drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41 #include "common.h"
  42
  43 #define BRCMF_SCAN_IE_LEN_MAX           2048
  44 #define BRCMF_PNO_VERSION               2
  45 #define BRCMF_PNO_TIME                  30
  46 #define BRCMF_PNO_REPEAT                4
  47 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  48 #define BRCMF_PNO_MAX_PFN_COUNT         16
  49 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  50 #define BRCMF_PNO_HIDDEN_BIT            2
  51 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  52 #define BRCMF_PNO_SCAN_COMPLETE         1
  53 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  54
  55 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  56 #define WPA_OUI_TYPE                    1
  57 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  58 #define WME_OUI_TYPE                    2
  59 #define WPS_OUI_TYPE                    4
  60
  61 #define VS_IE_FIXED_HDR_LEN             6
  62 #define WPA_IE_VERSION_LEN              2
  63 #define WPA_IE_MIN_OUI_LEN              4
  64 #define WPA_IE_SUITE_COUNT_LEN          2
  65
  66 #define WPA_CIPHER_NONE                 0       /* None */
  67 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  68 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  69 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  70 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  71
  72 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  73 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  74 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  75 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  76 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  77 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  78 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  79 #define RSN_CAP_MFPR_MASK               BIT(6)
  80 #define RSN_CAP_MFPC_MASK               BIT(7)
  81 #define RSN_PMKID_COUNT_LEN             2
  82
  83 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  84                                                  * string :"add", "del" (+ NUL)
  85                                                  */
  86 #define VNDR_IE_COUNT_OFFSET            4
  87 #define VNDR_IE_PKTFLAG_OFFSET          8
  88 #define VNDR_IE_VSIE_OFFSET             12
  89 #define VNDR_IE_HDR_SIZE                12
  90 #define VNDR_IE_PARSE_LIMIT             5
  91
  92 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  93 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  94
  95 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  96 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  97 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  98
  99 #define BRCMF_SCAN_CHANNEL_TIME         40
 100 #define BRCMF_SCAN_UNASSOC_TIME         40
 101 #define BRCMF_SCAN_PASSIVE_TIME         120
 102
 103 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
 104
 105 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 106         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 107
 108 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 109 {
 110         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 111                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 112                           vif->sme_state);
 113                 return false;
 114         }
 115         return true;
 116 }
 117
 118 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 119 #define RATETAB_ENT(_rateid, _flags) \
 120         {                                                               \
 121                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 122                 .hw_value       = (_rateid),                            \
 123                 .flags          = (_flags),                             \
 124         }
 125
 126 static struct ieee80211_rate __wl_rates[] = {
 127         RATETAB_ENT(BRCM_RATE_1M, 0),
 128         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(BRCM_RATE_6M, 0),
 132         RATETAB_ENT(BRCM_RATE_9M, 0),
 133         RATETAB_ENT(BRCM_RATE_12M, 0),
 134         RATETAB_ENT(BRCM_RATE_18M, 0),
 135         RATETAB_ENT(BRCM_RATE_24M, 0),
 136         RATETAB_ENT(BRCM_RATE_36M, 0),
 137         RATETAB_ENT(BRCM_RATE_48M, 0),
 138         RATETAB_ENT(BRCM_RATE_54M, 0),
 139 };
 140
 141 #define wl_g_rates              (__wl_rates + 0)
 142 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 143 #define wl_a_rates              (__wl_rates + 4)
 144 #define wl_a_rates_size         (wl_g_rates_size - 4)
 145
 146 #define CHAN2G(_channel, _freq) {                               \
 147         .band                   = NL80211_BAND_2GHZ,            \
 148         .center_freq            = (_freq),                      \
 149         .hw_value               = (_channel),                   \
 150         .flags                  = IEEE80211_CHAN_DISABLED,      \
 151         .max_antenna_gain       = 0,                            \
 152         .max_power              = 30,                           \
 153 }
 154
 155 #define CHAN5G(_channel) {                                      \
 156         .band                   = NL80211_BAND_5GHZ,            \
 157         .center_freq            = 5000 + (5 * (_channel)),      \
 158         .hw_value               = (_channel),                   \
 159         .flags                  = IEEE80211_CHAN_DISABLED,      \
 160         .max_antenna_gain       = 0,                            \
 161         .max_power              = 30,                           \
 162 }
 163
 164 static struct ieee80211_channel __wl_2ghz_channels[] = {
 165         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 166         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 167         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 168         CHAN2G(13, 2472), CHAN2G(14, 2484)
 169 };
 170
 171 static struct ieee80211_channel __wl_5ghz_channels[] = {
 172         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 173         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 174         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 175         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 176         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 177         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 178 };
 179
 180 /* Band templates duplicated per wiphy. The channel info
 181  * above is added to the band during setup.
 182  */
 183 static const struct ieee80211_supported_band __wl_band_2ghz = {
 184         .band = NL80211_BAND_2GHZ,
 185         .bitrates = wl_g_rates,
 186         .n_bitrates = wl_g_rates_size,
 187 };
 188
 189 static const struct ieee80211_supported_band __wl_band_5ghz = {
 190         .band = NL80211_BAND_5GHZ,
 191         .bitrates = wl_a_rates,
 192         .n_bitrates = wl_a_rates_size,
 193 };
 194
 195 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 196  * By default world regulatory domain defined in reg.c puts the flags
 197  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 198  * With respect to these flags, wpa_supplicant doesn't * start p2p
 199  * operations on 5GHz channels. All the changes in world regulatory
 200  * domain are to be done here.
 201  */
 202 static const struct ieee80211_regdomain brcmf_regdom = {
 203         .n_reg_rules = 4,
 204         .alpha2 =  "99",
 205         .reg_rules = {
 206                 /* IEEE 802.11b/g, channels 1..11 */
 207                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 208                 /* If any */
 209                 /* IEEE 802.11 channel 14 - Only JP enables
 210                  * this and for 802.11b only
 211                  */
 212                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 213                 /* IEEE 802.11a, channel 36..64 */
 214                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 215                 /* IEEE 802.11a, channel 100..165 */
 216                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 217 };
 218
 219 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 220  * are supported. A pointer to this array and the number of entries is passed
 221  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 222  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 223  * device does not support MFP then the number of suites will be decreased by 1
 224  */
 225 static const u32 brcmf_cipher_suites[] = {
 226         WLAN_CIPHER_SUITE_WEP40,
 227         WLAN_CIPHER_SUITE_WEP104,
 228         WLAN_CIPHER_SUITE_TKIP,
 229         WLAN_CIPHER_SUITE_CCMP,
 230         /* Keep as last entry: */
 231         WLAN_CIPHER_SUITE_AES_CMAC
 232 };
 233
 234 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 235 struct brcmf_vs_tlv {
 236         u8 id;
 237         u8 len;
 238         u8 oui[3];
 239         u8 oui_type;
 240 };
 241
 242 struct parsed_vndr_ie_info {
 243         u8 *ie_ptr;
 244         u32 ie_len;     /* total length including id & length field */
 245         struct brcmf_vs_tlv vndrie;
 246 };
 247
 248 struct parsed_vndr_ies {
 249         u32 count;
 250         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 251 };
 252
 253 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 254 {
 255         switch (band) {
 256         case NL80211_BAND_2GHZ:
 257                 return WLC_BAND_2G;
 258         case NL80211_BAND_5GHZ:
 259                 return WLC_BAND_5G;
 260         default:
 261                 WARN_ON(1);
 262                 break;
 263         }
 264         return 0;
 265 }
 266
 267 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 268                                struct cfg80211_chan_def *ch)
 269 {
 270         struct brcmu_chan ch_inf;
 271         s32 primary_offset;
 272
 273         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 274                   ch->chan->center_freq, ch->center_freq1, ch->width);
 275         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 276         primary_offset = ch->chan->center_freq - ch->center_freq1;
 277         switch (ch->width) {
 278         case NL80211_CHAN_WIDTH_20:
 279         case NL80211_CHAN_WIDTH_20_NOHT:
 280                 ch_inf.bw = BRCMU_CHAN_BW_20;
 281                 WARN_ON(primary_offset != 0);
 282                 break;
 283         case NL80211_CHAN_WIDTH_40:
 284                 ch_inf.bw = BRCMU_CHAN_BW_40;
 285                 if (primary_offset > 0)
 286                         ch_inf.sb = BRCMU_CHAN_SB_U;
 287                 else
 288                         ch_inf.sb = BRCMU_CHAN_SB_L;
 289                 break;
 290         case NL80211_CHAN_WIDTH_80:
 291                 ch_inf.bw = BRCMU_CHAN_BW_80;
 292                 if (primary_offset == -30)
 293                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 294                 else if (primary_offset == -10)
 295                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 296                 else if (primary_offset == 10)
 297                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 298                 else
 299                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 300                 break;
 301         case NL80211_CHAN_WIDTH_80P80:
 302         case NL80211_CHAN_WIDTH_160:
 303         case NL80211_CHAN_WIDTH_5:
 304         case NL80211_CHAN_WIDTH_10:
 305         default:
 306                 WARN_ON_ONCE(1);
 307         }
 308         switch (ch->chan->band) {
 309         case NL80211_BAND_2GHZ:
 310                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 311                 break;
 312         case NL80211_BAND_5GHZ:
 313                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 314                 break;
 315         case NL80211_BAND_60GHZ:
 316         default:
 317                 WARN_ON_ONCE(1);
 318         }
 319         d11inf->encchspec(&ch_inf);
 320
 321         return ch_inf.chspec;
 322 }
 323
 324 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 325                         struct ieee80211_channel *ch)
 326 {
 327         struct brcmu_chan ch_inf;
 328
 329         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 330         ch_inf.bw = BRCMU_CHAN_BW_20;
 331         d11inf->encchspec(&ch_inf);
 332
 333         return ch_inf.chspec;
 334 }
 335
 336 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 337  * triples, returning a pointer to the substring whose first element
 338  * matches tag
 339  */
 340 const struct brcmf_tlv *
 341 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 342 {
 343         const struct brcmf_tlv *elt = buf;
 344         int totlen = buflen;
 345
 346         /* find tagged parameter */
 347         while (totlen >= TLV_HDR_LEN) {
 348                 int len = elt->len;
 349
 350                 /* validate remaining totlen */
 351                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 352                         return elt;
 353
 354                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 355                 totlen -= (len + TLV_HDR_LEN);
 356         }
 357
 358         return NULL;
 359 }
 360
 361 /* Is any of the tlvs the expected entry? If
 362  * not update the tlvs buffer pointer/length.
 363  */
 364 static bool
 365 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 366                  const u8 *oui, u32 oui_len, u8 type)
 367 {
 368         /* If the contents match the OUI and the type */
 369         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 370             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 371             type == ie[TLV_BODY_OFF + oui_len]) {
 372                 return true;
 373         }
 374
 375         if (tlvs == NULL)
 376                 return false;
 377         /* point to the next ie */
 378         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 379         /* calculate the length of the rest of the buffer */
 380         *tlvs_len -= (int)(ie - *tlvs);
 381         /* update the pointer to the start of the buffer */
 382         *tlvs = ie;
 383
 384         return false;
 385 }
 386
 387 static struct brcmf_vs_tlv *
 388 brcmf_find_wpaie(const u8 *parse, u32 len)
 389 {
 390         const struct brcmf_tlv *ie;
 391
 392         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 393                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 394                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 395                         return (struct brcmf_vs_tlv *)ie;
 396         }
 397         return NULL;
 398 }
 399
 400 static struct brcmf_vs_tlv *
 401 brcmf_find_wpsie(const u8 *parse, u32 len)
 402 {
 403         const struct brcmf_tlv *ie;
 404
 405         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 406                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 407                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 408                         return (struct brcmf_vs_tlv *)ie;
 409         }
 410         return NULL;
 411 }
 412
 413 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 414                                      struct brcmf_cfg80211_vif *vif,
 415                                      enum nl80211_iftype new_type)
 416 {
 417         int iftype_num[NUM_NL80211_IFTYPES];
 418         struct brcmf_cfg80211_vif *pos;
 419         bool check_combos = false;
 420         int ret = 0;
 421
 422         memset(&iftype_num[0], 0, sizeof(iftype_num));
 423         list_for_each_entry(pos, &cfg->vif_list, list)
 424                 if (pos == vif) {
 425                         iftype_num[new_type]++;
 426                 } else {
 427                         /* concurrent interfaces so need check combinations */
 428                         check_combos = true;
 429                         iftype_num[pos->wdev.iftype]++;
 430                 }
 431
 432         if (check_combos)
 433                 ret = cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 434
 435         return ret;
 436 }
 437
 438 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 439                                   enum nl80211_iftype new_type)
 440 {
 441         int iftype_num[NUM_NL80211_IFTYPES];
 442         struct brcmf_cfg80211_vif *pos;
 443
 444         memset(&iftype_num[0], 0, sizeof(iftype_num));
 445         list_for_each_entry(pos, &cfg->vif_list, list)
 446                 iftype_num[pos->wdev.iftype]++;
 447
 448         iftype_num[new_type]++;
 449         return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 450 }
 451
 452 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 453                                  struct brcmf_wsec_key_le *key_le)
 454 {
 455         key_le->index = cpu_to_le32(key->index);
 456         key_le->len = cpu_to_le32(key->len);
 457         key_le->algo = cpu_to_le32(key->algo);
 458         key_le->flags = cpu_to_le32(key->flags);
 459         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 460         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 461         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 462         memcpy(key_le->data, key->data, sizeof(key->data));
 463         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 464 }
 465
 466 static int
 467 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 468 {
 469         int err;
 470         struct brcmf_wsec_key_le key_le;
 471
 472         convert_key_from_CPU(key, &key_le);
 473
 474         brcmf_netdev_wait_pend8021x(ifp);
 475
 476         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 477                                         sizeof(key_le));
 478
 479         if (err)
 480                 brcmf_err("wsec_key error (%d)\n", err);
 481         return err;
 482 }
 483
 484 static s32
 485 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 486 {
 487         s32 err;
 488         u32 mode;
 489
 490         if (enable)
 491                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 492         else
 493                 mode = 0;
 494
 495         /* Try to set and enable ARP offload feature, this may fail, then it  */
 496         /* is simply not supported and err 0 will be returned                 */
 497         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 498         if (err) {
 499                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 500                           mode, err);
 501                 err = 0;
 502         } else {
 503                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 504                 if (err) {
 505                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 506                                   enable, err);
 507                         err = 0;
 508                 } else
 509                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 510                                   enable, mode);
 511         }
 512
 513         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 514         if (err) {
 515                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 516                           enable, err);
 517                 err = 0;
 518         } else
 519                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 520                           enable, mode);
 521
 522         return err;
 523 }
 524
 525 static void
 526 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 527 {
 528         struct brcmf_cfg80211_vif *vif;
 529         struct brcmf_if *ifp;
 530
 531         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 532         ifp = vif->ifp;
 533
 534         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 535             (wdev->iftype == NL80211_IFTYPE_AP) ||
 536             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 537                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 538                                                 ADDR_DIRECT);
 539         else
 540                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 541                                                 ADDR_INDIRECT);
 542 }
 543
 544 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 545 {
 546         int bsscfgidx;
 547
 548         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 549                 /* bsscfgidx 1 is reserved for legacy P2P */
 550                 if (bsscfgidx == 1)
 551                         continue;
 552                 if (!drvr->iflist[bsscfgidx])
 553                         return bsscfgidx;
 554         }
 555
 556         return -ENOMEM;
 557 }
 558
 559 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 560 {
 561         struct brcmf_mbss_ssid_le mbss_ssid_le;
 562         int bsscfgidx;
 563         int err;
 564
 565         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 566         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 567         if (bsscfgidx < 0)
 568                 return bsscfgidx;
 569
 570         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 571         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 572         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 573
 574         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 575                                         sizeof(mbss_ssid_le));
 576         if (err < 0)
 577                 brcmf_err("setting ssid failed %d\n", err);
 578
 579         return err;
 580 }
 581
 582 /**
 583  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 584  *
 585  * @wiphy: wiphy device of new interface.
