *buf = NULL;
2601         s32 err = 0;
2602         u32 freq;
2603         u16 notify_capability;
2604         u16 notify_interval;
2605         u8 *notify_ie;
2606         size_t notify_ielen;
2607         s32 notify_signal;
2608
2609         brcmf_dbg(TRACE, "Enter\n");
2610
2611         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2612         if (buf == NULL) {
2613                 err = -ENOMEM;
2614                 goto CleanUp;
2615         }
2616
2617         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2618
2619         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2620                                      buf, WL_BSS_INFO_MAX);
2621         if (err) {
2622                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2623                 goto CleanUp;
2624         }
2625
2626         bi = (struct brcmf_bss_info_le *)(buf + 4);
2627
2628         ch.chspec = le16_to_cpu(bi->chanspec);
2629         cfg->d11inf.decchspec(&ch);
2630
2631         if (ch.band == BRCMU_CHAN_BAND_2G)
2632                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2633         else
2634                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2635
2636         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
2637         notify_channel = ieee80211_get_channel(wiphy, freq);
2638
2639         notify_capability = le16_to_cpu(bi->capability);
2640         notify_interval = le16_to_cpu(bi->beacon_period);
2641         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2642         notify_ielen = le32_to_cpu(bi->ie_length);
2643         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2644
2645         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.chnum, freq);
2646         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2647         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2648         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2649
2650         bss = cfg80211_inform_bss(wiphy, notify_channel,
2651                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2652                                   notify_capability, notify_interval,
2653                                   notify_ie, notify_ielen, notify_signal,
2654                                   GFP_KERNEL);
2655
2656         if (!bss) {
2657                 err = -ENOMEM;
2658                 goto CleanUp;
2659         }
2660
2661         cfg80211_put_bss(wiphy, bss);
2662
2663 CleanUp:
2664
2665         kfree(buf);
2666
2667         brcmf_dbg(TRACE, "Exit\n");
2668
2669         return err;
2670 }
2671
2672 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2673                                  struct brcmf_if *ifp)
2674 {
2675         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ifp->ndev);
2676         struct brcmf_bss_info_le *bi;
2677         struct brcmf_ssid *ssid;
2678         const struct brcmf_tlv *tim;
2679         u16 beacon_interval;
2680         u8 dtim_period;
2681         size_t ie_len;
2682         u8 *ie;
2683         s32 err = 0;
2684
2685         brcmf_dbg(TRACE, "Enter\n");
2686         if (brcmf_is_ibssmode(ifp->vif))
2687                 return err;
2688
2689         ssid = &profile->ssid;
2690
2691         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2692         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2693                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2694         if (err) {
2695                 brcmf_err("Could not get bss info %d\n", err);
2696                 goto update_bss_info_out;
2697         }
2698
2699         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2700         err = brcmf_inform_single_bss(cfg, bi);
2701         if (err)
2702                 goto update_bss_info_out;
2703
2704         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2705         ie_len = le32_to_cpu(bi->ie_length);
2706         beacon_interval = le16_to_cpu(bi->beacon_period);
2707
2708         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2709         if (tim)
2710                 dtim_period = tim->data[1];
2711         else {
2712                 /*
2713                 * active scan was done so we could not get dtim
2714                 * information out of probe response.
2715                 * so we speficially query dtim information to dongle.
2716                 */
2717                 u32 var;
2718                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2719                 if (err) {
2720                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2721                         goto update_bss_info_out;
2722                 }
2723                 dtim_period = (u8)var;
2724         }
2725
2726 update_bss_info_out:
2727         brcmf_dbg(TRACE, "Exit");
2728         return err;
2729 }
2730
2731 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
2732 {
2733         struct escan_info *escan = &cfg->escan_info;
2734
2735         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2736         if (cfg->scan_request) {
2737                 escan->escan_state = WL_ESCAN_STATE_IDLE;
2738                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
2739         }
2740         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
2741         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2742 }
2743
2744 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
2745 {
2746         struct brcmf_cfg80211_info *cfg =
2747                         container_of(work, struct brcmf_cfg80211_info,
2748                                      escan_timeout_work);
2749
2750         brcmf_inform_bss(cfg);
2751         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
2752 }
2753
2754 static void brcmf_escan_timeout(unsigned long data)
2755 {
2756         struct brcmf_cfg80211_info *cfg =
2757                         (struct brcmf_cfg80211_info *)data;
2758
2759         if (cfg->scan_request) {
2760                 brcmf_err("timer expired\n");
2761                 schedule_work(&cfg->escan_timeout_work);
2762         }
2763 }
2764
2765 static s32
2766 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
2767                               struct brcmf_bss_info_le *bss,
2768                               struct brcmf_bss_info_le *bss_info_le)
2769 {
2770         struct brcmu_chan ch_bss, ch_bss_info_le;
2771
2772         ch_bss.chspec = le16_to_cpu(bss->chanspec);
2773         cfg->d11inf.decchspec(&ch_bss);
2774         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
2775         cfg->d11inf.decchspec(&ch_bss_info_le);
2776
2777         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
2778                 ch_bss.band == ch_bss_info_le.band &&
2779                 bss_info_le->SSID_len == bss->SSID_len &&
2780                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
2781                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
2782                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
2783                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
2784                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
2785
2786                         /* preserve max RSSI if the measurements are
2787                         * both on-channel or both off-channel
2788                         */
2789                         if (bss_info_rssi > bss_rssi)
2790                                 bss->RSSI = bss_info_le->RSSI;
2791                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
2792                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
2793                         /* preserve the on-channel rssi measurement
2794                         * if the new measurement is off channel
2795                         */
2796                         bss->RSSI = bss_info_le->RSSI;
2797                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
2798                 }
2799                 return 1;
2800         }
2801         return 0;
2802 }
2803
2804 static s32
2805 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
2806                              const struct brcmf_event_msg *e, void *data)
2807 {
2808         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
2809         s32 status;
2810         struct brcmf_escan_result_le *escan_result_le;
2811         struct brcmf_bss_info_le *bss_info_le;
2812         struct brcmf_bss_info_le *bss = NULL;
2813         u32 bi_length;
2814         struct brcmf_scan_results *list;
2815         u32 i;
2816         bool aborted;
2817
2818         status = e->status;
2819
2820         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
2821                 brcmf_err("scan not ready, bssidx=%d\n", ifp->bssidx);
2822                 return -EPERM;
2823         }
2824
2825         if (status == BRCMF_E_STATUS_PARTIAL) {
2826                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
2827                 escan_result_le = (struct brcmf_escan_result_le *) data;
2828                 if (!escan_result_le) {
2829                         brcmf_err("Invalid escan result (NULL pointer)\n");
2830                         goto exit;
2831                 }
2832                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
2833                         brcmf_err("Invalid bss_count %d: ignoring\n",
2834                                   escan_result_le->bss_count);
2835                         goto exit;
2836                 }
2837                 bss_info_le = &escan_result_le->bss_info_le;
2838
2839                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
2840                         goto exit;
2841
2842                 if (!cfg->scan_request) {
2843                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
2844                         goto exit;
2845                 }
2846
2847                 bi_length = le32_to_cpu(bss_info_le->length);
2848                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
2849                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
2850                         brcmf_err("Invalid bss_info length %d: ignoring\n",
2851                                   bi_length);
2852                         goto exit;
2853                 }
2854
2855                 if (!(cfg_to_wiphy(cfg)->interface_modes &
2856                                         BIT(NL80211_IFTYPE_ADHOC))) {
2857                         if (le16_to_cpu(bss_info_le->capability) &
2858                                                 WLAN_CAPABILITY_IBSS) {
2859                                 brcmf_err("Ignoring IBSS result\n");
2860                                 goto exit;
2861                         }
2862                 }
2863
2864                 list = (struct brcmf_scan_results *)
2865                                 cfg->escan_info.escan_buf;
2866                 if (bi_length > WL_ESCAN_BUF_SIZE - list->buflen) {
2867                         brcmf_err("Buffer is too small: ignoring\n");
2868                         goto exit;
2869                 }
2870
2871                 for (i = 0; i < list->count; i++) {
2872                         bss = bss ? (struct brcmf_bss_info_le *)
2873                                 ((unsigned char *)bss +
2874                                 le32_to_cpu(bss->length)) : list->bss_info_le;
2875                         if (brcmf_compare_update_same_bss(cfg, bss,
2876                                                           bss_info_le))
2877                                 goto exit;
2878                 }
2879                 memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
2880                         bss_info_le, bi_length);
2881                 list->version = le32_to_cpu(bss_info_le->version);
2882                 list->buflen += bi_length;
2883                 list->count++;
2884         } else {
2885                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
2886                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
2887                         goto exit;
2888                 if (cfg->scan_request) {
2889                         brcmf_inform_bss(cfg);
2890                         aborted = status != BRCMF_E_STATUS_SUCCESS;
2891                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
2892                 } else
2893                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
2894                                   status);
2895         }
2896 exit:
2897         return 0;
2898 }
2899
2900 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
2901 {
2902         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
2903                             brcmf_cfg80211_escan_handler);
2904         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
2905         /* Init scan_timeout timer */
2906         init_timer(&cfg->escan_timeout);
2907         cfg->escan_timeout.data = (unsigned long) cfg;
2908         cfg->escan_timeout.function = brcmf_escan_timeout;
2909         INIT_WORK(&cfg->escan_timeout_work,
2910                   brcmf_cfg80211_escan_timeout_worker);
2911 }
2912
2913 static __always_inline void brcmf_delay(u32 ms)
2914 {
2915         if (ms < 1000 / HZ) {
2916                 cond_resched();
2917                 mdelay(ms);
2918         } else {
2919                 msleep(ms);
2920         }
2921 }
2922
2923 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
2924                                      u8 *pattern, u32 patternsize, u8 *mask,
2925                                      u32 packet_offset)
2926 {
2927         struct brcmf_fil_wowl_pattern_le *filter;
2928         u32 masksize;
2929         u32 patternoffset;
2930         u8 *buf;
2931         u32 bufsize;
2932         s32 ret;
2933
2934         masksize = (patternsize + 7) / 8;
2935         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
2936
2937         bufsize = sizeof(*filter) + patternsize + masksize;
2938         buf = kzalloc(bufsize, GFP_KERNEL);
2939         if (!buf)
2940                 return -ENOMEM;
2941         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
2942
2943         memcpy(filter->cmd, cmd, 4);
2944         filter->masksize = cpu_to_le32(masksize);
2945         filter->offset = cpu_to_le32(packet_offset);
2946         filter->patternoffset = cpu_to_le32(patternoffset);
2947         filter->patternsize = cpu_to_le32(patternsize);
2948         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
2949
2950         if ((mask) && (masksize))
2951                 memcpy(buf + sizeof(*filter), mask, masksize);
2952         if ((pattern) && (patternsize))
2953                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
2954
2955         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
2956
2957         kfree(buf);
2958         return ret;
2959 }
2960
2961 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
2962 {
2963         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2964         struct net_device *ndev = cfg_to_ndev(cfg);
2965         struct brcmf_if *ifp = netdev_priv(ndev);
2966
2967         brcmf_dbg(TRACE, "Enter\n");
2968
2969         if (cfg->wowl_enabled) {
2970                 brcmf_configure_arp_offload(ifp, true);
2971                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
2972                                       cfg->pre_wowl_pmmode);
2973                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
2974                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
2975                 cfg->wowl_enabled = false;
2976         }
2977         return 0;
2978 }
2979
2980 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
2981                                  struct brcmf_if *ifp,
2982                                  struct cfg80211_wowlan *wowl)
2983 {
2984         u32 wowl_config;
2985         u32 i;
2986
2987         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
2988
2989         brcmf_configure_arp_offload(ifp, false);
2990         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->pre_wowl_pmmode);
2991         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
2992
2993         wowl_config = 0;
2994         if (wowl->disconnect)
2995                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
2996         if (wowl->magic_pkt)
2997                 wowl_config |= BRCMF_WOWL_MAGIC;
2998         if ((wowl->patterns) && (wowl->n_patterns)) {
2999                 wowl_config |= BRCMF_WOWL_NET;
3000                 for (i = 0; i < wowl->n_patterns; i++) {
3001                         brcmf_config_wowl_pattern(ifp, "add",
3002                                 (u8 *)wowl->patterns[i].pattern,
3003                                 wowl->patterns[i].pattern_len,
3004                                 (u8 *)wowl->patterns[i].mask,
3005                                 wowl->patterns[i].pkt_offset);
3006                 }
3007         }
3008         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3009         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3010         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3011         cfg->wowl_enabled = true;
3012 }
3013
3014 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3015                                   struct cfg80211_wowlan *wowl)
3016 {
3017         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3018         struct net_device *ndev = cfg_to_ndev(cfg);
3019         struct brcmf_if *ifp = netdev_priv(ndev);
3020         struct brcmf_cfg80211_vif *vif;
3021
3022         brcmf_dbg(TRACE, "Enter\n");
3023
3024         /* if the primary net_device is not READY there is nothing
3025          * we can do but pray resume goes smoothly.
