drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41
  42 #define BRCMF_SCAN_IE_LEN_MAX           2048
  43 #define BRCMF_PNO_VERSION               2
  44 #define BRCMF_PNO_TIME                  30
  45 #define BRCMF_PNO_REPEAT                4
  46 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  47 #define BRCMF_PNO_MAX_PFN_COUNT         16
  48 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  49 #define BRCMF_PNO_HIDDEN_BIT            2
  50 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  51 #define BRCMF_PNO_SCAN_COMPLETE         1
  52 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  53
  54 #define BRCMF_IFACE_MAX_CNT             3
  55
  56 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  57 #define WPA_OUI_TYPE                    1
  58 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  59 #define WME_OUI_TYPE                    2
  60 #define WPS_OUI_TYPE                    4
  61
  62 #define VS_IE_FIXED_HDR_LEN             6
  63 #define WPA_IE_VERSION_LEN              2
  64 #define WPA_IE_MIN_OUI_LEN              4
  65 #define WPA_IE_SUITE_COUNT_LEN          2
  66
  67 #define WPA_CIPHER_NONE                 0       /* None */
  68 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  69 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  70 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  71 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  72
  73 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  74 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  75 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  76 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  77 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    0x000C
  78
  79 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  80                                                  * string :"add", "del" (+ NUL)
  81                                                  */
  82 #define VNDR_IE_COUNT_OFFSET            4
  83 #define VNDR_IE_PKTFLAG_OFFSET          8
  84 #define VNDR_IE_VSIE_OFFSET             12
  85 #define VNDR_IE_HDR_SIZE                12
  86 #define VNDR_IE_PARSE_LIMIT             5
  87
  88 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  89 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  90
  91 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  92 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  93 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  94
  95 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
  96         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
  97
  98 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
  99 {
 100         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 101                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 102                           vif->sme_state);
 103                 return false;
 104         }
 105         return true;
 106 }
 107
 108 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 109 #define RATETAB_ENT(_rateid, _flags) \
 110         {                                                               \
 111                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 112                 .hw_value       = (_rateid),                            \
 113                 .flags          = (_flags),                             \
 114         }
 115
 116 static struct ieee80211_rate __wl_rates[] = {
 117         RATETAB_ENT(BRCM_RATE_1M, 0),
 118         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 119         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 120         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 121         RATETAB_ENT(BRCM_RATE_6M, 0),
 122         RATETAB_ENT(BRCM_RATE_9M, 0),
 123         RATETAB_ENT(BRCM_RATE_12M, 0),
 124         RATETAB_ENT(BRCM_RATE_18M, 0),
 125         RATETAB_ENT(BRCM_RATE_24M, 0),
 126         RATETAB_ENT(BRCM_RATE_36M, 0),
 127         RATETAB_ENT(BRCM_RATE_48M, 0),
 128         RATETAB_ENT(BRCM_RATE_54M, 0),
 129 };
 130
 131 #define wl_a_rates              (__wl_rates + 4)
 132 #define wl_a_rates_size 8
 133 #define wl_g_rates              (__wl_rates + 0)
 134 #define wl_g_rates_size 12
 135
 136 /* Band templates duplicated per wiphy. The channel info
 137  * is filled in after querying the device.
 138  */
 139 static const struct ieee80211_supported_band __wl_band_2ghz = {
 140         .band = IEEE80211_BAND_2GHZ,
 141         .bitrates = wl_g_rates,
 142         .n_bitrates = wl_g_rates_size,
 143 };
 144
 145 static const struct ieee80211_supported_band __wl_band_5ghz_a = {
 146         .band = IEEE80211_BAND_5GHZ,
 147         .bitrates = wl_a_rates,
 148         .n_bitrates = wl_a_rates_size,
 149 };
 150
 151 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 152  * By default world regulatory domain defined in reg.c puts the flags
 153  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 154  * With respect to these flags, wpa_supplicant doesn't * start p2p
 155  * operations on 5GHz channels. All the changes in world regulatory
 156  * domain are to be done here.
 157  */
 158 static const struct ieee80211_regdomain brcmf_regdom = {
 159         .n_reg_rules = 4,
 160         .alpha2 =  "99",
 161         .reg_rules = {
 162                 /* IEEE 802.11b/g, channels 1..11 */
 163                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 164                 /* If any */
 165                 /* IEEE 802.11 channel 14 - Only JP enables
 166                  * this and for 802.11b only
 167                  */
 168                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 169                 /* IEEE 802.11a, channel 36..64 */
 170                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 171                 /* IEEE 802.11a, channel 100..165 */
 172                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 173 };
 174
 175 static const u32 __wl_cipher_suites[] = {
 176         WLAN_CIPHER_SUITE_WEP40,
 177         WLAN_CIPHER_SUITE_WEP104,
 178         WLAN_CIPHER_SUITE_TKIP,
 179         WLAN_CIPHER_SUITE_CCMP,
 180         WLAN_CIPHER_SUITE_AES_CMAC,
 181 };
 182
 183 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 184 struct brcmf_vs_tlv {
 185         u8 id;
 186         u8 len;
 187         u8 oui[3];
 188         u8 oui_type;
 189 };
 190
 191 struct parsed_vndr_ie_info {
 192         u8 *ie_ptr;
 193         u32 ie_len;     /* total length including id & length field */
 194         struct brcmf_vs_tlv vndrie;
 195 };
 196
 197 struct parsed_vndr_ies {
 198         u32 count;
 199         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 200 };
 201
 202 static int brcmf_roamoff;
 203 module_param_named(roamoff, brcmf_roamoff, int, S_IRUSR);
 204 MODULE_PARM_DESC(roamoff, "do not use internal roaming engine");
 205
 206 /* Quarter dBm units to mW
 207  * Table starts at QDBM_OFFSET, so the first entry is mW for qdBm=153
 208  * Table is offset so the last entry is largest mW value that fits in
 209  * a u16.
 210  */
 211
 212 #define QDBM_OFFSET 153         /* Offset for first entry */
 213 #define QDBM_TABLE_LEN 40       /* Table size */
 214
 215 /* Smallest mW value that will round up to the first table entry, QDBM_OFFSET.
 216  * Value is ( mW(QDBM_OFFSET - 1) + mW(QDBM_OFFSET) ) / 2
 217  */
 218 #define QDBM_TABLE_LOW_BOUND 6493       /* Low bound */
 219
 220 /* Largest mW value that will round down to the last table entry,
 221  * QDBM_OFFSET + QDBM_TABLE_LEN-1.
 222  * Value is ( mW(QDBM_OFFSET + QDBM_TABLE_LEN - 1) +
 223  * mW(QDBM_OFFSET + QDBM_TABLE_LEN) ) / 2.
 224  */
 225 #define QDBM_TABLE_HIGH_BOUND 64938     /* High bound */
 226
 227 static const u16 nqdBm_to_mW_map[QDBM_TABLE_LEN] = {
 228 /* qdBm:        +0      +1      +2      +3      +4      +5      +6      +7 */
 229 /* 153: */ 6683, 7079, 7499, 7943, 8414, 8913, 9441, 10000,
 230 /* 161: */ 10593, 11220, 11885, 12589, 13335, 14125, 14962, 15849,
 231 /* 169: */ 16788, 17783, 18836, 19953, 21135, 22387, 23714, 25119,
 232 /* 177: */ 26607, 28184, 29854, 31623, 33497, 35481, 37584, 39811,
 233 /* 185: */ 42170, 44668, 47315, 50119, 53088, 56234, 59566, 63096
 234 };
 235
 236 static u16 brcmf_qdbm_to_mw(u8 qdbm)
 237 {
 238         uint factor = 1;
 239         int idx = qdbm - QDBM_OFFSET;
 240
 241         if (idx >= QDBM_TABLE_LEN)
 242                 /* clamp to max u16 mW value */
 243                 return 0xFFFF;
 244
 245         /* scale the qdBm index up to the range of the table 0-40
 246          * where an offset of 40 qdBm equals a factor of 10 mW.
 247          */
 248         while (idx < 0) {
 249                 idx += 40;
 250                 factor *= 10;
 251         }
 252
 253         /* return the mW value scaled down to the correct factor of 10,
 254          * adding in factor/2 to get proper rounding.
 255          */
 256         return (nqdBm_to_mW_map[idx] + factor / 2) / factor;
 257 }
 258
 259 static u8 brcmf_mw_to_qdbm(u16 mw)
 260 {
 261         u8 qdbm;
 262         int offset;
 263         uint mw_uint = mw;
 264         uint boundary;
 265
 266         /* handle boundary case */
 267         if (mw_uint <= 1)
 268                 return 0;
 269
 270         offset = QDBM_OFFSET;
 271
 272         /* move mw into the range of the table */
 273         while (mw_uint < QDBM_TABLE_LOW_BOUND) {
 274                 mw_uint *= 10;
 275                 offset -= 40;
 276         }
 277
 278         for (qdbm = 0; qdbm < QDBM_TABLE_LEN - 1; qdbm++) {
 279                 boundary = nqdBm_to_mW_map[qdbm] + (nqdBm_to_mW_map[qdbm + 1] -
 280                                                     nqdBm_to_mW_map[qdbm]) / 2;
 281                 if (mw_uint < boundary)
 282                         break;
 283         }
 284
 285         qdbm += (u8) offset;
 286
 287         return qdbm;
 288 }
 289
 290 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 291                                struct cfg80211_chan_def *ch)
 292 {
 293         struct brcmu_chan ch_inf;
 294         s32 primary_offset;
 295
 296         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 297                   ch->chan->center_freq, ch->center_freq1, ch->width);
 298         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 299         primary_offset = ch->center_freq1 - ch->chan->center_freq;
 300         switch (ch->width) {
 301         case NL80211_CHAN_WIDTH_20:
 302         case NL80211_CHAN_WIDTH_20_NOHT:
 303                 ch_inf.bw = BRCMU_CHAN_BW_20;
 304                 WARN_ON(primary_offset != 0);
 305                 break;
 306         case NL80211_CHAN_WIDTH_40:
 307                 ch_inf.bw = BRCMU_CHAN_BW_40;
 308                 if (primary_offset < 0)
 309                         ch_inf.sb = BRCMU_CHAN_SB_U;
 310                 else
 311                         ch_inf.sb = BRCMU_CHAN_SB_L;
 312                 break;
 313         case NL80211_CHAN_WIDTH_80:
 314                 ch_inf.bw = BRCMU_CHAN_BW_80;
 315                 if (primary_offset < 0) {
 316                         if (primary_offset < -CH_10MHZ_APART)
 317                                 ch_inf.sb = BRCMU_CHAN_SB_UU;
 318                         else
 319                                 ch_inf.sb = BRCMU_CHAN_SB_UL;
 320                 } else {
 321                         if (primary_offset > CH_10MHZ_APART)
 322                                 ch_inf.sb = BRCMU_CHAN_SB_LL;
 323                         else
 324                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
 325                 }
 326                 break;
 327         case NL80211_CHAN_WIDTH_80P80:
 328         case NL80211_CHAN_WIDTH_160:
 329         case NL80211_CHAN_WIDTH_5:
 330         case NL80211_CHAN_WIDTH_10:
 331         default:
 332                 WARN_ON_ONCE(1);
 333         }
 334         switch (ch->chan->band) {
 335         case IEEE80211_BAND_2GHZ:
 336                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 337                 break;
 338         case IEEE80211_BAND_5GHZ:
 339                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 340                 break;
 341         case IEEE80211_BAND_60GHZ:
 342         default:
 343                 WARN_ON_ONCE(1);
 344         }
 345         d11inf->encchspec(&ch_inf);
 346
 347         return ch_inf.chspec;
 348 }
 349
 350 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 351                         struct ieee80211_channel *ch)
 352 {
 353         struct brcmu_chan ch_inf;
 354
 355         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 356         ch_inf.bw = BRCMU_CHAN_BW_20;
 357         d11inf->encchspec(&ch_inf);
 358
 359         return ch_inf.chspec;
 360 }
 361
 362 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 363  * triples, returning a pointer to the substring whose first element
 364  * matches tag
 365  */
 366 const struct brcmf_tlv *
 367 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 368 {
 369         const struct brcmf_tlv *elt = buf;
 370         int totlen = buflen;
 371
 372         /* find tagged parameter */
 373         while (totlen >= TLV_HDR_LEN) {
 374                 int len = elt->len;
 375
 376                 /* validate remaining totlen */
 377                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 378                         return elt;
 379
 380                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 381                 totlen -= (len + TLV_HDR_LEN);
 382         }
 383
 384         return NULL;
 385 }
 386
 387 /* Is any of the tlvs the expected entry? If
 388  * not update the tlvs buffer pointer/length.
 389  */
 390 static bool
 391 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 392                  const u8 *oui, u32 oui_len, u8 type)
 393 {
 394         /* If the contents match the OUI and the type */
 395         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 396             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 397             type == ie[TLV_BODY_OFF + oui_len]) {
 398                 return true;
 399         }
 400
 401         if (tlvs == NULL)
 402                 return false;
 403         /* point to the next ie */
 404         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 405         /* calculate the length of the rest of the buffer */
 406         *tlvs_len -= (int)(ie - *tlvs);
 407         /* update the pointer to the start of the buffer */
 408         *tlvs = ie;
 409
 410         return false;
 411 }
 412
 413 static struct brcmf_vs_tlv *
 414 brcmf_find_wpaie(const u8 *parse, u32 len)
 415 {
 416         const struct brcmf_tlv *ie;
 417
 418         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 419                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 420                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 421                         return (struct brcmf_vs_tlv *)ie;
 422         }
 423         return NULL;
 424 }
 425
 426 static struct brcmf_vs_tlv *
 427 brcmf_find_wpsie(const u8 *parse, u32 len)
 428 {
 429         const struct brcmf_tlv *ie;
 430
 431         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 432                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 433                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 434                         return (struct brcmf_vs_tlv *)ie;
 435         }
 436         return NULL;
 437 }
 438
 439
 440 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 441                                  struct brcmf_wsec_key_le *key_le)
 442 {
 443         key_le->index = cpu_to_le32(key->index);
 444         key_le->len = cpu_to_le32(key->len);
 445         key_le->algo = cpu_to_le32(key->algo);
 446         key_le->flags = cpu_to_le32(key->flags);
 447         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 448         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 449         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 450         memcpy(key_le->data, key->data, sizeof(key->data));
 451         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 452 }
 453
 454 static int
 455 send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
 456 {
 457         int err;
 458         struct brcmf_wsec_key_le key_le;
 459
 460         convert_key_from_CPU(key, &key_le);
 461
 462         brcmf_netdev_wait_pend8021x(ndev);
 463
 464         err = brcmf_fil_bsscfg_data_set(netdev_priv(ndev), "wsec_key", &key_le,
 465                                         sizeof(key_le));
 466
 467         if (err)
 468                 brcmf_err("wsec_key error (%d)\n", err);
 469         return err;
 470 }
 471
 472 static s32
 473 brcmf_configure_arp_offload(struct brcmf_if *ifp, bool enable)
 474 {
 475         s32 err;
 476         u32 mode;
 477
 478         if (enable)
 479                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 480         else
 481                 mode = 0;
 482
 483         /* Try to set and enable ARP offload feature, this may fail, then it  */
 484         /* is simply not supported and err 0 will be returned                 */
 485         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 486         if (err) {
 487                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 488                           mode, err);
 489                 err = 0;
 490         } else {
 491                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 492                 if (err) {
 493                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 494                                   enable, err);
 495                         err = 0;
 496                 } else
 497                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 498                                   enable, mode);
 499         }
 500
 501         return err;
 502 }
 503
 504 static void
 505 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 506 {
 507         struct brcmf_cfg80211_vif *vif;
 508         struct brcmf_if *ifp;
 509
 510         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 511         ifp = vif->ifp;
 512
 513         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 514             (wdev->iftype == NL80211_IFTYPE_AP) ||
 515             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 516                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 517                                                 ADDR_DIRECT);
 518         else
 519                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 520                                                 ADDR_INDIRECT);
 521 }
 522
 523 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 524 {
 525         struct brcmf_mbss_ssid_le mbss_ssid_le;
 526         int bsscfgidx;
 527         int err;
 528
 529         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 530         bsscfgidx = brcmf_get_next_free_bsscfgidx(ifp->drvr);
 531         if (bsscfgidx < 0)
 532                 return bsscfgidx;
 533
 534         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 535         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 536         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 537
 538         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 539                                         sizeof(mbss_ssid_le));
 540         if (err < 0)
 541                 brcmf_err("setting ssid failed %d\n", err);
 542
 543         return err;
 544 }
 545
 546 /**
 547  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 548  *
 549  * @wiphy: wiphy device of new interface.
 550  * @name: name of the new interface.
 551  * @flags: not used.
 552  * @params: contains mac address for AP device.
 553  */
 554 static
 555 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 556                                       u32 *flags, struct vif_params *params)
 557 {
 558         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 559         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 560         struct brcmf_cfg80211_vif *vif;
 561         int err;
 562
 563         if (brcmf_cfg80211_vif_event_armed(cfg))
 564                 return ERR_PTR(-EBUSY);
 565
 566         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 567
 568         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP, false);
 569         if (IS_ERR(vif))
 570                 return (struct wireless_dev *)vif;
 571
 572         brcmf_cfg80211_arm_vif_event(cfg, vif);
 573
 574         err = brcmf_cfg80211_request_ap_if(ifp);
 575         if (err) {
 576                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 577                 goto fail;
 578         }
 579
 580         /* wait for firmware event */
 581         err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
 582                                                     msecs_to_jiffies(1500));
 583         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 584         if (!err) {
 585                 brcmf_err("timeout occurred\n");
 586                 err = -EIO;
 587                 goto fail;
 588         }
 589
 590         /* interface created in firmware */
 591         ifp = vif->ifp;
 592         if (!ifp) {
 593                 brcmf_err("no if pointer provided\n");
 594                 err = -ENOENT;
 595                 goto fail;
 596         }
 597
 598         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 599         err = brcmf_net_attach(ifp, true);
 600         if (err) {
 601                 brcmf_err("Registering netdevice failed\n");
 602                 goto fail;
 603         }
 604
 605         return &ifp->vif->wdev;
 606
 607 fail:
 608         brcmf_free_vif(vif);
 609         return ERR_PTR(err);
 610 }
 611
 612 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 613 {
 614         enum nl80211_iftype iftype;
 615
 616         iftype = vif->wdev.iftype;
 617         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 618 }
 619
 620 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 621 {
 622         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 623 }
 624
 625 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 626                                                      const char *name,
 627                                                      enum nl80211_iftype type,
 628                                                      u32 *flags,
 629                                                      struct vif_params *params)
 630 {
 631         struct wireless_dev *wdev;
 632
 633         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 634         switch (type) {
 635         case NL80211_IFTYPE_ADHOC:
 636         case NL80211_IFTYPE_STATION:
 637         case NL80211_IFTYPE_AP_VLAN:
 638         case NL80211_IFTYPE_WDS:
 639         case NL80211_IFTYPE_MONITOR:
 640         case NL80211_IFTYPE_MESH_POINT:
 641                 return ERR_PTR(-EOPNOTSUPP);
 642         case NL80211_IFTYPE_AP:
 643                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 644                 if (!IS_ERR(wdev))
 645                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 646                 return wdev;
 647         case NL80211_IFTYPE_P2P_CLIENT:
 648         case NL80211_IFTYPE_P2P_GO:
 649         case NL80211_IFTYPE_P2P_DEVICE:
 650                 wdev = brcmf_p2p_add_vif(wiphy, name, type, flags, params);
 651                 if (!IS_ERR(wdev))
 652                         brcmf_cfg80211_update_proto_addr_mode(wdev);
 653                 return wdev;
 654         case NL80211_IFTYPE_UNSPECIFIED:
 655         default:
 656                 return ERR_PTR(-EINVAL);
 657         }
 658 }
 659
 660 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 661 {
 662         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 663                 brcmf_set_mpc(ifp, mpc);
 664 }
 665
 666 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 667 {
 668         s32 err = 0;
 669
 670         if (check_vif_up(ifp->vif)) {
 671                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 672                 if (err) {
 673                         brcmf_err("fail to set mpc\n");
 674                         return;
 675                 }
 676                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 677         }
 678 }
 679
 680 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 681                                 struct brcmf_if *ifp, bool aborted,
 682                                 bool fw_abort)
 683 {
 684         struct brcmf_scan_params_le params_le;
 685         struct cfg80211_scan_request *scan_request;
 686         s32 err = 0;
 687
 688         brcmf_dbg(SCAN, "Enter\n");
 689
 690         /* clear scan request, because the FW abort can cause a second call */
 691         /* to this functon and might cause a double cfg80211_scan_done      */
 692         scan_request = cfg->scan_request;
 693         cfg->scan_request = NULL;
 694
 695         if (timer_pending(&cfg->escan_timeout))
 696                 del_timer_sync(&cfg->escan_timeout);
 697
 698         if (fw_abort) {
 699                 /* Do a scan abort to stop the driver's scan engine */
 700                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 701                 memset(&params_le, 0, sizeof(params_le));
 702                 memset(params_le.bssid, 0xFF, ETH_ALEN);
 703                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 704                 params_le.scan_type = 0;
 705                 params_le.channel_num = cpu_to_le32(1);
 706                 params_le.nprobes = cpu_to_le32(1);
 707                 params_le.active_time = cpu_to_le32(-1);
 708                 params_le.passive_time = cpu_to_le32(-1);
 709                 params_le.home_time = cpu_to_le32(-1);
 710                 /* Scan is aborted by setting channel_list[0] to -1 */
 711                 params_le.channel_list[0] = cpu_to_le16(-1);
 712                 /* E-Scan (or anyother type) can be aborted by SCAN */
 713                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 714                                              &params_le, sizeof(params_le));
 715                 if (err)
 716                         brcmf_err("Scan abort  failed\n");
 717         }
 718
 719         brcmf_scan_config_mpc(ifp, 1);
 720
 721         /*
 722          * e-scan can be initiated by scheduled scan
 723          * which takes precedence.