 586  * @name: name of the new interface.
 587  * @flags: not used.
 588  * @params: contains mac address for AP device.
 589  */
 590 static
 591 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 592                                       u32 *flags, struct vif_params *params)
 593 {
 594         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 595         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 596         struct brcmf_cfg80211_vif *vif;
 597         int err;
 598
 599         if (brcmf_cfg80211_vif_event_armed(cfg))
 600                 return ERR_PTR(-EBUSY);
 601
 602         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 603
 604         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 605         if (IS_ERR(vif))
 606                 return (struct wireless_dev *)vif;
 607
 608         brcmf_cfg80211_arm_vif_event(cfg, vif);
 609
 610         err = brcmf_cfg80211_request_ap_if(ifp);
 611         if (err) {
 612                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 613                 goto fail;
 614         }
 615
 616         /* wait for firmware event */
 617         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 618                                             BRCMF_VIF_EVENT_TIMEOUT);
 619         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 620         if (!err) {
 621                 brcmf_err("timeout occurred\n");
 622                 err = -EIO;
 623                 goto fail;
 624         }
 625
 626         /* interface created in firmware */
 627         ifp = vif->ifp;
 628         if (!ifp) {
 629                 brcmf_err("no if pointer provided\n");
 630                 err = -ENOENT;
 631                 goto fail;
 632         }
 633
 634         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 635         err = brcmf_net_attach(ifp, true);
 636         if (err) {
 637                 brcmf_err("Registering netdevice failed\n");
 638                 goto fail;
 639         }
 640
 641         return &ifp->vif->wdev;
 642
 643 fail:
 644         brcmf_free_vif(vif);
 645         return ERR_PTR(err);
 646 }
 647
 648 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 649 {
 650         enum nl80211_iftype iftype;
 651
 652         iftype = vif->wdev.iftype;
 653         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 654 }
 655
 656 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 657 {
 658         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 659 }
 660
 661 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 662                                                      const char *name,
 663                                                      unsigned char name_assign_type,
 664                                                      enum nl80211_iftype type,
 665                                                      u32 *flags,
 666                                                      struct vif_params *params)
 667 {
 668         struct wireless_dev *wdev;
 669         int err;
 670
 671         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 672         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 673         if (err) {
 674                 brcmf_err("iface validation failed: err=%d\n", err);
 675                 return ERR_PTR(err);
 676         }
 677         switch (type) {
 678         case NL80211_IFTYPE_ADHOC:
 679         case NL80211_IFTYPE_STATION:
 680         case NL80211_IFTYPE_AP_VLAN:
 681         case NL80211_IFTYPE_WDS:
 682         case NL80211_IFTYPE_MONITOR:
 683         case NL80211_IFTYPE_MESH_POINT:
 684                 return ERR_PTR(-EOPNOTSUPP);
 685         case NL80211_IFTYPE_AP:
 686                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 687                 break;
 688         case NL80211_IFTYPE_P2P_CLIENT:
 689         case NL80211_IFTYPE_P2P_GO:
 690         case NL80211_IFTYPE_P2P_DEVICE:
 691                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, flags, params);
 692                 break;
 693         case NL80211_IFTYPE_UNSPECIFIED:
 694         default:
 695                 return ERR_PTR(-EINVAL);
 696         }
 697
 698         if (IS_ERR(wdev))
 699                 brcmf_err("add iface %s type %d failed: err=%d\n",
 700                           name, type, (int)PTR_ERR(wdev));
 701         else
 702                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 703
 704         return wdev;
 705 }
 706
 707 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 708 {
 709         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 710                 brcmf_set_mpc(ifp, mpc);
 711 }
 712
 713 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 714 {
 715         s32 err = 0;
 716
 717         if (check_vif_up(ifp->vif)) {
 718                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 719                 if (err) {
 720                         brcmf_err("fail to set mpc\n");
 721                         return;
 722                 }
 723                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 724         }
 725 }
 726
 727 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 728                                 struct brcmf_if *ifp, bool aborted,
 729                                 bool fw_abort)
 730 {
 731         struct brcmf_scan_params_le params_le;
 732         struct cfg80211_scan_request *scan_request;
 733         s32 err = 0;
 734
 735         brcmf_dbg(SCAN, "Enter\n");
 736
 737         /* clear scan request, because the FW abort can cause a second call */
 738         /* to this functon and might cause a double cfg80211_scan_done      */
 739         scan_request = cfg->scan_request;
 740         cfg->scan_request = NULL;
 741
 742         if (timer_pending(&cfg->escan_timeout))
 743                 del_timer_sync(&cfg->escan_timeout);
 744
 745         if (fw_abort) {
 746                 /* Do a scan abort to stop the driver's scan engine */
 747                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 748                 memset(&params_le, 0, sizeof(params_le));
 749                 eth_broadcast_addr(params_le.bssid);
 750                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 751                 params_le.scan_type = 0;
 752                 params_le.channel_num = cpu_to_le32(1);
 753                 params_le.nprobes = cpu_to_le32(1);
 754                 params_le.active_time = cpu_to_le32(-1);
 755                 params_le.passive_time = cpu_to_le32(-1);
 756                 params_le.home_time = cpu_to_le32(-1);
 757                 /* Scan is aborted by setting channel_list[0] to -1 */
 758                 params_le.channel_list[0] = cpu_to_le16(-1);
 759                 /* E-Scan (or anyother type) can be aborted by SCAN */
 760                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 761                                              &params_le, sizeof(params_le));
 762                 if (err)
 763                         brcmf_err("Scan abort  failed\n");
 764         }
 765
 766         brcmf_scan_config_mpc(ifp, 1);
 767
 768         /*
 769          * e-scan can be initiated by scheduled scan
 770          * which takes precedence.
 771          */
 772         if (cfg->sched_escan) {
 773                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 774                 cfg->sched_escan = false;
 775                 if (!aborted)
 776                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 777         } else if (scan_request) {
 778                 struct cfg80211_scan_info info = {
 779                         .aborted = aborted,
 780                 };
 781
 782                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 783                           aborted ? "Aborted" : "Done");
 784                 cfg80211_scan_done(scan_request, &info);
 785         }
 786         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 787                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 788
 789         return err;
 790 }
 791
 792 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 793                                        struct wireless_dev *wdev)
 794 {
 795         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 796         struct net_device *ndev = wdev->netdev;
 797         struct brcmf_if *ifp = netdev_priv(ndev);
 798         int ret;
 799         int err;
 800
 801         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 802
 803         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 804         if (err) {
 805                 brcmf_err("interface_remove failed %d\n", err);
 806                 goto err_unarm;
 807         }
 808
 809         /* wait for firmware event */
 810         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 811                                             BRCMF_VIF_EVENT_TIMEOUT);
 812         if (!ret) {
 813                 brcmf_err("timeout occurred\n");
 814                 err = -EIO;
 815                 goto err_unarm;
 816         }
 817
 818         brcmf_remove_interface(ifp, true);
 819
 820 err_unarm:
 821         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 822         return err;
 823 }
 824
 825 static
 826 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 827 {
 828         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 829         struct net_device *ndev = wdev->netdev;
 830
 831         if (ndev && ndev == cfg_to_ndev(cfg))
 832                 return -ENOTSUPP;
 833
 834         /* vif event pending in firmware */
 835         if (brcmf_cfg80211_vif_event_armed(cfg))
 836                 return -EBUSY;
 837
 838         if (ndev) {
 839                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 840                     cfg->escan_info.ifp == netdev_priv(ndev))
 841                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 842                                                     true, true);
 843
 844                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 845         }
 846
 847         switch (wdev->iftype) {
 848         case NL80211_IFTYPE_ADHOC:
 849         case NL80211_IFTYPE_STATION:
 850         case NL80211_IFTYPE_AP_VLAN:
 851         case NL80211_IFTYPE_WDS:
 852         case NL80211_IFTYPE_MONITOR:
 853         case NL80211_IFTYPE_MESH_POINT:
 854                 return -EOPNOTSUPP;
 855         case NL80211_IFTYPE_AP:
 856                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 857         case NL80211_IFTYPE_P2P_CLIENT:
 858         case NL80211_IFTYPE_P2P_GO:
 859         case NL80211_IFTYPE_P2P_DEVICE:
 860                 return brcmf_p2p_del_vif(wiphy, wdev);
 861         case NL80211_IFTYPE_UNSPECIFIED:
 862         default:
 863                 return -EINVAL;
 864         }
 865         return -EOPNOTSUPP;
 866 }
 867
 868 static s32
 869 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 870                          enum nl80211_iftype type, u32 *flags,
 871                          struct vif_params *params)
 872 {
 873         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 874         struct brcmf_if *ifp = netdev_priv(ndev);
 875         struct brcmf_cfg80211_vif *vif = ifp->vif;
 876         s32 infra = 0;
 877         s32 ap = 0;
 878         s32 err = 0;
 879
 880         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 881                   type);
 882
 883         /* WAR: There are a number of p2p interface related problems which
 884          * need to be handled initially (before doing the validate).
 885          * wpa_supplicant tends to do iface changes on p2p device/client/go
 886          * which are not always possible/allowed. However we need to return
 887          * OK otherwise the wpa_supplicant wont start. The situation differs
 888          * on configuration and setup (p2pon=1 module param). The first check
 889          * is to see if the request is a change to station for p2p iface.
 890          */
 891         if ((type == NL80211_IFTYPE_STATION) &&
 892             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 893              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 894              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 895                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 896                 /* Now depending on whether module param p2pon=1 was used the
 897                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 898                  * that if p2pon=1 is used, but a newer supplicant is used then
 899                  * we should return an error, as this combination wont work.
 900                  * In other situations 0 is returned and supplicant will start
 901                  * normally. It will give a trace in cfg80211, but it is the
 902                  * only way to get it working. Unfortunately this will result
 903                  * in situation where we wont support new supplicant in
 904                  * combination with module param p2pon=1, but that is the way
 905                  * it is. If the user tries this then unloading of driver might
 906                  * fail/lock.