3026          */
3027         if (!check_vif_up(ifp->vif))
3028                 goto exit;
3029
3030         /* end any scanning */
3031         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3032                 brcmf_abort_scanning(cfg);
3033
3034         if (wowl == NULL) {
3035                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3036                 list_for_each_entry(vif, &cfg->vif_list, list) {
3037                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3038                                 continue;
3039                         /* While going to suspend if associated with AP
3040                          * disassociate from AP to save power while system is
3041                          * in suspended state
3042                          */
3043                         brcmf_link_down(vif);
3044                         /* Make sure WPA_Supplicant receives all the event
3045                          * generated due to DISASSOC call to the fw to keep
3046                          * the state fw and WPA_Supplicant state consistent
3047                          */
3048                         brcmf_delay(500);
3049                 }
3050                 /* Configure MPC */
3051                 brcmf_set_mpc(ifp, 1);
3052
3053         } else {
3054                 /* Configure WOWL paramaters */
3055                 brcmf_configure_wowl(cfg, ifp, wowl);
3056         }
3057
3058 exit:
3059         brcmf_dbg(TRACE, "Exit\n");
3060         /* clear any scanning activity */
3061         cfg->scan_status = 0;
3062         return 0;
3063 }
3064
3065 static __used s32
3066 brcmf_update_pmklist(struct net_device *ndev,
3067                      struct brcmf_cfg80211_pmk_list *pmk_list, s32 err)
3068 {
3069         int i, j;
3070         u32 pmkid_len;
3071
3072         pmkid_len = le32_to_cpu(pmk_list->pmkids.npmkid);
3073
3074         brcmf_dbg(CONN, "No of elements %d\n", pmkid_len);
3075         for (i = 0; i < pmkid_len; i++) {
3076                 brcmf_dbg(CONN, "PMKID[%d]: %pM =\n", i,
3077                           &pmk_list->pmkids.pmkid[i].BSSID);
3078                 for (j = 0; j < WLAN_PMKID_LEN; j++)
3079                         brcmf_dbg(CONN, "%02x\n",
3080                                   pmk_list->pmkids.pmkid[i].PMKID[j]);
3081         }
3082
3083         if (!err)
3084                 brcmf_fil_iovar_data_set(netdev_priv(ndev), "pmkid_info",
3085                                          (char *)pmk_list, sizeof(*pmk_list));
3086
3087         return err;
3088 }
3089
3090 static s32
3091 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3092                          struct cfg80211_pmksa *pmksa)
3093 {
3094         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3095         struct brcmf_if *ifp = netdev_priv(ndev);
3096         struct pmkid_list *pmkids = &cfg->pmk_list->pmkids;
3097         s32 err = 0;
3098         u32 pmkid_len, i;
3099
3100         brcmf_dbg(TRACE, "Enter\n");
3101         if (!check_vif_up(ifp->vif))
3102                 return -EIO;
3103
3104         pmkid_len = le32_to_cpu(pmkids->npmkid);
3105         for (i = 0; i < pmkid_len; i++)
3106                 if (!memcmp(pmksa->bssid, pmkids->pmkid[i].BSSID, ETH_ALEN))
3107                         break;
3108         if (i < WL_NUM_PMKIDS_MAX) {
3109                 memcpy(pmkids->pmkid[i].BSSID, pmksa->bssid, ETH_ALEN);
3110                 memcpy(pmkids->pmkid[i].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
3111                 if (i == pmkid_len) {
3112                         pmkid_len++;
3113                         pmkids->npmkid = cpu_to_le32(pmkid_len);
3114                 }
3115         } else
3116                 err = -EINVAL;
3117
3118         brcmf_dbg(CONN, "set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
3119                   pmkids->pmkid[pmkid_len].BSSID);
3120         for (i = 0; i < WLAN_PMKID_LEN; i++)
3121                 brcmf_dbg(CONN, "%02x\n", pmkids->pmkid[pmkid_len].PMKID[i]);
3122
3123         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3124
3125         brcmf_dbg(TRACE, "Exit\n");
3126         return err;
3127 }
3128
3129 static s32
3130 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3131                       struct cfg80211_pmksa *pmksa)
3132 {
3133         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3134         struct brcmf_if *ifp = netdev_priv(ndev);
3135         struct pmkid_list pmkid;
3136         s32 err = 0;
3137         u32 pmkid_len, i;
3138
3139         brcmf_dbg(TRACE, "Enter\n");
3140         if (!check_vif_up(ifp->vif))
3141                 return -EIO;
3142
3143         memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETH_ALEN);
3144         memcpy(&pmkid.pmkid[0].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
3145
3146         brcmf_dbg(CONN, "del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
3147                   &pmkid.pmkid[0].BSSID);
3148         for (i = 0; i < WLAN_PMKID_LEN; i++)
3149                 brcmf_dbg(CONN, "%02x\n", pmkid.pmkid[0].PMKID[i]);
3150
3151         pmkid_len = le32_to_cpu(cfg->pmk_list->pmkids.npmkid);
3152         for (i = 0; i < pmkid_len; i++)
3153                 if (!memcmp
3154                     (pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
3155                      ETH_ALEN))
3156                         break;
3157
3158         if ((pmkid_len > 0)
3159             && (i < pmkid_len)) {
3160                 memset(&cfg->pmk_list->pmkids.pmkid[i], 0,
3161                        sizeof(struct pmkid));
3162                 for (; i < (pmkid_len - 1); i++) {
3163                         memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID,
3164                                &cfg->pmk_list->pmkids.pmkid[i + 1].BSSID,
3165                                ETH_ALEN);
3166                         memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID,
3167                                &cfg->pmk_list->pmkids.pmkid[i + 1].PMKID,
3168                                WLAN_PMKID_LEN);
3169                 }
3170                 cfg->pmk_list->pmkids.npmkid = cpu_to_le32(pmkid_len - 1);
3171         } else
3172                 err = -EINVAL;
3173
3174         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3175
3176         brcmf_dbg(TRACE, "Exit\n");
3177         return err;
3178
3179 }
3180
3181 static s32
3182 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3183 {
3184         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3185         struct brcmf_if *ifp = netdev_priv(ndev);
3186         s32 err = 0;
3187
3188         brcmf_dbg(TRACE, "Enter\n");
3189         if (!check_vif_up(ifp->vif))
3190                 return -EIO;
3191
3192         memset(cfg->pmk_list, 0, sizeof(*cfg->pmk_list));
3193         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3194
3195         brcmf_dbg(TRACE, "Exit\n");
3196         return err;
3197
3198 }
3199
3200 /*
3201  * PFN result doesn't have all the info which are
3202  * required by the supplicant
3203  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3204  * via wl_inform_single_bss in the required format. Escan does require the
3205  * scan request in the form of cfg80211_scan_request. For timebeing, create
3206  * cfg80211_scan_request one out of the received PNO event.
3207  */
3208 static s32
3209 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3210                                 const struct brcmf_event_msg *e, void *data)
3211 {
3212         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3213         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3214         struct cfg80211_scan_request *request = NULL;
3215         struct cfg80211_ssid *ssid = NULL;
3216         struct ieee80211_channel *channel = NULL;
3217         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3218         int err = 0;
3219         int channel_req = 0;
3220         int band = 0;
3221         struct brcmf_pno_scanresults_le *pfn_result;
3222         u32 result_count;
3223         u32 status;
3224
3225         brcmf_dbg(SCAN, "Enter\n");
3226
3227         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3228                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3229                 return 0;
3230         }
3231
3232         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3233         result_count = le32_to_cpu(pfn_result->count);
3234         status = le32_to_cpu(pfn_result->status);
3235
3236         /*
3237          * PFN event is limited to fit 512 bytes so we may get
3238          * multiple NET_FOUND events. For now place a warning here.
3239          */
3240         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3241         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3242         if (result_count > 0) {
3243                 int i;
3244
3245                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3246                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3247                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3248                 if (!request || !ssid || !channel) {
3249                         err = -ENOMEM;
3250                         goto out_err;
3251                 }
3252
3253                 request->wiphy = wiphy;
3254                 data += sizeof(struct brcmf_pno_scanresults_le);
3255                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3256
3257                 for (i = 0; i < result_count; i++) {
3258                         netinfo = &netinfo_start[i];
3259                         if (!netinfo) {
3260                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3261                                           i);
3262                                 err = -EINVAL;
3263                                 goto out_err;
3264                         }
3265
3266                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3267                                   netinfo->SSID, netinfo->channel);
3268                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3269                         ssid[i].ssid_len = netinfo->SSID_len;
3270                         request->n_ssids++;
3271
3272                         channel_req = netinfo->channel;
3273                         if (channel_req <= CH_MAX_2G_CHANNEL)
3274                                 band = NL80211_BAND_2GHZ;
3275                         else
3276                                 band = NL80211_BAND_5GHZ;
3277                         channel[i].center_freq =
3278                                 ieee80211_channel_to_frequency(channel_req,
3279                                                                band);
3280                         channel[i].band = band;
3281                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3282                         request->channels[i] = &channel[i];
3283                         request->n_channels++;
3284                 }
3285
3286                 /* assign parsed ssid array */
3287                 if (request->n_ssids)
3288                         request->ssids = &ssid[0];
3289
3290                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3291                         /* Abort any on-going scan */
3292                         brcmf_abort_scanning(cfg);
3293                 }
3294
3295                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3296                 cfg->escan_info.run = brcmf_run_escan;
3297                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3298                 if (err) {
3299                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3300                         goto out_err;
3301                 }
3302                 cfg->sched_escan = true;
3303                 cfg->scan_request = request;
3304         } else {
3305                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3306                 goto out_err;
3307         }
3308
3309         kfree(ssid);
3310         kfree(channel);
3311         kfree(request);
3312         return 0;
3313
3314 out_err:
3315         kfree(ssid);
3316         kfree(channel);
3317         kfree(request);
3318         cfg80211_sched_scan_stopped(wiphy);
3319         return err;
3320 }
3321
3322 static int brcmf_dev_pno_clean(struct net_device *ndev)
3323 {
3324         int ret;
3325
3326         /* Disable pfn */
3327         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3328         if (ret == 0) {
3329                 /* clear pfn */
3330                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3331                                                NULL, 0);
3332         }
3333         if (ret < 0)
3334                 brcmf_err("failed code %d\n", ret);
3335
3336         return ret;
3337 }
3338
3339 static int brcmf_dev_pno_config(struct net_device *ndev)
3340 {
3341         struct brcmf_pno_param_le pfn_param;
3342
3343         memset(&pfn_param, 0, sizeof(pfn_param));
3344         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3345
3346         /* set extra pno params */
3347         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3348         pfn_param.repeat = BRCMF_PNO_REPEAT;
3349         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3350
3351         /* set up pno scan fr */
3352         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3353
3354         return brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfn_set",
3355                                         &pfn_param, sizeof(pfn_param));
3356 }
3357
3358 static int
3359 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3360                                 struct net_device *ndev,
3361                                 struct cfg80211_sched_scan_request *request)
3362 {
3363         struct brcmf_if *ifp = netdev_priv(ndev);
3364         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3365         struct brcmf_pno_net_param_le pfn;
3366         int i;
3367         int ret = 0;
3368
3369         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3370                   request->n_match_sets, request->n_ssids);
3371         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3372                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3373                 return -EAGAIN;
3374         }
3375         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3376                 brcmf_err("Scanning suppressed: status (%lu)\n",
3377                           cfg->scan_status);
3378                 return -EAGAIN;
3379         }
3380
3381         if (!request->n_ssids || !request->n_match_sets) {
3382                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3383                           request->n_ssids);
3384                 return -EINVAL;
3385         }
3386
3387         if (request->n_ssids > 0) {
3388                 for (i = 0; i < request->n_ssids; i++) {
3389                         /* Active scan req for ssids */
3390                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3391                                   request->ssids[i].ssid);
3392
3393                         /*
3394                          * match_set ssids is a supert set of n_ssid list,
3395                          * so we need not add these set seperately.