 724          */
 725         if (cfg->sched_escan) {
 726                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 727                 cfg->sched_escan = false;
 728                 if (!aborted)
 729                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 730         } else if (scan_request) {
 731                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 732                           aborted ? "Aborted" : "Done");
 733                 cfg80211_scan_done(scan_request, aborted);
 734         }
 735         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 736                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 737
 738         return err;
 739 }
 740
 741 static
 742 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 743 {
 744         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 745         struct net_device *ndev = wdev->netdev;
 746
 747         /* vif event pending in firmware */
 748         if (brcmf_cfg80211_vif_event_armed(cfg))
 749                 return -EBUSY;
 750
 751         if (ndev) {
 752                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 753                     cfg->escan_info.ifp == netdev_priv(ndev))
 754                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 755                                                     true, true);
 756
 757                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 758         }
 759
 760         switch (wdev->iftype) {
 761         case NL80211_IFTYPE_ADHOC:
 762         case NL80211_IFTYPE_STATION:
 763         case NL80211_IFTYPE_AP:
 764         case NL80211_IFTYPE_AP_VLAN:
 765         case NL80211_IFTYPE_WDS:
 766         case NL80211_IFTYPE_MONITOR:
 767         case NL80211_IFTYPE_MESH_POINT:
 768                 return -EOPNOTSUPP;
 769         case NL80211_IFTYPE_P2P_CLIENT:
 770         case NL80211_IFTYPE_P2P_GO:
 771         case NL80211_IFTYPE_P2P_DEVICE:
 772                 return brcmf_p2p_del_vif(wiphy, wdev);
 773         case NL80211_IFTYPE_UNSPECIFIED:
 774         default:
 775                 return -EINVAL;
 776         }
 777         return -EOPNOTSUPP;
 778 }
 779
 780 static s32
 781 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 782                          enum nl80211_iftype type, u32 *flags,
 783                          struct vif_params *params)
 784 {
 785         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 786         struct brcmf_if *ifp = netdev_priv(ndev);
 787         struct brcmf_cfg80211_vif *vif = ifp->vif;
 788         s32 infra = 0;
 789         s32 ap = 0;
 790         s32 err = 0;
 791
 792         brcmf_dbg(TRACE, "Enter, ndev=%p, type=%d\n", ndev, type);
 793
 794         switch (type) {
 795         case NL80211_IFTYPE_MONITOR:
 796         case NL80211_IFTYPE_WDS:
 797                 brcmf_err("type (%d) : currently we do not support this type\n",
 798                           type);
 799                 return -EOPNOTSUPP;
 800         case NL80211_IFTYPE_ADHOC:
 801                 infra = 0;
 802                 break;
 803         case NL80211_IFTYPE_STATION:
 804                 /* Ignore change for p2p IF. Unclear why supplicant does this */
 805                 if ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 806                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO)) {
 807                         brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 808                         /* WAR: It is unexpected to get a change of VIF for P2P
 809                          * IF, but it happens. The request can not be handled
 810                          * but returning EPERM causes a crash. Returning 0
 811                          * without setting ieee80211_ptr->iftype causes trace
 812                          * (WARN_ON) but it works with wpa_supplicant
 813                          */
 814                         return 0;
 815                 }
 816                 infra = 1;
 817                 break;
 818         case NL80211_IFTYPE_AP:
 819         case NL80211_IFTYPE_P2P_GO:
 820                 ap = 1;
 821                 break;
 822         default:
 823                 err = -EINVAL;
 824                 goto done;
 825         }
 826
 827         if (ap) {
 828                 if (type == NL80211_IFTYPE_P2P_GO) {
 829                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 830                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 831                 }
 832                 if (!err) {
 833                         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
 834                         brcmf_dbg(INFO, "IF Type = AP\n");
 835                 }
 836         } else {
 837                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 838                 if (err) {
 839                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 840                         err = -EAGAIN;
 841                         goto done;
 842                 }
 843                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 844                           "Adhoc" : "Infra");
 845         }
 846         ndev->ieee80211_ptr->iftype = type;
 847
 848         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 849
 850 done:
 851         brcmf_dbg(TRACE, "Exit\n");
 852
 853         return err;
 854 }
 855
 856 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 857                              struct brcmf_scan_params_le *params_le,
 858                              struct cfg80211_scan_request *request)
 859 {
 860         u32 n_ssids;
 861         u32 n_channels;
 862         s32 i;
 863         s32 offset;
 864         u16 chanspec;
 865         char *ptr;
 866         struct brcmf_ssid_le ssid_le;
 867
 868         memset(params_le->bssid, 0xFF, ETH_ALEN);
 869         params_le->bss_type = DOT11_BSSTYPE_ANY;
 870         params_le->scan_type = 0;
 871         params_le->channel_num = 0;
 872         params_le->nprobes = cpu_to_le32(-1);
 873         params_le->active_time = cpu_to_le32(-1);
 874         params_le->passive_time = cpu_to_le32(-1);
 875         params_le->home_time = cpu_to_le32(-1);
 876         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 877
 878         /* if request is null exit so it will be all channel broadcast scan */
 879         if (!request)
 880                 return;
 881
 882         n_ssids = request->n_ssids;
 883         n_channels = request->n_channels;
 884         /* Copy channel array if applicable */
 885         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 886                   n_channels);
 887         if (n_channels > 0) {
 888                 for (i = 0; i < n_channels; i++) {
 889                         chanspec = channel_to_chanspec(&cfg->d11inf,
 890                                                        request->channels[i]);
 891                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 892                                   request->channels[i]->hw_value, chanspec);
 893                         params_le->channel_list[i] = cpu_to_le16(chanspec);
 894                 }
 895         } else {
 896                 brcmf_dbg(SCAN, "Scanning all channels\n");
 897         }
 898         /* Copy ssid array if applicable */
 899         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
 900         if (n_ssids > 0) {
 901                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
 902                                 n_channels * sizeof(u16);
 903                 offset = roundup(offset, sizeof(u32));
 904                 ptr = (char *)params_le + offset;
 905                 for (i = 0; i < n_ssids; i++) {
 906                         memset(&ssid_le, 0, sizeof(ssid_le));
 907                         ssid_le.SSID_len =
 908                                         cpu_to_le32(request->ssids[i].ssid_len);
 909                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
 910                                request->ssids[i].ssid_len);
 911                         if (!ssid_le.SSID_len)
 912                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
 913                         else
 914                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
 915                                           i, ssid_le.SSID, ssid_le.SSID_len);
 916                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
 917                         ptr += sizeof(ssid_le);
 918                 }
 919         } else {
 920                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
 921                 if ((request->ssids) && request->ssids->ssid_len) {
 922                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
 923                                   params_le->ssid_le.SSID,
 924                                   request->ssids->ssid_len);
 925                         params_le->ssid_le.SSID_len =
 926                                 cpu_to_le32(request->ssids->ssid_len);
 927                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
 928                                 request->ssids->ssid_len);
 929                 }
 930         }
 931         /* Adding mask to channel numbers */
 932         params_le->channel_num =
 933                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
 934                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
 935 }
 936
 937 static s32
 938 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
 939                 struct cfg80211_scan_request *request, u16 action)
 940 {
 941         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
 942                           offsetof(struct brcmf_escan_params_le, params_le);
 943         struct brcmf_escan_params_le *params;
 944         s32 err = 0;
 945
 946         brcmf_dbg(SCAN, "E-SCAN START\n");
 947
 948         if (request != NULL) {
 949                 /* Allocate space for populating ssids in struct */
 950                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
 951
 952                 /* Allocate space for populating ssids in struct */
 953                 params_size += sizeof(struct brcmf_ssid) * request->n_ssids;
 954         }
 955
 956         params = kzalloc(params_size, GFP_KERNEL);
 957         if (!params) {
 958                 err = -ENOMEM;
 959                 goto exit;
 960         }
 961         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
 962         brcmf_escan_prep(cfg, &params->params_le, request);
 963         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
 964         params->action = cpu_to_le16(action);
 965         params->sync_id = cpu_to_le16(0x1234);
 966
 967         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
 968         if (err) {
 969                 if (err == -EBUSY)
 970                         brcmf_dbg(INFO, "system busy : escan canceled\n");
 971                 else
 972                         brcmf_err("error (%d)\n", err);
 973         }
 974
 975         kfree(params);
 976 exit:
 977         return err;
 978 }
 979
 980 static s32
 981 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
 982                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
 983 {
 984         s32 err;
 985         u32 passive_scan;
 986         struct brcmf_scan_results *results;
 987         struct escan_info *escan = &cfg->escan_info;
 988
 989         brcmf_dbg(SCAN, "Enter\n");
 990         escan->ifp = ifp;
 991         escan->wiphy = wiphy;
 992         escan->escan_state = WL_ESCAN_STATE_SCANNING;
 993         passive_scan = cfg->active_scan ? 0 : 1;
 994         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
 995                                     passive_scan);
 996         if (err) {
 997                 brcmf_err("error (%d)\n", err);
 998                 return err;
 999         }
1000         brcmf_scan_config_mpc(ifp, 0);
1001         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1002         results->version = 0;
1003         results->count = 0;
1004         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1005
1006         err = escan->run(cfg, ifp, request, WL_ESCAN_ACTION_START);
1007         if (err)
1008                 brcmf_scan_config_mpc(ifp, 1);
1009         return err;
1010 }
1011
1012 static s32
1013 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1014                      struct cfg80211_scan_request *request,
1015                      struct cfg80211_ssid *this_ssid)
1016 {
1017         struct brcmf_if *ifp = vif->ifp;
1018         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1019         struct cfg80211_ssid *ssids;
1020         struct brcmf_cfg80211_scan_req *sr = &cfg->scan_req_int;
1021         u32 passive_scan;
1022         bool escan_req;
1023         bool spec_scan;
1024         s32 err;
1025         u32 SSID_len;
1026
1027         brcmf_dbg(SCAN, "START ESCAN\n");
1028
1029         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1030                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1031                 return -EAGAIN;
1032         }
1033         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1034                 brcmf_err("Scanning being aborted: status (%lu)\n",
1035                           cfg->scan_status);
1036                 return -EAGAIN;
1037         }
1038         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1039                 brcmf_err("Scanning suppressed: status (%lu)\n",
1040                           cfg->scan_status);
1041                 return -EAGAIN;
1042         }
1043         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1044                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1045                 return -EAGAIN;
1046         }
1047
1048         /* If scan req comes for p2p0, send it over primary I/F */
1049         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1050                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1051
1052         /* Arm scan timeout timer */
1053         mod_timer(&cfg->escan_timeout, jiffies +
1054                         WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1055
1056         escan_req = false;
1057         if (request) {
1058                 /* scan bss */
1059                 ssids = request->ssids;
1060                 escan_req = true;
1061         } else {
1062                 /* scan in ibss */
1063                 /* we don't do escan in ibss */
1064                 ssids = this_ssid;
1065         }
1066
1067         cfg->scan_request = request;
1068         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1069         if (escan_req) {
1070                 cfg->escan_info.run = brcmf_run_escan;
1071                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1072                 if (err)
1073                         goto scan_out;
1074
1075                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1076                 if (err)
1077                         goto scan_out;
1078         } else {
1079                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1080                           ssids->ssid, ssids->ssid_len);
1081                 memset(&sr->ssid_le, 0, sizeof(sr->ssid_le));
1082                 SSID_len = min_t(u8, sizeof(sr->ssid_le.SSID), ssids->ssid_len);
1083                 sr->ssid_le.SSID_len = cpu_to_le32(0);
1084                 spec_scan = false;
1085                 if (SSID_len) {
1086                         memcpy(sr->ssid_le.SSID, ssids->ssid, SSID_len);
1087                         sr->ssid_le.SSID_len = cpu_to_le32(SSID_len);
1088                         spec_scan = true;
1089                 } else
1090                         brcmf_dbg(SCAN, "Broadcast scan\n");
1091
1092                 passive_scan = cfg->active_scan ? 0 : 1;
1093                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1094                                             passive_scan);
1095                 if (err) {
1096                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1097                         goto scan_out;
1098                 }
1099                 brcmf_scan_config_mpc(ifp, 0);
1100                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1101                                              &sr->ssid_le, sizeof(sr->ssid_le));
1102                 if (err) {
1103                         if (err == -EBUSY)
1104                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1105                                           sr->ssid_le.SSID);
1106                         else
1107                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1108
1109                         brcmf_scan_config_mpc(ifp, 1);
1110                         goto scan_out;
1111                 }
1112         }
1113
1114         return 0;
1115
1116 scan_out:
1117         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1118         if (timer_pending(&cfg->escan_timeout))
1119                 del_timer_sync(&cfg->escan_timeout);
1120         cfg->scan_request = NULL;
1121         return err;
1122 }
1123
1124 static s32
1125 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1126 {
1127         struct brcmf_cfg80211_vif *vif;
1128         s32 err = 0;
1129
1130         brcmf_dbg(TRACE, "Enter\n");
1131         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1132         if (!check_vif_up(vif))
1133                 return -EIO;
1134
1135         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1136
1137         if (err)
1138                 brcmf_err("scan error (%d)\n", err);
1139
1140         brcmf_dbg(TRACE, "Exit\n");
1141         return err;
1142 }
1143
1144 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1145 {
1146         s32 err = 0;
1147
1148         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1149                                       rts_threshold);
1150         if (err)
1151                 brcmf_err("Error (%d)\n", err);
1152
1153         return err;
1154 }
1155
1156 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1157 {
1158         s32 err = 0;
1159
1160         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1161                                       frag_threshold);
1162         if (err)
1163                 brcmf_err("Error (%d)\n", err);
1164
1165         return err;
1166 }
1167
1168 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1169 {
1170         s32 err = 0;
1171         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1172
1173         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1174         if (err) {
1175                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1176                 return err;
1177         }
1178         return err;
1179 }
1180
1181 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1182 {
1183         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1184         struct net_device *ndev = cfg_to_ndev(cfg);
1185         struct brcmf_if *ifp = netdev_priv(ndev);
1186         s32 err = 0;
1187
1188         brcmf_dbg(TRACE, "Enter\n");
1189         if (!check_vif_up(ifp->vif))
1190                 return -EIO;
1191
1192         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1193             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1194                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1195                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1196                 if (!err)
1197                         goto done;
1198         }
1199         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1200             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1201                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1202                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1203                 if (!err)
1204                         goto done;
1205         }
1206         if (changed & WIPHY_PARAM_RETRY_LONG
1207             && (cfg->conf->retry_long != wiphy->retry_long)) {
1208                 cfg->conf->retry_long = wiphy->retry_long;
1209                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1210                 if (!err)
1211                         goto done;
1212         }
1213         if (changed & WIPHY_PARAM_RETRY_SHORT
1214             && (cfg->conf->retry_short != wiphy->retry_short)) {
1215                 cfg->conf->retry_short = wiphy->retry_short;
1216                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1217                 if (!err)
1218                         goto done;
1219         }
1220
1221 done:
1222         brcmf_dbg(TRACE, "Exit\n");
1223         return err;
1224 }
1225
1226 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1227 {
1228         memset(prof, 0, sizeof(*prof));
1229 }
1230
1231 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
1232 {
1233         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1234         s32 err = 0;
1235
1236         brcmf_dbg(TRACE, "Enter\n");
1237
1238         if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1239                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1240                 err = brcmf_fil_cmd_data_set(vif->ifp,
1241                                              BRCMF_C_DISASSOC, NULL, 0);
1242                 if (err) {
1243                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1244                 }
1245                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
1246                 cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
1247
1248         }
1249         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1250         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1251         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1252         brcmf_dbg(TRACE, "Exit\n");
1253 }
1254
1255 static s32
1256 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1257                       struct cfg80211_ibss_params *params)
1258 {
1259         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1260         struct brcmf_if *ifp = netdev_priv(ndev);
1261         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1262         struct brcmf_join_params join_params;
1263         size_t join_params_size = 0;
1264         s32 err = 0;
1265         s32 wsec = 0;
1266         s32 bcnprd;
1267         u16 chanspec;
1268
1269         brcmf_dbg(TRACE, "Enter\n");
1270         if (!check_vif_up(ifp->vif))
1271                 return -EIO;
1272
1273         if (params->ssid)
1274                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1275         else {
1276                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1277                 return -EOPNOTSUPP;
1278         }
1279
1280         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1281
1282         if (params->bssid)
1283                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1284         else
1285                 brcmf_dbg(CONN, "No BSSID specified\n");
1286
1287         if (params->chandef.chan)
1288                 brcmf_dbg(CONN, "channel: %d\n",
1289                           params->chandef.chan->center_freq);
1290         else
1291                 brcmf_dbg(CONN, "no channel specified\n");
1292
1293         if (params->channel_fixed)
1294                 brcmf_dbg(CONN, "fixed channel required\n");
1295         else
1296                 brcmf_dbg(CONN, "no fixed channel required\n");
1297
1298         if (params->ie && params->ie_len)
1299                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1300         else
1301                 brcmf_dbg(CONN, "no ie specified\n");
1302
1303         if (params->beacon_interval)
1304                 brcmf_dbg(CONN, "beacon interval: %d\n",
1305                           params->beacon_interval);
1306         else
1307                 brcmf_dbg(CONN, "no beacon interval specified\n");
1308
1309         if (params->basic_rates)
1310                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1311         else
1312                 brcmf_dbg(CONN, "no basic rates specified\n");
1313
1314         if (params->privacy)
1315                 brcmf_dbg(CONN, "privacy required\n");
1316         else
1317                 brcmf_dbg(CONN, "no privacy required\n");
1318
1319         /* Configure Privacy for starter */
1320         if (params->privacy)
1321                 wsec |= WEP_ENABLED;
1322
1323         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1324         if (err) {
1325                 brcmf_err("wsec failed (%d)\n", err);
1326                 goto done;
1327         }
1328
1329         /* Configure Beacon Interval for starter */
1330         if (params->beacon_interval)
1331                 bcnprd = params->beacon_interval;
1332         else
1333                 bcnprd = 100;
1334
1335         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1336         if (err) {
1337                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1338                 goto done;
1339         }
1340
1341         /* Configure required join parameter */
1342         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1343
1344         /* SSID */
1345         profile->ssid.SSID_len = min_t(u32, params->ssid_len, 32);
1346         memcpy(profile->ssid.SSID, params->ssid, profile->ssid.SSID_len);
1347         memcpy(join_params.ssid_le.SSID, params->ssid, profile->ssid.SSID_len);
1348         join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1349         join_params_size = sizeof(join_params.ssid_le);
1350
1351         /* BSSID */
1352         if (params->bssid) {
1353                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1354                 join_params_size = sizeof(join_params.ssid_le) +
1355                                    BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1356                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1357         } else {
1358                 memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
1359                 memset(profile->bssid, 0, ETH_ALEN);
1360         }
1361
1362         /* Channel */
1363         if (params->chandef.chan) {
1364                 u32 target_channel;
1365
1366                 cfg->channel =
1367                         ieee80211_frequency_to_channel(
1368                                 params->chandef.chan->center_freq);
1369                 if (params->channel_fixed) {
1370                         /* adding chanspec */
1371                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1372                                                        &params->chandef);
1373                         join_params.params_le.chanspec_list[0] =
1374                                 cpu_to_le16(chanspec);
1375                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1376                         join_params_size += sizeof(join_params.params_le);
1377                 }
1378
1379                 /* set channel for starter */
1380                 target_channel = cfg->channel;
1381                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1382                                             target_channel);
1383                 if (err) {
1384                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1385                         goto done;
1386                 }
1387         } else
1388                 cfg->channel = 0;
1389
1390         cfg->ibss_starter = false;
1391
1392
1393         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1394                                      &join_params, join_params_size);
1395         if (err) {
1396                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1397                 goto done;
1398         }
1399
1400 done:
1401         if (err)
1402                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1403         brcmf_dbg(TRACE, "Exit\n");
1404         return err;
1405 }
1406
1407 static s32
1408 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1409 {
1410         struct brcmf_if *ifp = netdev_priv(ndev);
1411
1412         brcmf_dbg(TRACE, "Enter\n");
1413         if (!check_vif_up(ifp->vif))
1414                 return -EIO;
1415
1416         brcmf_link_down(ifp->vif);
1417
1418         brcmf_dbg(TRACE, "Exit\n");
1419
1420         return 0;
1421 }
1422
1423 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1424                                  struct cfg80211_connect_params *sme)
1425 {
1426         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1427         struct brcmf_cfg80211_security *sec;
1428         s32 val = 0;
1429         s32 err = 0;
1430
1431         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1432                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1433         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1434                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1435         else
1436                 val = WPA_AUTH_DISABLED;
1437         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1438         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1439         if (err) {
1440                 brcmf_err("set wpa_auth failed (%d)\n", err);
1441                 return err;
1442         }
1443         sec = &profile->sec;
1444         sec->wpa_versions = sme->crypto.wpa_versions;
1445         return err;
1446 }
1447
1448 static s32 brcmf_set_auth_type(struct net_device *ndev,
1449                                struct cfg80211_connect_params *sme)
1450 {
1451         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1452         struct brcmf_cfg80211_security *sec;
1453         s32 val = 0;
1454         s32 err = 0;
1455
1456         switch (sme->auth_type) {
1457         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1458                 val = 0;
1459                 brcmf_dbg(CONN, "open system\n");
1460                 break;
1461         case NL80211_AUTHTYPE_SHARED_KEY:
1462                 val = 1;
1463                 brcmf_dbg(CONN, "shared key\n");
1464                 break;
1465         case NL80211_AUTHTYPE_AUTOMATIC:
1466                 val = 2;
1467                 brcmf_dbg(CONN, "automatic\n");
1468                 break;
1469         case NL80211_AUTHTYPE_NETWORK_EAP:
1470                 brcmf_dbg(CONN, "network eap\n");
1471         default:
1472                 val = 2;
1473                 brcmf_err("invalid auth type (%d)\n", sme->auth_type);
1474                 break;
1475         }
1476
1477         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1478         if (err) {
1479                 brcmf_err("set auth failed (%d)\n", err);
1480                 return err;
1481         }
1482         sec = &profile->sec;
1483         sec->auth_type = sme->auth_type;
1484         return err;
1485 }
1486
1487 static s32
1488 brcmf_set_wsec_mode(struct net_device *ndev,
1489                      struct cfg80211_connect_params *sme, bool mfp)
1490 {
1491         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1492         struct brcmf_cfg80211_security *sec;
1493         s32 pval = 0;
1494         s32 gval = 0;
1495         s32 wsec;
1496         s32 err = 0;