 907                  */
 908                 if (cfg->p2p.p2pdev_dynamically)
 909                         return -EOPNOTSUPP;
 910                 else
 911                         return 0;
 912         }
 913         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 914         if (err) {
 915                 brcmf_err("iface validation failed: err=%d\n", err);
 916                 return err;
 917         }
 918         switch (type) {
 919         case NL80211_IFTYPE_MONITOR:
 920         case NL80211_IFTYPE_WDS:
 921                 brcmf_err("type (%d) : currently we do not support this type\n",
 922                           type);
 923                 return -EOPNOTSUPP;
 924         case NL80211_IFTYPE_ADHOC:
 925                 infra = 0;
 926                 break;
 927         case NL80211_IFTYPE_STATION:
 928                 infra = 1;
 929                 break;
 930         case NL80211_IFTYPE_AP:
 931         case NL80211_IFTYPE_P2P_GO:
 932                 ap = 1;
 933                 break;
 934         default:
 935                 err = -EINVAL;
 936                 goto done;
 937         }
 938
 939         if (ap) {
 940                 if (type == NL80211_IFTYPE_P2P_GO) {
 941                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 942                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 943                 }
 944                 if (!err) {
 945                         brcmf_dbg(INFO, "IF Type = AP\n");
 946                 }
 947         } else {
 948                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 949                 if (err) {
 950                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 951                         err = -EAGAIN;
 952                         goto done;
 953                 }
 954                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 955                           "Adhoc" : "Infra");
 956         }
 957         ndev->ieee80211_ptr->iftype = type;
 958
 959         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 960
 961 done:
 962         brcmf_dbg(TRACE, "Exit\n");
 963
 964         return err;
 965 }
 966
 967 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 968                              struct brcmf_scan_params_le *params_le,
 969                              struct cfg80211_scan_request *request)
 970 {
 971         u32 n_ssids;
 972         u32 n_channels;
 973         s32 i;
 974         s32 offset;
 975         u16 chanspec;
 976         char *ptr;
 977         struct brcmf_ssid_le ssid_le;
 978
 979         eth_broadcast_addr(params_le->bssid);
 980         params_le->bss_type = DOT11_BSSTYPE_ANY;
 981         params_le->scan_type = 0;
 982         params_le->channel_num = 0;
 983         params_le->nprobes = cpu_to_le32(-1);
 984         params_le->active_time = cpu_to_le32(-1);
 985         params_le->passive_time = cpu_to_le32(-1);
 986         params_le->home_time = cpu_to_le32(-1);
 987         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 988
 989         /* if request is null exit so it will be all channel broadcast scan */
 990         if (!request)
 991                 return;
 992
 993         n_ssids = request->n_ssids;
 994         n_channels = request->n_channels;
 995         /* Copy channel array if applicable */
 996         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 997                   n_channels);
 998         if (n_channels > 0) {
 999                 for (i = 0; i < n_channels; i++) {
1000                         chanspec = channel_to_chanspec(&cfg->d11inf,
1001                                                        request->channels[i]);
1002                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1003                                   request->channels[i]->hw_value, chanspec);
1004                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1005                 }
1006         } else {
1007                 brcmf_dbg(SCAN, "Scanning all channels\n");
1008         }
1009         /* Copy ssid array if applicable */
1010         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1011         if (n_ssids > 0) {
1012                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1013                                 n_channels * sizeof(u16);
1014                 offset = roundup(offset, sizeof(u32));
1015                 ptr = (char *)params_le + offset;
1016                 for (i = 0; i < n_ssids; i++) {
1017                         memset(&ssid_le, 0, sizeof(ssid_le));
1018                         ssid_le.SSID_len =
1019                                         cpu_to_le32(request->ssids[i].ssid_len);
1020                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1021                                request->ssids[i].ssid_len);
1022                         if (!ssid_le.SSID_len)
1023                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1024                         else
1025                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
1026                                           i, ssid_le.SSID, ssid_le.SSID_len);
1027                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1028                         ptr += sizeof(ssid_le);
1029                 }
1030         } else {
1031                 brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
1032                 if ((request->ssids) && request->ssids->ssid_len) {
1033                         brcmf_dbg(SCAN, "SSID %s len=%d\n",
1034                                   params_le->ssid_le.SSID,
1035                                   request->ssids->ssid_len);
1036                         params_le->ssid_le.SSID_len =
1037                                 cpu_to_le32(request->ssids->ssid_len);
1038                         memcpy(&params_le->ssid_le.SSID, request->ssids->ssid,
1039                                 request->ssids->ssid_len);
1040                 }
1041         }
1042         /* Adding mask to channel numbers */
1043         params_le->channel_num =
1044                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1045                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1046 }
1047
1048 static s32
1049 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1050                 struct cfg80211_scan_request *request)
1051 {
1052         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1053                           offsetof(struct brcmf_escan_params_le, params_le);
1054         struct brcmf_escan_params_le *params;
1055         s32 err = 0;
1056
1057         brcmf_dbg(SCAN, "E-SCAN START\n");
1058
1059         if (request != NULL) {
1060                 /* Allocate space for populating ssids in struct */
1061                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1062
1063                 /* Allocate space for populating ssids in struct */
1064                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1065         }
1066
1067         params = kzalloc(params_size, GFP_KERNEL);
1068         if (!params) {
1069                 err = -ENOMEM;
1070                 goto exit;
1071         }
1072         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1073         brcmf_escan_prep(cfg, &params->params_le, request);
1074         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1075         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1076         params->sync_id = cpu_to_le16(0x1234);
1077
1078         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1079         if (err) {
1080                 if (err == -EBUSY)
1081                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1082                 else
1083                         brcmf_err("error (%d)\n", err);
1084         }
1085
1086         kfree(params);
1087 exit:
1088         return err;
1089 }
1090
1091 static s32
1092 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
1093                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1094 {
1095         s32 err;
1096         u32 passive_scan;
1097         struct brcmf_scan_results *results;
1098         struct escan_info *escan = &cfg->escan_info;
1099
1100         brcmf_dbg(SCAN, "Enter\n");
1101         escan->ifp = ifp;
1102         escan->wiphy = wiphy;
1103         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1104         passive_scan = cfg->active_scan ? 0 : 1;
1105         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1106                                     passive_scan);
1107         if (err) {
1108                 brcmf_err("error (%d)\n", err);
1109                 return err;
1110         }
1111         brcmf_scan_config_mpc(ifp, 0);
1112         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1113         results->version = 0;
1114         results->count = 0;
1115         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1116
1117         err = escan->run(cfg, ifp, request);
1118         if (err)
1119                 brcmf_scan_config_mpc(ifp, 1);
1120         return err;
1121 }
1122
1123 static s32
1124 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1125                      struct cfg80211_scan_request *request,
1126                      struct cfg80211_ssid *this_ssid)
1127 {
1128         struct brcmf_if *ifp = vif->ifp;
1129         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1130         struct cfg80211_ssid *ssids;
1131         u32 passive_scan;
1132         bool escan_req;
1133         bool spec_scan;
1134         s32 err;
1135         struct brcmf_ssid_le ssid_le;
1136         u32 SSID_len;
1137
1138         brcmf_dbg(SCAN, "START ESCAN\n");
1139
1140         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1141                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1142                 return -EAGAIN;
1143         }
1144         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1145                 brcmf_err("Scanning being aborted: status (%lu)\n",
1146                           cfg->scan_status);
1147                 return -EAGAIN;
1148         }
1149         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1150                 brcmf_err("Scanning suppressed: status (%lu)\n",
1151                           cfg->scan_status);
1152                 return -EAGAIN;
1153         }
1154         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1155                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1156                 return -EAGAIN;
1157         }
1158
1159         /* If scan req comes for p2p0, send it over primary I/F */
1160         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1161                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1162
1163         escan_req = false;
1164         if (request) {
1165                 /* scan bss */
1166                 ssids = request->ssids;
1167                 escan_req = true;
1168         } else {
1169                 /* scan in ibss */
1170                 /* we don't do escan in ibss */
1171                 ssids = this_ssid;
1172         }
1173
1174         cfg->scan_request = request;
1175         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1176         if (escan_req) {
1177                 cfg->escan_info.run = brcmf_run_escan;
1178                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1179                 if (err)
1180                         goto scan_out;
1181
1182                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1183                 if (err)
1184                         goto scan_out;
1185         } else {
1186                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1187                           ssids->ssid, ssids->ssid_len);
1188                 memset(&ssid_le, 0, sizeof(ssid_le));
1189                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1190                 ssid_le.SSID_len = cpu_to_le32(0);
1191                 spec_scan = false;
1192                 if (SSID_len) {
1193                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1194                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1195                         spec_scan = true;
1196                 } else
1197                         brcmf_dbg(SCAN, "Broadcast scan\n");
1198
1199                 passive_scan = cfg->active_scan ? 0 : 1;
1200                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1201                                             passive_scan);
1202                 if (err) {
1203                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1204                         goto scan_out;
1205                 }
1206                 brcmf_scan_config_mpc(ifp, 0);
1207                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1208                                              sizeof(ssid_le));
1209                 if (err) {
1210                         if (err == -EBUSY)
1211                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1212                                           ssid_le.SSID);
1213                         else
1214                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1215
1216                         brcmf_scan_config_mpc(ifp, 1);
1217                         goto scan_out;
1218                 }
1219         }
1220
1221         /* Arm scan timeout timer */
1222         mod_timer(&cfg->escan_timeout, jiffies +
1223                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1224
1225         return 0;
1226
1227 scan_out:
1228         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1229         cfg->scan_request = NULL;
1230         return err;
1231 }
1232
1233 static s32
1234 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1235 {
1236         struct brcmf_cfg80211_vif *vif;
1237         s32 err = 0;
1238
1239         brcmf_dbg(TRACE, "Enter\n");
1240         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1241         if (!check_vif_up(vif))
1242                 return -EIO;
1243
1244         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1245
1246         if (err)
1247                 brcmf_err("scan error (%d)\n", err);
1248
1249         brcmf_dbg(TRACE, "Exit\n");
1250         return err;
1251 }
1252
1253 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1254 {
1255         s32 err = 0;
1256
1257         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1258                                       rts_threshold);
1259         if (err)
1260                 brcmf_err("Error (%d)\n", err);
1261
1262         return err;
1263 }
1264
1265 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1266 {
1267         s32 err = 0;
1268
1269         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1270                                       frag_threshold);
1271         if (err)
1272                 brcmf_err("Error (%d)\n", err);
1273
1274         return err;
1275 }
1276
1277 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1278 {
1279         s32 err = 0;
1280         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1281
1282         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1283         if (err) {
1284                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1285                 return err;
1286         }
1287         return err;
1288 }
1289
1290 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1291 {
1292         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1293         struct net_device *ndev = cfg_to_ndev(cfg);
1294         struct brcmf_if *ifp = netdev_priv(ndev);
1295         s32 err = 0;
1296
1297         brcmf_dbg(TRACE, "Enter\n");
1298         if (!check_vif_up(ifp->vif))
1299                 return -EIO;
1300
1301         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1302             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1303                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1304                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1305                 if (!err)
1306                         goto done;
1307         }
1308         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1309             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1310                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1311                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1312                 if (!err)
1313                         goto done;
1314         }
1315         if (changed & WIPHY_PARAM_RETRY_LONG
1316             && (cfg->conf->retry_long != wiphy->retry_long)) {
1317                 cfg->conf->retry_long = wiphy->retry_long;
1318                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1319                 if (!err)
1320                         goto done;
1321         }
1322         if (changed & WIPHY_PARAM_RETRY_SHORT
1323             && (cfg->conf->retry_short != wiphy->retry_short)) {
1324                 cfg->conf->retry_short = wiphy->retry_short;
1325                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1326                 if (!err)
1327                         goto done;
1328         }
1329
1330 done:
1331         brcmf_dbg(TRACE, "Exit\n");
1332         return err;
1333 }
1334
1335 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1336 {
1337         memset(prof, 0, sizeof(*prof));
1338 }
1339
1340 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1341 {
1342         u16 reason;
1343
1344         switch (e->event_code) {
1345         case BRCMF_E_DEAUTH:
1346         case BRCMF_E_DEAUTH_IND:
1347         case BRCMF_E_DISASSOC_IND:
1348                 reason = e->reason;
1349                 break;
1350         case BRCMF_E_LINK:
1351         default:
1352                 reason = 0;
1353                 break;
1354         }
1355         return reason;
1356 }
1357
1358 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1359 {
1360         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1361         s32 err = 0;
1362
1363         brcmf_dbg(TRACE, "Enter\n");
1364
1365         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1366                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1367                 err = brcmf_fil_cmd_data_set(vif->ifp,
1368                                              BRCMF_C_DISASSOC, NULL, 0);
1369                 if (err) {
1370                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1371                 }
1372                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1373                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1374                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1375                                               true, GFP_KERNEL);
1376         }
1377         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1378         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1379         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1380         brcmf_dbg(TRACE, "Exit\n");
1381 }
1382
1383 static s32
1384 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1385                       struct cfg80211_ibss_params *params)
1386 {
1387         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1388         struct brcmf_if *ifp = netdev_priv(ndev);
1389         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1390         struct brcmf_join_params join_params;
1391         size_t join_params_size = 0;
1392         s32 err = 0;
1393         s32 wsec = 0;
1394         s32 bcnprd;
1395         u16 chanspec;
1396         u32 ssid_len;
1397
1398         brcmf_dbg(TRACE, "Enter\n");
1399         if (!check_vif_up(ifp->vif))
1400                 return -EIO;
1401
1402         if (params->ssid)
1403                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1404         else {
1405                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1406                 return -EOPNOTSUPP;
1407         }
1408
1409         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1410
1411         if (params->bssid)
1412                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1413         else
1414                 brcmf_dbg(CONN, "No BSSID specified\n");
1415
1416         if (params->chandef.chan)
1417                 brcmf_dbg(CONN, "channel: %d\n",
1418                           params->chandef.chan->center_freq);
1419         else
1420                 brcmf_dbg(CONN, "no channel specified\n");
1421
1422         if (params->channel_fixed)
1423                 brcmf_dbg(CONN, "fixed channel required\n");
1424         else
1425                 brcmf_dbg(CONN, "no fixed channel required\n");
1426
1427         if (params->ie && params->ie_len)
1428                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1429         else
1430                 brcmf_dbg(CONN, "no ie specified\n");
1431
1432         if (params->beacon_interval)
1433                 brcmf_dbg(CONN, "beacon interval: %d\n",
1434                           params->beacon_interval);
1435         else
1436                 brcmf_dbg(CONN, "no beacon interval specified\n");
1437
1438         if (params->basic_rates)
1439                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1440         else
1441                 brcmf_dbg(CONN, "no basic rates specified\n");
1442
1443         if (params->privacy)
1444                 brcmf_dbg(CONN, "privacy required\n");
1445         else
1446                 brcmf_dbg(CONN, "no privacy required\n");
1447
1448         /* Configure Privacy for starter */
1449         if (params->privacy)
1450                 wsec |= WEP_ENABLED;
1451
1452         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1453         if (err) {
1454                 brcmf_err("wsec failed (%d)\n", err);
1455                 goto done;
1456         }
1457
1458         /* Configure Beacon Interval for starter */
1459         if (params->beacon_interval)
1460                 bcnprd = params->beacon_interval;
1461         else
1462                 bcnprd = 100;
1463
1464         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1465         if (err) {
1466                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1467                 goto done;
1468         }
1469
1470         /* Configure required join parameter */
1471         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1472
1473         /* SSID */
1474         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1475         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1476         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1477         join_params_size = sizeof(join_params.ssid_le);
1478
1479         /* BSSID */
1480         if (params->bssid) {
1481                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1482                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1483                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1484         } else {
1485                 eth_broadcast_addr(join_params.params_le.bssid);
1486                 eth_zero_addr(profile->bssid);
1487         }
1488
1489         /* Channel */
1490         if (params->chandef.chan) {
1491                 u32 target_channel;
1492
1493                 cfg->channel =
1494                         ieee80211_frequency_to_channel(
1495                                 params->chandef.chan->center_freq);
1496                 if (params->channel_fixed) {
1497                         /* adding chanspec */
1498                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1499                                                        &params->chandef);
1500                         join_params.params_le.chanspec_list[0] =
1501                                 cpu_to_le16(chanspec);
1502                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1503                         join_params_size += sizeof(join_params.params_le);
1504                 }
1505
1506                 /* set channel for starter */
1507                 target_channel = cfg->channel;
1508                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1509                                             target_channel);
1510                 if (err) {
1511                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1512                         goto done;
1513                 }
1514         } else
1515                 cfg->channel = 0;
1516
1517         cfg->ibss_starter = false;
1518
1519
1520         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1521                                      &join_params, join_params_size);
1522         if (err) {
1523                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1524                 goto done;
1525         }
1526
1527 done:
1528         if (err)
1529                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1530         brcmf_dbg(TRACE, "Exit\n");
1531         return err;
1532 }
1533
1534 static s32
1535 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1536 {
1537         struct brcmf_if *ifp = netdev_priv(ndev);
1538
1539         brcmf_dbg(TRACE, "Enter\n");
1540         if (!check_vif_up(ifp->vif)) {
1541                 /* When driver is being unloaded, it can end up here. If an
1542                  * error is returned then later on a debug trace in the wireless
1543                  * core module will be printed. To avoid this 0 is returned.