3396                          */
3397                 }
3398         }
3399
3400         if (request->n_match_sets > 0) {
3401                 /* clean up everything */
3402                 ret = brcmf_dev_pno_clean(ndev);
3403                 if  (ret < 0) {
3404                         brcmf_err("failed error=%d\n", ret);
3405                         return ret;
3406                 }
3407
3408                 /* configure pno */
3409                 ret = brcmf_dev_pno_config(ndev);
3410                 if (ret < 0) {
3411                         brcmf_err("PNO setup failed!! ret=%d\n", ret);
3412                         return -EINVAL;
3413                 }
3414
3415                 /* configure each match set */
3416                 for (i = 0; i < request->n_match_sets; i++) {
3417                         struct cfg80211_ssid *ssid;
3418                         u32 ssid_len;
3419
3420                         ssid = &request->match_sets[i].ssid;
3421                         ssid_len = ssid->ssid_len;
3422
3423                         if (!ssid_len) {
3424                                 brcmf_err("skip broadcast ssid\n");
3425                                 continue;
3426                         }
3427                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3428                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3429                         pfn.wsec = cpu_to_le32(0);
3430                         pfn.infra = cpu_to_le32(1);
3431                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3432                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3433                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3434                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3435                                                        sizeof(pfn));
3436                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3437                                   ret == 0 ? "set" : "failed", ssid->ssid);
3438                 }
3439                 /* Enable the PNO */
3440                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3441                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3442                         return -EINVAL;
3443                 }
3444         } else {
3445                 return -EINVAL;
3446         }
3447
3448         return 0;
3449 }
3450
3451 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3452                                           struct net_device *ndev)
3453 {
3454         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3455
3456         brcmf_dbg(SCAN, "enter\n");
3457         brcmf_dev_pno_clean(ndev);
3458         if (cfg->sched_escan)
3459                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3460         return 0;
3461 }
3462
3463 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3464 {
3465         s32 err;
3466
3467         /* set auth */
3468         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3469         if (err < 0) {
3470                 brcmf_err("auth error %d\n", err);
3471                 return err;
3472         }
3473         /* set wsec */
3474         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3475         if (err < 0) {
3476                 brcmf_err("wsec error %d\n", err);
3477                 return err;
3478         }
3479         /* set upper-layer auth */
3480         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3481         if (err < 0) {
3482                 brcmf_err("wpa_auth error %d\n", err);
3483                 return err;
3484         }
3485
3486         return 0;
3487 }
3488
3489 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3490 {
3491         if (is_rsn_ie)
3492                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3493
3494         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3495 }
3496
3497 static s32
3498 brcmf_configure_wpaie(struct brcmf_if *ifp,
3499                       const struct brcmf_vs_tlv *wpa_ie,
3500                       bool is_rsn_ie)
3501 {
3502         u32 auth = 0; /* d11 open authentication */
3503         u16 count;
3504         s32 err = 0;
3505         s32 len = 0;
3506         u32 i;
3507         u32 wsec;
3508         u32 pval = 0;
3509         u32 gval = 0;
3510         u32 wpa_auth = 0;
3511         u32 offset;
3512         u8 *data;
3513         u16 rsn_cap;
3514         u32 wme_bss_disable;
3515
3516         brcmf_dbg(TRACE, "Enter\n");
3517         if (wpa_ie == NULL)
3518                 goto exit;
3519
3520         len = wpa_ie->len + TLV_HDR_LEN;
3521         data = (u8 *)wpa_ie;
3522         offset = TLV_HDR_LEN;
3523         if (!is_rsn_ie)
3524                 offset += VS_IE_FIXED_HDR_LEN;
3525         else
3526                 offset += WPA_IE_VERSION_LEN;
3527
3528         /* check for multicast cipher suite */
3529         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3530                 err = -EINVAL;
3531                 brcmf_err("no multicast cipher suite\n");
3532                 goto exit;
3533         }
3534
3535         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3536                 err = -EINVAL;
3537                 brcmf_err("ivalid OUI\n");
3538                 goto exit;
3539         }
3540         offset += TLV_OUI_LEN;
3541
3542         /* pick up multicast cipher */
3543         switch (data[offset]) {
3544         case WPA_CIPHER_NONE:
3545                 gval = 0;
3546                 break;
3547         case WPA_CIPHER_WEP_40:
3548         case WPA_CIPHER_WEP_104:
3549                 gval = WEP_ENABLED;
3550                 break;
3551         case WPA_CIPHER_TKIP:
3552                 gval = TKIP_ENABLED;
3553                 break;
3554         case WPA_CIPHER_AES_CCM:
3555                 gval = AES_ENABLED;
3556                 break;
3557         default:
3558                 err = -EINVAL;
3559                 brcmf_err("Invalid multi cast cipher info\n");
3560                 goto exit;
3561         }
3562
3563         offset++;
3564         /* walk thru unicast cipher list and pick up what we recognize */
3565         count = data[offset] + (data[offset + 1] << 8);
3566         offset += WPA_IE_SUITE_COUNT_LEN;
3567         /* Check for unicast suite(s) */
3568         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3569                 err = -EINVAL;
3570                 brcmf_err("no unicast cipher suite\n");
3571                 goto exit;
3572         }
3573         for (i = 0; i < count; i++) {
3574                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3575                         err = -EINVAL;
3576                         brcmf_err("ivalid OUI\n");
3577                         goto exit;
3578                 }
3579                 offset += TLV_OUI_LEN;
3580                 switch (data[offset]) {
3581                 case WPA_CIPHER_NONE:
3582                         break;
3583                 case WPA_CIPHER_WEP_40:
3584                 case WPA_CIPHER_WEP_104:
3585                         pval |= WEP_ENABLED;
3586                         break;
3587                 case WPA_CIPHER_TKIP:
3588                         pval |= TKIP_ENABLED;
3589                         break;
3590                 case WPA_CIPHER_AES_CCM:
3591                         pval |= AES_ENABLED;
3592                         break;
3593                 default:
3594                         brcmf_err("Ivalid unicast security info\n");
3595                 }
3596                 offset++;
3597         }
3598         /* walk thru auth management suite list and pick up what we recognize */
3599         count = data[offset] + (data[offset + 1] << 8);
3600         offset += WPA_IE_SUITE_COUNT_LEN;
3601         /* Check for auth key management suite(s) */
3602         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3603                 err = -EINVAL;
3604                 brcmf_err("no auth key mgmt suite\n");
3605                 goto exit;
3606         }
3607         for (i = 0; i < count; i++) {
3608                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3609                         err = -EINVAL;
3610                         brcmf_err("ivalid OUI\n");
3611                         goto exit;
3612                 }
3613                 offset += TLV_OUI_LEN;
3614                 switch (data[offset]) {
3615                 case RSN_AKM_NONE:
3616                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
3617                         wpa_auth |= WPA_AUTH_NONE;
3618                         break;
3619                 case RSN_AKM_UNSPECIFIED:
3620                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
3621                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
3622                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
3623                         break;
3624                 case RSN_AKM_PSK:
3625                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
3626                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
3627                                     (wpa_auth |= WPA_AUTH_PSK);
3628                         break;
3629                 default:
3630                         brcmf_err("Ivalid key mgmt info\n");
3631                 }
3632                 offset++;
3633         }
3634
3635         if (is_rsn_ie) {
3636                 wme_bss_disable = 1;
3637                 if ((offset + RSN_CAP_LEN) <= len) {
3638                         rsn_cap = data[offset] + (data[offset + 1] << 8);
3639                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
3640                                 wme_bss_disable = 0;
3641                 }
3642                 /* set wme_bss_disable to sync RSN Capabilities */
3643                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
3644                                                wme_bss_disable);
3645                 if (err < 0) {
3646                         brcmf_err("wme_bss_disable error %d\n", err);
3647                         goto exit;
3648                 }
3649         }
3650         /* FOR WPS , set SES_OW_ENABLED */
3651         wsec = (pval | gval | SES_OW_ENABLED);
3652
3653         /* set auth */
3654         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
3655         if (err < 0) {
3656                 brcmf_err("auth error %d\n", err);
3657                 goto exit;
3658         }
3659         /* set wsec */
3660         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3661         if (err < 0) {
3662                 brcmf_err("wsec error %d\n", err);
3663                 goto exit;
3664         }
3665         /* set upper-layer auth */
3666         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
3667         if (err < 0) {
3668                 brcmf_err("wpa_auth error %d\n", err);
3669                 goto exit;
3670         }
3671
3672 exit:
3673         return err;
3674 }
3675
3676 static s32
3677 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
3678                      struct parsed_vndr_ies *vndr_ies)
3679 {
3680         struct brcmf_vs_tlv *vndrie;
3681         struct brcmf_tlv *ie;
3682         struct parsed_vndr_ie_info *parsed_info;
3683         s32 remaining_len;
3684
3685         remaining_len = (s32)vndr_ie_len;
3686         memset(vndr_ies, 0, sizeof(*vndr_ies));
3687
3688         ie = (struct brcmf_tlv *)vndr_ie_buf;
3689         while (ie) {
3690                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
3691                         goto next;
3692                 vndrie = (struct brcmf_vs_tlv *)ie;
3693                 /* len should be bigger than OUI length + one */
3694                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
3695                         brcmf_err("invalid vndr ie. length is too small %d\n",
3696                                   vndrie->len);
3697                         goto next;
3698                 }
3699                 /* if wpa or wme ie, do not add ie */
3700                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
3701                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
3702                     (vndrie->oui_type == WME_OUI_TYPE))) {
3703                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
3704                         goto next;
3705                 }
3706
3707                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
3708
3709                 /* save vndr ie information */
3710                 parsed_info->ie_ptr = (char *)vndrie;
3711                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
3712                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
3713
3714                 vndr_ies->count++;
3715
3716                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
3717                           parsed_info->vndrie.oui[0],
3718                           parsed_info->vndrie.oui[1],
3719                           parsed_info->vndrie.oui[2],
3720                           parsed_info->vndrie.oui_type);
3721
3722                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
3723                         break;
3724 next:
3725                 remaining_len -= (ie->len + TLV_HDR_LEN);
3726                 if (remaining_len <= TLV_HDR_LEN)
3727                         ie = NULL;
3728                 else
3729                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
3730                                 TLV_HDR_LEN);
3731         }
3732         return 0;
3733 }
3734
3735 static u32
3736 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
3737 {
3738
3739         __le32 iecount_le;
3740         __le32 pktflag_le;
3741
3742         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
3743         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
3744
3745         iecount_le = cpu_to_le32(1);
3746         memcpy(&iebuf[VNDR_IE_COUNT_OFFSET], &iecount_le, sizeof(iecount_le));
3747
3748         pktflag_le = cpu_to_le32(pktflag);
3749         memcpy(&iebuf[VNDR_IE_PKTFLAG_OFFSET], &pktflag_le, sizeof(pktflag_le));
3750
3751         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
3752
3753         return ie_len + VNDR_IE_HDR_SIZE;
3754 }
3755
3756 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
3757                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
3758 {
3759         struct brcmf_if *ifp;
3760         struct vif_saved_ie *saved_ie;
3761         s32 err = 0;
3762         u8  *iovar_ie_buf;
3763         u8  *curr_ie_buf;
3764         u8  *mgmt_ie_buf = NULL;
3765         int mgmt_ie_buf_len;
3766         u32 *mgmt_ie_len;
3767         u32 del_add_ie_buf_len = 0;
3768         u32 total_ie_buf_len = 0;
3769         u32 parsed_ie_buf_len = 0;
3770         struct parsed_vndr_ies old_vndr_ies;
3771         struct parsed_vndr_ies new_vndr_ies;
3772         struct parsed_vndr_ie_info *vndrie_info;
3773         s32 i;
3774         u8 *ptr;
3775         int remained_buf_len;
3776
3777         if (!vif)
3778                 return -ENODEV;
3779         ifp = vif->ifp;
3780         saved_ie = &vif->saved_ie;
3781
3782         brcmf_dbg(TRACE, "bssidx %d, pktflag : 0x%02X\n", ifp->bssidx, pktflag);
3783         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
3784         if (!iovar_ie_buf)
3785                 return -ENOMEM;
3786         curr_ie_buf = iovar_ie_buf;
3787         switch (pktflag) {
3788         case BRCMF_VNDR_IE_PRBREQ_FLAG:
3789                 mgmt_ie_buf = saved_ie->probe_req_ie;
3790                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
3791                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
3792                 break;
3793         case BRCMF_VNDR_IE_PRBRSP_FLAG:
3794                 mgmt_ie_buf = saved_ie->probe_res_ie;
3795                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
3796                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
3797                 break;
3798         case BRCMF_VNDR_IE_BEACON_FLAG:
3799                 mgmt_ie_buf = saved_ie->beacon_ie;
3800                 mgmt_ie_len = &saved_ie->beacon_ie_len;
3801                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
3802                 break;
3803         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
3804                 mgmt_ie_buf = saved_ie->assoc_req_ie;
3805                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
3806                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
3807                 break;
3808         default:
3809                 err = -EPERM;
3810                 brcmf_err("not suitable type\n");
3811                 goto exit;
3812         }
3813
3814         if (vndr_ie_len > mgmt_ie_buf_len) {
3815                 err = -ENOMEM;
3816                 brcmf_err("extra IE size too big\n");
3817                 goto exit;
3818         }
3819
3820         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
3821         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
3822                 ptr = curr_ie_buf;
3823                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
3824                 for (i = 0; i < new_vndr_ies.count; i++) {
3825                         vndrie_info = &new_vndr_ies.ie_info[i];
3826                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
3827                                vndrie_info->ie_len);
3828                         parsed_ie_buf_len += vndrie_info->ie_len;
3829                 }
3830         }
3831
3832         if (mgmt_ie_buf && *mgmt_ie_len) {
3833                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
3834                     (memcmp(mgmt_ie_buf, curr_ie_buf,
3835                             parsed_ie_buf_len) == 0)) {
3836                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
3837                         goto exit;
3838                 }
3839
3840                 /* parse old vndr_ie */
3841                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
3842
3843                 /* make a command to delete old ie */
3844                 for (i = 0; i < old_vndr_ies.count; i++) {
3845                         vndrie_info = &old_vndr_ies.ie_info[i];
3846
3847                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
3848                                   vndrie_info->vndrie.id,
3849                                   vndrie_info->vndrie.len,
3850                                   vndrie_info->vndrie.oui[0],
3851                                   vndrie_info->vndrie.oui[1],
3852                                   vndrie_info->vndrie.oui[2]);
3853
3854                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
3855                                                            vndrie_info->ie_ptr,
3856                                                            vndrie_info->ie_len,