1497
1498         if (sme->crypto.n_ciphers_pairwise) {
1499                 switch (sme->crypto.ciphers_pairwise[0]) {
1500                 case WLAN_CIPHER_SUITE_WEP40:
1501                 case WLAN_CIPHER_SUITE_WEP104:
1502                         pval = WEP_ENABLED;
1503                         break;
1504                 case WLAN_CIPHER_SUITE_TKIP:
1505                         pval = TKIP_ENABLED;
1506                         break;
1507                 case WLAN_CIPHER_SUITE_CCMP:
1508                         pval = AES_ENABLED;
1509                         break;
1510                 case WLAN_CIPHER_SUITE_AES_CMAC:
1511                         pval = AES_ENABLED;
1512                         break;
1513                 default:
1514                         brcmf_err("invalid cipher pairwise (%d)\n",
1515                                   sme->crypto.ciphers_pairwise[0]);
1516                         return -EINVAL;
1517                 }
1518         }
1519         if (sme->crypto.cipher_group) {
1520                 switch (sme->crypto.cipher_group) {
1521                 case WLAN_CIPHER_SUITE_WEP40:
1522                 case WLAN_CIPHER_SUITE_WEP104:
1523                         gval = WEP_ENABLED;
1524                         break;
1525                 case WLAN_CIPHER_SUITE_TKIP:
1526                         gval = TKIP_ENABLED;
1527                         break;
1528                 case WLAN_CIPHER_SUITE_CCMP:
1529                         gval = AES_ENABLED;
1530                         break;
1531                 case WLAN_CIPHER_SUITE_AES_CMAC:
1532                         gval = AES_ENABLED;
1533                         break;
1534                 default:
1535                         brcmf_err("invalid cipher group (%d)\n",
1536                                   sme->crypto.cipher_group);
1537                         return -EINVAL;
1538                 }
1539         }
1540
1541         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1542         /* In case of privacy, but no security and WPS then simulate */
1543         /* setting AES. WPS-2.0 allows no security                   */
1544         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1545             sme->privacy)
1546                 pval = AES_ENABLED;
1547
1548         if (mfp)
1549                 wsec = pval | gval | MFP_CAPABLE;
1550         else
1551                 wsec = pval | gval;
1552         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1553         if (err) {
1554                 brcmf_err("error (%d)\n", err);
1555                 return err;
1556         }
1557
1558         sec = &profile->sec;
1559         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1560         sec->cipher_group = sme->crypto.cipher_group;
1561
1562         return err;
1563 }
1564
1565 static s32
1566 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1567 {
1568         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1569         struct brcmf_cfg80211_security *sec;
1570         s32 val = 0;
1571         s32 err = 0;
1572
1573         if (sme->crypto.n_akm_suites) {
1574                 err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
1575                                                "wpa_auth", &val);
1576                 if (err) {
1577                         brcmf_err("could not get wpa_auth (%d)\n", err);
1578                         return err;
1579                 }
1580                 if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1581                         switch (sme->crypto.akm_suites[0]) {
1582                         case WLAN_AKM_SUITE_8021X:
1583                                 val = WPA_AUTH_UNSPECIFIED;
1584                                 break;
1585                         case WLAN_AKM_SUITE_PSK:
1586                                 val = WPA_AUTH_PSK;
1587                                 break;
1588                         default:
1589                                 brcmf_err("invalid cipher group (%d)\n",
1590                                           sme->crypto.cipher_group);
1591                                 return -EINVAL;
1592                         }
1593                 } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1594                         switch (sme->crypto.akm_suites[0]) {
1595                         case WLAN_AKM_SUITE_8021X:
1596                                 val = WPA2_AUTH_UNSPECIFIED;
1597                                 break;
1598                         case WLAN_AKM_SUITE_PSK:
1599                                 val = WPA2_AUTH_PSK;
1600                                 break;
1601                         default:
1602                                 brcmf_err("invalid cipher group (%d)\n",
1603                                           sme->crypto.cipher_group);
1604                                 return -EINVAL;
1605                         }
1606                 }
1607
1608                 brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1609                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
1610                                                "wpa_auth", val);
1611                 if (err) {
1612                         brcmf_err("could not set wpa_auth (%d)\n", err);
1613                         return err;
1614                 }
1615         }
1616         sec = &profile->sec;
1617         sec->wpa_auth = sme->crypto.akm_suites[0];
1618
1619         return err;
1620 }
1621
1622 static s32
1623 brcmf_set_sharedkey(struct net_device *ndev,
1624                     struct cfg80211_connect_params *sme)
1625 {
1626         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1627         struct brcmf_cfg80211_security *sec;
1628         struct brcmf_wsec_key key;
1629         s32 val;
1630         s32 err = 0;
1631
1632         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1633
1634         if (sme->key_len == 0)
1635                 return 0;
1636
1637         sec = &profile->sec;
1638         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1639                   sec->wpa_versions, sec->cipher_pairwise);
1640
1641         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1642                 return 0;
1643
1644         if (!(sec->cipher_pairwise &
1645             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1646                 return 0;
1647
1648         memset(&key, 0, sizeof(key));
1649         key.len = (u32) sme->key_len;
1650         key.index = (u32) sme->key_idx;
1651         if (key.len > sizeof(key.data)) {
1652                 brcmf_err("Too long key length (%u)\n", key.len);
1653                 return -EINVAL;
1654         }
1655         memcpy(key.data, sme->key, key.len);
1656         key.flags = BRCMF_PRIMARY_KEY;
1657         switch (sec->cipher_pairwise) {
1658         case WLAN_CIPHER_SUITE_WEP40:
1659                 key.algo = CRYPTO_ALGO_WEP1;
1660                 break;
1661         case WLAN_CIPHER_SUITE_WEP104:
1662                 key.algo = CRYPTO_ALGO_WEP128;
1663                 break;
1664         default:
1665                 brcmf_err("Invalid algorithm (%d)\n",
1666                           sme->crypto.ciphers_pairwise[0]);
1667                 return -EINVAL;
1668         }
1669         /* Set the new key/index */
1670         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1671                   key.len, key.index, key.algo);
1672         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1673         err = send_key_to_dongle(ndev, &key);
1674         if (err)
1675                 return err;
1676
1677         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1678                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1679                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1680                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1681                 if (err)
1682                         brcmf_err("set auth failed (%d)\n", err);
1683         }
1684         return err;
1685 }
1686
1687 static
1688 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1689                                            enum nl80211_auth_type type)
1690 {
1691         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1692             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1693                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1694                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1695         }
1696         return type;
1697 }
1698
1699 static s32
1700 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1701                        struct cfg80211_connect_params *sme)
1702 {
1703         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1704         struct brcmf_if *ifp = netdev_priv(ndev);
1705         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1706         struct ieee80211_channel *chan = sme->channel;
1707         struct brcmf_join_params join_params;
1708         size_t join_params_size;
1709         const struct brcmf_tlv *rsn_ie;
1710         const struct brcmf_vs_tlv *wpa_ie;
1711         const void *ie;
1712         u32 ie_len;
1713         struct brcmf_ext_join_params_le *ext_join_params;
1714         u16 chanspec;
1715         s32 err = 0;
1716
1717         brcmf_dbg(TRACE, "Enter\n");
1718         if (!check_vif_up(ifp->vif))
1719                 return -EIO;
1720
1721         if (!sme->ssid) {
1722                 brcmf_err("Invalid ssid\n");
1723                 return -EOPNOTSUPP;
1724         }
1725
1726         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1727                 /* A normal (non P2P) connection request setup. */
1728                 ie = NULL;
1729                 ie_len = 0;
1730                 /* find the WPA_IE */
1731                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1732                 if (wpa_ie) {
1733                         ie = wpa_ie;
1734                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1735                 } else {
1736                         /* find the RSN_IE */
1737                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1738                                                   sme->ie_len,
1739                                                   WLAN_EID_RSN);
1740                         if (rsn_ie) {
1741                                 ie = rsn_ie;
1742                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1743                         }
1744                 }
1745                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1746         }
1747
1748         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1749                                     sme->ie, sme->ie_len);
1750         if (err)
1751                 brcmf_err("Set Assoc REQ IE Failed\n");
1752         else
1753                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1754
1755         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1756
1757         if (chan) {
1758                 cfg->channel =
1759                         ieee80211_frequency_to_channel(chan->center_freq);
1760                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1761                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1762                           cfg->channel, chan->center_freq, chanspec);
1763         } else {
1764                 cfg->channel = 0;
1765                 chanspec = 0;
1766         }
1767
1768         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1769
1770         err = brcmf_set_wpa_version(ndev, sme);
1771         if (err) {
1772                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1773                 goto done;
1774         }
1775
1776         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1777         err = brcmf_set_auth_type(ndev, sme);
1778         if (err) {
1779                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1780                 goto done;
1781         }
1782
1783         err = brcmf_set_wsec_mode(ndev, sme, sme->mfp == NL80211_MFP_REQUIRED);
1784         if (err) {
1785                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1786                 goto done;
1787         }
1788
1789         err = brcmf_set_key_mgmt(ndev, sme);
1790         if (err) {
1791                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1792                 goto done;
1793         }
1794
1795         err = brcmf_set_sharedkey(ndev, sme);
1796         if (err) {
1797                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1798                 goto done;
1799         }
1800
1801         profile->ssid.SSID_len = min_t(u32, (u32)sizeof(profile->ssid.SSID),
1802                                        (u32)sme->ssid_len);
1803         memcpy(&profile->ssid.SSID, sme->ssid, profile->ssid.SSID_len);
1804         if (profile->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
1805                 profile->ssid.SSID[profile->ssid.SSID_len] = 0;
1806                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n", profile->ssid.SSID,
1807                           profile->ssid.SSID_len);
1808         }
1809
1810         /* Join with specific BSSID and cached SSID
1811          * If SSID is zero join based on BSSID only
1812          */
1813         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
1814                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
1815         if (cfg->channel)
1816                 join_params_size += sizeof(u16);
1817         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
1818         if (ext_join_params == NULL) {
1819                 err = -ENOMEM;
1820                 goto done;
1821         }
1822         ext_join_params->ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1823         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid,
1824                profile->ssid.SSID_len);
1825
1826         /* Set up join scan parameters */
1827         ext_join_params->scan_le.scan_type = -1;
1828         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
1829
1830         if (sme->bssid)
1831                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
1832         else
1833                 memset(&ext_join_params->assoc_le.bssid, 0xFF, ETH_ALEN);
1834
1835         if (cfg->channel) {
1836                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
1837
1838                 ext_join_params->assoc_le.chanspec_list[0] =
1839                         cpu_to_le16(chanspec);
1840                 /* Increase dwell time to receive probe response or detect
1841                  * beacon from target AP at a noisy air only during connect
1842                  * command.
1843                  */
1844                 ext_join_params->scan_le.active_time =
1845                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
1846                 ext_join_params->scan_le.passive_time =
1847                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
1848                 /* To sync with presence period of VSDB GO send probe request
1849                  * more frequently. Probe request will be stopped when it gets
1850                  * probe response from target AP/GO.
1851                  */
1852                 ext_join_params->scan_le.nprobes =
1853                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
1854                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
1855         } else {
1856                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
1857                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
1858                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
1859         }
1860
1861         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
1862                                          join_params_size);
1863         kfree(ext_join_params);
1864         if (!err)
1865                 /* This is it. join command worked, we are done */
1866                 goto done;
1867
1868         /* join command failed, fallback to set ssid */
1869         memset(&join_params, 0, sizeof(join_params));
1870         join_params_size = sizeof(join_params.ssid_le);
1871
1872         memcpy(&join_params.ssid_le.SSID, sme->ssid, profile->ssid.SSID_len);
1873         join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
1874
1875         if (sme->bssid)
1876                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
1877         else
1878                 memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
1879
1880         if (cfg->channel) {
1881                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
1882                 join_params.params_le.chanspec_num = cpu_to_le32(1);
1883                 join_params_size += sizeof(join_params.params_le);
1884         }
1885         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1886                                      &join_params, join_params_size);
1887         if (err)
1888                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
1889
1890 done:
1891         if (err)
1892                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1893         brcmf_dbg(TRACE, "Exit\n");
1894         return err;
1895 }
1896
1897 static s32
1898 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
1899                        u16 reason_code)
1900 {
1901         struct brcmf_if *ifp = netdev_priv(ndev);
1902         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1903         struct brcmf_scb_val_le scbval;
1904         s32 err = 0;
1905
1906         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
1907         if (!check_vif_up(ifp->vif))
1908                 return -EIO;
1909
1910         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
1911         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1912         cfg80211_disconnected(ndev, reason_code, NULL, 0, GFP_KERNEL);
1913
1914         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
1915         scbval.val = cpu_to_le32(reason_code);
1916         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
1917                                      &scbval, sizeof(scbval));
1918         if (err)
1919                 brcmf_err("error (%d)\n", err);
1920
1921         brcmf_dbg(TRACE, "Exit\n");
1922         return err;
1923 }
1924
1925 static s32
1926 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
1927                             enum nl80211_tx_power_setting type, s32 mbm)
1928 {
1929
1930         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1931         struct net_device *ndev = cfg_to_ndev(cfg);
1932         struct brcmf_if *ifp = netdev_priv(ndev);
1933         u16 txpwrmw;
1934         s32 err = 0;
1935         s32 disable = 0;
1936         s32 dbm = MBM_TO_DBM(mbm);
1937
1938         brcmf_dbg(TRACE, "Enter\n");
1939         if (!check_vif_up(ifp->vif))
1940                 return -EIO;
1941
1942         switch (type) {
1943         case NL80211_TX_POWER_AUTOMATIC:
1944                 break;
1945         case NL80211_TX_POWER_LIMITED:
1946         case NL80211_TX_POWER_FIXED:
1947                 if (dbm < 0) {
1948                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
1949                         err = -EINVAL;
1950                         goto done;
1951                 }
1952                 break;
1953         }
1954         /* Make sure radio is off or on as far as software is concerned */
1955         disable = WL_RADIO_SW_DISABLE << 16;
1956         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
1957         if (err)
1958                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
1959
1960         if (dbm > 0xffff)
1961                 txpwrmw = 0xffff;
1962         else
1963                 txpwrmw = (u16) dbm;
1964         err = brcmf_fil_iovar_int_set(ifp, "qtxpower",
1965                                       (s32)brcmf_mw_to_qdbm(txpwrmw));
1966         if (err)
1967                 brcmf_err("qtxpower error (%d)\n", err);
1968         cfg->conf->tx_power = dbm;
1969
1970 done:
1971         brcmf_dbg(TRACE, "Exit\n");
1972         return err;
1973 }
1974
1975 static s32 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy,
1976                                        struct wireless_dev *wdev,
1977                                        s32 *dbm)
1978 {
1979         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1980         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
1981         s32 txpwrdbm;
1982         u8 result;
1983         s32 err = 0;
1984
1985         brcmf_dbg(TRACE, "Enter\n");
1986         if (!check_vif_up(ifp->vif))
1987                 return -EIO;
1988
1989         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &txpwrdbm);
1990         if (err) {
1991                 brcmf_err("error (%d)\n", err);
1992                 goto done;
1993         }
1994
1995         result = (u8) (txpwrdbm & ~WL_TXPWR_OVERRIDE);
1996         *dbm = (s32) brcmf_qdbm_to_mw(result);
1997
1998 done:
1999         brcmf_dbg(TRACE, "Exit\n");
2000         return err;
2001 }
2002
2003 static s32
2004 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2005                                u8 key_idx, bool unicast, bool multicast)
2006 {
2007         struct brcmf_if *ifp = netdev_priv(ndev);
2008         u32 index;
2009         u32 wsec;
2010         s32 err = 0;
2011
2012         brcmf_dbg(TRACE, "Enter\n");
2013         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2014         if (!check_vif_up(ifp->vif))
2015                 return -EIO;
2016
2017         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2018         if (err) {
2019                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2020                 goto done;
2021         }
2022
2023         if (wsec & WEP_ENABLED) {
2024                 /* Just select a new current key */
2025                 index = key_idx;
2026                 err = brcmf_fil_cmd_int_set(ifp,
2027                                             BRCMF_C_SET_KEY_PRIMARY, index);
2028                 if (err)
2029                         brcmf_err("error (%d)\n", err);
2030         }
2031 done:
2032         brcmf_dbg(TRACE, "Exit\n");
2033         return err;
2034 }
2035
2036 static s32
2037 brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
2038               u8 key_idx, const u8 *mac_addr, struct key_params *params)
2039 {
2040         struct brcmf_if *ifp = netdev_priv(ndev);
2041         struct brcmf_wsec_key key;
2042         s32 err = 0;
2043         u8 keybuf[8];
2044
2045         memset(&key, 0, sizeof(key));
2046         key.index = (u32) key_idx;
2047         /* Instead of bcast for ea address for default wep keys,
2048                  driver needs it to be Null */
2049         if (!is_multicast_ether_addr(mac_addr))
2050                 memcpy((char *)&key.ea, (void *)mac_addr, ETH_ALEN);
2051         key.len = (u32) params->key_len;
2052         /* check for key index change */
2053         if (key.len == 0) {
2054                 /* key delete */
2055                 err = send_key_to_dongle(ndev, &key);
2056                 if (err)
2057                         brcmf_err("key delete error (%d)\n", err);
2058         } else {
2059                 if (key.len > sizeof(key.data)) {
2060                         brcmf_err("Invalid key length (%d)\n", key.len);
2061                         return -EINVAL;
2062                 }
2063
2064                 brcmf_dbg(CONN, "Setting the key index %d\n", key.index);
2065                 memcpy(key.data, params->key, key.len);
2066
2067                 if (!brcmf_is_apmode(ifp->vif) &&
2068                     (params->cipher == WLAN_CIPHER_SUITE_TKIP)) {
2069                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2070                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
2071                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
2072                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
2073                 }
2074
2075                 /* if IW_ENCODE_EXT_RX_SEQ_VALID set */
2076                 if (params->seq && params->seq_len == 6) {
2077                         /* rx iv */
2078                         u8 *ivptr;
2079                         ivptr = (u8 *) params->seq;
2080                         key.rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2081                             (ivptr[3] << 8) | ivptr[2];
2082                         key.rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2083                         key.iv_initialized = true;
2084                 }
2085
2086                 switch (params->cipher) {
2087                 case WLAN_CIPHER_SUITE_WEP40:
2088                         key.algo = CRYPTO_ALGO_WEP1;
2089                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2090                         break;
2091                 case WLAN_CIPHER_SUITE_WEP104:
2092                         key.algo = CRYPTO_ALGO_WEP128;
2093                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2094                         break;
2095                 case WLAN_CIPHER_SUITE_TKIP:
2096                         key.algo = CRYPTO_ALGO_TKIP;
2097                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2098                         break;
2099                 case WLAN_CIPHER_SUITE_AES_CMAC:
2100                         key.algo = CRYPTO_ALGO_AES_CCM;
2101                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2102                         break;
2103                 case WLAN_CIPHER_SUITE_CCMP:
2104                         key.algo = CRYPTO_ALGO_AES_CCM;
2105                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2106                         break;
2107                 default:
2108                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2109                         return -EINVAL;
2110                 }
2111                 err = send_key_to_dongle(ndev, &key);
2112                 if (err)
2113                         brcmf_err("wsec_key error (%d)\n", err);
2114         }
2115         return err;
2116 }
2117
2118 static s32
2119 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2120                     u8 key_idx, bool pairwise, const u8 *mac_addr,
2121                     struct key_params *params)
2122 {
2123         struct brcmf_if *ifp = netdev_priv(ndev);
2124         struct brcmf_wsec_key key;
2125         s32 val;
2126         s32 wsec;
2127         s32 err = 0;
2128         u8 keybuf[8];
2129
2130         brcmf_dbg(TRACE, "Enter\n");
2131         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2132         if (!check_vif_up(ifp->vif))
2133                 return -EIO;
2134
2135         if (mac_addr &&
2136                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2137                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2138                 brcmf_dbg(TRACE, "Exit");
2139                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
2140         }
2141         memset(&key, 0, sizeof(key));
2142
2143         key.len = (u32) params->key_len;
2144         key.index = (u32) key_idx;
2145
2146         if (key.len > sizeof(key.data)) {
2147                 brcmf_err("Too long key length (%u)\n", key.len);
2148                 err = -EINVAL;
2149                 goto done;
2150         }
2151         memcpy(key.data, params->key, key.len);
2152
2153         key.flags = BRCMF_PRIMARY_KEY;
2154         switch (params->cipher) {
2155         case WLAN_CIPHER_SUITE_WEP40:
2156                 key.algo = CRYPTO_ALGO_WEP1;
2157                 val = WEP_ENABLED;
2158                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2159                 break;
2160         case WLAN_CIPHER_SUITE_WEP104:
2161                 key.algo = CRYPTO_ALGO_WEP128;
2162                 val = WEP_ENABLED;
2163                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2164                 break;
2165         case WLAN_CIPHER_SUITE_TKIP:
2166                 if (!brcmf_is_apmode(ifp->vif)) {
2167                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2168                         memcpy(keybuf, &key.data[24], sizeof(keybuf));
2169                         memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
2170                         memcpy(&key.data[16], keybuf, sizeof(keybuf));
2171                 }
2172                 key.algo = CRYPTO_ALGO_TKIP;
2173                 val = TKIP_ENABLED;
2174                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2175                 break;
2176         case WLAN_CIPHER_SUITE_AES_CMAC:
2177                 key.algo = CRYPTO_ALGO_AES_CCM;
2178                 val = AES_ENABLED;
2179                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2180                 break;
2181         case WLAN_CIPHER_SUITE_CCMP:
2182                 key.algo = CRYPTO_ALGO_AES_CCM;
2183                 val = AES_ENABLED;
2184                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2185                 break;
2186         default:
2187                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2188                 err = -EINVAL;
2189                 goto done;
2190         }
2191
2192         err = send_key_to_dongle(ndev, &key);
2193         if (err)
2194                 goto done;
2195
2196         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2197         if (err) {
2198                 brcmf_err("get wsec error (%d)\n", err);
2199                 goto done;
2200         }
2201         wsec |= val;
2202         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2203         if (err) {
2204                 brcmf_err("set wsec error (%d)\n", err);
2205                 goto done;
2206         }
2207
2208 done:
2209         brcmf_dbg(TRACE, "Exit\n");
2210         return err;
2211 }
2212
2213 static s32
2214 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2215                     u8 key_idx, bool pairwise, const u8 *mac_addr)
2216 {
2217         struct brcmf_if *ifp = netdev_priv(ndev);
2218         struct brcmf_wsec_key key;
2219         s32 err = 0;
2220
2221         brcmf_dbg(TRACE, "Enter\n");
2222         if (!check_vif_up(ifp->vif))
2223                 return -EIO;
2224
2225         if (key_idx >= DOT11_MAX_DEFAULT_KEYS) {
2226                 /* we ignore this key index in this case */
2227                 brcmf_err("invalid key index (%d)\n", key_idx);
2228                 return -EINVAL;
2229         }
2230
2231         memset(&key, 0, sizeof(key));
2232
2233         key.index = (u32) key_idx;
2234         key.flags = BRCMF_PRIMARY_KEY;
2235         key.algo = CRYPTO_ALGO_OFF;
2236
2237         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2238
2239         /* Set the new key/index */
2240         err = send_key_to_dongle(ndev, &key);
2241
2242         brcmf_dbg(TRACE, "Exit\n");
2243         return err;
2244 }
2245
2246 static s32
2247 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2248                     u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
2249                     void (*callback) (void *cookie, struct key_params * params))