1544                  */
1545                 return 0;
1546         }
1547
1548         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1549         brcmf_net_setcarrier(ifp, false);
1550
1551         brcmf_dbg(TRACE, "Exit\n");
1552
1553         return 0;
1554 }
1555
1556 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1557                                  struct cfg80211_connect_params *sme)
1558 {
1559         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1560         struct brcmf_cfg80211_security *sec;
1561         s32 val = 0;
1562         s32 err = 0;
1563
1564         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1565                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1566         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1567                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1568         else
1569                 val = WPA_AUTH_DISABLED;
1570         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1571         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1572         if (err) {
1573                 brcmf_err("set wpa_auth failed (%d)\n", err);
1574                 return err;
1575         }
1576         sec = &profile->sec;
1577         sec->wpa_versions = sme->crypto.wpa_versions;
1578         return err;
1579 }
1580
1581 static s32 brcmf_set_auth_type(struct net_device *ndev,
1582                                struct cfg80211_connect_params *sme)
1583 {
1584         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1585         struct brcmf_cfg80211_security *sec;
1586         s32 val = 0;
1587         s32 err = 0;
1588
1589         switch (sme->auth_type) {
1590         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1591                 val = 0;
1592                 brcmf_dbg(CONN, "open system\n");
1593                 break;
1594         case NL80211_AUTHTYPE_SHARED_KEY:
1595                 val = 1;
1596                 brcmf_dbg(CONN, "shared key\n");
1597                 break;
1598         case NL80211_AUTHTYPE_AUTOMATIC:
1599                 val = 2;
1600                 brcmf_dbg(CONN, "automatic\n");
1601                 break;
1602         case NL80211_AUTHTYPE_NETWORK_EAP:
1603                 brcmf_dbg(CONN, "network eap\n");
1604         default:
1605                 val = 2;
1606                 brcmf_err("invalid auth type (%d)\n", sme->auth_type);
1607                 break;
1608         }
1609
1610         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1611         if (err) {
1612                 brcmf_err("set auth failed (%d)\n", err);
1613                 return err;
1614         }
1615         sec = &profile->sec;
1616         sec->auth_type = sme->auth_type;
1617         return err;
1618 }
1619
1620 static s32
1621 brcmf_set_wsec_mode(struct net_device *ndev,
1622                     struct cfg80211_connect_params *sme)
1623 {
1624         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1625         struct brcmf_cfg80211_security *sec;
1626         s32 pval = 0;
1627         s32 gval = 0;
1628         s32 wsec;
1629         s32 err = 0;
1630
1631         if (sme->crypto.n_ciphers_pairwise) {
1632                 switch (sme->crypto.ciphers_pairwise[0]) {
1633                 case WLAN_CIPHER_SUITE_WEP40:
1634                 case WLAN_CIPHER_SUITE_WEP104:
1635                         pval = WEP_ENABLED;
1636                         break;
1637                 case WLAN_CIPHER_SUITE_TKIP:
1638                         pval = TKIP_ENABLED;
1639                         break;
1640                 case WLAN_CIPHER_SUITE_CCMP:
1641                         pval = AES_ENABLED;
1642                         break;
1643                 case WLAN_CIPHER_SUITE_AES_CMAC:
1644                         pval = AES_ENABLED;
1645                         break;
1646                 default:
1647                         brcmf_err("invalid cipher pairwise (%d)\n",
1648                                   sme->crypto.ciphers_pairwise[0]);
1649                         return -EINVAL;
1650                 }
1651         }
1652         if (sme->crypto.cipher_group) {
1653                 switch (sme->crypto.cipher_group) {
1654                 case WLAN_CIPHER_SUITE_WEP40:
1655                 case WLAN_CIPHER_SUITE_WEP104:
1656                         gval = WEP_ENABLED;
1657                         break;
1658                 case WLAN_CIPHER_SUITE_TKIP:
1659                         gval = TKIP_ENABLED;
1660                         break;
1661                 case WLAN_CIPHER_SUITE_CCMP:
1662                         gval = AES_ENABLED;
1663                         break;
1664                 case WLAN_CIPHER_SUITE_AES_CMAC:
1665                         gval = AES_ENABLED;
1666                         break;
1667                 default:
1668                         brcmf_err("invalid cipher group (%d)\n",
1669                                   sme->crypto.cipher_group);
1670                         return -EINVAL;
1671                 }
1672         }
1673
1674         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1675         /* In case of privacy, but no security and WPS then simulate */
1676         /* setting AES. WPS-2.0 allows no security                   */
1677         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1678             sme->privacy)
1679                 pval = AES_ENABLED;
1680
1681         wsec = pval | gval;
1682         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1683         if (err) {
1684                 brcmf_err("error (%d)\n", err);
1685                 return err;
1686         }
1687
1688         sec = &profile->sec;
1689         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1690         sec->cipher_group = sme->crypto.cipher_group;
1691
1692         return err;
1693 }
1694
1695 static s32
1696 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1697 {
1698         struct brcmf_if *ifp = netdev_priv(ndev);
1699         s32 val;
1700         s32 err;
1701         const struct brcmf_tlv *rsn_ie;
1702         const u8 *ie;
1703         u32 ie_len;
1704         u32 offset;
1705         u16 rsn_cap;
1706         u32 mfp;
1707         u16 count;
1708
1709         if (!sme->crypto.n_akm_suites)
1710                 return 0;
1711
1712         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1713         if (err) {
1714                 brcmf_err("could not get wpa_auth (%d)\n", err);
1715                 return err;
1716         }
1717         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1718                 switch (sme->crypto.akm_suites[0]) {
1719                 case WLAN_AKM_SUITE_8021X:
1720                         val = WPA_AUTH_UNSPECIFIED;
1721                         break;
1722                 case WLAN_AKM_SUITE_PSK:
1723                         val = WPA_AUTH_PSK;
1724                         break;
1725                 default:
1726                         brcmf_err("invalid cipher group (%d)\n",
1727                                   sme->crypto.cipher_group);
1728                         return -EINVAL;
1729                 }
1730         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1731                 switch (sme->crypto.akm_suites[0]) {
1732                 case WLAN_AKM_SUITE_8021X:
1733                         val = WPA2_AUTH_UNSPECIFIED;
1734                         break;
1735                 case WLAN_AKM_SUITE_8021X_SHA256:
1736                         val = WPA2_AUTH_1X_SHA256;
1737                         break;
1738                 case WLAN_AKM_SUITE_PSK_SHA256:
1739                         val = WPA2_AUTH_PSK_SHA256;
1740                         break;
1741                 case WLAN_AKM_SUITE_PSK:
1742                         val = WPA2_AUTH_PSK;
1743                         break;
1744                 default:
1745                         brcmf_err("invalid cipher group (%d)\n",
1746                                   sme->crypto.cipher_group);
1747                         return -EINVAL;
1748                 }
1749         }
1750
1751         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1752                 goto skip_mfp_config;
1753         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1754          * IE will not be verified, just a quick search for MFP config
1755          */
1756         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1757                                   WLAN_EID_RSN);
1758         if (!rsn_ie)
1759                 goto skip_mfp_config;
1760         ie = (const u8 *)rsn_ie;
1761         ie_len = rsn_ie->len + TLV_HDR_LEN;
1762         /* Skip unicast suite */
1763         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1764         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1765                 goto skip_mfp_config;
1766         /* Skip multicast suite */
1767         count = ie[offset] + (ie[offset + 1] << 8);
1768         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1769         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1770                 goto skip_mfp_config;
1771         /* Skip auth key management suite(s) */
1772         count = ie[offset] + (ie[offset + 1] << 8);
1773         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1774         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1775                 goto skip_mfp_config;
1776         /* Ready to read capabilities */
1777         mfp = BRCMF_MFP_NONE;
1778         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1779         if (rsn_cap & RSN_CAP_MFPR_MASK)
1780                 mfp = BRCMF_MFP_REQUIRED;
1781         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1782                 mfp = BRCMF_MFP_CAPABLE;
1783         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1784
1785 skip_mfp_config:
1786         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1787         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1788         if (err) {
1789                 brcmf_err("could not set wpa_auth (%d)\n", err);
1790                 return err;
1791         }
1792
1793         return err;
1794 }
1795
1796 static s32
1797 brcmf_set_sharedkey(struct net_device *ndev,
1798                     struct cfg80211_connect_params *sme)
1799 {
1800         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1801         struct brcmf_cfg80211_security *sec;
1802         struct brcmf_wsec_key key;
1803         s32 val;
1804         s32 err = 0;
1805
1806         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1807
1808         if (sme->key_len == 0)
1809                 return 0;
1810
1811         sec = &profile->sec;
1812         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1813                   sec->wpa_versions, sec->cipher_pairwise);
1814
1815         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1816                 return 0;
1817
1818         if (!(sec->cipher_pairwise &
1819             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1820                 return 0;
1821
1822         memset(&key, 0, sizeof(key));
1823         key.len = (u32) sme->key_len;
1824         key.index = (u32) sme->key_idx;
1825         if (key.len > sizeof(key.data)) {
1826                 brcmf_err("Too long key length (%u)\n", key.len);
1827                 return -EINVAL;
1828         }
1829         memcpy(key.data, sme->key, key.len);
1830         key.flags = BRCMF_PRIMARY_KEY;
1831         switch (sec->cipher_pairwise) {
1832         case WLAN_CIPHER_SUITE_WEP40:
1833                 key.algo = CRYPTO_ALGO_WEP1;
1834                 break;
1835         case WLAN_CIPHER_SUITE_WEP104:
1836                 key.algo = CRYPTO_ALGO_WEP128;
1837                 break;
1838         default:
1839                 brcmf_err("Invalid algorithm (%d)\n",
1840                           sme->crypto.ciphers_pairwise[0]);
1841                 return -EINVAL;
1842         }
1843         /* Set the new key/index */
1844         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1845                   key.len, key.index, key.algo);
1846         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1847         err = send_key_to_dongle(netdev_priv(ndev), &key);
1848         if (err)
1849                 return err;
1850
1851         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1852                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1853                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1854                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1855                 if (err)
1856                         brcmf_err("set auth failed (%d)\n", err);
1857         }
1858         return err;
1859 }
1860
1861 static
1862 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1863                                            enum nl80211_auth_type type)
1864 {
1865         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1866             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1867                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1868                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1869         }
1870         return type;
1871 }
1872
1873 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1874                                 struct cfg80211_bss_selection *bss_select)
1875 {
1876         struct brcmf_join_pref_params join_pref_params[2];
1877         enum nl80211_band band;
1878         int err, i = 0;
1879
1880         join_pref_params[i].len = 2;
1881         join_pref_params[i].rssi_gain = 0;
1882
1883         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1884                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1885
1886         switch (bss_select->behaviour) {
1887         case __NL80211_BSS_SELECT_ATTR_INVALID:
1888                 brcmf_c_set_joinpref_default(ifp);
1889                 return;
1890         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1891                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1892                 band = bss_select->param.band_pref;
1893                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1894                 i++;
1895                 break;
1896         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1897                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1898                 band = bss_select->param.adjust.band;
1899                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1900                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1901                 i++;
1902                 break;
1903         case NL80211_BSS_SELECT_ATTR_RSSI:
1904         default:
1905                 break;
1906         }
1907         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1908         join_pref_params[i].len = 2;
1909         join_pref_params[i].rssi_gain = 0;
1910         join_pref_params[i].band = 0;
1911         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1912                                        sizeof(join_pref_params));
1913         if (err)
1914                 brcmf_err("Set join_pref error (%d)\n", err);
1915 }
1916
1917 static s32
1918 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1919                        struct cfg80211_connect_params *sme)
1920 {
1921         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1922         struct brcmf_if *ifp = netdev_priv(ndev);
1923         struct ieee80211_channel *chan = sme->channel;
1924         struct brcmf_join_params join_params;
1925         size_t join_params_size;
1926         const struct brcmf_tlv *rsn_ie;
1927         const struct brcmf_vs_tlv *wpa_ie;
1928         const void *ie;
1929         u32 ie_len;
1930         struct brcmf_ext_join_params_le *ext_join_params;
1931         u16 chanspec;
1932         s32 err = 0;
1933         u32 ssid_len;
1934
1935         brcmf_dbg(TRACE, "Enter\n");
1936         if (!check_vif_up(ifp->vif))
1937                 return -EIO;
1938
1939         if (!sme->ssid) {
1940                 brcmf_err("Invalid ssid\n");
1941                 return -EOPNOTSUPP;
1942         }
1943
1944         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1945                 /* A normal (non P2P) connection request setup. */
1946                 ie = NULL;
1947                 ie_len = 0;
1948                 /* find the WPA_IE */
1949                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1950                 if (wpa_ie) {
1951                         ie = wpa_ie;
1952                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1953                 } else {
1954                         /* find the RSN_IE */
1955                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1956                                                   sme->ie_len,
1957                                                   WLAN_EID_RSN);
1958                         if (rsn_ie) {
1959                                 ie = rsn_ie;
1960                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1961                         }
1962                 }
1963                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1964         }
1965
1966         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1967                                     sme->ie, sme->ie_len);
1968         if (err)
1969                 brcmf_err("Set Assoc REQ IE Failed\n");
1970         else
1971                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1972
1973         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1974
1975         if (chan) {