3857                                                            "del");
3858                         curr_ie_buf += del_add_ie_buf_len;
3859                         total_ie_buf_len += del_add_ie_buf_len;
3860                 }
3861         }
3862
3863         *mgmt_ie_len = 0;
3864         /* Add if there is any extra IE */
3865         if (mgmt_ie_buf && parsed_ie_buf_len) {
3866                 ptr = mgmt_ie_buf;
3867
3868                 remained_buf_len = mgmt_ie_buf_len;
3869
3870                 /* make a command to add new ie */
3871                 for (i = 0; i < new_vndr_ies.count; i++) {
3872                         vndrie_info = &new_vndr_ies.ie_info[i];
3873
3874                         /* verify remained buf size before copy data */
3875                         if (remained_buf_len < (vndrie_info->vndrie.len +
3876                                                         VNDR_IE_VSIE_OFFSET)) {
3877                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
3878                                           remained_buf_len);
3879                                 break;
3880                         }
3881                         remained_buf_len -= (vndrie_info->ie_len +
3882                                              VNDR_IE_VSIE_OFFSET);
3883
3884                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
3885                                   vndrie_info->vndrie.id,
3886                                   vndrie_info->vndrie.len,
3887                                   vndrie_info->vndrie.oui[0],
3888                                   vndrie_info->vndrie.oui[1],
3889                                   vndrie_info->vndrie.oui[2]);
3890
3891                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
3892                                                            vndrie_info->ie_ptr,
3893                                                            vndrie_info->ie_len,
3894                                                            "add");
3895
3896                         /* save the parsed IE in wl struct */
3897                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
3898                                vndrie_info->ie_len);
3899                         *mgmt_ie_len += vndrie_info->ie_len;
3900
3901                         curr_ie_buf += del_add_ie_buf_len;
3902                         total_ie_buf_len += del_add_ie_buf_len;
3903                 }
3904         }
3905         if (total_ie_buf_len) {
3906                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
3907                                                  total_ie_buf_len);
3908                 if (err)
3909                         brcmf_err("vndr ie set error : %d\n", err);
3910         }
3911
3912 exit:
3913         kfree(iovar_ie_buf);
3914         return err;
3915 }
3916
3917 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
3918 {
3919         s32 pktflags[] = {
3920                 BRCMF_VNDR_IE_PRBREQ_FLAG,
3921                 BRCMF_VNDR_IE_PRBRSP_FLAG,
3922                 BRCMF_VNDR_IE_BEACON_FLAG
3923         };
3924         int i;
3925
3926         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
3927                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
3928
3929         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
3930         return 0;
3931 }
3932
3933 static s32
3934 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
3935                         struct cfg80211_beacon_data *beacon)
3936 {
3937         s32 err;
3938
3939         /* Set Beacon IEs to FW */
3940         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
3941                                     beacon->tail, beacon->tail_len);
3942         if (err) {
3943                 brcmf_err("Set Beacon IE Failed\n");
3944                 return err;
3945         }
3946         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
3947
3948         /* Set Probe Response IEs to FW */
3949         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
3950                                     beacon->proberesp_ies,
3951                                     beacon->proberesp_ies_len);
3952         if (err)
3953                 brcmf_err("Set Probe Resp IE Failed\n");
3954         else
3955                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
3956
3957         return err;
3958 }
3959
3960 static s32
3961 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
3962                         struct cfg80211_ap_settings *settings)
3963 {
3964         s32 ie_offset;
3965         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3966         struct brcmf_if *ifp = netdev_priv(ndev);
3967         const struct brcmf_tlv *ssid_ie;
3968         struct brcmf_ssid_le ssid_le;
3969         s32 err = -EPERM;
3970         const struct brcmf_tlv *rsn_ie;
3971         const struct brcmf_vs_tlv *wpa_ie;
3972         struct brcmf_join_params join_params;
3973         enum nl80211_iftype dev_role;
3974         struct brcmf_fil_bss_enable_le bss_enable;
3975         u16 chanspec;
3976         bool mbss;
3977
3978         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
3979                   settings->chandef.chan->hw_value,
3980                   settings->chandef.center_freq1, settings->chandef.width,
3981                   settings->beacon_interval, settings->dtim_period);
3982         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
3983                   settings->ssid, settings->ssid_len, settings->auth_type,
3984                   settings->inactivity_timeout);
3985
3986         dev_role = ifp->vif->wdev.iftype;
3987         mbss = ifp->vif->mbss;
3988
3989         memset(&ssid_le, 0, sizeof(ssid_le));
3990         if (settings->ssid == NULL || settings->ssid_len == 0) {
3991                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
3992                 ssid_ie = brcmf_parse_tlvs(
3993                                 (u8 *)&settings->beacon.head[ie_offset],
3994                                 settings->beacon.head_len - ie_offset,
3995                                 WLAN_EID_SSID);
3996                 if (!ssid_ie)
3997                         return -EINVAL;
3998
3999                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4000                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4001                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4002         } else {
4003                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4004                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4005         }
4006
4007         if (!mbss) {
4008                 brcmf_set_mpc(ifp, 0);
4009                 brcmf_configure_arp_offload(ifp, false);
4010         }
4011
4012         /* find the RSN_IE */
4013         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4014                                   settings->beacon.tail_len, WLAN_EID_RSN);
4015
4016         /* find the WPA_IE */
4017         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4018                                   settings->beacon.tail_len);
4019
4020         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4021                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4022                 if (wpa_ie != NULL) {
4023                         /* WPA IE */
4024                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4025                         if (err < 0)
4026                                 goto exit;
4027                 } else {
4028                         struct brcmf_vs_tlv *tmp_ie;
4029
4030                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4031
4032                         /* RSN IE */
4033                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4034                         if (err < 0)
4035                                 goto exit;
4036                 }
4037         } else {
4038                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4039                 brcmf_configure_opensecurity(ifp);
4040         }
4041
4042         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4043
4044         if (!mbss) {
4045                 chanspec = chandef_to_chanspec(&cfg->d11inf,
4046                                                &settings->chandef);
4047                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4048                 if (err < 0) {
4049                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4050                                   chanspec, err);
4051                         goto exit;
4052                 }
4053
4054                 if (settings->beacon_interval) {
4055                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4056                                                     settings->beacon_interval);
4057                         if (err < 0) {
4058                                 brcmf_err("Beacon Interval Set Error, %d\n",
4059                                           err);
4060                                 goto exit;
4061                         }
4062                 }
4063                 if (settings->dtim_period) {
4064                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4065                                                     settings->dtim_period);
4066                         if (err < 0) {
4067                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4068                                 goto exit;
4069                         }
4070                 }
4071
4072                 if (dev_role == NL80211_IFTYPE_AP) {
4073                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4074                         if (err < 0) {
4075                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4076                                 goto exit;
4077                         }
4078                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4079                 }
4080
4081                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4082                 if (err < 0) {
4083                         brcmf_err("SET INFRA error %d\n", err);
4084                         goto exit;
4085                 }
4086         }
4087         if (dev_role == NL80211_IFTYPE_AP) {
4088                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4089                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4090
4091                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4092                 if (err < 0) {
4093                         brcmf_err("setting AP mode failed %d\n", err);
4094                         goto exit;
4095                 }
4096                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4097                 if (err < 0) {
4098                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4099                         goto exit;
4100                 }
4101                 /* On DOWN the firmware removes the WEP keys, reconfigure
4102                  * them if they were set.
4103                  */
4104                 brcmf_cfg80211_reconfigure_wep(ifp);
4105
4106                 memset(&join_params, 0, sizeof(join_params));
4107                 /* join parameters starts with ssid */
4108                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4109                 /* create softap */
4110                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4111                                              &join_params, sizeof(join_params));
4112                 if (err < 0) {
4113                         brcmf_err("SET SSID error (%d)\n", err);
4114                         goto exit;
4115                 }
4116                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4117         } else {
4118                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4119                                                 sizeof(ssid_le));
4120                 if (err < 0) {
4121                         brcmf_err("setting ssid failed %d\n", err);
4122                         goto exit;
4123                 }
4124                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
4125                 bss_enable.enable = cpu_to_le32(1);
4126                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4127                                                sizeof(bss_enable));
4128                 if (err < 0) {
4129                         brcmf_err("bss_enable config failed %d\n", err);
4130                         goto exit;
4131                 }
4132
4133                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4134         }
4135         clear_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
4136         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4137
4138 exit:
4139         if ((err) && (!mbss)) {
4140                 brcmf_set_mpc(ifp, 1);
4141                 brcmf_configure_arp_offload(ifp, true);
4142         }
4143         return err;
4144 }
4145
4146 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4147 {
4148         struct brcmf_if *ifp = netdev_priv(ndev);
4149         s32 err;
4150         struct brcmf_fil_bss_enable_le bss_enable;
4151         struct brcmf_join_params join_params;
4152
4153         brcmf_dbg(TRACE, "Enter\n");
4154
4155         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4156                 /* Due to most likely deauths outstanding we sleep */
4157                 /* first to make sure they get processed by fw. */
4158                 msleep(400);
4159
4160                 if (ifp->vif->mbss) {
4161                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4162                         return err;
4163                 }
4164
4165                 memset(&join_params, 0, sizeof(join_params));
4166                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4167                                              &join_params, sizeof(join_params));
4168                 if (err < 0)
4169                         brcmf_err("SET SSID error (%d)\n", err);
4170                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4171                 if (err < 0)
4172                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4173                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4174                 if (err < 0)
4175                         brcmf_err("setting AP mode failed %d\n", err);
4176                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4177                 if (err < 0)
4178                         brcmf_err("setting INFRA mode failed %d\n", err);
4179                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4180                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4181                 /* Bring device back up so it can be used again */
4182                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4183                 if (err < 0)
4184                         brcmf_err("BRCMF_C_UP error %d\n", err);
4185         } else {
4186                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
4187                 bss_enable.enable = cpu_to_le32(0);
4188                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4189                                                sizeof(bss_enable));
4190                 if (err < 0)
4191                         brcmf_err("bss_enable config failed %d\n", err);
4192         }
4193         brcmf_set_mpc(ifp, 1);
4194         brcmf_configure_arp_offload(ifp, true);
4195         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
4196         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4197
4198         return err;
4199 }
4200
4201 static s32
4202 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4203                              struct cfg80211_beacon_data *info)
4204 {
4205         struct brcmf_if *ifp = netdev_priv(ndev);
4206         s32 err;
4207
4208         brcmf_dbg(TRACE, "Enter\n");
4209
4210         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4211
4212         return err;
4213 }
4214
4215 static int
4216 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4217                            struct station_del_parameters *params)
4218 {
4219         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4220         struct brcmf_scb_val_le scbval;
4221         struct brcmf_if *ifp = netdev_priv(ndev);
4222         s32 err;
4223
4224         if (!params->mac)
4225                 return -EFAULT;
4226
4227         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4228
4229         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4230                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4231         if (!check_vif_up(ifp->vif))
4232                 return -EIO;
4233
4234         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4235         scbval.val = cpu_to_le32(WLAN_REASON_DEAUTH_LEAVING);
4236         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4237                                      &scbval, sizeof(scbval));
4238         if (err)
4239                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4240
4241         brcmf_dbg(TRACE, "Exit\n");
4242         return err;
4243 }
4244
4245
4246 static void
4247 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4248                                    struct wireless_dev *wdev,
4249                                    u16 frame_type, bool reg)
4250 {
4251         struct brcmf_cfg80211_vif *vif;
4252         u16 mgmt_type;
4253
4254         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4255
4256         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4257         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4258         if (reg)
4259                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4260         else
4261                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4262 }
4263
4264
4265 static int
4266 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4267                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4268 {
4269         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4270         struct ieee80211_channel *chan = params->chan;
4271         const u8 *buf = params->buf;
4272         size_t len = params->len;
4273         const struct ieee80211_mgmt *mgmt;
4274         struct brcmf_cfg80211_vif *vif;
4275         s32 err = 0;
4276         s32 ie_offset;
4277         s32 ie_len;
4278         struct brcmf_fil_action_frame_le *action_frame;
4279         struct brcmf_fil_af_params_le *af_params;
4280         bool ack;
4281         s32 chan_nr;
4282         u32 freq;
4283
4284         brcmf_dbg(TRACE, "Enter\n");
4285
4286         *cookie = 0;
4287
4288         mgmt = (const struct ieee80211_mgmt *)buf;
4289
4290         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4291                 brcmf_err("Driver only allows MGMT packet type\n");