2250 {
2251         struct key_params params;
2252         struct brcmf_if *ifp = netdev_priv(ndev);
2253         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2254         struct brcmf_cfg80211_security *sec;
2255         s32 wsec;
2256         s32 err = 0;
2257
2258         brcmf_dbg(TRACE, "Enter\n");
2259         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2260         if (!check_vif_up(ifp->vif))
2261                 return -EIO;
2262
2263         memset(&params, 0, sizeof(params));
2264
2265         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2266         if (err) {
2267                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2268                 /* Ignore this error, may happen during DISASSOC */
2269                 err = -EAGAIN;
2270                 goto done;
2271         }
2272         if (wsec & WEP_ENABLED) {
2273                 sec = &profile->sec;
2274                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2275                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2276                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2277                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2278                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2279                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2280                 }
2281         } else if (wsec & TKIP_ENABLED) {
2282                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2283                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2284         } else if (wsec & AES_ENABLED) {
2285                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2286                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2287         } else  {
2288                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2289                 err = -EINVAL;
2290                 goto done;
2291         }
2292         callback(cookie, &params);
2293
2294 done:
2295         brcmf_dbg(TRACE, "Exit\n");
2296         return err;
2297 }
2298
2299 static s32
2300 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2301                                     struct net_device *ndev, u8 key_idx)
2302 {
2303         brcmf_dbg(INFO, "Not supported\n");
2304
2305         return -EOPNOTSUPP;
2306 }
2307
2308 static s32
2309 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2310                            const u8 *mac, struct station_info *sinfo)
2311 {
2312         struct brcmf_if *ifp = netdev_priv(ndev);
2313         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2314         struct brcmf_scb_val_le scb_val;
2315         int rssi;
2316         s32 rate;
2317         s32 err = 0;
2318         u8 *bssid = profile->bssid;
2319         struct brcmf_sta_info_le sta_info_le;
2320         u32 beacon_period;
2321         u32 dtim_period;
2322
2323         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2324         if (!check_vif_up(ifp->vif))
2325                 return -EIO;
2326
2327         if (brcmf_is_apmode(ifp->vif)) {
2328                 memcpy(&sta_info_le, mac, ETH_ALEN);
2329                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2330                                                &sta_info_le,
2331                                                sizeof(sta_info_le));
2332                 if (err < 0) {
2333                         brcmf_err("GET STA INFO failed, %d\n", err);
2334                         goto done;
2335                 }
2336                 sinfo->filled = STATION_INFO_INACTIVE_TIME;
2337                 sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2338                 if (le32_to_cpu(sta_info_le.flags) & BRCMF_STA_ASSOC) {
2339                         sinfo->filled |= STATION_INFO_CONNECTED_TIME;
2340                         sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2341                 }
2342                 brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
2343                           sinfo->inactive_time, sinfo->connected_time);
2344         } else if (ifp->vif->wdev.iftype == NL80211_IFTYPE_STATION) {
2345                 if (memcmp(mac, bssid, ETH_ALEN)) {
2346                         brcmf_err("Wrong Mac address cfg_mac-%pM wl_bssid-%pM\n",
2347                                   mac, bssid);
2348                         err = -ENOENT;
2349                         goto done;
2350                 }
2351                 /* Report the current tx rate */
2352                 err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2353                 if (err) {
2354                         brcmf_err("Could not get rate (%d)\n", err);
2355                         goto done;
2356                 } else {
2357                         sinfo->filled |= STATION_INFO_TX_BITRATE;
2358                         sinfo->txrate.legacy = rate * 5;
2359                         brcmf_dbg(CONN, "Rate %d Mbps\n", rate / 2);
2360                 }
2361
2362                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2363                              &ifp->vif->sme_state)) {
2364                         memset(&scb_val, 0, sizeof(scb_val));
2365                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2366                                                      &scb_val, sizeof(scb_val));
2367                         if (err) {
2368                                 brcmf_err("Could not get rssi (%d)\n", err);
2369                                 goto done;
2370                         } else {
2371                                 rssi = le32_to_cpu(scb_val.val);
2372                                 sinfo->filled |= STATION_INFO_SIGNAL;
2373                                 sinfo->signal = rssi;
2374                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2375                         }
2376                         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_BCNPRD,
2377                                                     &beacon_period);
2378                         if (err) {
2379                                 brcmf_err("Could not get beacon period (%d)\n",
2380                                           err);
2381                                 goto done;
2382                         } else {
2383                                 sinfo->bss_param.beacon_interval =
2384                                         beacon_period;
2385                                 brcmf_dbg(CONN, "Beacon peroid %d\n",
2386                                           beacon_period);
2387                         }
2388                         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_DTIMPRD,
2389                                                     &dtim_period);
2390                         if (err) {
2391                                 brcmf_err("Could not get DTIM period (%d)\n",
2392                                           err);
2393                                 goto done;
2394                         } else {
2395                                 sinfo->bss_param.dtim_period = dtim_period;
2396                                 brcmf_dbg(CONN, "DTIM peroid %d\n",
2397                                           dtim_period);
2398                         }
2399                         sinfo->filled |= STATION_INFO_BSS_PARAM;
2400                 }
2401         } else
2402                 err = -EPERM;
2403 done:
2404         brcmf_dbg(TRACE, "Exit\n");
2405         return err;
2406 }
2407
2408 static s32
2409 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2410                            bool enabled, s32 timeout)
2411 {
2412         s32 pm;
2413         s32 err = 0;
2414         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2415         struct brcmf_if *ifp = netdev_priv(ndev);
2416
2417         brcmf_dbg(TRACE, "Enter\n");
2418
2419         /*
2420          * Powersave enable/disable request is coming from the
2421          * cfg80211 even before the interface is up. In that
2422          * scenario, driver will be storing the power save
2423          * preference in cfg struct to apply this to
2424          * FW later while initializing the dongle
2425          */
2426         cfg->pwr_save = enabled;
2427         if (!check_vif_up(ifp->vif)) {
2428
2429                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2430                 goto done;
2431         }
2432
2433         pm = enabled ? PM_FAST : PM_OFF;
2434         /* Do not enable the power save after assoc if it is a p2p interface */
2435         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2436                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2437                 pm = PM_OFF;
2438         }
2439         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2440
2441         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2442         if (err) {
2443                 if (err == -ENODEV)
2444                         brcmf_err("net_device is not ready yet\n");
2445                 else
2446                         brcmf_err("error (%d)\n", err);
2447         }
2448 done:
2449         brcmf_dbg(TRACE, "Exit\n");
2450         return err;
2451 }
2452
2453 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2454                                    struct brcmf_bss_info_le *bi)
2455 {
2456         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2457         struct ieee80211_channel *notify_channel;
2458         struct cfg80211_bss *bss;
2459         struct ieee80211_supported_band *band;
2460         struct brcmu_chan ch;
2461         u16 channel;
2462         u32 freq;
2463         u16 notify_capability;
2464         u16 notify_interval;
2465         u8 *notify_ie;
2466         size_t notify_ielen;
2467         s32 notify_signal;
2468
2469         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2470                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2471                 return 0;
2472         }
2473
2474         if (!bi->ctl_ch) {
2475                 ch.chspec = le16_to_cpu(bi->chanspec);
2476                 cfg->d11inf.decchspec(&ch);
2477                 bi->ctl_ch = ch.chnum;
2478         }
2479         channel = bi->ctl_ch;
2480
2481         if (channel <= CH_MAX_2G_CHANNEL)
2482                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2483         else
2484                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2485
2486         freq = ieee80211_channel_to_frequency(channel, band->band);
2487         notify_channel = ieee80211_get_channel(wiphy, freq);
2488
2489         notify_capability = le16_to_cpu(bi->capability);
2490         notify_interval = le16_to_cpu(bi->beacon_period);
2491         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2492         notify_ielen = le32_to_cpu(bi->ie_length);
2493         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2494
2495         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2496         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2497         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2498         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2499         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2500
2501         bss = cfg80211_inform_bss(wiphy, notify_channel,
2502                                   CFG80211_BSS_FTYPE_UNKNOWN,
2503                                   (const u8 *)bi->BSSID,
2504                                   0, notify_capability,
2505                                   notify_interval, notify_ie,
2506                                   notify_ielen, notify_signal,
2507                                   GFP_KERNEL);
2508
2509         if (!bss)
2510                 return -ENOMEM;
2511
2512         cfg80211_put_bss(wiphy, bss);
2513
2514         return 0;
2515 }
2516
2517 static struct brcmf_bss_info_le *
2518 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2519 {
2520         if (bss == NULL)
2521                 return list->bss_info_le;
2522         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2523                                             le32_to_cpu(bss->length));
2524 }
2525
2526 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2527 {
2528         struct brcmf_scan_results *bss_list;
2529         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2530         s32 err = 0;
2531         int i;
2532
2533         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2534         if (bss_list->count != 0 &&
2535             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2536                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2537                           bss_list->version);
2538                 return -EOPNOTSUPP;
2539         }
2540         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2541         for (i = 0; i < bss_list->count; i++) {
2542                 bi = next_bss_le(bss_list, bi);
2543                 err = brcmf_inform_single_bss(cfg, bi);
2544                 if (err)
2545                         break;
2546         }
2547         return err;
2548 }
2549
2550 static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
2551                           struct net_device *ndev, const u8 *bssid)
2552 {
2553         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2554         struct ieee80211_channel *notify_channel;
2555         struct brcmf_bss_info_le *bi = NULL;
2556         struct ieee80211_supported_band *band;
2557         struct cfg80211_bss *bss;
2558         struct brcmu_chan ch;
2559         u8 *buf = NULL;
2560         s32 err = 0;
2561         u32 freq;
2562         u16 notify_capability;
2563         u16 notify_interval;
2564         u8 *notify_ie;
2565         size_t notify_ielen;
2566         s32 notify_signal;
2567
2568         brcmf_dbg(TRACE, "Enter\n");
2569
2570         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2571         if (buf == NULL) {
2572                 err = -ENOMEM;
2573                 goto CleanUp;
2574         }
2575
2576         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2577
2578         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2579                                      buf, WL_BSS_INFO_MAX);
2580         if (err) {
2581                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2582                 goto CleanUp;
2583         }
2584
2585         bi = (struct brcmf_bss_info_le *)(buf + 4);
2586
2587         ch.chspec = le16_to_cpu(bi->chanspec);
2588         cfg->d11inf.decchspec(&ch);
2589
2590         if (ch.band == BRCMU_CHAN_BAND_2G)
2591                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
2592         else
2593                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
2594
2595         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
2596         notify_channel = ieee80211_get_channel(wiphy, freq);
2597
2598         notify_capability = le16_to_cpu(bi->capability);
2599         notify_interval = le16_to_cpu(bi->beacon_period);
2600         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2601         notify_ielen = le32_to_cpu(bi->ie_length);
2602         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2603
2604         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.chnum, freq);
2605         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2606         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2607         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2608
2609         bss = cfg80211_inform_bss(wiphy, notify_channel,
2610                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2611                                   notify_capability, notify_interval,
2612                                   notify_ie, notify_ielen, notify_signal,
2613                                   GFP_KERNEL);
2614
2615         if (!bss) {
2616                 err = -ENOMEM;
2617                 goto CleanUp;
2618         }
2619
2620         cfg80211_put_bss(wiphy, bss);
2621
2622 CleanUp:
2623
2624         kfree(buf);
2625
2626         brcmf_dbg(TRACE, "Exit\n");
2627
2628         return err;
2629 }
2630
2631 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2632                                  struct brcmf_if *ifp)
2633 {
2634         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ifp->ndev);
2635         struct brcmf_bss_info_le *bi;
2636         struct brcmf_ssid *ssid;
2637         const struct brcmf_tlv *tim;
2638         u16 beacon_interval;
2639         u8 dtim_period;
2640         size_t ie_len;
2641         u8 *ie;
2642         s32 err = 0;
2643
2644         brcmf_dbg(TRACE, "Enter\n");
2645         if (brcmf_is_ibssmode(ifp->vif))
2646                 return err;
2647
2648         ssid = &profile->ssid;
2649
2650         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2651         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2652                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2653         if (err) {
2654                 brcmf_err("Could not get bss info %d\n", err);
2655                 goto update_bss_info_out;
2656         }
2657
2658         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2659         err = brcmf_inform_single_bss(cfg, bi);
2660         if (err)
2661                 goto update_bss_info_out;
2662
2663         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2664         ie_len = le32_to_cpu(bi->ie_length);
2665         beacon_interval = le16_to_cpu(bi->beacon_period);
2666
2667         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2668         if (tim)
2669                 dtim_period = tim->data[1];
2670         else {
2671                 /*
2672                 * active scan was done so we could not get dtim
2673                 * information out of probe response.
2674                 * so we speficially query dtim information to dongle.
2675                 */
2676                 u32 var;
2677                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2678                 if (err) {
2679                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2680                         goto update_bss_info_out;
2681                 }
2682                 dtim_period = (u8)var;
2683         }
2684
2685 update_bss_info_out:
2686         brcmf_dbg(TRACE, "Exit");
2687         return err;
2688 }
2689
2690 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
2691 {
2692         struct escan_info *escan = &cfg->escan_info;
2693
2694         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2695         if (cfg->scan_request) {
2696                 escan->escan_state = WL_ESCAN_STATE_IDLE;
2697                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
2698         }
2699         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
2700         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
2701 }
2702
2703 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
2704 {
2705         struct brcmf_cfg80211_info *cfg =
2706                         container_of(work, struct brcmf_cfg80211_info,
2707                                      escan_timeout_work);
2708
2709         brcmf_inform_bss(cfg);
2710         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
2711 }
2712
2713 static void brcmf_escan_timeout(unsigned long data)
2714 {
2715         struct brcmf_cfg80211_info *cfg =
2716                         (struct brcmf_cfg80211_info *)data;
2717
2718         if (cfg->scan_request) {
2719                 brcmf_err("timer expired\n");
2720                 schedule_work(&cfg->escan_timeout_work);
2721         }
2722 }
2723
2724 static s32
2725 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
2726                               struct brcmf_bss_info_le *bss,
2727                               struct brcmf_bss_info_le *bss_info_le)
2728 {
2729         struct brcmu_chan ch_bss, ch_bss_info_le;
2730
2731         ch_bss.chspec = le16_to_cpu(bss->chanspec);
2732         cfg->d11inf.decchspec(&ch_bss);
2733         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
2734         cfg->d11inf.decchspec(&ch_bss_info_le);
2735
2736         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
2737                 ch_bss.band == ch_bss_info_le.band &&
2738                 bss_info_le->SSID_len == bss->SSID_len &&
2739                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
2740                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
2741                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
2742                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
2743                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
2744
2745                         /* preserve max RSSI if the measurements are
2746                         * both on-channel or both off-channel
2747                         */
2748                         if (bss_info_rssi > bss_rssi)
2749                                 bss->RSSI = bss_info_le->RSSI;
2750                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
2751                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
2752                         /* preserve the on-channel rssi measurement
2753                         * if the new measurement is off channel
2754                         */
2755                         bss->RSSI = bss_info_le->RSSI;
2756                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
2757                 }
2758                 return 1;
2759         }
2760         return 0;
2761 }
2762
2763 static s32
2764 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
2765                              const struct brcmf_event_msg *e, void *data)
2766 {
2767         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
2768         s32 status;
2769         struct brcmf_escan_result_le *escan_result_le;
2770         struct brcmf_bss_info_le *bss_info_le;
2771         struct brcmf_bss_info_le *bss = NULL;
2772         u32 bi_length;
2773         struct brcmf_scan_results *list;
2774         u32 i;
2775         bool aborted;
2776
2777         status = e->status;
2778
2779         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
2780                 brcmf_err("scan not ready, bssidx=%d\n", ifp->bssidx);
2781                 return -EPERM;
2782         }
2783
2784         if (status == BRCMF_E_STATUS_PARTIAL) {
2785                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
2786                 escan_result_le = (struct brcmf_escan_result_le *) data;
2787                 if (!escan_result_le) {
2788                         brcmf_err("Invalid escan result (NULL pointer)\n");
2789                         goto exit;
2790                 }
2791                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
2792                         brcmf_err("Invalid bss_count %d: ignoring\n",
2793                                   escan_result_le->bss_count);
2794                         goto exit;
2795                 }
2796                 bss_info_le = &escan_result_le->bss_info_le;
2797
2798                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
2799                         goto exit;
2800
2801                 if (!cfg->scan_request) {
2802                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
2803                         goto exit;
2804                 }
2805
2806                 bi_length = le32_to_cpu(bss_info_le->length);
2807                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
2808                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
2809                         brcmf_err("Invalid bss_info length %d: ignoring\n",
2810                                   bi_length);
2811                         goto exit;
2812                 }
2813
2814                 if (!(cfg_to_wiphy(cfg)->interface_modes &
2815                                         BIT(NL80211_IFTYPE_ADHOC))) {
2816                         if (le16_to_cpu(bss_info_le->capability) &
2817                                                 WLAN_CAPABILITY_IBSS) {
2818                                 brcmf_err("Ignoring IBSS result\n");
2819                                 goto exit;
2820                         }
2821                 }
2822
2823                 list = (struct brcmf_scan_results *)
2824                                 cfg->escan_info.escan_buf;
2825                 if (bi_length > WL_ESCAN_BUF_SIZE - list->buflen) {
2826                         brcmf_err("Buffer is too small: ignoring\n");
2827                         goto exit;
2828                 }
2829
2830                 for (i = 0; i < list->count; i++) {
2831                         bss = bss ? (struct brcmf_bss_info_le *)
2832                                 ((unsigned char *)bss +
2833                                 le32_to_cpu(bss->length)) : list->bss_info_le;
2834                         if (brcmf_compare_update_same_bss(cfg, bss,
2835                                                           bss_info_le))
2836                                 goto exit;
2837                 }
2838                 memcpy(&(cfg->escan_info.escan_buf[list->buflen]),
2839                         bss_info_le, bi_length);
2840                 list->version = le32_to_cpu(bss_info_le->version);
2841                 list->buflen += bi_length;
2842                 list->count++;
2843         } else {
2844                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
2845                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
2846                         goto exit;
2847                 if (cfg->scan_request) {
2848                         brcmf_inform_bss(cfg);
2849                         aborted = status != BRCMF_E_STATUS_SUCCESS;
2850                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
2851                 } else
2852                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
2853                                   status);
2854         }
2855 exit:
2856         return 0;
2857 }
2858
2859 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
2860 {
2861         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
2862                             brcmf_cfg80211_escan_handler);
2863         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
2864         /* Init scan_timeout timer */
2865         init_timer(&cfg->escan_timeout);
2866         cfg->escan_timeout.data = (unsigned long) cfg;
2867         cfg->escan_timeout.function = brcmf_escan_timeout;
2868         INIT_WORK(&cfg->escan_timeout_work,
2869                   brcmf_cfg80211_escan_timeout_worker);
2870 }
2871
2872 static __always_inline void brcmf_delay(u32 ms)
2873 {
2874         if (ms < 1000 / HZ) {
2875                 cond_resched();
2876                 mdelay(ms);
2877         } else {
2878                 msleep(ms);
2879         }
2880 }
2881
2882 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
2883                                      u8 *pattern, u32 patternsize, u8 *mask,
2884                                      u32 packet_offset)
2885 {
2886         struct brcmf_fil_wowl_pattern_le *filter;
2887         u32 masksize;
2888         u32 patternoffset;
2889         u8 *buf;
2890         u32 bufsize;
2891         s32 ret;
2892
2893         masksize = (patternsize + 7) / 8;
2894         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
2895
2896         bufsize = sizeof(*filter) + patternsize + masksize;
2897         buf = kzalloc(bufsize, GFP_KERNEL);
2898         if (!buf)
2899                 return -ENOMEM;
2900         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
2901
2902         memcpy(filter->cmd, cmd, 4);
2903         filter->masksize = cpu_to_le32(masksize);
2904         filter->offset = cpu_to_le32(packet_offset);
2905         filter->patternoffset = cpu_to_le32(patternoffset);
2906         filter->patternsize = cpu_to_le32(patternsize);
2907         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
2908
2909         if ((mask) && (masksize))
2910                 memcpy(buf + sizeof(*filter), mask, masksize);
2911         if ((pattern) && (patternsize))
2912                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
2913
2914         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
2915
2916         kfree(buf);
2917         return ret;
2918 }
2919
2920 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
2921 {
2922         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2923         struct net_device *ndev = cfg_to_ndev(cfg);
2924         struct brcmf_if *ifp = netdev_priv(ndev);
2925
2926         brcmf_dbg(TRACE, "Enter\n");
2927
2928         if (cfg->wowl_enabled) {
2929                 brcmf_configure_arp_offload(ifp, true);
2930                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
2931                                       cfg->pre_wowl_pmmode);
2932                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
2933                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
2934                 cfg->wowl_enabled = false;
2935         }
2936         return 0;
2937 }
2938
2939 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
2940                                  struct brcmf_if *ifp,
2941                                  struct cfg80211_wowlan *wowl)
2942 {
2943         u32 wowl_config;
2944         u32 i;
2945
2946         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
2947
2948         brcmf_configure_arp_offload(ifp, false);
2949         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->pre_wowl_pmmode);
2950         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
2951
2952         wowl_config = 0;
2953         if (wowl->disconnect)
2954                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
2955         if (wowl->magic_pkt)
2956                 wowl_config |= BRCMF_WOWL_MAGIC;
2957         if ((wowl->patterns) && (wowl->n_patterns)) {
2958                 wowl_config |= BRCMF_WOWL_NET;
2959                 for (i = 0; i < wowl->n_patterns; i++) {
2960                         brcmf_config_wowl_pattern(ifp, "add",
2961                                 (u8 *)wowl->patterns[i].pattern,
2962                                 wowl->patterns[i].pattern_len,
2963                                 (u8 *)wowl->patterns[i].mask,
2964                                 wowl->patterns[i].pkt_offset);
2965                 }
2966         }
2967         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
2968         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
2969         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
2970         cfg->wowl_enabled = true;
2971 }
2972
2973 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
2974                                   struct cfg80211_wowlan *wowl)
2975 {
2976         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2977         struct net_device *ndev = cfg_to_ndev(cfg);
2978         struct brcmf_if *ifp = netdev_priv(ndev);
2979         struct brcmf_cfg80211_vif *vif;
2980
2981         brcmf_dbg(TRACE, "Enter\n");
2982
2983         /* if the primary net_device is not READY there is nothing
2984          * we can do but pray resume goes smoothly.