1976                 cfg->channel =
1977                         ieee80211_frequency_to_channel(chan->center_freq);
1978                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1979                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1980                           cfg->channel, chan->center_freq, chanspec);
1981         } else {
1982                 cfg->channel = 0;
1983                 chanspec = 0;
1984         }
1985
1986         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1987
1988         err = brcmf_set_wpa_version(ndev, sme);
1989         if (err) {
1990                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1991                 goto done;
1992         }
1993
1994         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1995         err = brcmf_set_auth_type(ndev, sme);
1996         if (err) {
1997                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1998                 goto done;
1999         }
2000
2001         err = brcmf_set_wsec_mode(ndev, sme);
2002         if (err) {
2003                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
2004                 goto done;
2005         }
2006
2007         err = brcmf_set_key_mgmt(ndev, sme);
2008         if (err) {
2009                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
2010                 goto done;
2011         }
2012
2013         err = brcmf_set_sharedkey(ndev, sme);
2014         if (err) {
2015                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
2016                 goto done;
2017         }
2018
2019         /* Join with specific BSSID and cached SSID
2020          * If SSID is zero join based on BSSID only
2021          */
2022         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2023                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2024         if (cfg->channel)
2025                 join_params_size += sizeof(u16);
2026         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2027         if (ext_join_params == NULL) {
2028                 err = -ENOMEM;
2029                 goto done;
2030         }
2031         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2032         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2033         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2034         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2035                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2036                           ext_join_params->ssid_le.SSID, ssid_len);
2037
2038         /* Set up join scan parameters */
2039         ext_join_params->scan_le.scan_type = -1;
2040         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2041
2042         if (sme->bssid)
2043                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2044         else
2045                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2046
2047         if (cfg->channel) {
2048                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2049
2050                 ext_join_params->assoc_le.chanspec_list[0] =
2051                         cpu_to_le16(chanspec);
2052                 /* Increase dwell time to receive probe response or detect
2053                  * beacon from target AP at a noisy air only during connect
2054                  * command.
2055                  */
2056                 ext_join_params->scan_le.active_time =
2057                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2058                 ext_join_params->scan_le.passive_time =
2059                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2060                 /* To sync with presence period of VSDB GO send probe request
2061                  * more frequently. Probe request will be stopped when it gets
2062                  * probe response from target AP/GO.
2063                  */
2064                 ext_join_params->scan_le.nprobes =
2065                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2066                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2067         } else {
2068                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2069                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2070                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2071         }
2072
2073         brcmf_set_join_pref(ifp, &sme->bss_select);
2074
2075         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2076                                          join_params_size);
2077         kfree(ext_join_params);
2078         if (!err)
2079                 /* This is it. join command worked, we are done */
2080                 goto done;
2081
2082         /* join command failed, fallback to set ssid */
2083         memset(&join_params, 0, sizeof(join_params));
2084         join_params_size = sizeof(join_params.ssid_le);
2085
2086         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2087         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2088
2089         if (sme->bssid)
2090                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2091         else
2092                 eth_broadcast_addr(join_params.params_le.bssid);
2093
2094         if (cfg->channel) {
2095                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2096                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2097                 join_params_size += sizeof(join_params.params_le);
2098         }
2099         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2100                                      &join_params, join_params_size);
2101         if (err)
2102                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2103
2104 done:
2105         if (err)
2106                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2107         brcmf_dbg(TRACE, "Exit\n");
2108         return err;
2109 }
2110
2111 static s32
2112 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2113                        u16 reason_code)
2114 {
2115         struct brcmf_if *ifp = netdev_priv(ndev);
2116         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2117         struct brcmf_scb_val_le scbval;
2118         s32 err = 0;
2119
2120         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2121         if (!check_vif_up(ifp->vif))
2122                 return -EIO;
2123
2124         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2125         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2126         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2127
2128         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2129         scbval.val = cpu_to_le32(reason_code);
2130         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2131                                      &scbval, sizeof(scbval));
2132         if (err)
2133                 brcmf_err("error (%d)\n", err);
2134
2135         brcmf_dbg(TRACE, "Exit\n");
2136         return err;
2137 }
2138
2139 static s32
2140 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2141                             enum nl80211_tx_power_setting type, s32 mbm)
2142 {
2143         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2144         struct net_device *ndev = cfg_to_ndev(cfg);
2145         struct brcmf_if *ifp = netdev_priv(ndev);
2146         s32 err;
2147         s32 disable;
2148         u32 qdbm = 127;
2149
2150         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2151         if (!check_vif_up(ifp->vif))
2152                 return -EIO;
2153
2154         switch (type) {
2155         case NL80211_TX_POWER_AUTOMATIC:
2156                 break;
2157         case NL80211_TX_POWER_LIMITED:
2158         case NL80211_TX_POWER_FIXED:
2159                 if (mbm < 0) {
2160                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2161                         err = -EINVAL;
2162                         goto done;
2163                 }
2164                 qdbm =  MBM_TO_DBM(4 * mbm);
2165                 if (qdbm > 127)
2166                         qdbm = 127;
2167                 qdbm |= WL_TXPWR_OVERRIDE;
2168                 break;
2169         default:
2170                 brcmf_err("Unsupported type %d\n", type);
2171                 err = -EINVAL;
2172                 goto done;
2173         }
2174         /* Make sure radio is off or on as far as software is concerned */
2175         disable = WL_RADIO_SW_DISABLE << 16;
2176         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2177         if (err)
2178                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2179
2180         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2181         if (err)
2182                 brcmf_err("qtxpower error (%d)\n", err);
2183
2184 done:
2185         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2186         return err;
2187 }
2188
2189 static s32
2190 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2191                             s32 *dbm)
2192 {
2193         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2194         struct net_device *ndev = cfg_to_ndev(cfg);
2195         struct brcmf_if *ifp = netdev_priv(ndev);
2196         s32 qdbm = 0;
2197         s32 err;
2198
2199         brcmf_dbg(TRACE, "Enter\n");
2200         if (!check_vif_up(ifp->vif))
2201                 return -EIO;
2202
2203         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2204         if (err) {
2205                 brcmf_err("error (%d)\n", err);
2206                 goto done;
2207         }
2208         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2209
2210 done:
2211         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2212         return err;
2213 }
2214
2215 static s32
2216 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2217                                   u8 key_idx, bool unicast, bool multicast)
2218 {
2219         struct brcmf_if *ifp = netdev_priv(ndev);
2220         u32 index;
2221         u32 wsec;
2222         s32 err = 0;
2223
2224         brcmf_dbg(TRACE, "Enter\n");
2225         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2226         if (!check_vif_up(ifp->vif))
2227                 return -EIO;
2228
2229         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2230         if (err) {
2231                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2232                 goto done;
2233         }
2234
2235         if (wsec & WEP_ENABLED) {
2236                 /* Just select a new current key */
2237                 index = key_idx;
2238                 err = brcmf_fil_cmd_int_set(ifp,
2239                                             BRCMF_C_SET_KEY_PRIMARY, index);
2240                 if (err)
2241                         brcmf_err("error (%d)\n", err);
2242         }
2243 done:
2244         brcmf_dbg(TRACE, "Exit\n");
2245         return err;
2246 }
2247
2248 static s32
2249 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2250                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2251 {
2252         struct brcmf_if *ifp = netdev_priv(ndev);
2253         struct brcmf_wsec_key *key;
2254         s32 err;
2255
2256         brcmf_dbg(TRACE, "Enter\n");
2257         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2258
2259         if (!check_vif_up(ifp->vif))
2260                 return -EIO;
2261
2262         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2263                 /* we ignore this key index in this case */
2264                 return -EINVAL;
2265         }
2266
2267         key = &ifp->vif->profile.key[key_idx];
2268
2269         if (key->algo == CRYPTO_ALGO_OFF) {
2270                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2271                 return -EINVAL;
2272         }
2273
2274         memset(key, 0, sizeof(*key));
2275         key->index = (u32)key_idx;
2276         key->flags = BRCMF_PRIMARY_KEY;
2277
2278         /* Clear the key/index */
2279         err = send_key_to_dongle(ifp, key);
2280
2281         brcmf_dbg(TRACE, "Exit\n");
2282         return err;
2283 }
2284
2285 static s32
2286 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2287                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2288                        struct key_params *params)
2289 {
2290         struct brcmf_if *ifp = netdev_priv(ndev);
2291         struct brcmf_wsec_key *key;
2292         s32 val;
2293         s32 wsec;
2294         s32 err;
2295         u8 keybuf[8];
2296         bool ext_key;
2297
2298         brcmf_dbg(TRACE, "Enter\n");
2299         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2300         if (!check_vif_up(ifp->vif))
2301                 return -EIO;
2302
2303         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2304                 /* we ignore this key index in this case */
2305                 brcmf_err("invalid key index (%d)\n", key_idx);
2306                 return -EINVAL;
2307         }
2308
2309         if (params->key_len == 0)
2310                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2311                                               mac_addr);
2312
2313         if (params->key_len > sizeof(key->data)) {
2314                 brcmf_err("Too long key length (%u)\n", params->key_len);
2315                 return -EINVAL;
2316         }
2317
2318         ext_key = false;
2319         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2320             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2321                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2322                 ext_key = true;
2323         }
2324
2325         key = &ifp->vif->profile.key[key_idx];
2326         memset(key, 0, sizeof(*key));
2327         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2328                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2329         key->len = params->key_len;
2330         key->index = key_idx;
2331         memcpy(key->data, params->key, key->len);
2332         if (!ext_key)
2333                 key->flags = BRCMF_PRIMARY_KEY;
2334
2335         switch (params->cipher) {
2336         case WLAN_CIPHER_SUITE_WEP40:
2337                 key->algo = CRYPTO_ALGO_WEP1;
2338                 val = WEP_ENABLED;
2339                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2340                 break;
2341         case WLAN_CIPHER_SUITE_WEP104:
2342                 key->algo = CRYPTO_ALGO_WEP128;
2343                 val = WEP_ENABLED;
2344                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2345                 break;
2346         case WLAN_CIPHER_SUITE_TKIP:
2347                 if (!brcmf_is_apmode(ifp->vif)) {
2348                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2349                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2350                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2351                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2352                 }
2353                 key->algo = CRYPTO_ALGO_TKIP;
2354                 val = TKIP_ENABLED;
2355                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2356                 break;
2357         case WLAN_CIPHER_SUITE_AES_CMAC:
2358                 key->algo = CRYPTO_ALGO_AES_CCM;
2359                 val = AES_ENABLED;
2360                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2361                 break;
2362         case WLAN_CIPHER_SUITE_CCMP:
2363                 key->algo = CRYPTO_ALGO_AES_CCM;
2364                 val = AES_ENABLED;
2365                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2366                 break;
2367         default:
2368                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2369                 err = -EINVAL;
2370                 goto done;
2371         }
2372
2373         err = send_key_to_dongle(ifp, key);
2374         if (ext_key || err)
2375                 goto done;
2376
2377         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2378         if (err) {
2379                 brcmf_err("get wsec error (%d)\n", err);
2380                 goto done;
2381         }
2382         wsec |= val;
2383         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2384         if (err) {
2385                 brcmf_err("set wsec error (%d)\n", err);
2386                 goto done;
2387         }
2388
2389 done:
2390         brcmf_dbg(TRACE, "Exit\n");
2391         return err;
2392 }
2393
2394 static s32
2395 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2396                        bool pairwise, const u8 *mac_addr, void *cookie,
2397                        void (*callback)(void *cookie,
2398                                         struct key_params *params))
2399 {
2400         struct key_params params;
2401         struct brcmf_if *ifp = netdev_priv(ndev);
2402         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2403         struct brcmf_cfg80211_security *sec;
2404         s32 wsec;
2405         s32 err = 0;
2406
2407         brcmf_dbg(TRACE, "Enter\n");
2408         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2409         if (!check_vif_up(ifp->vif))
2410                 return -EIO;
2411
2412         memset(&params, 0, sizeof(params));
2413
2414         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2415         if (err) {
2416                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2417                 /* Ignore this error, may happen during DISASSOC */
2418                 err = -EAGAIN;
2419                 goto done;
2420         }
2421         if (wsec & WEP_ENABLED) {