4292                 return -EPERM;
4293         }
4294
4295         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4296
4297         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4298                 /* Right now the only reason to get a probe response */
4299                 /* is for p2p listen response or for p2p GO from     */
4300                 /* wpa_supplicant. Unfortunately the probe is send   */
4301                 /* on primary ndev, while dongle wants it on the p2p */
4302                 /* vif. Since this is only reason for a probe        */
4303                 /* response to be sent, the vif is taken from cfg.   */
4304                 /* If ever desired to send proberesp for non p2p     */
4305                 /* response then data should be checked for          */
4306                 /* "DIRECT-". Note in future supplicant will take    */
4307                 /* dedicated p2p wdev to do this and then this 'hack'*/
4308                 /* is not needed anymore.                            */
4309                 ie_offset =  DOT11_MGMT_HDR_LEN +
4310                              DOT11_BCN_PRB_FIXED_LEN;
4311                 ie_len = len - ie_offset;
4312                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4313                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4314                 err = brcmf_vif_set_mgmt_ie(vif,
4315                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4316                                             &buf[ie_offset],
4317                                             ie_len);
4318                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4319                                         GFP_KERNEL);
4320         } else if (ieee80211_is_action(mgmt->frame_control)) {
4321                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4322                 if (af_params == NULL) {
4323                         brcmf_err("unable to allocate frame\n");
4324                         err = -ENOMEM;
4325                         goto exit;
4326                 }
4327                 action_frame = &af_params->action_frame;
4328                 /* Add the packet Id */
4329                 action_frame->packet_id = cpu_to_le32(*cookie);
4330                 /* Add BSSID */
4331                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4332                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4333                 /* Add the length exepted for 802.11 header  */
4334                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4335                 /* Add the channel. Use the one specified as parameter if any or
4336                  * the current one (got from the firmware) otherwise
4337                  */
4338                 if (chan)
4339                         freq = chan->center_freq;
4340                 else
4341                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4342                                               &freq);
4343                 chan_nr = ieee80211_frequency_to_channel(freq);
4344                 af_params->channel = cpu_to_le32(chan_nr);
4345
4346                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4347                        le16_to_cpu(action_frame->len));
4348
4349                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4350                           *cookie, le16_to_cpu(action_frame->len), freq);
4351
4352                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4353                                                   af_params);
4354
4355                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4356                                         GFP_KERNEL);
4357                 kfree(af_params);
4358         } else {
4359                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4360                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4361         }
4362
4363 exit:
4364         return err;
4365 }
4366
4367
4368 static int
4369 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4370                                         struct wireless_dev *wdev,
4371                                         u64 cookie)
4372 {
4373         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4374         struct brcmf_cfg80211_vif *vif;
4375         int err = 0;
4376
4377         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4378
4379         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4380         if (vif == NULL) {
4381                 brcmf_err("No p2p device available for probe response\n");
4382                 err = -ENODEV;
4383                 goto exit;
4384         }
4385         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4386 exit:
4387         return err;
4388 }
4389
4390 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
4391                                            struct wireless_dev *wdev,
4392                                            enum nl80211_crit_proto_id proto,
4393                                            u16 duration)
4394 {
4395         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4396         struct brcmf_cfg80211_vif *vif;
4397
4398         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4399
4400         /* only DHCP support for now */
4401         if (proto != NL80211_CRIT_PROTO_DHCP)
4402                 return -EINVAL;
4403
4404         /* suppress and abort scanning */
4405         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4406         brcmf_abort_scanning(cfg);
4407
4408         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
4409 }
4410
4411 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
4412                                            struct wireless_dev *wdev)
4413 {
4414         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4415         struct brcmf_cfg80211_vif *vif;
4416
4417         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4418
4419         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
4420         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4421 }
4422
4423 static s32
4424 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
4425                              const struct brcmf_event_msg *e, void *data)
4426 {
4427         switch (e->reason) {
4428         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
4429                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
4430                 break;
4431         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
4432                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
4433                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4434                 break;
4435         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
4436                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
4437                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4438                 break;
4439         }
4440
4441         return 0;
4442 }
4443
4444 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
4445 {
4446         int ret;
4447
4448         switch (oper) {
4449         case NL80211_TDLS_DISCOVERY_REQ:
4450                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
4451                 break;
4452         case NL80211_TDLS_SETUP:
4453                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
4454                 break;
4455         case NL80211_TDLS_TEARDOWN:
4456                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
4457                 break;
4458         default:
4459                 brcmf_err("unsupported operation: %d\n", oper);
4460                 ret = -EOPNOTSUPP;
4461         }
4462         return ret;
4463 }
4464
4465 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
4466                                     struct net_device *ndev, const u8 *peer,
4467                                     enum nl80211_tdls_operation oper)
4468 {
4469         struct brcmf_if *ifp;
4470         struct brcmf_tdls_iovar_le info;
4471         int ret = 0;
4472
4473         ret = brcmf_convert_nl80211_tdls_oper(oper);
4474         if (ret < 0)
4475                 return ret;
4476
4477         ifp = netdev_priv(ndev);
4478         memset(&info, 0, sizeof(info));
4479         info.mode = (u8)ret;
4480         if (peer)
4481                 memcpy(info.ea, peer, ETH_ALEN);
4482
4483         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
4484                                        &info, sizeof(info));
4485         if (ret < 0)
4486                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
4487
4488         return ret;
4489 }
4490
4491 static struct cfg80211_ops wl_cfg80211_ops = {
4492         .add_virtual_intf = brcmf_cfg80211_add_iface,
4493         .del_virtual_intf = brcmf_cfg80211_del_iface,
4494         .change_virtual_intf = brcmf_cfg80211_change_iface,
4495         .scan = brcmf_cfg80211_scan,
4496         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
4497         .join_ibss = brcmf_cfg80211_join_ibss,
4498         .leave_ibss = brcmf_cfg80211_leave_ibss,
4499         .get_station = brcmf_cfg80211_get_station,
4500         .set_tx_power = brcmf_cfg80211_set_tx_power,
4501         .get_tx_power = brcmf_cfg80211_get_tx_power,
4502         .add_key = brcmf_cfg80211_add_key,
4503         .del_key = brcmf_cfg80211_del_key,
4504         .get_key = brcmf_cfg80211_get_key,
4505         .set_default_key = brcmf_cfg80211_config_default_key,
4506         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
4507         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
4508         .connect = brcmf_cfg80211_connect,
4509         .disconnect = brcmf_cfg80211_disconnect,
4510         .suspend = brcmf_cfg80211_suspend,
4511         .resume = brcmf_cfg80211_resume,
4512         .set_pmksa = brcmf_cfg80211_set_pmksa,
4513         .del_pmksa = brcmf_cfg80211_del_pmksa,
4514         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
4515         .start_ap = brcmf_cfg80211_start_ap,
4516         .stop_ap = brcmf_cfg80211_stop_ap,
4517         .change_beacon = brcmf_cfg80211_change_beacon,
4518         .del_station = brcmf_cfg80211_del_station,
4519         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
4520         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
4521         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
4522         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
4523         .remain_on_channel = brcmf_p2p_remain_on_channel,
4524         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
4525         .start_p2p_device = brcmf_p2p_start_device,
4526         .stop_p2p_device = brcmf_p2p_stop_device,
4527         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
4528         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
4529         .tdls_oper = brcmf_cfg80211_tdls_oper,
4530 };
4531
4532 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
4533                                            enum nl80211_iftype type,
4534                                            bool pm_block)
4535 {
4536         struct brcmf_cfg80211_vif *vif_walk;
4537         struct brcmf_cfg80211_vif *vif;
4538         bool mbss;
4539
4540         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
4541                   sizeof(*vif));
4542         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
4543         if (!vif)
4544                 return ERR_PTR(-ENOMEM);
4545
4546         vif->wdev.wiphy = cfg->wiphy;
4547         vif->wdev.iftype = type;
4548
4549         vif->pm_block = pm_block;
4550         vif->roam_off = -1;
4551
4552         brcmf_init_prof(&vif->profile);
4553
4554         if (type == NL80211_IFTYPE_AP) {
4555                 mbss = false;
4556                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
4557                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
4558                                 mbss = true;
4559                                 break;
4560                         }
4561                 }
4562                 vif->mbss = mbss;
4563         }
4564
4565         list_add_tail(&vif->list, &cfg->vif_list);
4566         return vif;
4567 }
4568
4569 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
4570 {
4571         list_del(&vif->list);
4572         kfree(vif);
4573 }
4574
4575 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
4576 {
4577         struct brcmf_cfg80211_vif *vif;
4578         struct brcmf_if *ifp;
4579
4580         ifp = netdev_priv(ndev);
4581         vif = ifp->vif;
4582
4583         brcmf_free_vif(vif);
4584         free_netdev(ndev);
4585 }
4586
4587 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
4588 {
4589         u32 event = e->event_code;
4590         u32 status = e->status;
4591
4592         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
4593                 brcmf_dbg(CONN, "Processing set ssid\n");
4594                 return true;
4595         }
4596
4597         return false;
4598 }
4599
4600 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
4601 {
4602         u32 event = e->event_code;
4603         u16 flags = e->flags;
4604
4605         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
4606             (event == BRCMF_E_DISASSOC_IND) ||
4607             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
4608                 brcmf_dbg(CONN, "Processing link down\n");
4609                 return true;
4610         }
4611         return false;
4612 }
4613
4614 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
4615                                const struct brcmf_event_msg *e)
4616 {
4617         u32 event = e->event_code;
4618         u32 status = e->status;
4619
4620         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
4621                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
4622                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
4623                 return true;
4624         }
4625
4626         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
4627                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
4628                 return true;
4629         }
4630
4631         return false;
4632 }
4633
4634 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
4635 {
4636         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4637
4638         kfree(conn_info->req_ie);
4639         conn_info->req_ie = NULL;
4640         conn_info->req_ie_len = 0;
4641         kfree(conn_info->resp_ie);
4642         conn_info->resp_ie = NULL;
4643         conn_info->resp_ie_len = 0;
4644 }
4645
4646 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
4647                                struct brcmf_if *ifp)
4648 {
4649         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
4650         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4651         u32 req_len;
4652         u32 resp_len;
4653         s32 err = 0;
4654
4655         brcmf_clear_assoc_ies(cfg);
4656
4657         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
4658                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
4659         if (err) {
4660                 brcmf_err("could not get assoc info (%d)\n", err);
4661                 return err;
4662         }
4663         assoc_info =
4664                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
4665         req_len = le32_to_cpu(assoc_info->req_len);
4666         resp_len = le32_to_cpu(assoc_info->resp_len);
4667         if (req_len) {
4668                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
4669                                                cfg->extra_buf,
4670                                                WL_ASSOC_INFO_MAX);
4671                 if (err) {
4672                         brcmf_err("could not get assoc req (%d)\n", err);
4673                         return err;
4674                 }
4675                 conn_info->req_ie_len = req_len;
4676                 conn_info->req_ie =
4677                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
4678                             GFP_KERNEL);
4679         } else {
4680                 conn_info->req_ie_len = 0;
4681                 conn_info->req_ie = NULL;
4682         }
4683         if (resp_len) {
4684                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
4685                                                cfg->extra_buf,
4686                                                WL_ASSOC_INFO_MAX);
4687                 if (err) {
4688                         brcmf_err("could not get assoc resp (%d)\n", err);
4689                         return err;
4690                 }
4691                 conn_info->resp_ie_len = resp_len;
4692                 conn_info->resp_ie =
4693                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
4694                             GFP_KERNEL);
4695         } else {
4696                 conn_info->resp_ie_len = 0;
4697                 conn_info->resp_ie = NULL;
4698         }
4699         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
4700                   conn_info->req_ie_len, conn_info->resp_ie_len);
4701
4702         return err;
4703 }
4704
4705 static s32
4706 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
4707                        struct net_device *ndev,
4708                        const struct brcmf_event_msg *e)
4709 {
4710         struct brcmf_if *ifp = netdev_priv(ndev);
4711         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4712         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4713         struct wiphy *wiphy = cfg_to_wiphy(cfg);
4714         struct ieee80211_channel *notify_channel = NULL;
4715         struct ieee80211_supported_band *band;
4716         struct brcmf_bss_info_le *bi;
4717         struct brcmu_chan ch;
4718         u32 freq;
4719         s32 err = 0;
4720         u8 *buf;
4721
4722         brcmf_dbg(TRACE, "Enter\n");
4723
4724         brcmf_get_assoc_ies(cfg, ifp);
4725         memcpy(profile->bssid, e->addr, ETH_ALEN);
4726         brcmf_update_bss_info(cfg, ifp);
4727
4728         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
4729         if (buf == NULL) {
4730                 err = -ENOMEM;
4731                 goto done;
4732         }
4733
4734         /* data sent to dongle has to be little endian */
4735         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
4736         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
4737                                      buf, WL_BSS_INFO_MAX);
4738
4739         if (err)
4740                 goto done;
4741
4742         bi = (struct brcmf_bss_info_le *)(buf + 4);
4743         ch.chspec = le16_to_cpu(bi->chanspec);
4744         cfg->d11inf.decchspec(&ch);
4745
4746         if (ch.band == BRCMU_CHAN_BAND_2G)
4747                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