2985          */
2986         if (!check_vif_up(ifp->vif))
2987                 goto exit;
2988
2989         /* end any scanning */
2990         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
2991                 brcmf_abort_scanning(cfg);
2992
2993         if (wowl == NULL) {
2994                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
2995                 list_for_each_entry(vif, &cfg->vif_list, list) {
2996                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
2997                                 continue;
2998                         /* While going to suspend if associated with AP
2999                          * disassociate from AP to save power while system is
3000                          * in suspended state
3001                          */
3002                         brcmf_link_down(vif);
3003                         /* Make sure WPA_Supplicant receives all the event
3004                          * generated due to DISASSOC call to the fw to keep
3005                          * the state fw and WPA_Supplicant state consistent
3006                          */
3007                         brcmf_delay(500);
3008                 }
3009                 /* Configure MPC */
3010                 brcmf_set_mpc(ifp, 1);
3011
3012         } else {
3013                 /* Configure WOWL paramaters */
3014                 brcmf_configure_wowl(cfg, ifp, wowl);
3015         }
3016
3017 exit:
3018         brcmf_dbg(TRACE, "Exit\n");
3019         /* clear any scanning activity */
3020         cfg->scan_status = 0;
3021         return 0;
3022 }
3023
3024 static __used s32
3025 brcmf_update_pmklist(struct net_device *ndev,
3026                      struct brcmf_cfg80211_pmk_list *pmk_list, s32 err)
3027 {
3028         int i, j;
3029         u32 pmkid_len;
3030
3031         pmkid_len = le32_to_cpu(pmk_list->pmkids.npmkid);
3032
3033         brcmf_dbg(CONN, "No of elements %d\n", pmkid_len);
3034         for (i = 0; i < pmkid_len; i++) {
3035                 brcmf_dbg(CONN, "PMKID[%d]: %pM =\n", i,
3036                           &pmk_list->pmkids.pmkid[i].BSSID);
3037                 for (j = 0; j < WLAN_PMKID_LEN; j++)
3038                         brcmf_dbg(CONN, "%02x\n",
3039                                   pmk_list->pmkids.pmkid[i].PMKID[j]);
3040         }
3041
3042         if (!err)
3043                 brcmf_fil_iovar_data_set(netdev_priv(ndev), "pmkid_info",
3044                                          (char *)pmk_list, sizeof(*pmk_list));
3045
3046         return err;
3047 }
3048
3049 static s32
3050 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3051                          struct cfg80211_pmksa *pmksa)
3052 {
3053         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3054         struct brcmf_if *ifp = netdev_priv(ndev);
3055         struct pmkid_list *pmkids = &cfg->pmk_list->pmkids;
3056         s32 err = 0;
3057         u32 pmkid_len, i;
3058
3059         brcmf_dbg(TRACE, "Enter\n");
3060         if (!check_vif_up(ifp->vif))
3061                 return -EIO;
3062
3063         pmkid_len = le32_to_cpu(pmkids->npmkid);
3064         for (i = 0; i < pmkid_len; i++)
3065                 if (!memcmp(pmksa->bssid, pmkids->pmkid[i].BSSID, ETH_ALEN))
3066                         break;
3067         if (i < WL_NUM_PMKIDS_MAX) {
3068                 memcpy(pmkids->pmkid[i].BSSID, pmksa->bssid, ETH_ALEN);
3069                 memcpy(pmkids->pmkid[i].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
3070                 if (i == pmkid_len) {
3071                         pmkid_len++;
3072                         pmkids->npmkid = cpu_to_le32(pmkid_len);
3073                 }
3074         } else
3075                 err = -EINVAL;
3076
3077         brcmf_dbg(CONN, "set_pmksa,IW_PMKSA_ADD - PMKID: %pM =\n",
3078                   pmkids->pmkid[pmkid_len].BSSID);
3079         for (i = 0; i < WLAN_PMKID_LEN; i++)
3080                 brcmf_dbg(CONN, "%02x\n", pmkids->pmkid[pmkid_len].PMKID[i]);
3081
3082         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3083
3084         brcmf_dbg(TRACE, "Exit\n");
3085         return err;
3086 }
3087
3088 static s32
3089 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3090                       struct cfg80211_pmksa *pmksa)
3091 {
3092         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3093         struct brcmf_if *ifp = netdev_priv(ndev);
3094         struct pmkid_list pmkid;
3095         s32 err = 0;
3096         u32 pmkid_len, i;
3097
3098         brcmf_dbg(TRACE, "Enter\n");
3099         if (!check_vif_up(ifp->vif))
3100                 return -EIO;
3101
3102         memcpy(&pmkid.pmkid[0].BSSID, pmksa->bssid, ETH_ALEN);
3103         memcpy(&pmkid.pmkid[0].PMKID, pmksa->pmkid, WLAN_PMKID_LEN);
3104
3105         brcmf_dbg(CONN, "del_pmksa,IW_PMKSA_REMOVE - PMKID: %pM =\n",
3106                   &pmkid.pmkid[0].BSSID);
3107         for (i = 0; i < WLAN_PMKID_LEN; i++)
3108                 brcmf_dbg(CONN, "%02x\n", pmkid.pmkid[0].PMKID[i]);
3109
3110         pmkid_len = le32_to_cpu(cfg->pmk_list->pmkids.npmkid);
3111         for (i = 0; i < pmkid_len; i++)
3112                 if (!memcmp
3113                     (pmksa->bssid, &cfg->pmk_list->pmkids.pmkid[i].BSSID,
3114                      ETH_ALEN))
3115                         break;
3116
3117         if ((pmkid_len > 0)
3118             && (i < pmkid_len)) {
3119                 memset(&cfg->pmk_list->pmkids.pmkid[i], 0,
3120                        sizeof(struct pmkid));
3121                 for (; i < (pmkid_len - 1); i++) {
3122                         memcpy(&cfg->pmk_list->pmkids.pmkid[i].BSSID,
3123                                &cfg->pmk_list->pmkids.pmkid[i + 1].BSSID,
3124                                ETH_ALEN);
3125                         memcpy(&cfg->pmk_list->pmkids.pmkid[i].PMKID,
3126                                &cfg->pmk_list->pmkids.pmkid[i + 1].PMKID,
3127                                WLAN_PMKID_LEN);
3128                 }
3129                 cfg->pmk_list->pmkids.npmkid = cpu_to_le32(pmkid_len - 1);
3130         } else
3131                 err = -EINVAL;
3132
3133         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3134
3135         brcmf_dbg(TRACE, "Exit\n");
3136         return err;
3137
3138 }
3139
3140 static s32
3141 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3142 {
3143         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3144         struct brcmf_if *ifp = netdev_priv(ndev);
3145         s32 err = 0;
3146
3147         brcmf_dbg(TRACE, "Enter\n");
3148         if (!check_vif_up(ifp->vif))
3149                 return -EIO;
3150
3151         memset(cfg->pmk_list, 0, sizeof(*cfg->pmk_list));
3152         err = brcmf_update_pmklist(ndev, cfg->pmk_list, err);
3153
3154         brcmf_dbg(TRACE, "Exit\n");
3155         return err;
3156
3157 }
3158
3159 /*
3160  * PFN result doesn't have all the info which are
3161  * required by the supplicant
3162  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3163  * via wl_inform_single_bss in the required format. Escan does require the
3164  * scan request in the form of cfg80211_scan_request. For timebeing, create
3165  * cfg80211_scan_request one out of the received PNO event.
3166  */
3167 static s32
3168 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3169                                 const struct brcmf_event_msg *e, void *data)
3170 {
3171         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3172         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3173         struct cfg80211_scan_request *request = NULL;
3174         struct cfg80211_ssid *ssid = NULL;
3175         struct ieee80211_channel *channel = NULL;
3176         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3177         int err = 0;
3178         int channel_req = 0;
3179         int band = 0;
3180         struct brcmf_pno_scanresults_le *pfn_result;
3181         u32 result_count;
3182         u32 status;
3183
3184         brcmf_dbg(SCAN, "Enter\n");
3185
3186         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3187                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3188                 return 0;
3189         }
3190
3191         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3192         result_count = le32_to_cpu(pfn_result->count);
3193         status = le32_to_cpu(pfn_result->status);
3194
3195         /*
3196          * PFN event is limited to fit 512 bytes so we may get
3197          * multiple NET_FOUND events. For now place a warning here.
3198          */
3199         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3200         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3201         if (result_count > 0) {
3202                 int i;
3203
3204                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3205                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3206                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3207                 if (!request || !ssid || !channel) {
3208                         err = -ENOMEM;
3209                         goto out_err;
3210                 }
3211
3212                 request->wiphy = wiphy;
3213                 data += sizeof(struct brcmf_pno_scanresults_le);
3214                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3215
3216                 for (i = 0; i < result_count; i++) {
3217                         netinfo = &netinfo_start[i];
3218                         if (!netinfo) {
3219                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3220                                           i);
3221                                 err = -EINVAL;
3222                                 goto out_err;
3223                         }
3224
3225                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3226                                   netinfo->SSID, netinfo->channel);
3227                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3228                         ssid[i].ssid_len = netinfo->SSID_len;
3229                         request->n_ssids++;
3230
3231                         channel_req = netinfo->channel;
3232                         if (channel_req <= CH_MAX_2G_CHANNEL)
3233                                 band = NL80211_BAND_2GHZ;
3234                         else
3235                                 band = NL80211_BAND_5GHZ;
3236                         channel[i].center_freq =
3237                                 ieee80211_channel_to_frequency(channel_req,
3238                                                                band);
3239                         channel[i].band = band;
3240                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3241                         request->channels[i] = &channel[i];
3242                         request->n_channels++;
3243                 }
3244
3245                 /* assign parsed ssid array */
3246                 if (request->n_ssids)
3247                         request->ssids = &ssid[0];
3248
3249                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3250                         /* Abort any on-going scan */
3251                         brcmf_abort_scanning(cfg);
3252                 }
3253
3254                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3255                 cfg->escan_info.run = brcmf_run_escan;
3256                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3257                 if (err) {
3258                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3259                         goto out_err;
3260                 }
3261                 cfg->sched_escan = true;
3262                 cfg->scan_request = request;
3263         } else {
3264                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3265                 goto out_err;
3266         }
3267
3268         kfree(ssid);
3269         kfree(channel);
3270         kfree(request);
3271         return 0;
3272
3273 out_err:
3274         kfree(ssid);
3275         kfree(channel);
3276         kfree(request);
3277         cfg80211_sched_scan_stopped(wiphy);
3278         return err;
3279 }
3280
3281 static int brcmf_dev_pno_clean(struct net_device *ndev)
3282 {
3283         int ret;
3284
3285         /* Disable pfn */
3286         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3287         if (ret == 0) {
3288                 /* clear pfn */
3289                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3290                                                NULL, 0);
3291         }
3292         if (ret < 0)
3293                 brcmf_err("failed code %d\n", ret);
3294
3295         return ret;
3296 }
3297
3298 static int brcmf_dev_pno_config(struct net_device *ndev)
3299 {
3300         struct brcmf_pno_param_le pfn_param;
3301
3302         memset(&pfn_param, 0, sizeof(pfn_param));
3303         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3304
3305         /* set extra pno params */
3306         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3307         pfn_param.repeat = BRCMF_PNO_REPEAT;
3308         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3309
3310         /* set up pno scan fr */
3311         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3312
3313         return brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfn_set",
3314                                         &pfn_param, sizeof(pfn_param));
3315 }
3316
3317 static int
3318 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3319                                 struct net_device *ndev,
3320                                 struct cfg80211_sched_scan_request *request)
3321 {
3322         struct brcmf_if *ifp = netdev_priv(ndev);
3323         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3324         struct brcmf_pno_net_param_le pfn;
3325         int i;
3326         int ret = 0;
3327
3328         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3329                   request->n_match_sets, request->n_ssids);
3330         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3331                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3332                 return -EAGAIN;
3333         }
3334         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3335                 brcmf_err("Scanning suppressed: status (%lu)\n",
3336                           cfg->scan_status);
3337                 return -EAGAIN;
3338         }
3339
3340         if (!request->n_ssids || !request->n_match_sets) {
3341                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3342                           request->n_ssids);
3343                 return -EINVAL;
3344         }
3345
3346         if (request->n_ssids > 0) {
3347                 for (i = 0; i < request->n_ssids; i++) {
3348                         /* Active scan req for ssids */
3349                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3350                                   request->ssids[i].ssid);
3351
3352                         /*
3353                          * match_set ssids is a supert set of n_ssid list,
3354                          * so we need not add these set seperately.
3355                          */
3356                 }
3357         }
3358
3359         if (request->n_match_sets > 0) {
3360                 /* clean up everything */
3361                 ret = brcmf_dev_pno_clean(ndev);
3362                 if  (ret < 0) {
3363                         brcmf_err("failed error=%d\n", ret);
3364                         return ret;
3365                 }
3366
3367                 /* configure pno */
3368                 ret = brcmf_dev_pno_config(ndev);
3369                 if (ret < 0) {
3370                         brcmf_err("PNO setup failed!! ret=%d\n", ret);
3371                         return -EINVAL;
3372                 }
3373
3374                 /* configure each match set */
3375                 for (i = 0; i < request->n_match_sets; i++) {
3376                         struct cfg80211_ssid *ssid;
3377                         u32 ssid_len;
3378
3379                         ssid = &request->match_sets[i].ssid;
3380                         ssid_len = ssid->ssid_len;
3381
3382                         if (!ssid_len) {
3383                                 brcmf_err("skip broadcast ssid\n");
3384                                 continue;
3385                         }
3386                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3387                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3388                         pfn.wsec = cpu_to_le32(0);
3389                         pfn.infra = cpu_to_le32(1);
3390                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3391                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3392                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3393                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3394                                                        sizeof(pfn));
3395                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3396                                   ret == 0 ? "set" : "failed", ssid->ssid);
3397                 }
3398                 /* Enable the PNO */
3399                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3400                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3401                         return -EINVAL;
3402                 }
3403         } else {
3404                 return -EINVAL;
3405         }
3406
3407         return 0;
3408 }
3409
3410 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3411                                           struct net_device *ndev)
3412 {
3413         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3414
3415         brcmf_dbg(SCAN, "enter\n");
3416         brcmf_dev_pno_clean(ndev);
3417         if (cfg->sched_escan)
3418                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3419         return 0;
3420 }
3421
3422 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3423 {
3424         s32 err;
3425
3426         /* set auth */
3427         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3428         if (err < 0) {
3429                 brcmf_err("auth error %d\n", err);
3430                 return err;
3431         }
3432         /* set wsec */
3433         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3434         if (err < 0) {
3435                 brcmf_err("wsec error %d\n", err);
3436                 return err;
3437         }
3438         /* set upper-layer auth */
3439         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3440         if (err < 0) {
3441                 brcmf_err("wpa_auth error %d\n", err);
3442                 return err;
3443         }
3444
3445         return 0;
3446 }
3447
3448 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3449 {
3450         if (is_rsn_ie)
3451                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3452
3453         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3454 }
3455
3456 static s32
3457 brcmf_configure_wpaie(struct brcmf_if *ifp,
3458                       const struct brcmf_vs_tlv *wpa_ie,
3459                       bool is_rsn_ie)
3460 {
3461         u32 auth = 0; /* d11 open authentication */
3462         u16 count;
3463         s32 err = 0;
3464         s32 len = 0;
3465         u32 i;
3466         u32 wsec;
3467         u32 pval = 0;
3468         u32 gval = 0;
3469         u32 wpa_auth = 0;
3470         u32 offset;
3471         u8 *data;
3472         u16 rsn_cap;
3473         u32 wme_bss_disable;
3474
3475         brcmf_dbg(TRACE, "Enter\n");
3476         if (wpa_ie == NULL)
3477                 goto exit;
3478
3479         len = wpa_ie->len + TLV_HDR_LEN;
3480         data = (u8 *)wpa_ie;
3481         offset = TLV_HDR_LEN;
3482         if (!is_rsn_ie)
3483                 offset += VS_IE_FIXED_HDR_LEN;
3484         else
3485                 offset += WPA_IE_VERSION_LEN;
3486
3487         /* check for multicast cipher suite */
3488         if (offset + WPA_IE_MIN_OUI_LEN > len) {
3489                 err = -EINVAL;
3490                 brcmf_err("no multicast cipher suite\n");
3491                 goto exit;
3492         }
3493
3494         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3495                 err = -EINVAL;
3496                 brcmf_err("ivalid OUI\n");
3497                 goto exit;
3498         }
3499         offset += TLV_OUI_LEN;
3500
3501         /* pick up multicast cipher */
3502         switch (data[offset]) {
3503         case WPA_CIPHER_NONE:
3504                 gval = 0;
3505                 break;
3506         case WPA_CIPHER_WEP_40:
3507         case WPA_CIPHER_WEP_104:
3508                 gval = WEP_ENABLED;
3509                 break;
3510         case WPA_CIPHER_TKIP:
3511                 gval = TKIP_ENABLED;
3512                 break;
3513         case WPA_CIPHER_AES_CCM:
3514                 gval = AES_ENABLED;
3515                 break;
3516         default:
3517                 err = -EINVAL;
3518                 brcmf_err("Invalid multi cast cipher info\n");
3519                 goto exit;
3520         }
3521
3522         offset++;
3523         /* walk thru unicast cipher list and pick up what we recognize */
3524         count = data[offset] + (data[offset + 1] << 8);
3525         offset += WPA_IE_SUITE_COUNT_LEN;
3526         /* Check for unicast suite(s) */
3527         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3528                 err = -EINVAL;
3529                 brcmf_err("no unicast cipher suite\n");
3530                 goto exit;
3531         }
3532         for (i = 0; i < count; i++) {
3533                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3534                         err = -EINVAL;
3535                         brcmf_err("ivalid OUI\n");
3536                         goto exit;
3537                 }
3538                 offset += TLV_OUI_LEN;
3539                 switch (data[offset]) {
3540                 case WPA_CIPHER_NONE:
3541                         break;
3542                 case WPA_CIPHER_WEP_40:
3543                 case WPA_CIPHER_WEP_104:
3544                         pval |= WEP_ENABLED;
3545                         break;
3546                 case WPA_CIPHER_TKIP:
3547                         pval |= TKIP_ENABLED;
3548                         break;
3549                 case WPA_CIPHER_AES_CCM:
3550                         pval |= AES_ENABLED;
3551                         break;
3552                 default:
3553                         brcmf_err("Ivalid unicast security info\n");
3554                 }
3555                 offset++;
3556         }
3557         /* walk thru auth management suite list and pick up what we recognize */
3558         count = data[offset] + (data[offset + 1] << 8);
3559         offset += WPA_IE_SUITE_COUNT_LEN;
3560         /* Check for auth key management suite(s) */
3561         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
3562                 err = -EINVAL;
3563                 brcmf_err("no auth key mgmt suite\n");
3564                 goto exit;
3565         }
3566         for (i = 0; i < count; i++) {
3567                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
3568                         err = -EINVAL;
3569                         brcmf_err("ivalid OUI\n");
3570                         goto exit;
3571                 }
3572                 offset += TLV_OUI_LEN;
3573                 switch (data[offset]) {
3574                 case RSN_AKM_NONE:
3575                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
3576                         wpa_auth |= WPA_AUTH_NONE;
3577                         break;
3578                 case RSN_AKM_UNSPECIFIED:
3579                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
3580                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
3581                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
3582                         break;
3583                 case RSN_AKM_PSK:
3584                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
3585                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
3586                                     (wpa_auth |= WPA_AUTH_PSK);
3587                         break;
3588                 default:
3589                         brcmf_err("Ivalid key mgmt info\n");
3590                 }
3591                 offset++;
3592         }
3593
3594         if (is_rsn_ie) {
3595                 wme_bss_disable = 1;
3596                 if ((offset + RSN_CAP_LEN) <= len) {
3597                         rsn_cap = data[offset] + (data[offset + 1] << 8);
3598                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
3599                                 wme_bss_disable = 0;
3600                 }
3601                 /* set wme_bss_disable to sync RSN Capabilities */
3602                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
3603                                                wme_bss_disable);
3604                 if (err < 0) {
3605                         brcmf_err("wme_bss_disable error %d\n", err);
3606                         goto exit;
3607                 }
3608         }
3609         /* FOR WPS , set SES_OW_ENABLED */
3610         wsec = (pval | gval | SES_OW_ENABLED);
3611
3612         /* set auth */
3613         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
3614         if (err < 0) {
3615                 brcmf_err("auth error %d\n", err);
3616                 goto exit;
3617         }
3618         /* set wsec */
3619         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3620         if (err < 0) {
3621                 brcmf_err("wsec error %d\n", err);
3622                 goto exit;
3623         }
3624         /* set upper-layer auth */
3625         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
3626         if (err < 0) {
3627                 brcmf_err("wpa_auth error %d\n", err);
3628                 goto exit;
3629         }
3630
3631 exit:
3632         return err;
3633 }
3634
3635 static s32
3636 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
3637                      struct parsed_vndr_ies *vndr_ies)
3638 {
3639         struct brcmf_vs_tlv *vndrie;
3640         struct brcmf_tlv *ie;
3641         struct parsed_vndr_ie_info *parsed_info;
3642         s32 remaining_len;
3643
3644         remaining_len = (s32)vndr_ie_len;
3645         memset(vndr_ies, 0, sizeof(*vndr_ies));
3646
3647         ie = (struct brcmf_tlv *)vndr_ie_buf;
3648         while (ie) {
3649                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
3650                         goto next;
3651                 vndrie = (struct brcmf_vs_tlv *)ie;
3652                 /* len should be bigger than OUI length + one */
3653                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
3654                         brcmf_err("invalid vndr ie. length is too small %d\n",
3655                                   vndrie->len);
3656                         goto next;
3657                 }
3658                 /* if wpa or wme ie, do not add ie */
3659                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
3660                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
3661                     (vndrie->oui_type == WME_OUI_TYPE))) {
3662                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
3663                         goto next;
3664                 }
3665
3666                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
3667
3668                 /* save vndr ie information */
3669                 parsed_info->ie_ptr = (char *)vndrie;
3670                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
3671                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
3672
3673                 vndr_ies->count++;
3674
3675                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
3676                           parsed_info->vndrie.oui[0],
3677                           parsed_info->vndrie.oui[1],
3678                           parsed_info->vndrie.oui[2],
3679                           parsed_info->vndrie.oui_type);
3680
3681                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
3682                         break;
3683 next:
3684                 remaining_len -= (ie->len + TLV_HDR_LEN);
3685                 if (remaining_len <= TLV_HDR_LEN)
3686                         ie = NULL;
3687                 else
3688                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
3689                                 TLV_HDR_LEN);
3690         }
3691         return 0;
3692 }
3693
3694 static u32
3695 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
3696 {
3697
3698         __le32 iecount_le;
3699         __le32 pktflag_le;
3700
3701         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
3702         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
3703
3704         iecount_le = cpu_to_le32(1);
3705         memcpy(&iebuf[VNDR_IE_COUNT_OFFSET], &iecount_le, sizeof(iecount_le));
3706
3707         pktflag_le = cpu_to_le32(pktflag);
3708         memcpy(&iebuf[VNDR_IE_PKTFLAG_OFFSET], &pktflag_le, sizeof(pktflag_le));
3709
3710         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
3711
3712         return ie_len + VNDR_IE_HDR_SIZE;
3713 }
3714
3715 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
3716                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
3717 {
3718         struct brcmf_if *ifp;
3719         struct vif_saved_ie *saved_ie;
3720         s32 err = 0;
3721         u8  *iovar_ie_buf;
3722         u8  *curr_ie_buf;
3723         u8  *mgmt_ie_buf = NULL;
3724         int mgmt_ie_buf_len;
3725         u32 *mgmt_ie_len;
3726         u32 del_add_ie_buf_len = 0;
3727         u32 total_ie_buf_len = 0;
3728         u32 parsed_ie_buf_len = 0;
3729         struct parsed_vndr_ies old_vndr_ies;
3730         struct parsed_vndr_ies new_vndr_ies;
3731         struct parsed_vndr_ie_info *vndrie_info;
3732         s32 i;
3733         u8 *ptr;
3734         int remained_buf_len;
3735
3736         if (!vif)
3737                 return -ENODEV;
3738         ifp = vif->ifp;
3739         saved_ie = &vif->saved_ie;
3740
3741         brcmf_dbg(TRACE, "bssidx %d, pktflag : 0x%02X\n", ifp->bssidx, pktflag);
3742         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
3743         if (!iovar_ie_buf)
3744                 return -ENOMEM;
3745         curr_ie_buf = iovar_ie_buf;
3746         switch (pktflag) {
3747         case BRCMF_VNDR_IE_PRBREQ_FLAG:
3748                 mgmt_ie_buf = saved_ie->probe_req_ie;
3749                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
3750                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
3751                 break;
3752         case BRCMF_VNDR_IE_PRBRSP_FLAG:
3753                 mgmt_ie_buf = saved_ie->probe_res_ie;
3754                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
3755                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
3756                 break;
3757         case BRCMF_VNDR_IE_BEACON_FLAG:
3758                 mgmt_ie_buf = saved_ie->beacon_ie;
3759                 mgmt_ie_len = &saved_ie->beacon_ie_len;
3760                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
3761                 break;
3762         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
3763                 mgmt_ie_buf = saved_ie->assoc_req_ie;
3764                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
3765                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
3766                 break;
3767         default:
3768                 err = -EPERM;
3769                 brcmf_err("not suitable type\n");
3770                 goto exit;
3771         }
3772
3773         if (vndr_ie_len > mgmt_ie_buf_len) {
3774                 err = -ENOMEM;
3775                 brcmf_err("extra IE size too big\n");
3776                 goto exit;
3777         }
3778
3779         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
3780         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
3781                 ptr = curr_ie_buf;
3782                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
3783                 for (i = 0; i < new_vndr_ies.count; i++) {