2422                 sec = &profile->sec;
2423                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2424                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2425                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2426                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2427                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2428                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2429                 }
2430         } else if (wsec & TKIP_ENABLED) {
2431                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2432                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2433         } else if (wsec & AES_ENABLED) {
2434                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2435                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2436         } else  {
2437                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2438                 err = -EINVAL;
2439                 goto done;
2440         }
2441         callback(cookie, &params);
2442
2443 done:
2444         brcmf_dbg(TRACE, "Exit\n");
2445         return err;
2446 }
2447
2448 static s32
2449 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2450                                        struct net_device *ndev, u8 key_idx)
2451 {
2452         struct brcmf_if *ifp = netdev_priv(ndev);
2453
2454         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2455
2456         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2457                 return 0;
2458
2459         brcmf_dbg(INFO, "Not supported\n");
2460
2461         return -EOPNOTSUPP;
2462 }
2463
2464 static void
2465 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2466 {
2467         s32 err;
2468         u8 key_idx;
2469         struct brcmf_wsec_key *key;
2470         s32 wsec;
2471
2472         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2473                 key = &ifp->vif->profile.key[key_idx];
2474                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2475                     (key->algo == CRYPTO_ALGO_WEP128))
2476                         break;
2477         }
2478         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2479                 return;
2480
2481         err = send_key_to_dongle(ifp, key);
2482         if (err) {
2483                 brcmf_err("Setting WEP key failed (%d)\n", err);
2484                 return;
2485         }
2486         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2487         if (err) {
2488                 brcmf_err("get wsec error (%d)\n", err);
2489                 return;
2490         }
2491         wsec |= WEP_ENABLED;
2492         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2493         if (err)
2494                 brcmf_err("set wsec error (%d)\n", err);
2495 }
2496
2497 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2498 {
2499         struct nl80211_sta_flag_update *sfu;
2500
2501         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2502         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2503         sfu = &si->sta_flags;
2504         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2505                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2506                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2507                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2508         if (fw_sta_flags & BRCMF_STA_WME)
2509                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2510         if (fw_sta_flags & BRCMF_STA_AUTHE)
2511                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2512         if (fw_sta_flags & BRCMF_STA_ASSOC)
2513                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2514         if (fw_sta_flags & BRCMF_STA_AUTHO)
2515                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2516 }
2517
2518 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2519 {
2520         struct {
2521                 __le32 len;
2522                 struct brcmf_bss_info_le bss_le;
2523         } *buf;
2524         u16 capability;
2525         int err;
2526
2527         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2528         if (!buf)
2529                 return;
2530
2531         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2532         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2533                                      WL_BSS_INFO_MAX);
2534         if (err) {
2535                 brcmf_err("Failed to get bss info (%d)\n", err);
2536                 return;
2537         }
2538         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2539         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2540         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2541         capability = le16_to_cpu(buf->bss_le.capability);
2542         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2543                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2544         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2545                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2546         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2547                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2548 }
2549
2550 static s32
2551 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2552                                 struct station_info *sinfo)
2553 {
2554         struct brcmf_scb_val_le scbval;
2555         struct brcmf_pktcnt_le pktcnt;
2556         s32 err;
2557         u32 rate;
2558         u32 rssi;
2559
2560         /* Get the current tx rate */
2561         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2562         if (err < 0) {
2563                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2564                 return err;
2565         }
2566         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2567         sinfo->txrate.legacy = rate * 5;
2568
2569         memset(&scbval, 0, sizeof(scbval));
2570         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2571                                      sizeof(scbval));
2572         if (err) {
2573                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2574                 return err;
2575         }
2576         rssi = le32_to_cpu(scbval.val);
2577         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2578         sinfo->signal = rssi;
2579
2580         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2581                                      sizeof(pktcnt));
2582         if (err) {
2583                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2584                 return err;
2585         }
2586         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2587                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2588                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2589                          BIT(NL80211_STA_INFO_TX_FAILED);
2590         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2591         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2592         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2593         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2594
2595         return 0;
2596 }
2597
2598 static s32
2599 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2600                            const u8 *mac, struct station_info *sinfo)
2601 {
2602         struct brcmf_if *ifp = netdev_priv(ndev);
2603         struct brcmf_scb_val_le scb_val;
2604         s32 err = 0;
2605         struct brcmf_sta_info_le sta_info_le;
2606         u32 sta_flags;
2607         u32 is_tdls_peer;
2608         s32 total_rssi;
2609         s32 count_rssi;
2610         int rssi;
2611         u32 i;
2612
2613         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2614         if (!check_vif_up(ifp->vif))
2615                 return -EIO;
2616
2617         if (brcmf_is_ibssmode(ifp->vif))
2618                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2619
2620         memset(&sta_info_le, 0, sizeof(sta_info_le));
2621         memcpy(&sta_info_le, mac, ETH_ALEN);
2622         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2623                                        &sta_info_le,
2624                                        sizeof(sta_info_le));
2625         is_tdls_peer = !err;
2626         if (err) {
2627                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2628                                                &sta_info_le,
2629                                                sizeof(sta_info_le));
2630                 if (err < 0) {
2631                         brcmf_err("GET STA INFO failed, %d\n", err);
2632                         goto done;
2633                 }
2634         }
2635         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2636         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2637         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2638         sta_flags = le32_to_cpu(sta_info_le.flags);
2639         brcmf_convert_sta_flags(sta_flags, sinfo);
2640         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2641         if (is_tdls_peer)
2642                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2643         else
2644                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2645         if (sta_flags & BRCMF_STA_ASSOC) {
2646                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2647                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2648                 brcmf_fill_bss_param(ifp, sinfo);
2649         }
2650         if (sta_flags & BRCMF_STA_SCBSTATS) {
2651                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2652                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2653                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2654                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2655                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2656                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2657                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2658                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2659                 if (sinfo->tx_packets) {
2660                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2661                         sinfo->txrate.legacy =
2662                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2663                 }
2664                 if (sinfo->rx_packets) {
2665                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2666                         sinfo->rxrate.legacy =
2667                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2668                 }
2669                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2670                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2671                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2672                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2673                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2674                 }
2675                 total_rssi = 0;
2676                 count_rssi = 0;
2677                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2678                         if (sta_info_le.rssi[i]) {
2679                                 sinfo->chain_signal_avg[count_rssi] =
2680                                         sta_info_le.rssi[i];
2681                                 sinfo->chain_signal[count_rssi] =
2682                                         sta_info_le.rssi[i];
2683                                 total_rssi += sta_info_le.rssi[i];
2684                                 count_rssi++;
2685                         }
2686                 }
2687                 if (count_rssi) {
2688                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2689                         sinfo->chains = count_rssi;
2690
2691                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2692                         total_rssi /= count_rssi;
2693                         sinfo->signal = total_rssi;
2694                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2695                         &ifp->vif->sme_state)) {
2696                         memset(&scb_val, 0, sizeof(scb_val));
2697                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2698                                                      &scb_val, sizeof(scb_val));
2699                         if (err) {
2700                                 brcmf_err("Could not get rssi (%d)\n", err);
2701                                 goto done;
2702                         } else {
2703                                 rssi = le32_to_cpu(scb_val.val);
2704                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2705                                 sinfo->signal = rssi;
2706                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2707                         }
2708                 }
2709         }
2710 done:
2711         brcmf_dbg(TRACE, "Exit\n");
2712         return err;
2713 }
2714
2715 static int
2716 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2717                             int idx, u8 *mac, struct station_info *sinfo)
2718 {
2719         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2720         struct brcmf_if *ifp = netdev_priv(ndev);
2721         s32 err;
2722
2723         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2724
2725         if (idx == 0) {
2726                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2727                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2728                                              &cfg->assoclist,
2729                                              sizeof(cfg->assoclist));
2730                 if (err) {
2731                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2732                                   err);
2733                         cfg->assoclist.count = 0;
2734                         return -EOPNOTSUPP;
2735                 }
2736         }
2737         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2738                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2739                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2740         }
2741         return -ENOENT;
2742 }
2743
2744 static s32
2745 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2746                            bool enabled, s32 timeout)
2747 {
2748         s32 pm;
2749         s32 err = 0;
2750         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2751         struct brcmf_if *ifp = netdev_priv(ndev);
2752
2753         brcmf_dbg(TRACE, "Enter\n");
2754
2755         /*
2756          * Powersave enable/disable request is coming from the
2757          * cfg80211 even before the interface is up. In that
2758          * scenario, driver will be storing the power save
2759          * preference in cfg struct to apply this to
2760          * FW later while initializing the dongle
2761          */
2762         cfg->pwr_save = enabled;
2763         if (!check_vif_up(ifp->vif)) {
2764
2765                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2766                 goto done;
2767         }
2768
2769         pm = enabled ? PM_FAST : PM_OFF;
2770         /* Do not enable the power save after assoc if it is a p2p interface */
2771         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2772                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2773                 pm = PM_OFF;
2774         }
2775         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2776
2777         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2778         if (err) {
2779                 if (err == -ENODEV)
2780                         brcmf_err("net_device is not ready yet\n");
2781                 else
2782                         brcmf_err("error (%d)\n", err);
2783         }
2784 done:
2785         brcmf_dbg(TRACE, "Exit\n");
2786         return err;
2787 }
2788
2789 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2790                                    struct brcmf_bss_info_le *bi)
2791 {
2792         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2793         struct ieee80211_channel *notify_channel;
2794         struct cfg80211_bss *bss;
2795         struct ieee80211_supported_band *band;
2796         struct brcmu_chan ch;
2797         u16 channel;
2798         u32 freq;
2799         u16 notify_capability;
2800         u16 notify_interval;
2801         u8 *notify_ie;
2802         size_t notify_ielen;
2803         s32 notify_signal;
2804
2805         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2806                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2807                 return 0;
2808         }
2809
2810         if (!bi->ctl_ch) {
2811                 ch.chspec = le16_to_cpu(bi->chanspec);
2812                 cfg->d11inf.decchspec(&ch);
2813                 bi->ctl_ch = ch.control_ch_num;
2814         }
2815         channel = bi->ctl_ch;
2816
2817         if (channel <= CH_MAX_2G_CHANNEL)
2818                 band = wiphy->bands[NL80211_BAND_2GHZ];
2819         else
2820                 band = wiphy->bands[NL80211_BAND_5GHZ];
2821
2822         freq = ieee80211_channel_to_frequency(channel, band->band);
2823         notify_channel = ieee80211_get_channel(wiphy, freq);
2824
2825         notify_capability = le16_to_cpu(bi->capability);