4748         else
4749                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
4750
4751         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
4752         notify_channel = ieee80211_get_channel(wiphy, freq);
4753
4754 done:
4755         kfree(buf);
4756         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
4757                         conn_info->req_ie, conn_info->req_ie_len,
4758                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
4759         brcmf_dbg(CONN, "Report roaming result\n");
4760
4761         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
4762         brcmf_dbg(TRACE, "Exit\n");
4763         return err;
4764 }
4765
4766 static s32
4767 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
4768                        struct net_device *ndev, const struct brcmf_event_msg *e,
4769                        bool completed)
4770 {
4771         struct brcmf_if *ifp = netdev_priv(ndev);
4772         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4773         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4774
4775         brcmf_dbg(TRACE, "Enter\n");
4776
4777         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4778                                &ifp->vif->sme_state)) {
4779                 if (completed) {
4780                         brcmf_get_assoc_ies(cfg, ifp);
4781                         memcpy(profile->bssid, e->addr, ETH_ALEN);
4782                         brcmf_update_bss_info(cfg, ifp);
4783                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
4784                                 &ifp->vif->sme_state);
4785                 }
4786                 cfg80211_connect_result(ndev,
4787                                         (u8 *)profile->bssid,
4788                                         conn_info->req_ie,
4789                                         conn_info->req_ie_len,
4790                                         conn_info->resp_ie,
4791                                         conn_info->resp_ie_len,
4792                                         completed ? WLAN_STATUS_SUCCESS :
4793                                                     WLAN_STATUS_AUTH_TIMEOUT,
4794                                         GFP_KERNEL);
4795                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
4796                           completed ? "succeeded" : "failed");
4797         }
4798         brcmf_dbg(TRACE, "Exit\n");
4799         return 0;
4800 }
4801
4802 static s32
4803 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
4804                                struct net_device *ndev,
4805                                const struct brcmf_event_msg *e, void *data)
4806 {
4807         struct brcmf_if *ifp = netdev_priv(ndev);
4808         static int generation;
4809         u32 event = e->event_code;
4810         u32 reason = e->reason;
4811         struct station_info sinfo;
4812
4813         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
4814         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
4815             ndev != cfg_to_ndev(cfg)) {
4816                 brcmf_dbg(CONN, "AP mode link down\n");
4817                 complete(&cfg->vif_disabled);
4818                 if (ifp->vif->mbss)
4819                         brcmf_remove_interface(ifp->drvr, ifp->bssidx);
4820                 return 0;
4821         }
4822
4823         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
4824             (reason == BRCMF_E_STATUS_SUCCESS)) {
4825                 memset(&sinfo, 0, sizeof(sinfo));
4826                 sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
4827                 if (!data) {
4828                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
4829                         return -EINVAL;
4830                 }
4831                 sinfo.assoc_req_ies = data;
4832                 sinfo.assoc_req_ies_len = e->datalen;
4833                 generation++;
4834                 sinfo.generation = generation;
4835                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
4836         } else if ((event == BRCMF_E_DISASSOC_IND) ||
4837                    (event == BRCMF_E_DEAUTH_IND) ||
4838                    (event == BRCMF_E_DEAUTH)) {
4839                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
4840         }
4841         return 0;
4842 }
4843
4844 static s32
4845 brcmf_notify_connect_status(struct brcmf_if *ifp,
4846                             const struct brcmf_event_msg *e, void *data)
4847 {
4848         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4849         struct net_device *ndev = ifp->ndev;
4850         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4851         struct ieee80211_channel *chan;
4852         s32 err = 0;
4853
4854         if ((e->event_code == BRCMF_E_DEAUTH) ||
4855             (e->event_code == BRCMF_E_DEAUTH_IND) ||
4856             (e->event_code == BRCMF_E_DISASSOC_IND) ||
4857             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
4858                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4859         }
4860
4861         if (brcmf_is_apmode(ifp->vif)) {
4862                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
4863         } else if (brcmf_is_linkup(e)) {
4864                 brcmf_dbg(CONN, "Linkup\n");
4865                 if (brcmf_is_ibssmode(ifp->vif)) {
4866                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
4867                         memcpy(profile->bssid, e->addr, ETH_ALEN);
4868                         wl_inform_ibss(cfg, ndev, e->addr);
4869                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
4870                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4871                                   &ifp->vif->sme_state);
4872                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
4873                                 &ifp->vif->sme_state);
4874                 } else
4875                         brcmf_bss_connect_done(cfg, ndev, e, true);
4876         } else if (brcmf_is_linkdown(e)) {
4877                 brcmf_dbg(CONN, "Linkdown\n");
4878                 if (!brcmf_is_ibssmode(ifp->vif)) {
4879                         brcmf_bss_connect_done(cfg, ndev, e, false);
4880                 }
4881                 brcmf_link_down(ifp->vif);
4882                 brcmf_init_prof(ndev_to_prof(ndev));
4883                 if (ndev != cfg_to_ndev(cfg))
4884                         complete(&cfg->vif_disabled);
4885         } else if (brcmf_is_nonetwork(cfg, e)) {
4886                 if (brcmf_is_ibssmode(ifp->vif))
4887                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4888                                   &ifp->vif->sme_state);
4889                 else
4890                         brcmf_bss_connect_done(cfg, ndev, e, false);
4891         }
4892
4893         return err;
4894 }
4895
4896 static s32
4897 brcmf_notify_roaming_status(struct brcmf_if *ifp,
4898                             const struct brcmf_event_msg *e, void *data)
4899 {
4900         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4901         u32 event = e->event_code;
4902         u32 status = e->status;
4903
4904         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
4905                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4906                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
4907                 else
4908                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
4909         }
4910
4911         return 0;
4912 }
4913
4914 static s32
4915 brcmf_notify_mic_status(struct brcmf_if *ifp,
4916                         const struct brcmf_event_msg *e, void *data)
4917 {
4918         u16 flags = e->flags;
4919         enum nl80211_key_type key_type;
4920
4921         if (flags & BRCMF_EVENT_MSG_GROUP)
4922                 key_type = NL80211_KEYTYPE_GROUP;
4923         else
4924                 key_type = NL80211_KEYTYPE_PAIRWISE;
4925
4926         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
4927                                      NULL, GFP_KERNEL);
4928
4929         return 0;
4930 }
4931
4932 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
4933                                   const struct brcmf_event_msg *e, void *data)
4934 {
4935         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4936         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
4937         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
4938         struct brcmf_cfg80211_vif *vif;
4939
4940         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfg %u\n",
4941                   ifevent->action, ifevent->flags, ifevent->ifidx,
4942                   ifevent->bssidx);
4943
4944         mutex_lock(&event->vif_event_lock);
4945         event->action = ifevent->action;
4946         vif = event->vif;
4947
4948         switch (ifevent->action) {
4949         case BRCMF_E_IF_ADD:
4950                 /* waiting process may have timed out */
4951                 if (!cfg->vif_event.vif) {
4952                         mutex_unlock(&event->vif_event_lock);
4953                         return -EBADF;
4954                 }
4955
4956                 ifp->vif = vif;
4957                 vif->ifp = ifp;
4958                 if (ifp->ndev) {
4959                         vif->wdev.netdev = ifp->ndev;
4960                         ifp->ndev->ieee80211_ptr = &vif->wdev;
4961                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
4962                 }
4963                 mutex_unlock(&event->vif_event_lock);
4964                 wake_up(&event->vif_wq);
4965                 return 0;
4966
4967         case BRCMF_E_IF_DEL:
4968                 mutex_unlock(&event->vif_event_lock);
4969                 /* event may not be upon user request */
4970                 if (brcmf_cfg80211_vif_event_armed(cfg))
4971                         wake_up(&event->vif_wq);
4972                 return 0;
4973
4974         case BRCMF_E_IF_CHANGE:
4975                 mutex_unlock(&event->vif_event_lock);
4976                 wake_up(&event->vif_wq);
4977                 return 0;
4978
4979         default:
4980                 mutex_unlock(&event->vif_event_lock);
4981                 break;
4982         }
4983         return -EINVAL;
4984 }
4985
4986 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
4987 {
4988         conf->frag_threshold = (u32)-1;
4989         conf->rts_threshold = (u32)-1;
4990         conf->retry_short = (u32)-1;
4991         conf->retry_long = (u32)-1;
4992         conf->tx_power = -1;
4993 }
4994
4995 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
4996 {
4997         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
4998                             brcmf_notify_connect_status);
4999         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5000                             brcmf_notify_connect_status);
5001         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5002                             brcmf_notify_connect_status);
5003         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5004                             brcmf_notify_connect_status);
5005         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5006                             brcmf_notify_connect_status);
5007         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5008                             brcmf_notify_connect_status);
5009         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5010                             brcmf_notify_roaming_status);
5011         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5012                             brcmf_notify_mic_status);
5013         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5014                             brcmf_notify_connect_status);
5015         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5016                             brcmf_notify_sched_scan_results);
5017         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5018                             brcmf_notify_vif_event);
5019         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5020                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5021         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5022                             brcmf_p2p_notify_listen_complete);
5023         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5024                             brcmf_p2p_notify_action_frame_rx);
5025         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5026                             brcmf_p2p_notify_action_tx_complete);
5027         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5028                             brcmf_p2p_notify_action_tx_complete);
5029 }
5030
5031 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5032 {
5033         kfree(cfg->conf);
5034         cfg->conf = NULL;
5035         kfree(cfg->escan_ioctl_buf);
5036         cfg->escan_ioctl_buf = NULL;
5037         kfree(cfg->extra_buf);
5038         cfg->extra_buf = NULL;
5039         kfree(cfg->pmk_list);
5040         cfg->pmk_list = NULL;
5041 }
5042
5043 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5044 {
5045         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5046         if (!cfg->conf)
5047                 goto init_priv_mem_out;
5048         cfg->escan_ioctl_buf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5049         if (!cfg->escan_ioctl_buf)
5050                 goto init_priv_mem_out;
5051         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5052         if (!cfg->extra_buf)
5053                 goto init_priv_mem_out;
5054         cfg->pmk_list = kzalloc(sizeof(*cfg->pmk_list), GFP_KERNEL);
5055         if (!cfg->pmk_list)
5056                 goto init_priv_mem_out;
5057
5058         return 0;
5059
5060 init_priv_mem_out:
5061         brcmf_deinit_priv_mem(cfg);
5062
5063         return -ENOMEM;
5064 }
5065
5066 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5067 {
5068         s32 err = 0;
5069
5070         cfg->scan_request = NULL;
5071         cfg->pwr_save = true;
5072         cfg->active_scan = true;        /* we do active scan per default */
5073         cfg->dongle_up = false;         /* dongle is not up yet */
5074         err = brcmf_init_priv_mem(cfg);
5075         if (err)
5076                 return err;
5077         brcmf_register_event_handlers(cfg);
5078         mutex_init(&cfg->usr_sync);
5079         brcmf_init_escan(cfg);
5080         brcmf_init_conf(cfg->conf);
5081         init_completion(&cfg->vif_disabled);
5082         return err;
5083 }
5084
5085 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5086 {
5087         cfg->dongle_up = false; /* dongle down */
5088         brcmf_abort_scanning(cfg);
5089         brcmf_deinit_priv_mem(cfg);
5090 }
5091
5092 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5093 {
5094         init_waitqueue_head(&event->vif_wq);
5095         mutex_init(&event->vif_event_lock);
5096 }
5097
5098 static s32
5099 brcmf_dongle_roam(struct brcmf_if *ifp, u32 bcn_timeout)
5100 {
5101         s32 err = 0;
5102         __le32 roamtrigger[2];
5103         __le32 roam_delta[2];
5104
5105         /*
5106          * Setup timeout if Beacons are lost and roam is
5107          * off to report link down
5108          */
5109         if (brcmf_roamoff) {
5110                 err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5111                 if (err) {
5112                         brcmf_err("bcn_timeout error (%d)\n", err);
5113                         goto dongle_rom_out;
5114                 }
5115         }
5116
5117         /*
5118          * Enable/Disable built-in roaming to allow supplicant
5119          * to take care of roaming
5120          */
5121         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5122                   brcmf_roamoff ? "Off" : "On");
5123         err = brcmf_fil_iovar_int_set(ifp, "roam_off", !!(brcmf_roamoff));
5124         if (err) {
5125                 brcmf_err("roam_off error (%d)\n", err);
5126                 goto dongle_rom_out;
5127         }
5128
5129         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5130         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5131         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5132                                      (void *)roamtrigger, sizeof(roamtrigger));
5133         if (err) {
5134                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5135                 goto dongle_rom_out;
5136         }
5137
5138         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5139         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5140         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5141                                      (void *)roam_delta, sizeof(roam_delta));
5142         if (err) {
5143                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5144                 goto dongle_rom_out;
5145         }
5146
5147 dongle_rom_out:
5148         return err;
5149 }
5150
5151 static s32
5152 brcmf_dongle_scantime(struct brcmf_if *ifp, s32 scan_assoc_time,
5153                       s32 scan_unassoc_time, s32 scan_passive_time)
5154 {
5155         s32 err = 0;
5156
5157         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5158                                     scan_assoc_time);
5159         if (err) {
5160                 if (err == -EOPNOTSUPP)
5161                         brcmf_dbg(INFO, "Scan assoc time is not supported\n");
5162                 else
5163                         brcmf_err("Scan assoc time error (%d)\n", err);
5164                 goto dongle_scantime_out;
5165         }
5166         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5167                                     scan_unassoc_time);
5168         if (err) {
5169                 if (err == -EOPNOTSUPP)
5170                         brcmf_dbg(INFO, "Scan unassoc time is not supported\n");
5171                 else
5172                         brcmf_err("Scan unassoc time error (%d)\n", err);
5173                 goto dongle_scantime_out;
5174         }
5175
5176         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5177                                     scan_passive_time);
5178         if (err) {
5179                 if (err == -EOPNOTSUPP)
5180                         brcmf_dbg(INFO, "Scan passive time is not supported\n");
5181                 else
5182                         brcmf_err("Scan passive time error (%d)\n", err);
5183                 goto dongle_scantime_out;
5184         }
5185
5186 dongle_scantime_out:
5187         return err;
5188 }
5189
5190 /* Filter the list of channels received from firmware counting only
5191  * the 20MHz channels. The wiphy band data only needs those which get
5192  * flagged to indicate if they can take part in higher bandwidth.