3784                         vndrie_info = &new_vndr_ies.ie_info[i];
3785                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
3786                                vndrie_info->ie_len);
3787                         parsed_ie_buf_len += vndrie_info->ie_len;
3788                 }
3789         }
3790
3791         if (mgmt_ie_buf && *mgmt_ie_len) {
3792                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
3793                     (memcmp(mgmt_ie_buf, curr_ie_buf,
3794                             parsed_ie_buf_len) == 0)) {
3795                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
3796                         goto exit;
3797                 }
3798
3799                 /* parse old vndr_ie */
3800                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
3801
3802                 /* make a command to delete old ie */
3803                 for (i = 0; i < old_vndr_ies.count; i++) {
3804                         vndrie_info = &old_vndr_ies.ie_info[i];
3805
3806                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
3807                                   vndrie_info->vndrie.id,
3808                                   vndrie_info->vndrie.len,
3809                                   vndrie_info->vndrie.oui[0],
3810                                   vndrie_info->vndrie.oui[1],
3811                                   vndrie_info->vndrie.oui[2]);
3812
3813                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
3814                                                            vndrie_info->ie_ptr,
3815                                                            vndrie_info->ie_len,
3816                                                            "del");
3817                         curr_ie_buf += del_add_ie_buf_len;
3818                         total_ie_buf_len += del_add_ie_buf_len;
3819                 }
3820         }
3821
3822         *mgmt_ie_len = 0;
3823         /* Add if there is any extra IE */
3824         if (mgmt_ie_buf && parsed_ie_buf_len) {
3825                 ptr = mgmt_ie_buf;
3826
3827                 remained_buf_len = mgmt_ie_buf_len;
3828
3829                 /* make a command to add new ie */
3830                 for (i = 0; i < new_vndr_ies.count; i++) {
3831                         vndrie_info = &new_vndr_ies.ie_info[i];
3832
3833                         /* verify remained buf size before copy data */
3834                         if (remained_buf_len < (vndrie_info->vndrie.len +
3835                                                         VNDR_IE_VSIE_OFFSET)) {
3836                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
3837                                           remained_buf_len);
3838                                 break;
3839                         }
3840                         remained_buf_len -= (vndrie_info->ie_len +
3841                                              VNDR_IE_VSIE_OFFSET);
3842
3843                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
3844                                   vndrie_info->vndrie.id,
3845                                   vndrie_info->vndrie.len,
3846                                   vndrie_info->vndrie.oui[0],
3847                                   vndrie_info->vndrie.oui[1],
3848                                   vndrie_info->vndrie.oui[2]);
3849
3850                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
3851                                                            vndrie_info->ie_ptr,
3852                                                            vndrie_info->ie_len,
3853                                                            "add");
3854
3855                         /* save the parsed IE in wl struct */
3856                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
3857                                vndrie_info->ie_len);
3858                         *mgmt_ie_len += vndrie_info->ie_len;
3859
3860                         curr_ie_buf += del_add_ie_buf_len;
3861                         total_ie_buf_len += del_add_ie_buf_len;
3862                 }
3863         }
3864         if (total_ie_buf_len) {
3865                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
3866                                                  total_ie_buf_len);
3867                 if (err)
3868                         brcmf_err("vndr ie set error : %d\n", err);
3869         }
3870
3871 exit:
3872         kfree(iovar_ie_buf);
3873         return err;
3874 }
3875
3876 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
3877 {
3878         s32 pktflags[] = {
3879                 BRCMF_VNDR_IE_PRBREQ_FLAG,
3880                 BRCMF_VNDR_IE_PRBRSP_FLAG,
3881                 BRCMF_VNDR_IE_BEACON_FLAG
3882         };
3883         int i;
3884
3885         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
3886                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
3887
3888         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
3889         return 0;
3890 }
3891
3892 static s32
3893 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
3894                         struct cfg80211_beacon_data *beacon)
3895 {
3896         s32 err;
3897
3898         /* Set Beacon IEs to FW */
3899         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
3900                                     beacon->tail, beacon->tail_len);
3901         if (err) {
3902                 brcmf_err("Set Beacon IE Failed\n");
3903                 return err;
3904         }
3905         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
3906
3907         /* Set Probe Response IEs to FW */
3908         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
3909                                     beacon->proberesp_ies,
3910                                     beacon->proberesp_ies_len);
3911         if (err)
3912                 brcmf_err("Set Probe Resp IE Failed\n");
3913         else
3914                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
3915
3916         return err;
3917 }
3918
3919 static s32
3920 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
3921                         struct cfg80211_ap_settings *settings)
3922 {
3923         s32 ie_offset;
3924         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3925         struct brcmf_if *ifp = netdev_priv(ndev);
3926         const struct brcmf_tlv *ssid_ie;
3927         struct brcmf_ssid_le ssid_le;
3928         s32 err = -EPERM;
3929         const struct brcmf_tlv *rsn_ie;
3930         const struct brcmf_vs_tlv *wpa_ie;
3931         struct brcmf_join_params join_params;
3932         enum nl80211_iftype dev_role;
3933         struct brcmf_fil_bss_enable_le bss_enable;
3934         u16 chanspec;
3935         bool mbss;
3936
3937         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
3938                   settings->chandef.chan->hw_value,
3939                   settings->chandef.center_freq1, settings->chandef.width,
3940                   settings->beacon_interval, settings->dtim_period);
3941         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
3942                   settings->ssid, settings->ssid_len, settings->auth_type,
3943                   settings->inactivity_timeout);
3944
3945         dev_role = ifp->vif->wdev.iftype;
3946         mbss = ifp->vif->mbss;
3947
3948         memset(&ssid_le, 0, sizeof(ssid_le));
3949         if (settings->ssid == NULL || settings->ssid_len == 0) {
3950                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
3951                 ssid_ie = brcmf_parse_tlvs(
3952                                 (u8 *)&settings->beacon.head[ie_offset],
3953                                 settings->beacon.head_len - ie_offset,
3954                                 WLAN_EID_SSID);
3955                 if (!ssid_ie)
3956                         return -EINVAL;
3957
3958                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
3959                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
3960                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
3961         } else {
3962                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
3963                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
3964         }
3965
3966         if (!mbss) {
3967                 brcmf_set_mpc(ifp, 0);
3968                 brcmf_configure_arp_offload(ifp, false);
3969         }
3970
3971         /* find the RSN_IE */
3972         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
3973                                   settings->beacon.tail_len, WLAN_EID_RSN);
3974
3975         /* find the WPA_IE */
3976         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
3977                                   settings->beacon.tail_len);
3978
3979         if ((wpa_ie != NULL || rsn_ie != NULL)) {
3980                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
3981                 if (wpa_ie != NULL) {
3982                         /* WPA IE */
3983                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
3984                         if (err < 0)
3985                                 goto exit;
3986                 } else {
3987                         struct brcmf_vs_tlv *tmp_ie;
3988
3989                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
3990
3991                         /* RSN IE */
3992                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
3993                         if (err < 0)
3994                                 goto exit;
3995                 }
3996         } else {
3997                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
3998                 brcmf_configure_opensecurity(ifp);
3999         }
4000
4001         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4002
4003         if (!mbss) {
4004                 chanspec = chandef_to_chanspec(&cfg->d11inf,
4005                                                &settings->chandef);
4006                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4007                 if (err < 0) {
4008                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4009                                   chanspec, err);
4010                         goto exit;
4011                 }
4012
4013                 if (settings->beacon_interval) {
4014                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4015                                                     settings->beacon_interval);
4016                         if (err < 0) {
4017                                 brcmf_err("Beacon Interval Set Error, %d\n",
4018                                           err);
4019                                 goto exit;
4020                         }
4021                 }
4022                 if (settings->dtim_period) {
4023                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4024                                                     settings->dtim_period);
4025                         if (err < 0) {
4026                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4027                                 goto exit;
4028                         }
4029                 }
4030
4031                 if (dev_role == NL80211_IFTYPE_AP) {
4032                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4033                         if (err < 0) {
4034                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4035                                 goto exit;
4036                         }
4037                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4038                 }
4039
4040                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4041                 if (err < 0) {
4042                         brcmf_err("SET INFRA error %d\n", err);
4043                         goto exit;
4044                 }
4045         }
4046         if (dev_role == NL80211_IFTYPE_AP) {
4047                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4048                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4049
4050                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4051                 if (err < 0) {
4052                         brcmf_err("setting AP mode failed %d\n", err);
4053                         goto exit;
4054                 }
4055                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4056                 if (err < 0) {
4057                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4058                         goto exit;
4059                 }
4060
4061                 memset(&join_params, 0, sizeof(join_params));
4062                 /* join parameters starts with ssid */
4063                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4064                 /* create softap */
4065                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4066                                              &join_params, sizeof(join_params));
4067                 if (err < 0) {
4068                         brcmf_err("SET SSID error (%d)\n", err);
4069                         goto exit;
4070                 }
4071                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4072         } else {
4073                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4074                                                 sizeof(ssid_le));
4075                 if (err < 0) {
4076                         brcmf_err("setting ssid failed %d\n", err);
4077                         goto exit;
4078                 }
4079                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
4080                 bss_enable.enable = cpu_to_le32(1);
4081                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4082                                                sizeof(bss_enable));
4083                 if (err < 0) {
4084                         brcmf_err("bss_enable config failed %d\n", err);
4085                         goto exit;
4086                 }
4087
4088                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4089         }
4090         clear_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
4091         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4092
4093 exit:
4094         if ((err) && (!mbss)) {
4095                 brcmf_set_mpc(ifp, 1);
4096                 brcmf_configure_arp_offload(ifp, true);
4097         }
4098         return err;
4099 }
4100
4101 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4102 {
4103         struct brcmf_if *ifp = netdev_priv(ndev);
4104         s32 err;
4105         struct brcmf_fil_bss_enable_le bss_enable;
4106         struct brcmf_join_params join_params;
4107
4108         brcmf_dbg(TRACE, "Enter\n");
4109
4110         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4111                 /* Due to most likely deauths outstanding we sleep */
4112                 /* first to make sure they get processed by fw. */
4113                 msleep(400);
4114
4115                 if (ifp->vif->mbss) {
4116                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4117                         return err;
4118                 }
4119
4120                 memset(&join_params, 0, sizeof(join_params));
4121                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4122                                              &join_params, sizeof(join_params));
4123                 if (err < 0)
4124                         brcmf_err("SET SSID error (%d)\n", err);
4125                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4126                 if (err < 0)
4127                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4128                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4129                 if (err < 0)
4130                         brcmf_err("setting AP mode failed %d\n", err);
4131                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4132                 if (err < 0)
4133                         brcmf_err("setting INFRA mode failed %d\n", err);
4134                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4135                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4136                 /* Bring device back up so it can be used again */
4137                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4138                 if (err < 0)
4139                         brcmf_err("BRCMF_C_UP error %d\n", err);
4140         } else {
4141                 bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
4142                 bss_enable.enable = cpu_to_le32(0);
4143                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4144                                                sizeof(bss_enable));
4145                 if (err < 0)
4146                         brcmf_err("bss_enable config failed %d\n", err);
4147         }
4148         brcmf_set_mpc(ifp, 1);
4149         brcmf_configure_arp_offload(ifp, true);
4150         set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
4151         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4152
4153         return err;
4154 }
4155
4156 static s32
4157 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4158                              struct cfg80211_beacon_data *info)
4159 {
4160         struct brcmf_if *ifp = netdev_priv(ndev);
4161         s32 err;
4162
4163         brcmf_dbg(TRACE, "Enter\n");
4164
4165         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4166
4167         return err;
4168 }
4169
4170 static int
4171 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4172                            struct station_del_parameters *params)
4173 {
4174         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4175         struct brcmf_scb_val_le scbval;
4176         struct brcmf_if *ifp = netdev_priv(ndev);
4177         s32 err;
4178
4179         if (!params->mac)
4180                 return -EFAULT;
4181
4182         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4183
4184         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4185                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4186         if (!check_vif_up(ifp->vif))
4187                 return -EIO;
4188
4189         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4190         scbval.val = cpu_to_le32(WLAN_REASON_DEAUTH_LEAVING);
4191         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4192                                      &scbval, sizeof(scbval));
4193         if (err)
4194                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4195
4196         brcmf_dbg(TRACE, "Exit\n");
4197         return err;
4198 }
4199
4200
4201 static void
4202 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4203                                    struct wireless_dev *wdev,
4204                                    u16 frame_type, bool reg)
4205 {
4206         struct brcmf_cfg80211_vif *vif;
4207         u16 mgmt_type;
4208
4209         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4210
4211         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4212         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4213         if (reg)
4214                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4215         else
4216                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4217 }
4218
4219
4220 static int
4221 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4222                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4223 {
4224         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4225         struct ieee80211_channel *chan = params->chan;
4226         const u8 *buf = params->buf;
4227         size_t len = params->len;
4228         const struct ieee80211_mgmt *mgmt;
4229         struct brcmf_cfg80211_vif *vif;
4230         s32 err = 0;
4231         s32 ie_offset;
4232         s32 ie_len;
4233         struct brcmf_fil_action_frame_le *action_frame;
4234         struct brcmf_fil_af_params_le *af_params;
4235         bool ack;
4236         s32 chan_nr;
4237         u32 freq;
4238
4239         brcmf_dbg(TRACE, "Enter\n");
4240
4241         *cookie = 0;
4242
4243         mgmt = (const struct ieee80211_mgmt *)buf;
4244
4245         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4246                 brcmf_err("Driver only allows MGMT packet type\n");
4247                 return -EPERM;
4248         }
4249
4250         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4251
4252         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4253                 /* Right now the only reason to get a probe response */
4254                 /* is for p2p listen response or for p2p GO from     */
4255                 /* wpa_supplicant. Unfortunately the probe is send   */
4256                 /* on primary ndev, while dongle wants it on the p2p */
4257                 /* vif. Since this is only reason for a probe        */
4258                 /* response to be sent, the vif is taken from cfg.   */
4259                 /* If ever desired to send proberesp for non p2p     */
4260                 /* response then data should be checked for          */
4261                 /* "DIRECT-". Note in future supplicant will take    */
4262                 /* dedicated p2p wdev to do this and then this 'hack'*/
4263                 /* is not needed anymore.                            */
4264                 ie_offset =  DOT11_MGMT_HDR_LEN +
4265                              DOT11_BCN_PRB_FIXED_LEN;
4266                 ie_len = len - ie_offset;
4267                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4268                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4269                 err = brcmf_vif_set_mgmt_ie(vif,
4270                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4271                                             &buf[ie_offset],
4272                                             ie_len);
4273                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4274                                         GFP_KERNEL);
4275         } else if (ieee80211_is_action(mgmt->frame_control)) {
4276                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4277                 if (af_params == NULL) {
4278                         brcmf_err("unable to allocate frame\n");
4279                         err = -ENOMEM;
4280                         goto exit;
4281                 }
4282                 action_frame = &af_params->action_frame;
4283                 /* Add the packet Id */
4284                 action_frame->packet_id = cpu_to_le32(*cookie);
4285                 /* Add BSSID */
4286                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4287                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4288                 /* Add the length exepted for 802.11 header  */
4289                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4290                 /* Add the channel. Use the one specified as parameter if any or
4291                  * the current one (got from the firmware) otherwise
4292                  */
4293                 if (chan)
4294                         freq = chan->center_freq;
4295                 else
4296                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4297                                               &freq);
4298                 chan_nr = ieee80211_frequency_to_channel(freq);
4299                 af_params->channel = cpu_to_le32(chan_nr);
4300
4301                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4302                        le16_to_cpu(action_frame->len));
4303
4304                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4305                           *cookie, le16_to_cpu(action_frame->len), freq);
4306
4307                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4308                                                   af_params);
4309
4310                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4311                                         GFP_KERNEL);
4312                 kfree(af_params);
4313         } else {
4314                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4315                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4316         }
4317
4318 exit:
4319         return err;
4320 }
4321
4322
4323 static int
4324 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4325                                         struct wireless_dev *wdev,
4326                                         u64 cookie)
4327 {
4328         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4329         struct brcmf_cfg80211_vif *vif;
4330         int err = 0;
4331
4332         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4333
4334         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4335         if (vif == NULL) {
4336                 brcmf_err("No p2p device available for probe response\n");
4337                 err = -ENODEV;
4338                 goto exit;
4339         }
4340         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4341 exit:
4342         return err;
4343 }
4344
4345 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
4346                                            struct wireless_dev *wdev,
4347                                            enum nl80211_crit_proto_id proto,
4348                                            u16 duration)
4349 {
4350         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4351         struct brcmf_cfg80211_vif *vif;
4352
4353         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4354
4355         /* only DHCP support for now */
4356         if (proto != NL80211_CRIT_PROTO_DHCP)
4357                 return -EINVAL;
4358
4359         /* suppress and abort scanning */
4360         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4361         brcmf_abort_scanning(cfg);
4362
4363         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
4364 }
4365
4366 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
4367                                            struct wireless_dev *wdev)
4368 {
4369         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4370         struct brcmf_cfg80211_vif *vif;
4371
4372         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4373
4374         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
4375         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
4376 }
4377
4378 static s32
4379 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
4380                              const struct brcmf_event_msg *e, void *data)
4381 {
4382         switch (e->reason) {
4383         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
4384                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
4385                 break;
4386         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
4387                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
4388                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4389                 break;
4390         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
4391                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
4392                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4393                 break;
4394         }
4395
4396         return 0;
4397 }
4398
4399 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
4400 {
4401         int ret;
4402
4403         switch (oper) {
4404         case NL80211_TDLS_DISCOVERY_REQ:
4405                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
4406                 break;
4407         case NL80211_TDLS_SETUP:
4408                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
4409                 break;
4410         case NL80211_TDLS_TEARDOWN:
4411                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
4412                 break;
4413         default:
4414                 brcmf_err("unsupported operation: %d\n", oper);
4415                 ret = -EOPNOTSUPP;
4416         }
4417         return ret;
4418 }
4419
4420 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
4421                                     struct net_device *ndev, const u8 *peer,
4422                                     enum nl80211_tdls_operation oper)
4423 {
4424         struct brcmf_if *ifp;
4425         struct brcmf_tdls_iovar_le info;
4426         int ret = 0;
4427
4428         ret = brcmf_convert_nl80211_tdls_oper(oper);
4429         if (ret < 0)
4430                 return ret;
4431
4432         ifp = netdev_priv(ndev);
4433         memset(&info, 0, sizeof(info));
4434         info.mode = (u8)ret;
4435         if (peer)
4436                 memcpy(info.ea, peer, ETH_ALEN);
4437
4438         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
4439                                        &info, sizeof(info));
4440         if (ret < 0)
4441                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
4442
4443         return ret;
4444 }
4445
4446 static struct cfg80211_ops wl_cfg80211_ops = {
4447         .add_virtual_intf = brcmf_cfg80211_add_iface,
4448         .del_virtual_intf = brcmf_cfg80211_del_iface,
4449         .change_virtual_intf = brcmf_cfg80211_change_iface,
4450         .scan = brcmf_cfg80211_scan,
4451         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
4452         .join_ibss = brcmf_cfg80211_join_ibss,
4453         .leave_ibss = brcmf_cfg80211_leave_ibss,
4454         .get_station = brcmf_cfg80211_get_station,
4455         .set_tx_power = brcmf_cfg80211_set_tx_power,
4456         .get_tx_power = brcmf_cfg80211_get_tx_power,
4457         .add_key = brcmf_cfg80211_add_key,
4458         .del_key = brcmf_cfg80211_del_key,
4459         .get_key = brcmf_cfg80211_get_key,
4460         .set_default_key = brcmf_cfg80211_config_default_key,
4461         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
4462         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
4463         .connect = brcmf_cfg80211_connect,
4464         .disconnect = brcmf_cfg80211_disconnect,
4465         .suspend = brcmf_cfg80211_suspend,
4466         .resume = brcmf_cfg80211_resume,
4467         .set_pmksa = brcmf_cfg80211_set_pmksa,
4468         .del_pmksa = brcmf_cfg80211_del_pmksa,
4469         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
4470         .start_ap = brcmf_cfg80211_start_ap,
4471         .stop_ap = brcmf_cfg80211_stop_ap,
4472         .change_beacon = brcmf_cfg80211_change_beacon,
4473         .del_station = brcmf_cfg80211_del_station,
4474         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
4475         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
4476         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
4477         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
4478         .remain_on_channel = brcmf_p2p_remain_on_channel,
4479         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
4480         .start_p2p_device = brcmf_p2p_start_device,
4481         .stop_p2p_device = brcmf_p2p_stop_device,
4482         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
4483         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
4484         .tdls_oper = brcmf_cfg80211_tdls_oper,
4485 };
4486
4487 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
4488                                            enum nl80211_iftype type,
4489                                            bool pm_block)
4490 {
4491         struct brcmf_cfg80211_vif *vif_walk;
4492         struct brcmf_cfg80211_vif *vif;
4493         bool mbss;
4494
4495         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
4496                   sizeof(*vif));
4497         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
4498         if (!vif)
4499                 return ERR_PTR(-ENOMEM);
4500
4501         vif->wdev.wiphy = cfg->wiphy;
4502         vif->wdev.iftype = type;
4503
4504         vif->pm_block = pm_block;
4505         vif->roam_off = -1;
4506
4507         brcmf_init_prof(&vif->profile);
4508
4509         if (type == NL80211_IFTYPE_AP) {
4510                 mbss = false;
4511                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
4512                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
4513                                 mbss = true;