2826         notify_interval = le16_to_cpu(bi->beacon_period);
2827         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2828         notify_ielen = le32_to_cpu(bi->ie_length);
2829         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2830
2831         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2832         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2833         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2834         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2835         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2836
2837         bss = cfg80211_inform_bss(wiphy, notify_channel,
2838                                   CFG80211_BSS_FTYPE_UNKNOWN,
2839                                   (const u8 *)bi->BSSID,
2840                                   0, notify_capability,
2841                                   notify_interval, notify_ie,
2842                                   notify_ielen, notify_signal,
2843                                   GFP_KERNEL);
2844
2845         if (!bss)
2846                 return -ENOMEM;
2847
2848         cfg80211_put_bss(wiphy, bss);
2849
2850         return 0;
2851 }
2852
2853 static struct brcmf_bss_info_le *
2854 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2855 {
2856         if (bss == NULL)
2857                 return list->bss_info_le;
2858         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2859                                             le32_to_cpu(bss->length));
2860 }
2861
2862 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2863 {
2864         struct brcmf_scan_results *bss_list;
2865         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2866         s32 err = 0;
2867         int i;
2868
2869         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2870         if (bss_list->count != 0 &&
2871             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2872                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2873                           bss_list->version);
2874                 return -EOPNOTSUPP;
2875         }
2876         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2877         for (i = 0; i < bss_list->count; i++) {
2878                 bi = next_bss_le(bss_list, bi);
2879                 err = brcmf_inform_single_bss(cfg, bi);
2880                 if (err)
2881                         break;
2882         }
2883         return err;
2884 }
2885
2886 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2887                              struct net_device *ndev, const u8 *bssid)
2888 {
2889         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2890         struct ieee80211_channel *notify_channel;
2891         struct brcmf_bss_info_le *bi = NULL;
2892         struct ieee80211_supported_band *band;
2893         struct cfg80211_bss *bss;
2894         struct brcmu_chan ch;
2895         u8 *buf = NULL;
2896         s32 err = 0;
2897         u32 freq;
2898         u16 notify_capability;
2899         u16 notify_interval;
2900         u8 *notify_ie;
2901         size_t notify_ielen;
2902         s32 notify_signal;
2903
2904         brcmf_dbg(TRACE, "Enter\n");
2905
2906         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2907         if (buf == NULL) {
2908                 err = -ENOMEM;
2909                 goto CleanUp;
2910         }
2911
2912         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2913
2914         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2915                                      buf, WL_BSS_INFO_MAX);
2916         if (err) {
2917                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2918                 goto CleanUp;
2919         }
2920
2921         bi = (struct brcmf_bss_info_le *)(buf + 4);
2922
2923         ch.chspec = le16_to_cpu(bi->chanspec);
2924         cfg->d11inf.decchspec(&ch);
2925
2926         if (ch.band == BRCMU_CHAN_BAND_2G)
2927                 band = wiphy->bands[NL80211_BAND_2GHZ];
2928         else
2929                 band = wiphy->bands[NL80211_BAND_5GHZ];
2930
2931         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2932         cfg->channel = freq;
2933         notify_channel = ieee80211_get_channel(wiphy, freq);
2934
2935         notify_capability = le16_to_cpu(bi->capability);
2936         notify_interval = le16_to_cpu(bi->beacon_period);
2937         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2938         notify_ielen = le32_to_cpu(bi->ie_length);
2939         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2940
2941         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2942         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2943         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2944         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2945
2946         bss = cfg80211_inform_bss(wiphy, notify_channel,
2947                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2948                                   notify_capability, notify_interval,
2949                                   notify_ie, notify_ielen, notify_signal,
2950                                   GFP_KERNEL);
2951
2952         if (!bss) {
2953                 err = -ENOMEM;
2954                 goto CleanUp;
2955         }
2956
2957         cfg80211_put_bss(wiphy, bss);
2958
2959 CleanUp:
2960
2961         kfree(buf);
2962
2963         brcmf_dbg(TRACE, "Exit\n");
2964
2965         return err;
2966 }
2967
2968 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2969                                  struct brcmf_if *ifp)
2970 {
2971         struct brcmf_bss_info_le *bi;
2972         const struct brcmf_tlv *tim;
2973         u16 beacon_interval;
2974         u8 dtim_period;
2975         size_t ie_len;
2976         u8 *ie;
2977         s32 err = 0;
2978
2979         brcmf_dbg(TRACE, "Enter\n");
2980         if (brcmf_is_ibssmode(ifp->vif))
2981                 return err;
2982
2983         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2984         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2985                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2986         if (err) {
2987                 brcmf_err("Could not get bss info %d\n", err);
2988                 goto update_bss_info_out;
2989         }
2990
2991         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2992         err = brcmf_inform_single_bss(cfg, bi);
2993         if (err)
2994                 goto update_bss_info_out;
2995
2996         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2997         ie_len = le32_to_cpu(bi->ie_length);
2998         beacon_interval = le16_to_cpu(bi->beacon_period);
2999
3000         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
3001         if (tim)
3002                 dtim_period = tim->data[1];
3003         else {
3004                 /*
3005                 * active scan was done so we could not get dtim
3006                 * information out of probe response.
3007                 * so we speficially query dtim information to dongle.
3008                 */
3009                 u32 var;
3010                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
3011                 if (err) {
3012                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
3013                         goto update_bss_info_out;
3014                 }
3015                 dtim_period = (u8)var;
3016         }
3017
3018 update_bss_info_out:
3019         brcmf_dbg(TRACE, "Exit");
3020         return err;
3021 }
3022
3023 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3024 {
3025         struct escan_info *escan = &cfg->escan_info;
3026
3027         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3028         if (cfg->scan_request) {
3029                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3030                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3031         }
3032         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3033         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3034 }
3035
3036 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3037 {
3038         struct brcmf_cfg80211_info *cfg =
3039                         container_of(work, struct brcmf_cfg80211_info,
3040                                      escan_timeout_work);
3041
3042         brcmf_inform_bss(cfg);
3043         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3044 }
3045
3046 static void brcmf_escan_timeout(unsigned long data)
3047 {
3048         struct brcmf_cfg80211_info *cfg =
3049                         (struct brcmf_cfg80211_info *)data;
3050
3051         if (cfg->scan_request) {
3052                 brcmf_err("timer expired\n");
3053                 schedule_work(&cfg->escan_timeout_work);
3054         }
3055 }
3056
3057 static s32
3058 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3059                               struct brcmf_bss_info_le *bss,
3060                               struct brcmf_bss_info_le *bss_info_le)
3061 {
3062         struct brcmu_chan ch_bss, ch_bss_info_le;
3063
3064         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3065         cfg->d11inf.decchspec(&ch_bss);
3066         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3067         cfg->d11inf.decchspec(&ch_bss_info_le);
3068
3069         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3070                 ch_bss.band == ch_bss_info_le.band &&
3071                 bss_info_le->SSID_len == bss->SSID_len &&
3072                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3073                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3074                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3075                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3076                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3077
3078                         /* preserve max RSSI if the measurements are
3079                         * both on-channel or both off-channel
3080                         */
3081                         if (bss_info_rssi > bss_rssi)
3082                                 bss->RSSI = bss_info_le->RSSI;
3083                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3084                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3085                         /* preserve the on-channel rssi measurement
3086                         * if the new measurement is off channel
3087                         */
3088                         bss->RSSI = bss_info_le->RSSI;
3089                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3090                 }
3091                 return 1;
3092         }
3093         return 0;
3094 }
3095
3096 static s32
3097 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3098                              const struct brcmf_event_msg *e, void *data)
3099 {
3100         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3101         s32 status;
3102         struct brcmf_escan_result_le *escan_result_le;
3103         struct brcmf_bss_info_le *bss_info_le;
3104         struct brcmf_bss_info_le *bss = NULL;
3105         u32 bi_length;
3106         struct brcmf_scan_results *list;
3107         u32 i;
3108         bool aborted;
3109
3110         status = e->status;
3111
3112         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3113                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3114                 return -EPERM;
3115         }
3116
3117         if (status == BRCMF_E_STATUS_PARTIAL) {
3118                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3119                 escan_result_le = (struct brcmf_escan_result_le *) data;
3120                 if (!escan_result_le) {
3121                         brcmf_err("Invalid escan result (NULL pointer)\n");
3122                         goto exit;
3123                 }
3124                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3125                         brcmf_err("Invalid bss_count %d: ignoring\n",
3126                                   escan_result_le->bss_count);
3127                         goto exit;
3128                 }
3129                 bss_info_le = &escan_result_le->bss_info_le;
3130
3131                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3132                         goto exit;
3133
3134                 if (!cfg->scan_request) {
3135                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3136                         goto exit;
3137                 }
3138
3139                 bi_length = le32_to_cpu(bss_info_le->length);
3140                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
3141                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
3142                         brcmf_err("Invalid bss_info length %d: ignoring\n",
3143                                   bi_length);
3144                         goto exit;
3145                 }
3146
3147                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3148                                         BIT(NL80211_IFTYPE_ADHOC))) {
3149                         if (le16_to_cpu(bss_info_le->capability) &
3150                                                 WLAN_CAPABILITY_IBSS) {
3151                                 brcmf_err("Ignoring IBSS result\n");
3152                                 goto exit;
3153                         }
3154                 }
3155
3156                 list = (struct brcmf_scan_results *)
3157                                 cfg->escan_info.escan_buf;
3158                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3159                         brcmf_err("Buffer is too small: ignoring\n");
3160                         goto exit;
3161                 }
3162
3163                 for (i = 0; i < list->count; i++) {
3164                         bss = bss ? (struct brcmf_bss_info_le *)
3165                                 ((unsigned char *)bss +
3166                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3167                         if (brcmf_compare_update_same_bss(cfg, bss,
3168                                                           bss_info_le))
3169                                 goto exit;
3170                 }
3171                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3172                        bi_length);
3173                 list->version = le32_to_cpu(bss_info_le->version);
3174                 list->buflen += bi_length;
3175                 list->count++;
3176         } else {
3177                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3178                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3179                         goto exit;
3180                 if (cfg->scan_request) {
3181                         brcmf_inform_bss(cfg);
3182                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3183                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3184                 } else
3185                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3186                                   status);
3187         }
3188 exit:
3189         return 0;
3190 }
3191
3192 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3193 {
3194         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3195                             brcmf_cfg80211_escan_handler);
3196         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3197         /* Init scan_timeout timer */
3198         init_timer(&cfg->escan_timeout);
3199         cfg->escan_timeout.data = (unsigned long) cfg;
3200         cfg->escan_timeout.function = brcmf_escan_timeout;
3201         INIT_WORK(&cfg->escan_timeout_work,
3202                   brcmf_cfg80211_escan_timeout_worker);
3203 }
3204
3205 /* PFN result doesn't have all the info which are required by the supplicant
3206  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3207  * via wl_inform_single_bss in the required format. Escan does require the
3208  * scan request in the form of cfg80211_scan_request. For timebeing, create
3209  * cfg80211_scan_request one out of the received PNO event.
3210  */
3211 static s32
3212 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3213                                 const struct brcmf_event_msg *e, void *data)
3214 {
3215         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3216         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3217         struct cfg80211_scan_request *request = NULL;
3218         struct cfg80211_ssid *ssid = NULL;
3219         struct ieee80211_channel *channel = NULL;
3220         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3221         int err = 0;
3222         int channel_req = 0;
3223         int band = 0;
3224         struct brcmf_pno_scanresults_le *pfn_result;
3225         u32 result_count;
3226         u32 status;
3227
3228         brcmf_dbg(SCAN, "Enter\n");
3229
3230         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3231                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3232                 return 0;
3233         }
3234
3235         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3236                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3237                 return 0;
3238         }
3239
3240         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3241         result_count = le32_to_cpu(pfn_result->count);
3242         status = le32_to_cpu(pfn_result->status);
3243
3244         /* PFN event is limited to fit 512 bytes so we may get
3245          * multiple NET_FOUND events. For now place a warning here.