5193  */
5194 static void brcmf_count_20mhz_channels(struct brcmf_cfg80211_info *cfg,
5195                                        struct brcmf_chanspec_list *chlist,
5196                                        u32 chcnt[])
5197 {
5198         u32 total = le32_to_cpu(chlist->count);
5199         struct brcmu_chan ch;
5200         int i;
5201
5202         for (i = 0; i < total; i++) {
5203                 ch.chspec = (u16)le32_to_cpu(chlist->element[i]);
5204                 cfg->d11inf.decchspec(&ch);
5205
5206                 /* Firmware gives a ordered list. We skip non-20MHz
5207                  * channels is 2G. For 5G we can abort upon reaching
5208                  * a non-20MHz channel in the list.
5209                  */
5210                 if (ch.bw != BRCMU_CHAN_BW_20) {
5211                         if (ch.band == BRCMU_CHAN_BAND_5G)
5212                                 break;
5213                         else
5214                                 continue;
5215                 }
5216
5217                 if (ch.band == BRCMU_CHAN_BAND_2G)
5218                         chcnt[0] += 1;
5219                 else if (ch.band == BRCMU_CHAN_BAND_5G)
5220                         chcnt[1] += 1;
5221         }
5222 }
5223
5224 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5225                                            struct brcmu_chan *ch)
5226 {
5227         u32 ht40_flag;
5228
5229         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5230         if (ch->sb == BRCMU_CHAN_SB_U) {
5231                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5232                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5233                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5234         } else {
5235                 /* It should be one of
5236                  * IEEE80211_CHAN_NO_HT40 or
5237                  * IEEE80211_CHAN_NO_HT40PLUS
5238                  */
5239                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5240                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5241                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5242         }
5243 }
5244
5245 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5246                                     u32 bw_cap[])
5247 {
5248         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5249         struct ieee80211_supported_band *band;
5250         struct ieee80211_channel *channel;
5251         struct wiphy *wiphy;
5252         struct brcmf_chanspec_list *list;
5253         struct brcmu_chan ch;
5254         int err;
5255         u8 *pbuf;
5256         u32 i, j;
5257         u32 total;
5258         u32 chaninfo;
5259         u32 chcnt[2] = { 0, 0 };
5260         u32 index;
5261
5262         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5263
5264         if (pbuf == NULL)
5265                 return -ENOMEM;
5266
5267         list = (struct brcmf_chanspec_list *)pbuf;
5268
5269         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5270                                        BRCMF_DCMD_MEDLEN);
5271         if (err) {
5272                 brcmf_err("get chanspecs error (%d)\n", err);
5273                 goto fail_pbuf;
5274         }
5275
5276         brcmf_count_20mhz_channels(cfg, list, chcnt);
5277         wiphy = cfg_to_wiphy(cfg);
5278         if (chcnt[0]) {
5279                 band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
5280                                GFP_KERNEL);
5281                 if (band == NULL) {
5282                         err = -ENOMEM;
5283                         goto fail_pbuf;
5284                 }
5285                 band->channels = kcalloc(chcnt[0], sizeof(*channel),
5286                                          GFP_KERNEL);
5287                 if (band->channels == NULL) {
5288                         kfree(band);
5289                         err = -ENOMEM;
5290                         goto fail_pbuf;
5291                 }
5292                 band->n_channels = 0;
5293                 wiphy->bands[IEEE80211_BAND_2GHZ] = band;
5294         }
5295         if (chcnt[1]) {
5296                 band = kmemdup(&__wl_band_5ghz_a, sizeof(__wl_band_5ghz_a),
5297                                GFP_KERNEL);
5298                 if (band == NULL) {
5299                         err = -ENOMEM;
5300                         goto fail_band2g;
5301                 }
5302                 band->channels = kcalloc(chcnt[1], sizeof(*channel),
5303                                          GFP_KERNEL);
5304                 if (band->channels == NULL) {
5305                         kfree(band);
5306                         err = -ENOMEM;
5307                         goto fail_band2g;
5308                 }
5309                 band->n_channels = 0;
5310                 wiphy->bands[IEEE80211_BAND_5GHZ] = band;
5311         }
5312
5313         total = le32_to_cpu(list->count);
5314         for (i = 0; i < total; i++) {
5315                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5316                 cfg->d11inf.decchspec(&ch);
5317
5318                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5319                         band = wiphy->bands[IEEE80211_BAND_2GHZ];
5320                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5321                         band = wiphy->bands[IEEE80211_BAND_5GHZ];
5322                 } else {
5323                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5324                         continue;
5325                 }
5326                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5327                     ch.bw == BRCMU_CHAN_BW_40)
5328                         continue;
5329                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5330                     ch.bw == BRCMU_CHAN_BW_80)
5331                         continue;
5332
5333                 channel = band->channels;
5334                 index = band->n_channels;
5335                 for (j = 0; j < band->n_channels; j++) {
5336                         if (channel[j].hw_value == ch.chnum) {
5337                                 index = j;
5338                                 break;
5339                         }
5340                 }
5341                 channel[index].center_freq =
5342                         ieee80211_channel_to_frequency(ch.chnum, band->band);
5343                 channel[index].hw_value = ch.chnum;
5344
5345                 /* assuming the chanspecs order is HT20,
5346                  * HT40 upper, HT40 lower, and VHT80.
5347                  */
5348                 if (ch.bw == BRCMU_CHAN_BW_80) {
5349                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5350                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5351                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5352                 } else {
5353                         /* disable other bandwidths for now as mentioned
5354                          * order assure they are enabled for subsequent
5355                          * chanspecs.
5356                          */
5357                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5358                                                IEEE80211_CHAN_NO_80MHZ;
5359                         ch.bw = BRCMU_CHAN_BW_20;
5360                         cfg->d11inf.encchspec(&ch);
5361                         chaninfo = ch.chspec;
5362                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5363                                                        &chaninfo);
5364                         if (!err) {
5365                                 if (chaninfo & WL_CHAN_RADAR)
5366                                         channel[index].flags |=
5367                                                 (IEEE80211_CHAN_RADAR |
5368                                                  IEEE80211_CHAN_NO_IR);
5369                                 if (chaninfo & WL_CHAN_PASSIVE)
5370                                         channel[index].flags |=
5371                                                 IEEE80211_CHAN_NO_IR;
5372                         }
5373                 }
5374                 if (index == band->n_channels)
5375                         band->n_channels++;
5376         }
5377         kfree(pbuf);
5378         return 0;
5379
5380 fail_band2g:
5381         kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
5382         kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
5383         wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
5384 fail_pbuf:
5385         kfree(pbuf);
5386         return err;
5387 }
5388
5389 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
5390 {
5391         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5392         struct ieee80211_supported_band *band;
5393         struct brcmf_fil_bwcap_le band_bwcap;
5394         struct brcmf_chanspec_list *list;
5395         u8 *pbuf;
5396         u32 val;
5397         int err;
5398         struct brcmu_chan ch;
5399         u32 num_chan;
5400         int i, j;
5401
5402         /* verify support for bw_cap command */
5403         val = WLC_BAND_5G;
5404         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
5405
5406         if (!err) {
5407                 /* only set 2G bandwidth using bw_cap command */
5408                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
5409                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
5410                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
5411                                                sizeof(band_bwcap));
5412         } else {
5413                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
5414                 val = WLC_N_BW_40ALL;
5415                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
5416         }
5417
5418         if (!err) {
5419                 /* update channel info in 2G band */
5420                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5421
5422                 if (pbuf == NULL)
5423                         return -ENOMEM;
5424
5425                 ch.band = BRCMU_CHAN_BAND_2G;
5426                 ch.bw = BRCMU_CHAN_BW_40;
5427                 ch.sb = BRCMU_CHAN_SB_NONE;
5428                 ch.chnum = 0;
5429                 cfg->d11inf.encchspec(&ch);
5430
5431                 /* pass encoded chanspec in query */
5432                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
5433
5434                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5435                                                BRCMF_DCMD_MEDLEN);
5436                 if (err) {
5437                         brcmf_err("get chanspecs error (%d)\n", err);
5438                         kfree(pbuf);
5439                         return err;
5440                 }
5441
5442                 band = cfg_to_wiphy(cfg)->bands[IEEE80211_BAND_2GHZ];
5443                 list = (struct brcmf_chanspec_list *)pbuf;
5444                 num_chan = le32_to_cpu(list->count);
5445                 for (i = 0; i < num_chan; i++) {
5446                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
5447                         cfg->d11inf.decchspec(&ch);
5448                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
5449                                 continue;
5450                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
5451                                 continue;
5452                         for (j = 0; j < band->n_channels; j++) {
5453                                 if (band->channels[j].hw_value == ch.chnum)
5454                                         break;
5455                         }
5456                         if (WARN_ON(j == band->n_channels))
5457                                 continue;
5458
5459                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
5460                 }
5461                 kfree(pbuf);
5462         }
5463         return err;
5464 }
5465
5466 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
5467 {
5468         u32 band, mimo_bwcap;
5469         int err;
5470
5471         band = WLC_BAND_2G;
5472         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5473         if (!err) {
5474                 bw_cap[IEEE80211_BAND_2GHZ] = band;
5475                 band = WLC_BAND_5G;
5476                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5477                 if (!err) {
5478                         bw_cap[IEEE80211_BAND_5GHZ] = band;
5479                         return;
5480                 }
5481                 WARN_ON(1);
5482                 return;
5483         }
5484         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
5485         mimo_bwcap = 0;
5486         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
5487         if (err)
5488                 /* assume 20MHz if firmware does not give a clue */
5489                 mimo_bwcap = WLC_N_BW_20ALL;
5490
5491         switch (mimo_bwcap) {
5492         case WLC_N_BW_40ALL:
5493                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
5494                 /* fall-thru */
5495         case WLC_N_BW_20IN2G_40IN5G:
5496                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
5497                 /* fall-thru */
5498         case WLC_N_BW_20ALL:
5499                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
5500                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
5501                 break;
5502         default:
5503                 brcmf_err("invalid mimo_bw_cap value\n");
5504         }
5505 }
5506
5507 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
5508                                 u32 bw_cap[2], u32 nchain)
5509 {
5510         band->ht_cap.ht_supported = true;
5511         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
5512                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
5513                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5514         }
5515         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
5516         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
5517         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
5518         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
5519         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
5520         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5521 }
5522
5523 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
5524 {
5525         u16 mcs_map;
5526         int i;
5527
5528         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
5529                 mcs_map = (mcs_map << 2) | supp;
5530
5531         return cpu_to_le16(mcs_map);
5532 }
5533
5534 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
5535                                  u32 bw_cap[2], u32 nchain)
5536 {
5537         __le16 mcs_map;
5538
5539         /* not allowed in 2.4G band */
5540         if (band->band == IEEE80211_BAND_2GHZ)
5541                 return;
5542
5543         band->vht_cap.vht_supported = true;
5544         /* 80MHz is mandatory */
5545         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
5546         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
5547                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
5548                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
5549         }
5550         /* all support 256-QAM */
5551         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
5552         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
5553         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
5554 }
5555
5556 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
5557 {
5558         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
5559         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5560         u32 nmode = 0;
5561         u32 vhtmode = 0;
5562         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
5563         u32 rxchain;
5564         u32 nchain;
5565         int err;
5566         s32 i;
5567         struct ieee80211_supported_band *band;
5568
5569         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
5570         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
5571         if (err) {
5572                 brcmf_err("nmode error (%d)\n", err);
5573         } else {
5574                 brcmf_get_bwcap(ifp, bw_cap);
5575         }
5576         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
5577                   nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
5578                   bw_cap[IEEE80211_BAND_5GHZ]);
5579
5580         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
5581         if (err) {
5582                 brcmf_err("rxchain error (%d)\n", err);
5583                 nchain = 1;
5584         } else {
5585                 for (nchain = 0; rxchain; nchain++)
5586                         rxchain = rxchain & (rxchain - 1);
5587         }
5588         brcmf_dbg(INFO, "nchain=%d\n", nchain);
5589
5590         err = brcmf_construct_chaninfo(cfg, bw_cap);
5591         if (err) {
5592                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
5593                 return err;
5594         }
5595
5596         wiphy = cfg_to_wiphy(cfg);
5597         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
5598                 band = wiphy->bands[i];
5599                 if (band == NULL)
5600                         continue;
5601
5602                 if (nmode)
5603                         brcmf_update_ht_cap(band, bw_cap, nchain);
5604                 if (vhtmode)
5605                         brcmf_update_vht_cap(band, bw_cap, nchain);
5606         }
5607
5608         return 0;