4514                                 break;
4515                         }
4516                 }
4517                 vif->mbss = mbss;
4518         }
4519
4520         list_add_tail(&vif->list, &cfg->vif_list);
4521         return vif;
4522 }
4523
4524 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
4525 {
4526         list_del(&vif->list);
4527         kfree(vif);
4528 }
4529
4530 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
4531 {
4532         struct brcmf_cfg80211_vif *vif;
4533         struct brcmf_if *ifp;
4534
4535         ifp = netdev_priv(ndev);
4536         vif = ifp->vif;
4537
4538         brcmf_free_vif(vif);
4539         free_netdev(ndev);
4540 }
4541
4542 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
4543 {
4544         u32 event = e->event_code;
4545         u32 status = e->status;
4546
4547         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
4548                 brcmf_dbg(CONN, "Processing set ssid\n");
4549                 return true;
4550         }
4551
4552         return false;
4553 }
4554
4555 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
4556 {
4557         u32 event = e->event_code;
4558         u16 flags = e->flags;
4559
4560         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
4561             (event == BRCMF_E_DISASSOC_IND) ||
4562             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
4563                 brcmf_dbg(CONN, "Processing link down\n");
4564                 return true;
4565         }
4566         return false;
4567 }
4568
4569 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
4570                                const struct brcmf_event_msg *e)
4571 {
4572         u32 event = e->event_code;
4573         u32 status = e->status;
4574
4575         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
4576                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
4577                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
4578                 return true;
4579         }
4580
4581         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
4582                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
4583                 return true;
4584         }
4585
4586         return false;
4587 }
4588
4589 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
4590 {
4591         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4592
4593         kfree(conn_info->req_ie);
4594         conn_info->req_ie = NULL;
4595         conn_info->req_ie_len = 0;
4596         kfree(conn_info->resp_ie);
4597         conn_info->resp_ie = NULL;
4598         conn_info->resp_ie_len = 0;
4599 }
4600
4601 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
4602                                struct brcmf_if *ifp)
4603 {
4604         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
4605         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4606         u32 req_len;
4607         u32 resp_len;
4608         s32 err = 0;
4609
4610         brcmf_clear_assoc_ies(cfg);
4611
4612         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
4613                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
4614         if (err) {
4615                 brcmf_err("could not get assoc info (%d)\n", err);
4616                 return err;
4617         }
4618         assoc_info =
4619                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
4620         req_len = le32_to_cpu(assoc_info->req_len);
4621         resp_len = le32_to_cpu(assoc_info->resp_len);
4622         if (req_len) {
4623                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
4624                                                cfg->extra_buf,
4625                                                WL_ASSOC_INFO_MAX);
4626                 if (err) {
4627                         brcmf_err("could not get assoc req (%d)\n", err);
4628                         return err;
4629                 }
4630                 conn_info->req_ie_len = req_len;
4631                 conn_info->req_ie =
4632                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
4633                             GFP_KERNEL);
4634         } else {
4635                 conn_info->req_ie_len = 0;
4636                 conn_info->req_ie = NULL;
4637         }
4638         if (resp_len) {
4639                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
4640                                                cfg->extra_buf,
4641                                                WL_ASSOC_INFO_MAX);
4642                 if (err) {
4643                         brcmf_err("could not get assoc resp (%d)\n", err);
4644                         return err;
4645                 }
4646                 conn_info->resp_ie_len = resp_len;
4647                 conn_info->resp_ie =
4648                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
4649                             GFP_KERNEL);
4650         } else {
4651                 conn_info->resp_ie_len = 0;
4652                 conn_info->resp_ie = NULL;
4653         }
4654         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
4655                   conn_info->req_ie_len, conn_info->resp_ie_len);
4656
4657         return err;
4658 }
4659
4660 static s32
4661 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
4662                        struct net_device *ndev,
4663                        const struct brcmf_event_msg *e)
4664 {
4665         struct brcmf_if *ifp = netdev_priv(ndev);
4666         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4667         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4668         struct wiphy *wiphy = cfg_to_wiphy(cfg);
4669         struct ieee80211_channel *notify_channel = NULL;
4670         struct ieee80211_supported_band *band;
4671         struct brcmf_bss_info_le *bi;
4672         struct brcmu_chan ch;
4673         u32 freq;
4674         s32 err = 0;
4675         u8 *buf;
4676
4677         brcmf_dbg(TRACE, "Enter\n");
4678
4679         brcmf_get_assoc_ies(cfg, ifp);
4680         memcpy(profile->bssid, e->addr, ETH_ALEN);
4681         brcmf_update_bss_info(cfg, ifp);
4682
4683         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
4684         if (buf == NULL) {
4685                 err = -ENOMEM;
4686                 goto done;
4687         }
4688
4689         /* data sent to dongle has to be little endian */
4690         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
4691         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
4692                                      buf, WL_BSS_INFO_MAX);
4693
4694         if (err)
4695                 goto done;
4696
4697         bi = (struct brcmf_bss_info_le *)(buf + 4);
4698         ch.chspec = le16_to_cpu(bi->chanspec);
4699         cfg->d11inf.decchspec(&ch);
4700
4701         if (ch.band == BRCMU_CHAN_BAND_2G)
4702                 band = wiphy->bands[IEEE80211_BAND_2GHZ];
4703         else
4704                 band = wiphy->bands[IEEE80211_BAND_5GHZ];
4705
4706         freq = ieee80211_channel_to_frequency(ch.chnum, band->band);
4707         notify_channel = ieee80211_get_channel(wiphy, freq);
4708
4709 done:
4710         kfree(buf);
4711         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
4712                         conn_info->req_ie, conn_info->req_ie_len,
4713                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
4714         brcmf_dbg(CONN, "Report roaming result\n");
4715
4716         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
4717         brcmf_dbg(TRACE, "Exit\n");
4718         return err;
4719 }
4720
4721 static s32
4722 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
4723                        struct net_device *ndev, const struct brcmf_event_msg *e,
4724                        bool completed)
4725 {
4726         struct brcmf_if *ifp = netdev_priv(ndev);
4727         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4728         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
4729
4730         brcmf_dbg(TRACE, "Enter\n");
4731
4732         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4733                                &ifp->vif->sme_state)) {
4734                 if (completed) {
4735                         brcmf_get_assoc_ies(cfg, ifp);
4736                         memcpy(profile->bssid, e->addr, ETH_ALEN);
4737                         brcmf_update_bss_info(cfg, ifp);
4738                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
4739                                 &ifp->vif->sme_state);
4740                 }
4741                 cfg80211_connect_result(ndev,
4742                                         (u8 *)profile->bssid,
4743                                         conn_info->req_ie,
4744                                         conn_info->req_ie_len,
4745                                         conn_info->resp_ie,
4746                                         conn_info->resp_ie_len,
4747                                         completed ? WLAN_STATUS_SUCCESS :
4748                                                     WLAN_STATUS_AUTH_TIMEOUT,
4749                                         GFP_KERNEL);
4750                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
4751                           completed ? "succeeded" : "failed");
4752         }
4753         brcmf_dbg(TRACE, "Exit\n");
4754         return 0;
4755 }
4756
4757 static s32
4758 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
4759                                struct net_device *ndev,
4760                                const struct brcmf_event_msg *e, void *data)
4761 {
4762         struct brcmf_if *ifp = netdev_priv(ndev);
4763         static int generation;
4764         u32 event = e->event_code;
4765         u32 reason = e->reason;
4766         struct station_info sinfo;
4767
4768         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
4769         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
4770             ndev != cfg_to_ndev(cfg)) {
4771                 brcmf_dbg(CONN, "AP mode link down\n");
4772                 complete(&cfg->vif_disabled);
4773                 if (ifp->vif->mbss)
4774                         brcmf_remove_interface(ifp->drvr, ifp->bssidx);
4775                 return 0;
4776         }
4777
4778         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
4779             (reason == BRCMF_E_STATUS_SUCCESS)) {
4780                 memset(&sinfo, 0, sizeof(sinfo));
4781                 sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
4782                 if (!data) {
4783                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
4784                         return -EINVAL;
4785                 }
4786                 sinfo.assoc_req_ies = data;
4787                 sinfo.assoc_req_ies_len = e->datalen;
4788                 generation++;
4789                 sinfo.generation = generation;
4790                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
4791         } else if ((event == BRCMF_E_DISASSOC_IND) ||
4792                    (event == BRCMF_E_DEAUTH_IND) ||
4793                    (event == BRCMF_E_DEAUTH)) {
4794                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
4795         }
4796         return 0;
4797 }
4798
4799 static s32
4800 brcmf_notify_connect_status(struct brcmf_if *ifp,
4801                             const struct brcmf_event_msg *e, void *data)
4802 {
4803         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4804         struct net_device *ndev = ifp->ndev;
4805         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
4806         struct ieee80211_channel *chan;
4807         s32 err = 0;
4808
4809         if ((e->event_code == BRCMF_E_DEAUTH) ||
4810             (e->event_code == BRCMF_E_DEAUTH_IND) ||
4811             (e->event_code == BRCMF_E_DISASSOC_IND) ||
4812             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
4813                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
4814         }
4815
4816         if (brcmf_is_apmode(ifp->vif)) {
4817                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
4818         } else if (brcmf_is_linkup(e)) {
4819                 brcmf_dbg(CONN, "Linkup\n");
4820                 if (brcmf_is_ibssmode(ifp->vif)) {
4821                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
4822                         memcpy(profile->bssid, e->addr, ETH_ALEN);
4823                         wl_inform_ibss(cfg, ndev, e->addr);
4824                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
4825                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4826                                   &ifp->vif->sme_state);
4827                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
4828                                 &ifp->vif->sme_state);
4829                 } else
4830                         brcmf_bss_connect_done(cfg, ndev, e, true);
4831         } else if (brcmf_is_linkdown(e)) {
4832                 brcmf_dbg(CONN, "Linkdown\n");
4833                 if (!brcmf_is_ibssmode(ifp->vif)) {
4834                         brcmf_bss_connect_done(cfg, ndev, e, false);
4835                 }
4836                 brcmf_link_down(ifp->vif);
4837                 brcmf_init_prof(ndev_to_prof(ndev));
4838                 if (ndev != cfg_to_ndev(cfg))
4839                         complete(&cfg->vif_disabled);
4840         } else if (brcmf_is_nonetwork(cfg, e)) {
4841                 if (brcmf_is_ibssmode(ifp->vif))
4842                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
4843                                   &ifp->vif->sme_state);
4844                 else
4845                         brcmf_bss_connect_done(cfg, ndev, e, false);
4846         }
4847
4848         return err;
4849 }
4850
4851 static s32
4852 brcmf_notify_roaming_status(struct brcmf_if *ifp,
4853                             const struct brcmf_event_msg *e, void *data)
4854 {
4855         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4856         u32 event = e->event_code;
4857         u32 status = e->status;
4858
4859         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
4860                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4861                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
4862                 else
4863                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
4864         }
4865
4866         return 0;
4867 }
4868
4869 static s32
4870 brcmf_notify_mic_status(struct brcmf_if *ifp,
4871                         const struct brcmf_event_msg *e, void *data)
4872 {
4873         u16 flags = e->flags;
4874         enum nl80211_key_type key_type;
4875
4876         if (flags & BRCMF_EVENT_MSG_GROUP)
4877                 key_type = NL80211_KEYTYPE_GROUP;
4878         else
4879                 key_type = NL80211_KEYTYPE_PAIRWISE;
4880
4881         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
4882                                      NULL, GFP_KERNEL);
4883
4884         return 0;
4885 }
4886
4887 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
4888                                   const struct brcmf_event_msg *e, void *data)
4889 {
4890         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
4891         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
4892         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
4893         struct brcmf_cfg80211_vif *vif;
4894
4895         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfg %u\n",
4896                   ifevent->action, ifevent->flags, ifevent->ifidx,
4897                   ifevent->bssidx);
4898
4899         mutex_lock(&event->vif_event_lock);
4900         event->action = ifevent->action;
4901         vif = event->vif;
4902
4903         switch (ifevent->action) {
4904         case BRCMF_E_IF_ADD:
4905                 /* waiting process may have timed out */
4906                 if (!cfg->vif_event.vif) {
4907                         mutex_unlock(&event->vif_event_lock);
4908                         return -EBADF;
4909                 }
4910
4911                 ifp->vif = vif;
4912                 vif->ifp = ifp;
4913                 if (ifp->ndev) {
4914                         vif->wdev.netdev = ifp->ndev;
4915                         ifp->ndev->ieee80211_ptr = &vif->wdev;
4916                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
4917                 }
4918                 mutex_unlock(&event->vif_event_lock);
4919                 wake_up(&event->vif_wq);
4920                 return 0;
4921
4922         case BRCMF_E_IF_DEL:
4923                 mutex_unlock(&event->vif_event_lock);
4924                 /* event may not be upon user request */
4925                 if (brcmf_cfg80211_vif_event_armed(cfg))
4926                         wake_up(&event->vif_wq);
4927                 return 0;
4928
4929         case BRCMF_E_IF_CHANGE:
4930                 mutex_unlock(&event->vif_event_lock);
4931                 wake_up(&event->vif_wq);
4932                 return 0;
4933
4934         default:
4935                 mutex_unlock(&event->vif_event_lock);
4936                 break;
4937         }
4938         return -EINVAL;
4939 }
4940
4941 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
4942 {
4943         conf->frag_threshold = (u32)-1;
4944         conf->rts_threshold = (u32)-1;
4945         conf->retry_short = (u32)-1;
4946         conf->retry_long = (u32)-1;
4947         conf->tx_power = -1;
4948 }
4949
4950 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
4951 {
4952         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
4953                             brcmf_notify_connect_status);
4954         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
4955                             brcmf_notify_connect_status);
4956         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
4957                             brcmf_notify_connect_status);
4958         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
4959                             brcmf_notify_connect_status);
4960         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
4961                             brcmf_notify_connect_status);
4962         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
4963                             brcmf_notify_connect_status);
4964         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
4965                             brcmf_notify_roaming_status);
4966         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
4967                             brcmf_notify_mic_status);
4968         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
4969                             brcmf_notify_connect_status);
4970         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4971                             brcmf_notify_sched_scan_results);
4972         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
4973                             brcmf_notify_vif_event);
4974         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
4975                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
4976         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
4977                             brcmf_p2p_notify_listen_complete);
4978         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
4979                             brcmf_p2p_notify_action_frame_rx);
4980         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
4981                             brcmf_p2p_notify_action_tx_complete);
4982         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
4983                             brcmf_p2p_notify_action_tx_complete);
4984 }
4985
4986 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
4987 {
4988         kfree(cfg->conf);
4989         cfg->conf = NULL;
4990         kfree(cfg->escan_ioctl_buf);
4991         cfg->escan_ioctl_buf = NULL;
4992         kfree(cfg->extra_buf);
4993         cfg->extra_buf = NULL;
4994         kfree(cfg->pmk_list);
4995         cfg->pmk_list = NULL;
4996 }
4997
4998 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
4999 {
5000         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5001         if (!cfg->conf)
5002                 goto init_priv_mem_out;
5003         cfg->escan_ioctl_buf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5004         if (!cfg->escan_ioctl_buf)
5005                 goto init_priv_mem_out;
5006         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5007         if (!cfg->extra_buf)
5008                 goto init_priv_mem_out;
5009         cfg->pmk_list = kzalloc(sizeof(*cfg->pmk_list), GFP_KERNEL);
5010         if (!cfg->pmk_list)
5011                 goto init_priv_mem_out;
5012
5013         return 0;
5014
5015 init_priv_mem_out:
5016         brcmf_deinit_priv_mem(cfg);
5017
5018         return -ENOMEM;
5019 }
5020
5021 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5022 {
5023         s32 err = 0;
5024
5025         cfg->scan_request = NULL;
5026         cfg->pwr_save = true;
5027         cfg->active_scan = true;        /* we do active scan per default */
5028         cfg->dongle_up = false;         /* dongle is not up yet */
5029         err = brcmf_init_priv_mem(cfg);
5030         if (err)
5031                 return err;
5032         brcmf_register_event_handlers(cfg);
5033         mutex_init(&cfg->usr_sync);
5034         brcmf_init_escan(cfg);
5035         brcmf_init_conf(cfg->conf);
5036         init_completion(&cfg->vif_disabled);
5037         return err;
5038 }
5039
5040 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5041 {
5042         cfg->dongle_up = false; /* dongle down */
5043         brcmf_abort_scanning(cfg);
5044         brcmf_deinit_priv_mem(cfg);
5045 }
5046
5047 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5048 {
5049         init_waitqueue_head(&event->vif_wq);
5050         mutex_init(&event->vif_event_lock);
5051 }
5052
5053 static s32
5054 brcmf_dongle_roam(struct brcmf_if *ifp, u32 bcn_timeout)
5055 {
5056         s32 err = 0;
5057         __le32 roamtrigger[2];
5058         __le32 roam_delta[2];
5059
5060         /*
5061          * Setup timeout if Beacons are lost and roam is
5062          * off to report link down
5063          */
5064         if (brcmf_roamoff) {
5065                 err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5066                 if (err) {
5067                         brcmf_err("bcn_timeout error (%d)\n", err);
5068                         goto dongle_rom_out;
5069                 }
5070         }
5071
5072         /*
5073          * Enable/Disable built-in roaming to allow supplicant
5074          * to take care of roaming
5075          */
5076         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5077                   brcmf_roamoff ? "Off" : "On");
5078         err = brcmf_fil_iovar_int_set(ifp, "roam_off", !!(brcmf_roamoff));
5079         if (err) {
5080                 brcmf_err("roam_off error (%d)\n", err);
5081                 goto dongle_rom_out;
5082         }
5083
5084         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5085         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5086         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5087                                      (void *)roamtrigger, sizeof(roamtrigger));
5088         if (err) {
5089                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5090                 goto dongle_rom_out;
5091         }
5092
5093         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5094         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5095         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5096                                      (void *)roam_delta, sizeof(roam_delta));
5097         if (err) {
5098                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5099                 goto dongle_rom_out;
5100         }
5101
5102 dongle_rom_out:
5103         return err;
5104 }
5105
5106 static s32
5107 brcmf_dongle_scantime(struct brcmf_if *ifp, s32 scan_assoc_time,
5108                       s32 scan_unassoc_time, s32 scan_passive_time)
5109 {
5110         s32 err = 0;
5111
5112         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5113                                     scan_assoc_time);
5114         if (err) {
5115                 if (err == -EOPNOTSUPP)
5116                         brcmf_dbg(INFO, "Scan assoc time is not supported\n");
5117                 else
5118                         brcmf_err("Scan assoc time error (%d)\n", err);
5119                 goto dongle_scantime_out;
5120         }
5121         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5122                                     scan_unassoc_time);
5123         if (err) {
5124                 if (err == -EOPNOTSUPP)
5125                         brcmf_dbg(INFO, "Scan unassoc time is not supported\n");
5126                 else
5127                         brcmf_err("Scan unassoc time error (%d)\n", err);
5128                 goto dongle_scantime_out;
5129         }
5130
5131         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5132                                     scan_passive_time);
5133         if (err) {
5134                 if (err == -EOPNOTSUPP)
5135                         brcmf_dbg(INFO, "Scan passive time is not supported\n");
5136                 else
5137                         brcmf_err("Scan passive time error (%d)\n", err);
5138                 goto dongle_scantime_out;
5139         }
5140
5141 dongle_scantime_out:
5142         return err;
5143 }
5144
5145 /* Filter the list of channels received from firmware counting only
5146  * the 20MHz channels. The wiphy band data only needs those which get
5147  * flagged to indicate if they can take part in higher bandwidth.
5148  */
5149 static void brcmf_count_20mhz_channels(struct brcmf_cfg80211_info *cfg,
5150                                        struct brcmf_chanspec_list *chlist,
5151                                        u32 chcnt[])
5152 {
5153         u32 total = le32_to_cpu(chlist->count);
5154         struct brcmu_chan ch;
5155         int i;
5156
5157         for (i = 0; i < total; i++) {
5158                 ch.chspec = (u16)le32_to_cpu(chlist->element[i]);
5159                 cfg->d11inf.decchspec(&ch);
5160
5161                 /* Firmware gives a ordered list. We skip non-20MHz
5162                  * channels is 2G. For 5G we can abort upon reaching
5163                  * a non-20MHz channel in the list.
5164                  */
5165                 if (ch.bw != BRCMU_CHAN_BW_20) {
5166                         if (ch.band == BRCMU_CHAN_BAND_5G)
5167                                 break;
5168                         else
5169                                 continue;
5170                 }
5171
5172                 if (ch.band == BRCMU_CHAN_BAND_2G)
5173                         chcnt[0] += 1;
5174                 else if (ch.band == BRCMU_CHAN_BAND_5G)
5175                         chcnt[1] += 1;
5176         }
5177 }
5178
5179 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5180                                            struct brcmu_chan *ch)
5181 {
5182         u32 ht40_flag;
5183
5184         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5185         if (ch->sb == BRCMU_CHAN_SB_U) {
5186                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5187                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5188                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5189         } else {
5190                 /* It should be one of
5191                  * IEEE80211_CHAN_NO_HT40 or
5192                  * IEEE80211_CHAN_NO_HT40PLUS
5193                  */
5194                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5195                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5196                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5197         }
5198 }
5199
5200 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5201                                     u32 bw_cap[])
5202 {
5203         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5204         struct ieee80211_supported_band *band;
5205         struct ieee80211_channel *channel;
5206         struct wiphy *wiphy;
5207         struct brcmf_chanspec_list *list;
5208         struct brcmu_chan ch;
5209         int err;
5210         u8 *pbuf;
5211         u32 i, j;
5212         u32 total;
5213         u32 chaninfo;
5214         u32 chcnt[2] = { 0, 0 };
5215         u32 index;
5216
5217         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5218
5219         if (pbuf == NULL)
5220                 return -ENOMEM;
5221
5222         list = (struct brcmf_chanspec_list *)pbuf;
5223
5224         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5225                                        BRCMF_DCMD_MEDLEN);
5226         if (err) {
5227                 brcmf_err("get chanspecs error (%d)\n", err);
5228                 goto fail_pbuf;
5229         }
5230
5231         brcmf_count_20mhz_channels(cfg, list, chcnt);
5232         wiphy = cfg_to_wiphy(cfg);
5233         if (chcnt[0]) {
5234                 band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
5235                                GFP_KERNEL);
5236                 if (band == NULL) {
5237                         err = -ENOMEM;
5238                         goto fail_pbuf;
5239                 }
5240                 band->channels = kcalloc(chcnt[0], sizeof(*channel),
5241                                          GFP_KERNEL);
5242                 if (band->channels == NULL) {
5243                         kfree(band);
5244                         err = -ENOMEM;
5245                         goto fail_pbuf;
5246                 }
5247                 band->n_channels = 0;
5248                 wiphy->bands[IEEE80211_BAND_2GHZ] = band;
5249         }
5250         if (chcnt[1]) {
5251                 band = kmemdup(&__wl_band_5ghz_a, sizeof(__wl_band_5ghz_a),
5252                                GFP_KERNEL);
5253                 if (band == NULL) {
5254                         err = -ENOMEM;
5255                         goto fail_band2g;
5256                 }
5257                 band->channels = kcalloc(chcnt[1], sizeof(*channel),
5258                                          GFP_KERNEL);
5259                 if (band->channels == NULL) {
5260                         kfree(band);
5261                         err = -ENOMEM;
5262                         goto fail_band2g;
5263                 }
5264                 band->n_channels = 0;
5265                 wiphy->bands[IEEE80211_BAND_5GHZ] = band;
5266         }
5267
5268         total = le32_to_cpu(list->count);
5269         for (i = 0; i < total; i++) {
5270                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5271                 cfg->d11inf.decchspec(&ch);
5272
5273                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5274                         band = wiphy->bands[IEEE80211_BAND_2GHZ];
5275                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5276                         band = wiphy->bands[IEEE80211_BAND_5GHZ];
5277                 } else {
5278                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5279                         continue;
5280                 }
5281                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5282                     ch.bw == BRCMU_CHAN_BW_40)
5283                         continue;
5284                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5285                     ch.bw == BRCMU_CHAN_BW_80)
5286                         continue;
5287
5288                 channel = band->channels;
5289                 index = band->n_channels;
5290                 for (j = 0; j < band->n_channels; j++) {
5291                         if (channel[j].hw_value == ch.chnum) {
5292                                 index = j;
5293                                 break;
5294                         }
5295                 }
5296                 channel[index].center_freq =
5297                         ieee80211_channel_to_frequency(ch.chnum, band->band);
5298                 channel[index].hw_value = ch.chnum;
5299
5300                 /* assuming the chanspecs order is HT20,
5301                  * HT40 upper, HT40 lower, and VHT80.