5609 }
5610
5611 static const struct ieee80211_iface_limit brcmf_iface_limits_mbss[] = {
5612         {
5613                 .max = 1,
5614                 .types = BIT(NL80211_IFTYPE_STATION) |
5615                          BIT(NL80211_IFTYPE_ADHOC)
5616         },
5617         {
5618                 .max = 4,
5619                 .types = BIT(NL80211_IFTYPE_AP)
5620         },
5621         {
5622                 .max = 1,
5623                 .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
5624                          BIT(NL80211_IFTYPE_P2P_GO)
5625         },
5626         {
5627                 .max = 1,
5628                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
5629         }
5630 };
5631
5632 static const struct ieee80211_iface_limit brcmf_iface_limits_sbss[] = {
5633         {
5634                 .max = 2,
5635                 .types = BIT(NL80211_IFTYPE_STATION) |
5636                          BIT(NL80211_IFTYPE_ADHOC) |
5637                          BIT(NL80211_IFTYPE_AP)
5638         },
5639         {
5640                 .max = 1,
5641                 .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
5642                          BIT(NL80211_IFTYPE_P2P_GO)
5643         },
5644         {
5645                 .max = 1,
5646                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
5647         }
5648 };
5649 static struct ieee80211_iface_combination brcmf_iface_combos[] = {
5650         {
5651                  .max_interfaces = BRCMF_IFACE_MAX_CNT,
5652                  .num_different_channels = 1,
5653                  .n_limits = ARRAY_SIZE(brcmf_iface_limits_sbss),
5654                  .limits = brcmf_iface_limits_sbss,
5655         }
5656 };
5657
5658 static const struct ieee80211_txrx_stypes
5659 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
5660         [NL80211_IFTYPE_STATION] = {
5661                 .tx = 0xffff,
5662                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5663                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5664         },
5665         [NL80211_IFTYPE_P2P_CLIENT] = {
5666                 .tx = 0xffff,
5667                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5668                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5669         },
5670         [NL80211_IFTYPE_P2P_GO] = {
5671                 .tx = 0xffff,
5672                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
5673                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
5674                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
5675                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
5676                       BIT(IEEE80211_STYPE_AUTH >> 4) |
5677                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
5678                       BIT(IEEE80211_STYPE_ACTION >> 4)
5679         },
5680         [NL80211_IFTYPE_P2P_DEVICE] = {
5681                 .tx = 0xffff,
5682                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5683                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5684         }
5685 };
5686
5687 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
5688 {
5689         /* scheduled scan settings */
5690         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
5691         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
5692         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
5693         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
5694 }
5695
5696 #ifdef CONFIG_PM
5697 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
5698         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
5699         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
5700         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
5701         .pattern_min_len = 1,
5702         .max_pkt_offset = 1500,
5703 };
5704 #endif
5705
5706 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy)
5707 {
5708 #ifdef CONFIG_PM
5709         /* wowl settings */
5710         wiphy->wowlan = &brcmf_wowlan_support;
5711 #endif
5712 }
5713
5714 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
5715 {
5716         struct ieee80211_iface_combination ifc_combo;
5717         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
5718         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
5719         wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
5720         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
5721                                  BIT(NL80211_IFTYPE_ADHOC) |
5722                                  BIT(NL80211_IFTYPE_AP) |
5723                                  BIT(NL80211_IFTYPE_P2P_CLIENT) |
5724                                  BIT(NL80211_IFTYPE_P2P_GO) |
5725                                  BIT(NL80211_IFTYPE_P2P_DEVICE);
5726         /* need VSDB firmware feature for concurrent channels */
5727         ifc_combo = brcmf_iface_combos[0];
5728         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
5729                 ifc_combo.num_different_channels = 2;
5730         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
5731                 ifc_combo.n_limits = ARRAY_SIZE(brcmf_iface_limits_mbss),
5732                 ifc_combo.limits = brcmf_iface_limits_mbss;
5733         }
5734         wiphy->iface_combinations = kmemdup(&ifc_combo,
5735                                             sizeof(ifc_combo),
5736                                             GFP_KERNEL);
5737         wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
5738         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
5739         wiphy->cipher_suites = __wl_cipher_suites;
5740         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
5741         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
5742                         WIPHY_FLAG_OFFCHAN_TX |
5743                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5744                         WIPHY_FLAG_SUPPORTS_TDLS;
5745         if (!brcmf_roamoff)
5746                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
5747         wiphy->mgmt_stypes = brcmf_txrx_stypes;
5748         wiphy->max_remain_on_channel_duration = 5000;
5749         brcmf_wiphy_pno_params(wiphy);
5750
5751         /* vendor commands/events support */
5752         wiphy->vendor_commands = brcmf_vendor_cmds;
5753         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
5754
5755         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
5756                 brcmf_wiphy_wowl_params(wiphy);
5757
5758         return brcmf_setup_wiphybands(wiphy);
5759 }
5760
5761 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
5762 {
5763         struct net_device *ndev;
5764         struct wireless_dev *wdev;
5765         struct brcmf_if *ifp;
5766         s32 power_mode;
5767         s32 err = 0;
5768
5769         if (cfg->dongle_up)
5770                 return err;
5771
5772         ndev = cfg_to_ndev(cfg);
5773         wdev = ndev->ieee80211_ptr;
5774         ifp = netdev_priv(ndev);
5775
5776         /* make sure RF is ready for work */
5777         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
5778
5779         brcmf_dongle_scantime(ifp, WL_SCAN_CHANNEL_TIME,
5780                               WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
5781
5782         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
5783         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
5784         if (err)
5785                 goto default_conf_out;
5786         brcmf_dbg(INFO, "power save set to %s\n",
5787                   (power_mode ? "enabled" : "disabled"));
5788
5789         err = brcmf_dongle_roam(ifp, WL_BEACON_TIMEOUT);
5790         if (err)
5791                 goto default_conf_out;
5792         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
5793                                           NULL, NULL);
5794         if (err)
5795                 goto default_conf_out;
5796
5797         brcmf_configure_arp_offload(ifp, true);
5798
5799         cfg->dongle_up = true;
5800 default_conf_out:
5801
5802         return err;
5803
5804 }
5805
5806 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
5807 {
5808         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
5809
5810         return brcmf_config_dongle(ifp->drvr->config);
5811 }
5812
5813 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
5814 {
5815         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5816
5817         /*
5818          * While going down, if associated with AP disassociate
5819          * from AP to save power
5820          */
5821         if (check_vif_up(ifp->vif)) {
5822                 brcmf_link_down(ifp->vif);
5823
5824                 /* Make sure WPA_Supplicant receives all the event
5825                    generated due to DISASSOC call to the fw to keep
5826                    the state fw and WPA_Supplicant state consistent
5827                  */
5828                 brcmf_delay(500);
5829         }
5830
5831         brcmf_abort_scanning(cfg);
5832         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
5833
5834         return 0;
5835 }
5836
5837 s32 brcmf_cfg80211_up(struct net_device *ndev)
5838 {
5839         struct brcmf_if *ifp = netdev_priv(ndev);
5840         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5841         s32 err = 0;
5842
5843         mutex_lock(&cfg->usr_sync);
5844         err = __brcmf_cfg80211_up(ifp);
5845         mutex_unlock(&cfg->usr_sync);
5846
5847         return err;
5848 }
5849
5850 s32 brcmf_cfg80211_down(struct net_device *ndev)
5851 {
5852         struct brcmf_if *ifp = netdev_priv(ndev);
5853         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5854         s32 err = 0;
5855
5856         mutex_lock(&cfg->usr_sync);
5857         err = __brcmf_cfg80211_down(ifp);
5858         mutex_unlock(&cfg->usr_sync);
5859
5860         return err;
5861 }
5862
5863 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
5864 {
5865         struct wireless_dev *wdev = &ifp->vif->wdev;
5866
5867         return wdev->iftype;
5868 }
5869
5870 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
5871                              unsigned long state)
5872 {
5873         struct brcmf_cfg80211_vif *vif;
5874
5875         list_for_each_entry(vif, &cfg->vif_list, list) {
5876                 if (test_bit(state, &vif->sme_state))
5877                         return true;
5878         }
5879         return false;
5880 }
5881
5882 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
5883                                     u8 action)
5884 {
5885         u8 evt_action;
5886
5887         mutex_lock(&event->vif_event_lock);
5888         evt_action = event->action;
5889         mutex_unlock(&event->vif_event_lock);
5890         return evt_action == action;
5891 }
5892
5893 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
5894                                   struct brcmf_cfg80211_vif *vif)
5895 {
5896         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5897
5898         mutex_lock(&event->vif_event_lock);
5899         event->vif = vif;
5900         event->action = 0;
5901         mutex_unlock(&event->vif_event_lock);
5902 }
5903
5904 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
5905 {
5906         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5907         bool armed;
5908
5909         mutex_lock(&event->vif_event_lock);
5910         armed = event->vif != NULL;
5911         mutex_unlock(&event->vif_event_lock);
5912
5913         return armed;
5914 }
5915 int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
5916                                           u8 action, ulong timeout)
5917 {
5918         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5919
5920         return wait_event_timeout(event->vif_wq,
5921                                   vif_event_equals(event, action), timeout);
5922 }
5923
5924 static void brcmf_free_wiphy(struct wiphy *wiphy)
5925 {
5926         kfree(wiphy->iface_combinations);
5927         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
5928                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
5929                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
5930         }
5931         if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
5932                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]->channels);
5933                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]);
5934         }
5935         wiphy_free(wiphy);
5936 }
5937
5938 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
5939                                                   struct device *busdev)
5940 {
5941         struct net_device *ndev = drvr->iflist[0]->ndev;
5942         struct brcmf_cfg80211_info *cfg;
5943         struct wiphy *wiphy;
5944         struct brcmf_cfg80211_vif *vif;
5945         struct brcmf_if *ifp;
5946         s32 err = 0;
5947         s32 io_type;
5948         u16 *cap = NULL;
5949
5950         if (!ndev) {
5951                 brcmf_err("ndev is invalid\n");
5952                 return NULL;
5953         }
5954
5955         ifp = netdev_priv(ndev);
5956         wiphy = wiphy_new(&wl_cfg80211_ops, sizeof(struct brcmf_cfg80211_info));
5957         if (!wiphy) {
5958                 brcmf_err("Could not allocate wiphy device\n");
5959                 return NULL;
5960         }
5961         set_wiphy_dev(wiphy, busdev);
5962
5963         cfg = wiphy_priv(wiphy);
5964         cfg->wiphy = wiphy;
5965         cfg->pub = drvr;
5966         init_vif_event(&cfg->vif_event);
5967         INIT_LIST_HEAD(&cfg->vif_list);
5968
5969         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
5970         if (IS_ERR(vif))
5971                 goto wiphy_out;
5972
5973         vif->ifp = ifp;
5974         vif->wdev.netdev = ndev;
5975         ndev->ieee80211_ptr = &vif->wdev;
5976         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
5977
5978         err = wl_init_priv(cfg);
5979         if (err) {
5980                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
5981                 brcmf_free_vif(vif);
5982                 goto wiphy_out;
5983         }
5984         ifp->vif = vif;
5985
5986         /* determine d11 io type before wiphy setup */
5987         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
5988         if (err) {
5989                 brcmf_err("Failed to get D11 version (%d)\n", err);
5990                 goto priv_out;
5991         }
5992         cfg->d11inf.io_type = (u8)io_type;
5993         brcmu_d11_attach(&cfg->d11inf);
5994
5995         err = brcmf_setup_wiphy(wiphy, ifp);
5996         if (err < 0)
5997                 goto priv_out;
5998
5999         brcmf_dbg(INFO, "Registering custom regulatory\n");
6000         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6001         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6002
6003         /* firmware defaults to 40MHz disabled in 2G band. We signal
6004          * cfg80211 here that we do and have it decide we can enable
6005          * it. But first check if device does support 2G operation.
6006          */
6007         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
6008                 cap = &wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap.cap;
6009                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6010         }
6011         err = wiphy_register(wiphy);
6012         if (err < 0) {
6013                 brcmf_err("Could not register wiphy device (%d)\n", err);
6014                 goto priv_out;
6015         }
6016
6017         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6018          * setup 40MHz in 2GHz band and enable OBSS scanning.
6019          */
6020         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6021                 err = brcmf_enable_bw40_2g(cfg);
6022                 if (!err)
6023                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6024                                                       BRCMF_OBSS_COEX_AUTO);
6025                 else
6026                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6027         }
6028
6029         err = brcmf_p2p_attach(cfg);
6030         if (err) {
6031                 brcmf_err("P2P initilisation failed (%d)\n", err);
6032                 goto wiphy_unreg_out;
6033         }
6034         err = brcmf_btcoex_attach(cfg);
6035         if (err) {
6036                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6037                 brcmf_p2p_detach(&cfg->p2p);
6038                 goto wiphy_unreg_out;
6039         }
6040
6041         err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6042         if (err) {
6043                 brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6044                 wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6045         } else {
6046                 brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6047                                     brcmf_notify_tdls_peer_event);
6048         }
6049
6050         return cfg;
6051
6052 wiphy_unreg_out:
6053         wiphy_unregister(cfg->wiphy);
6054 priv_out:
6055         wl_deinit_priv(cfg);
6056         brcmf_free_vif(vif);
6057 wiphy_out:
6058         brcmf_free_wiphy(wiphy);
6059         return NULL;
6060 }
6061
6062 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
6063 {
6064         if (!cfg)
6065                 return;
6066
6067         WARN_ON(!list_empty(&cfg->vif_list));
6068         wiphy_unregister(cfg->wiphy);
6069         brcmf_btcoex_detach(cfg);
6070         brcmf_p2p_detach(&cfg->p2p);
6071         wl_deinit_priv(cfg);
6072         brcmf_free_wiphy(cfg->wiphy);
6073 }