5302                  */
5303                 if (ch.bw == BRCMU_CHAN_BW_80) {
5304                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5305                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5306                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5307                 } else {
5308                         /* disable other bandwidths for now as mentioned
5309                          * order assure they are enabled for subsequent
5310                          * chanspecs.
5311                          */
5312                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5313                                                IEEE80211_CHAN_NO_80MHZ;
5314                         ch.bw = BRCMU_CHAN_BW_20;
5315                         cfg->d11inf.encchspec(&ch);
5316                         chaninfo = ch.chspec;
5317                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5318                                                        &chaninfo);
5319                         if (!err) {
5320                                 if (chaninfo & WL_CHAN_RADAR)
5321                                         channel[index].flags |=
5322                                                 (IEEE80211_CHAN_RADAR |
5323                                                  IEEE80211_CHAN_NO_IR);
5324                                 if (chaninfo & WL_CHAN_PASSIVE)
5325                                         channel[index].flags |=
5326                                                 IEEE80211_CHAN_NO_IR;
5327                         }
5328                 }
5329                 if (index == band->n_channels)
5330                         band->n_channels++;
5331         }
5332         kfree(pbuf);
5333         return 0;
5334
5335 fail_band2g:
5336         kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
5337         kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
5338         wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
5339 fail_pbuf:
5340         kfree(pbuf);
5341         return err;
5342 }
5343
5344 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
5345 {
5346         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5347         struct ieee80211_supported_band *band;
5348         struct brcmf_fil_bwcap_le band_bwcap;
5349         struct brcmf_chanspec_list *list;
5350         u8 *pbuf;
5351         u32 val;
5352         int err;
5353         struct brcmu_chan ch;
5354         u32 num_chan;
5355         int i, j;
5356
5357         /* verify support for bw_cap command */
5358         val = WLC_BAND_5G;
5359         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
5360
5361         if (!err) {
5362                 /* only set 2G bandwidth using bw_cap command */
5363                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
5364                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
5365                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
5366                                                sizeof(band_bwcap));
5367         } else {
5368                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
5369                 val = WLC_N_BW_40ALL;
5370                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
5371         }
5372
5373         if (!err) {
5374                 /* update channel info in 2G band */
5375                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5376
5377                 if (pbuf == NULL)
5378                         return -ENOMEM;
5379
5380                 ch.band = BRCMU_CHAN_BAND_2G;
5381                 ch.bw = BRCMU_CHAN_BW_40;
5382                 ch.sb = BRCMU_CHAN_SB_NONE;
5383                 ch.chnum = 0;
5384                 cfg->d11inf.encchspec(&ch);
5385
5386                 /* pass encoded chanspec in query */
5387                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
5388
5389                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5390                                                BRCMF_DCMD_MEDLEN);
5391                 if (err) {
5392                         brcmf_err("get chanspecs error (%d)\n", err);
5393                         kfree(pbuf);
5394                         return err;
5395                 }
5396
5397                 band = cfg_to_wiphy(cfg)->bands[IEEE80211_BAND_2GHZ];
5398                 list = (struct brcmf_chanspec_list *)pbuf;
5399                 num_chan = le32_to_cpu(list->count);
5400                 for (i = 0; i < num_chan; i++) {
5401                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
5402                         cfg->d11inf.decchspec(&ch);
5403                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
5404                                 continue;
5405                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
5406                                 continue;
5407                         for (j = 0; j < band->n_channels; j++) {
5408                                 if (band->channels[j].hw_value == ch.chnum)
5409                                         break;
5410                         }
5411                         if (WARN_ON(j == band->n_channels))
5412                                 continue;
5413
5414                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
5415                 }
5416                 kfree(pbuf);
5417         }
5418         return err;
5419 }
5420
5421 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
5422 {
5423         u32 band, mimo_bwcap;
5424         int err;
5425
5426         band = WLC_BAND_2G;
5427         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5428         if (!err) {
5429                 bw_cap[IEEE80211_BAND_2GHZ] = band;
5430                 band = WLC_BAND_5G;
5431                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
5432                 if (!err) {
5433                         bw_cap[IEEE80211_BAND_5GHZ] = band;
5434                         return;
5435                 }
5436                 WARN_ON(1);
5437                 return;
5438         }
5439         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
5440         mimo_bwcap = 0;
5441         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
5442         if (err)
5443                 /* assume 20MHz if firmware does not give a clue */
5444                 mimo_bwcap = WLC_N_BW_20ALL;
5445
5446         switch (mimo_bwcap) {
5447         case WLC_N_BW_40ALL:
5448                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
5449                 /* fall-thru */
5450         case WLC_N_BW_20IN2G_40IN5G:
5451                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
5452                 /* fall-thru */
5453         case WLC_N_BW_20ALL:
5454                 bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
5455                 bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
5456                 break;
5457         default:
5458                 brcmf_err("invalid mimo_bw_cap value\n");
5459         }
5460 }
5461
5462 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
5463                                 u32 bw_cap[2], u32 nchain)
5464 {
5465         band->ht_cap.ht_supported = true;
5466         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
5467                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
5468                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5469         }
5470         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
5471         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
5472         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
5473         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
5474         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
5475         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
5476 }
5477
5478 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
5479 {
5480         u16 mcs_map;
5481         int i;
5482
5483         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
5484                 mcs_map = (mcs_map << 2) | supp;
5485
5486         return cpu_to_le16(mcs_map);
5487 }
5488
5489 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
5490                                  u32 bw_cap[2], u32 nchain)
5491 {
5492         __le16 mcs_map;
5493
5494         /* not allowed in 2.4G band */
5495         if (band->band == IEEE80211_BAND_2GHZ)
5496                 return;
5497
5498         band->vht_cap.vht_supported = true;
5499         /* 80MHz is mandatory */
5500         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
5501         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
5502                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
5503                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
5504         }
5505         /* all support 256-QAM */
5506         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
5507         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
5508         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
5509 }
5510
5511 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
5512 {
5513         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
5514         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5515         u32 nmode = 0;
5516         u32 vhtmode = 0;
5517         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
5518         u32 rxchain;
5519         u32 nchain;
5520         int err;
5521         s32 i;
5522         struct ieee80211_supported_band *band;
5523
5524         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
5525         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
5526         if (err) {
5527                 brcmf_err("nmode error (%d)\n", err);
5528         } else {
5529                 brcmf_get_bwcap(ifp, bw_cap);
5530         }
5531         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
5532                   nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
5533                   bw_cap[IEEE80211_BAND_5GHZ]);
5534
5535         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
5536         if (err) {
5537                 brcmf_err("rxchain error (%d)\n", err);
5538                 nchain = 1;
5539         } else {
5540                 for (nchain = 0; rxchain; nchain++)
5541                         rxchain = rxchain & (rxchain - 1);
5542         }
5543         brcmf_dbg(INFO, "nchain=%d\n", nchain);
5544
5545         err = brcmf_construct_chaninfo(cfg, bw_cap);
5546         if (err) {
5547                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
5548                 return err;
5549         }
5550
5551         wiphy = cfg_to_wiphy(cfg);
5552         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
5553                 band = wiphy->bands[i];
5554                 if (band == NULL)
5555                         continue;
5556
5557                 if (nmode)
5558                         brcmf_update_ht_cap(band, bw_cap, nchain);
5559                 if (vhtmode)
5560                         brcmf_update_vht_cap(band, bw_cap, nchain);
5561         }
5562
5563         return 0;
5564 }
5565
5566 static const struct ieee80211_iface_limit brcmf_iface_limits_mbss[] = {
5567         {
5568                 .max = 1,
5569                 .types = BIT(NL80211_IFTYPE_STATION) |
5570                          BIT(NL80211_IFTYPE_ADHOC)
5571         },
5572         {
5573                 .max = 4,
5574                 .types = BIT(NL80211_IFTYPE_AP)
5575         },
5576         {
5577                 .max = 1,
5578                 .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
5579                          BIT(NL80211_IFTYPE_P2P_GO)
5580         },
5581         {
5582                 .max = 1,
5583                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
5584         }
5585 };
5586
5587 static const struct ieee80211_iface_limit brcmf_iface_limits_sbss[] = {
5588         {
5589                 .max = 2,
5590                 .types = BIT(NL80211_IFTYPE_STATION) |
5591                          BIT(NL80211_IFTYPE_ADHOC) |
5592                          BIT(NL80211_IFTYPE_AP)
5593         },
5594         {
5595                 .max = 1,
5596                 .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
5597                          BIT(NL80211_IFTYPE_P2P_GO)
5598         },
5599         {
5600                 .max = 1,
5601                 .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
5602         }
5603 };
5604 static struct ieee80211_iface_combination brcmf_iface_combos[] = {
5605         {
5606                  .max_interfaces = BRCMF_IFACE_MAX_CNT,
5607                  .num_different_channels = 1,
5608                  .n_limits = ARRAY_SIZE(brcmf_iface_limits_sbss),
5609                  .limits = brcmf_iface_limits_sbss,
5610         }
5611 };
5612
5613 static const struct ieee80211_txrx_stypes
5614 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
5615         [NL80211_IFTYPE_STATION] = {
5616                 .tx = 0xffff,
5617                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5618                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5619         },
5620         [NL80211_IFTYPE_P2P_CLIENT] = {
5621                 .tx = 0xffff,
5622                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5623                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5624         },
5625         [NL80211_IFTYPE_P2P_GO] = {
5626                 .tx = 0xffff,
5627                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
5628                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
5629                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
5630                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
5631                       BIT(IEEE80211_STYPE_AUTH >> 4) |
5632                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
5633                       BIT(IEEE80211_STYPE_ACTION >> 4)
5634         },
5635         [NL80211_IFTYPE_P2P_DEVICE] = {
5636                 .tx = 0xffff,
5637                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
5638                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
5639         }
5640 };
5641
5642 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
5643 {
5644         /* scheduled scan settings */
5645         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
5646         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
5647         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
5648         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
5649 }
5650
5651 #ifdef CONFIG_PM
5652 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
5653         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
5654         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
5655         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
5656         .pattern_min_len = 1,
5657         .max_pkt_offset = 1500,
5658 };
5659 #endif
5660
5661 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy)
5662 {
5663 #ifdef CONFIG_PM
5664         /* wowl settings */
5665         wiphy->wowlan = &brcmf_wowlan_support;
5666 #endif
5667 }
5668
5669 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
5670 {
5671         struct ieee80211_iface_combination ifc_combo;
5672         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
5673         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
5674         wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
5675         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
5676                                  BIT(NL80211_IFTYPE_ADHOC) |
5677                                  BIT(NL80211_IFTYPE_AP) |
5678                                  BIT(NL80211_IFTYPE_P2P_CLIENT) |
5679                                  BIT(NL80211_IFTYPE_P2P_GO) |
5680                                  BIT(NL80211_IFTYPE_P2P_DEVICE);
5681         /* need VSDB firmware feature for concurrent channels */
5682         ifc_combo = brcmf_iface_combos[0];
5683         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
5684                 ifc_combo.num_different_channels = 2;
5685         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
5686                 ifc_combo.n_limits = ARRAY_SIZE(brcmf_iface_limits_mbss),
5687                 ifc_combo.limits = brcmf_iface_limits_mbss;
5688         }
5689         wiphy->iface_combinations = kmemdup(&ifc_combo,
5690                                             sizeof(ifc_combo),
5691                                             GFP_KERNEL);
5692         wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
5693         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
5694         wiphy->cipher_suites = __wl_cipher_suites;
5695         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
5696         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
5697                         WIPHY_FLAG_OFFCHAN_TX |
5698                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
5699                         WIPHY_FLAG_SUPPORTS_TDLS;
5700         if (!brcmf_roamoff)
5701                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
5702         wiphy->mgmt_stypes = brcmf_txrx_stypes;
5703         wiphy->max_remain_on_channel_duration = 5000;
5704         brcmf_wiphy_pno_params(wiphy);
5705
5706         /* vendor commands/events support */
5707         wiphy->vendor_commands = brcmf_vendor_cmds;
5708         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
5709
5710         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
5711                 brcmf_wiphy_wowl_params(wiphy);
5712
5713         return brcmf_setup_wiphybands(wiphy);
5714 }
5715
5716 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
5717 {
5718         struct net_device *ndev;
5719         struct wireless_dev *wdev;
5720         struct brcmf_if *ifp;
5721         s32 power_mode;
5722         s32 err = 0;
5723
5724         if (cfg->dongle_up)
5725                 return err;
5726
5727         ndev = cfg_to_ndev(cfg);
5728         wdev = ndev->ieee80211_ptr;
5729         ifp = netdev_priv(ndev);
5730
5731         /* make sure RF is ready for work */
5732         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
5733
5734         brcmf_dongle_scantime(ifp, WL_SCAN_CHANNEL_TIME,
5735                               WL_SCAN_UNASSOC_TIME, WL_SCAN_PASSIVE_TIME);
5736
5737         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
5738         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
5739         if (err)
5740                 goto default_conf_out;
5741         brcmf_dbg(INFO, "power save set to %s\n",
5742                   (power_mode ? "enabled" : "disabled"));
5743
5744         err = brcmf_dongle_roam(ifp, WL_BEACON_TIMEOUT);
5745         if (err)
5746                 goto default_conf_out;
5747         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
5748                                           NULL, NULL);
5749         if (err)
5750                 goto default_conf_out;
5751
5752         brcmf_configure_arp_offload(ifp, true);
5753
5754         cfg->dongle_up = true;
5755 default_conf_out:
5756
5757         return err;
5758
5759 }
5760
5761 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
5762 {
5763         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
5764
5765         return brcmf_config_dongle(ifp->drvr->config);
5766 }
5767
5768 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
5769 {
5770         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5771
5772         /*
5773          * While going down, if associated with AP disassociate
5774          * from AP to save power
5775          */
5776         if (check_vif_up(ifp->vif)) {
5777                 brcmf_link_down(ifp->vif);
5778
5779                 /* Make sure WPA_Supplicant receives all the event
5780                    generated due to DISASSOC call to the fw to keep
5781                    the state fw and WPA_Supplicant state consistent
5782                  */
5783                 brcmf_delay(500);
5784         }
5785
5786         brcmf_abort_scanning(cfg);
5787         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
5788
5789         return 0;
5790 }
5791
5792 s32 brcmf_cfg80211_up(struct net_device *ndev)
5793 {
5794         struct brcmf_if *ifp = netdev_priv(ndev);
5795         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5796         s32 err = 0;
5797
5798         mutex_lock(&cfg->usr_sync);
5799         err = __brcmf_cfg80211_up(ifp);
5800         mutex_unlock(&cfg->usr_sync);
5801
5802         return err;
5803 }
5804
5805 s32 brcmf_cfg80211_down(struct net_device *ndev)
5806 {
5807         struct brcmf_if *ifp = netdev_priv(ndev);
5808         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5809         s32 err = 0;
5810
5811         mutex_lock(&cfg->usr_sync);
5812         err = __brcmf_cfg80211_down(ifp);
5813         mutex_unlock(&cfg->usr_sync);
5814
5815         return err;
5816 }
5817
5818 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
5819 {
5820         struct wireless_dev *wdev = &ifp->vif->wdev;
5821
5822         return wdev->iftype;
5823 }
5824
5825 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
5826                              unsigned long state)
5827 {
5828         struct brcmf_cfg80211_vif *vif;
5829
5830         list_for_each_entry(vif, &cfg->vif_list, list) {
5831                 if (test_bit(state, &vif->sme_state))
5832                         return true;
5833         }
5834         return false;
5835 }
5836
5837 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
5838                                     u8 action)
5839 {
5840         u8 evt_action;
5841
5842         mutex_lock(&event->vif_event_lock);
5843         evt_action = event->action;
5844         mutex_unlock(&event->vif_event_lock);
5845         return evt_action == action;
5846 }
5847
5848 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
5849                                   struct brcmf_cfg80211_vif *vif)
5850 {
5851         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5852
5853         mutex_lock(&event->vif_event_lock);
5854         event->vif = vif;
5855         event->action = 0;
5856         mutex_unlock(&event->vif_event_lock);
5857 }
5858
5859 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
5860 {
5861         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5862         bool armed;
5863
5864         mutex_lock(&event->vif_event_lock);
5865         armed = event->vif != NULL;
5866         mutex_unlock(&event->vif_event_lock);
5867
5868         return armed;
5869 }
5870 int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
5871                                           u8 action, ulong timeout)
5872 {
5873         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5874
5875         return wait_event_timeout(event->vif_wq,
5876                                   vif_event_equals(event, action), timeout);
5877 }
5878
5879 static void brcmf_free_wiphy(struct wiphy *wiphy)
5880 {
5881         kfree(wiphy->iface_combinations);
5882         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
5883                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]->channels);
5884                 kfree(wiphy->bands[IEEE80211_BAND_2GHZ]);
5885         }
5886         if (wiphy->bands[IEEE80211_BAND_5GHZ]) {
5887                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]->channels);
5888                 kfree(wiphy->bands[IEEE80211_BAND_5GHZ]);
5889         }
5890         wiphy_free(wiphy);
5891 }
5892
5893 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
5894                                                   struct device *busdev)
5895 {
5896         struct net_device *ndev = drvr->iflist[0]->ndev;
5897         struct brcmf_cfg80211_info *cfg;
5898         struct wiphy *wiphy;
5899         struct brcmf_cfg80211_vif *vif;
5900         struct brcmf_if *ifp;
5901         s32 err = 0;
5902         s32 io_type;
5903         u16 *cap = NULL;
5904
5905         if (!ndev) {
5906                 brcmf_err("ndev is invalid\n");
5907                 return NULL;
5908         }
5909
5910         ifp = netdev_priv(ndev);
5911         wiphy = wiphy_new(&wl_cfg80211_ops, sizeof(struct brcmf_cfg80211_info));
5912         if (!wiphy) {
5913                 brcmf_err("Could not allocate wiphy device\n");
5914                 return NULL;
5915         }
5916         set_wiphy_dev(wiphy, busdev);
5917
5918         cfg = wiphy_priv(wiphy);
5919         cfg->wiphy = wiphy;
5920         cfg->pub = drvr;
5921         init_vif_event(&cfg->vif_event);
5922         INIT_LIST_HEAD(&cfg->vif_list);
5923
5924         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
5925         if (IS_ERR(vif))
5926                 goto wiphy_out;
5927
5928         vif->ifp = ifp;
5929         vif->wdev.netdev = ndev;
5930         ndev->ieee80211_ptr = &vif->wdev;
5931         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
5932
5933         err = wl_init_priv(cfg);
5934         if (err) {
5935                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
5936                 brcmf_free_vif(vif);
5937                 goto wiphy_out;
5938         }
5939         ifp->vif = vif;
5940
5941         /* determine d11 io type before wiphy setup */
5942         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
5943         if (err) {
5944                 brcmf_err("Failed to get D11 version (%d)\n", err);
5945                 goto priv_out;
5946         }
5947         cfg->d11inf.io_type = (u8)io_type;
5948         brcmu_d11_attach(&cfg->d11inf);
5949
5950         err = brcmf_setup_wiphy(wiphy, ifp);
5951         if (err < 0)
5952                 goto priv_out;
5953
5954         brcmf_dbg(INFO, "Registering custom regulatory\n");
5955         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
5956         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
5957
5958         /* firmware defaults to 40MHz disabled in 2G band. We signal
5959          * cfg80211 here that we do and have it decide we can enable
5960          * it. But first check if device does support 2G operation.
5961          */
5962         if (wiphy->bands[IEEE80211_BAND_2GHZ]) {
5963                 cap = &wiphy->bands[IEEE80211_BAND_2GHZ]->ht_cap.cap;
5964                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5965         }
5966         err = wiphy_register(wiphy);
5967         if (err < 0) {
5968                 brcmf_err("Could not register wiphy device (%d)\n", err);
5969                 goto priv_out;
5970         }
5971
5972         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
5973          * setup 40MHz in 2GHz band and enable OBSS scanning.
5974          */
5975         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
5976                 err = brcmf_enable_bw40_2g(cfg);
5977                 if (!err)
5978                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
5979                                                       BRCMF_OBSS_COEX_AUTO);
5980                 else
5981                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
5982         }
5983
5984         err = brcmf_p2p_attach(cfg);
5985         if (err) {
5986                 brcmf_err("P2P initilisation failed (%d)\n", err);
5987                 goto wiphy_unreg_out;
5988         }
5989         err = brcmf_btcoex_attach(cfg);
5990         if (err) {
5991                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
5992                 brcmf_p2p_detach(&cfg->p2p);
5993                 goto wiphy_unreg_out;
5994         }
5995
5996         err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
5997         if (err) {
5998                 brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
5999                 wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6000         } else {
6001                 brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6002                                     brcmf_notify_tdls_peer_event);
6003         }
6004
6005         return cfg;
6006
6007 wiphy_unreg_out:
6008         wiphy_unregister(cfg->wiphy);
6009 priv_out:
6010         wl_deinit_priv(cfg);
6011         brcmf_free_vif(vif);
6012 wiphy_out:
6013         brcmf_free_wiphy(wiphy);
6014         return NULL;
6015 }
6016
6017 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
6018 {
6019         if (!cfg)
6020                 return;
6021
6022         WARN_ON(!list_empty(&cfg->vif_list));
6023         wiphy_unregister(cfg->wiphy);
6024         brcmf_btcoex_detach(cfg);
6025         brcmf_p2p_detach(&cfg->p2p);
6026         wl_deinit_priv(cfg);
6027         brcmf_free_wiphy(cfg->wiphy);
6028 }