3246          */
3247         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3248         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3249         if (result_count > 0) {
3250                 int i;
3251
3252                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3253                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3254                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3255                 if (!request || !ssid || !channel) {
3256                         err = -ENOMEM;
3257                         goto out_err;
3258                 }
3259
3260                 request->wiphy = wiphy;
3261                 data += sizeof(struct brcmf_pno_scanresults_le);
3262                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3263
3264                 for (i = 0; i < result_count; i++) {
3265                         netinfo = &netinfo_start[i];
3266                         if (!netinfo) {
3267                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3268                                           i);
3269                                 err = -EINVAL;
3270                                 goto out_err;
3271                         }
3272
3273                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3274                                   netinfo->SSID, netinfo->channel);
3275                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3276                         ssid[i].ssid_len = netinfo->SSID_len;
3277                         request->n_ssids++;
3278
3279                         channel_req = netinfo->channel;
3280                         if (channel_req <= CH_MAX_2G_CHANNEL)
3281                                 band = NL80211_BAND_2GHZ;
3282                         else
3283                                 band = NL80211_BAND_5GHZ;
3284                         channel[i].center_freq =
3285                                 ieee80211_channel_to_frequency(channel_req,
3286                                                                band);
3287                         channel[i].band = band;
3288                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3289                         request->channels[i] = &channel[i];
3290                         request->n_channels++;
3291                 }
3292
3293                 /* assign parsed ssid array */
3294                 if (request->n_ssids)
3295                         request->ssids = &ssid[0];
3296
3297                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3298                         /* Abort any on-going scan */
3299                         brcmf_abort_scanning(cfg);
3300                 }
3301
3302                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3303                 cfg->escan_info.run = brcmf_run_escan;
3304                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3305                 if (err) {
3306                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3307                         goto out_err;
3308                 }
3309                 cfg->sched_escan = true;
3310                 cfg->scan_request = request;
3311         } else {
3312                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3313                 goto out_err;
3314         }
3315
3316         kfree(ssid);
3317         kfree(channel);
3318         kfree(request);
3319         return 0;
3320
3321 out_err:
3322         kfree(ssid);
3323         kfree(channel);
3324         kfree(request);
3325         cfg80211_sched_scan_stopped(wiphy);
3326         return err;
3327 }
3328
3329 static int brcmf_dev_pno_clean(struct net_device *ndev)
3330 {
3331         int ret;
3332
3333         /* Disable pfn */
3334         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3335         if (ret == 0) {
3336                 /* clear pfn */
3337                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3338                                                NULL, 0);
3339         }
3340         if (ret < 0)
3341                 brcmf_err("failed code %d\n", ret);
3342
3343         return ret;
3344 }
3345
3346 static int brcmf_dev_pno_config(struct brcmf_if *ifp,
3347                                 struct cfg80211_sched_scan_request *request)
3348 {
3349         struct brcmf_pno_param_le pfn_param;
3350         struct brcmf_pno_macaddr_le pfn_mac;
3351         s32 err;
3352         u8 *mac_mask;
3353         int i;
3354
3355         memset(&pfn_param, 0, sizeof(pfn_param));
3356         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3357
3358         /* set extra pno params */
3359         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3360         pfn_param.repeat = BRCMF_PNO_REPEAT;
3361         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3362
3363         /* set up pno scan fr */
3364         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3365
3366         err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
3367                                        sizeof(pfn_param));
3368         if (err) {
3369                 brcmf_err("pfn_set failed, err=%d\n", err);
3370                 return err;
3371         }
3372
3373         /* Find out if mac randomization should be turned on */
3374         if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
3375                 return 0;
3376
3377         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
3378         pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
3379
3380         memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
3381         mac_mask = request->mac_addr_mask;
3382         for (i = 0; i < ETH_ALEN; i++) {
3383                 pfn_mac.mac[i] &= mac_mask[i];
3384                 pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
3385         }
3386         /* Clear multi bit */
3387         pfn_mac.mac[0] &= 0xFE;
3388         /* Set locally administered */
3389         pfn_mac.mac[0] |= 0x02;
3390
3391         err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
3392                                        sizeof(pfn_mac));
3393         if (err)
3394                 brcmf_err("pfn_macaddr failed, err=%d\n", err);
3395
3396         return err;
3397 }
3398
3399 static int
3400 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3401                                 struct net_device *ndev,
3402                                 struct cfg80211_sched_scan_request *request)
3403 {
3404         struct brcmf_if *ifp = netdev_priv(ndev);
3405         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3406         struct brcmf_pno_net_param_le pfn;
3407         int i;
3408         int ret = 0;
3409
3410         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3411                   request->n_match_sets, request->n_ssids);
3412         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3413                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3414                 return -EAGAIN;
3415         }
3416         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3417                 brcmf_err("Scanning suppressed: status (%lu)\n",
3418                           cfg->scan_status);
3419                 return -EAGAIN;
3420         }
3421
3422         if (!request->n_ssids || !request->n_match_sets) {
3423                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3424                           request->n_ssids);
3425                 return -EINVAL;
3426         }
3427
3428         if (request->n_ssids > 0) {
3429                 for (i = 0; i < request->n_ssids; i++) {
3430                         /* Active scan req for ssids */
3431                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3432                                   request->ssids[i].ssid);
3433
3434                         /* match_set ssids is a supert set of n_ssid list,
3435                          * so we need not add these set separately.
3436                          */
3437                 }
3438         }
3439
3440         if (request->n_match_sets > 0) {
3441                 /* clean up everything */
3442                 ret = brcmf_dev_pno_clean(ndev);
3443                 if  (ret < 0) {
3444                         brcmf_err("failed error=%d\n", ret);
3445                         return ret;
3446                 }
3447
3448                 /* configure pno */
3449                 if (brcmf_dev_pno_config(ifp, request))
3450                         return -EINVAL;
3451
3452                 /* configure each match set */
3453                 for (i = 0; i < request->n_match_sets; i++) {
3454                         struct cfg80211_ssid *ssid;
3455                         u32 ssid_len;
3456
3457                         ssid = &request->match_sets[i].ssid;
3458                         ssid_len = ssid->ssid_len;
3459
3460                         if (!ssid_len) {
3461                                 brcmf_err("skip broadcast ssid\n");
3462                                 continue;
3463                         }
3464                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3465                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3466                         pfn.wsec = cpu_to_le32(0);
3467                         pfn.infra = cpu_to_le32(1);
3468                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3469                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3470                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3471                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3472                                                        sizeof(pfn));
3473                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3474                                   ret == 0 ? "set" : "failed", ssid->ssid);
3475                 }
3476                 /* Enable the PNO */
3477                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3478                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3479                         return -EINVAL;
3480                 }
3481         } else {
3482                 return -EINVAL;
3483         }
3484
3485         return 0;
3486 }
3487
3488 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3489                                           struct net_device *ndev)
3490 {
3491         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3492
3493         brcmf_dbg(SCAN, "enter\n");
3494         brcmf_dev_pno_clean(ndev);
3495         if (cfg->sched_escan)
3496                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3497         return 0;
3498 }
3499
3500 static __always_inline void brcmf_delay(u32 ms)
3501 {
3502         if (ms < 1000 / HZ) {
3503                 cond_resched();
3504                 mdelay(ms);
3505         } else {
3506                 msleep(ms);
3507         }
3508 }
3509
3510 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3511                                      u8 *pattern, u32 patternsize, u8 *mask,
3512                                      u32 packet_offset)
3513 {
3514         struct brcmf_fil_wowl_pattern_le *filter;
3515         u32 masksize;
3516         u32 patternoffset;
3517         u8 *buf;
3518         u32 bufsize;
3519         s32 ret;
3520
3521         masksize = (patternsize + 7) / 8;
3522         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3523
3524         bufsize = sizeof(*filter) + patternsize + masksize;
3525         buf = kzalloc(bufsize, GFP_KERNEL);
3526         if (!buf)
3527                 return -ENOMEM;
3528         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3529
3530         memcpy(filter->cmd, cmd, 4);
3531         filter->masksize = cpu_to_le32(masksize);
3532         filter->offset = cpu_to_le32(packet_offset);
3533         filter->patternoffset = cpu_to_le32(patternoffset);
3534         filter->patternsize = cpu_to_le32(patternsize);
3535         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3536
3537         if ((mask) && (masksize))
3538                 memcpy(buf + sizeof(*filter), mask, masksize);
3539         if ((pattern) && (patternsize))
3540                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3541
3542         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3543
3544         kfree(buf);
3545         return ret;
3546 }
3547
3548 static s32
3549 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3550                       void *data)
3551 {
3552         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3553         struct brcmf_pno_scanresults_le *pfn_result;
3554         struct brcmf_pno_net_info_le *netinfo;
3555
3556         brcmf_dbg(SCAN, "Enter\n");
3557
3558         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3559                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3560                 return 0;
3561         }
3562
3563         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3564
3565         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3566                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3567                 return 0;
3568         }
3569
3570         if (le32_to_cpu(pfn_result->count) < 1) {
3571                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3572                           le32_to_cpu(pfn_result->count));
3573                 return -EINVAL;
3574         }
3575
3576         data += sizeof(struct brcmf_pno_scanresults_le);
3577         netinfo = (struct brcmf_pno_net_info_le *)data;
3578         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3579         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3580         cfg->wowl.nd->n_channels = 1;
3581         cfg->wowl.nd->channels[0] =
3582                 ieee80211_channel_to_frequency(netinfo->channel,
3583                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3584                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3585         cfg->wowl.nd_info->n_matches = 1;
3586         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3587
3588         /* Inform (the resume task) that the net detect information was recvd */
3589         cfg->wowl.nd_data_completed = true;
3590         wake_up(&cfg->wowl.nd_data_wait);
3591
3592         return 0;
3593 }
3594
3595 #ifdef CONFIG_PM
3596
3597 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3598 {
3599         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3600         struct brcmf_wowl_wakeind_le wake_ind_le;
3601         struct cfg80211_wowlan_wakeup wakeup_data;
3602         struct cfg80211_wowlan_wakeup *wakeup;
3603         u32 wakeind;
3604         s32 err;
3605         int timeout;
3606
3607         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3608                                        sizeof(wake_ind_le));
3609         if (err) {
3610                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3611                 return;
3612         }
3613
3614         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3615         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3616                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3617                        BRCMF_WOWL_PFN_FOUND)) {
3618                 wakeup = &wakeup_data;
3619                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3620                 wakeup_data.pattern_idx = -1;
3621
3622                 if (wakeind & BRCMF_WOWL_MAGIC) {
3623                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3624                         wakeup_data.magic_pkt = true;
3625                 }
3626                 if (wakeind & BRCMF_WOWL_DIS) {
3627                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3628                         wakeup_data.disconnect = true;
3629                 }
3630                 if (wakeind & BRCMF_WOWL_BCN) {
3631                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3632                         wakeup_data.disconnect = true;
3633                 }
3634                 if (wakeind & BRCMF_WOWL_RETR) {
3635                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3636                         wakeup_data.disconnect = true;
3637                 }
3638                 if (wakeind & BRCMF_WOWL_NET) {
3639                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3640                         /* For now always map to pattern 0, no API to get
3641                          * correct information available at the moment.
3642                          */
3643                         wakeup_data.pattern_idx = 0;
3644                 }
3645                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3646                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3647                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3648                                 cfg->wowl.nd_data_completed,
3649                                 BRCMF_ND_INFO_TIMEOUT);
3650                         if (!timeout)
3651                                 brcmf_err("No result for wowl net detect\n");
3652                         else
3653                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3654                 }
3655                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3656                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3657                         wakeup_data.gtk_rekey_failure = true;
3658                 }
3659         } else {
3660                 wakeup = NULL;
3661         }
3662         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3663 }
3664
3665 #else
3666
3667 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3668 {
3669 }
3670
3671 #endif /* CONFIG_PM */
3672
3673 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3674 {
3675         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3676         struct net_device *ndev = cfg_to_ndev(cfg);
3677         struct brcmf_if *ifp = netdev_priv(ndev);
3678
3679         brcmf_dbg(TRACE, "Enter\n");
3680
3681         if (cfg->wowl.active) {
3682                 brcmf_report_wowl_wakeind(wiphy, ifp);
3683                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3684                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3685                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3686                         brcmf_configure_arp_nd_offload(ifp, true);
3687                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3688                                       cfg->wowl.pre_pmmode);
3689                 cfg->wowl.active = false;
3690                 if (cfg->wowl.nd_enabled) {
3691                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
3692                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3693                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3694                                             brcmf_notify_sched_scan_results);
3695                         cfg->wowl.nd_enabled = false;
3696                 }
3697         }
3698         return 0;
3699 }
3700
3701 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3702                                  struct brcmf_if *ifp,
3703                                  struct cfg80211_wowlan *wowl)
3704 {
3705         u32 wowl_config;
3706         u32 i;
3707
3708         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3709
3710         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3711                 brcmf_configure_arp_nd_offload(ifp, false);
3712         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3713         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3714
3715         wowl_config = 0;
3716         if (wowl->disconnect)
3717                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3718         if (wowl->magic_pkt)
3719                 wowl_config |= BRCMF_WOWL_MAGIC;
3720         if ((wowl->patterns) && (wowl->n_patterns)) {
3721                 wowl_config |= BRCMF_WOWL_NET;
3722                 for (i = 0; i < wowl->n_patterns; i++) {
3723                         brcmf_config_wowl_pattern(ifp, "add",
3724                                 (u8 *)wowl->patterns[i].pattern,
3725                                 wowl->patterns[i].pattern_len,
3726                                 (u8 *)wowl->patterns[i].mask,
3727                                 wowl->patterns[i].pkt_offset);
3728                 }
3729         }
3730         if (wowl->nd_config) {
3731                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3732                                                 wowl->nd_config);
3733                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3734
3735                 cfg->wowl.nd_data_completed = false;
3736                 cfg->wowl.nd_enabled = true;
3737                 /* Now reroute the event for PFN to the wowl function. */
3738                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3739                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3740                                     brcmf_wowl_nd_results);
3741         }
3742         if (wowl->gtk_rekey_failure)
3743                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3744         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3745                 wowl_config |= BRCMF_WOWL_UNASSOC;
3746
3747         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear",
3748                                  sizeof(struct brcmf_wowl_wakeind_le));
3749         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3750         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3751         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3752         cfg->wowl.active = true;
3753 }
3754
3755 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3756                                   struct cfg80211_wowlan *wowl)
3757 {
3758         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3759         struct net_device *ndev = cfg_to_ndev(cfg);
3760         struct brcmf_if *ifp = netdev_priv(ndev);
3761         struct brcmf_cfg80211_vif *vif;
3762
3763         brcmf_dbg(TRACE, "Enter\n");
3764
3765         /* if the primary net_device is not READY there is nothing
3766          * we can do but pray resume goes smoothly.
3767          */
3768         if (!check_vif_up(ifp->vif))
3769                 goto exit;
3770
3771         /* Stop scheduled scan */
3772         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3773                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
3774
3775         /* end any scanning */
3776         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3777                 brcmf_abort_scanning(cfg);
3778
3779         if (wowl == NULL) {
3780                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3781                 list_for_each_entry(vif, &cfg->vif_list, list) {
3782                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3783                                 continue;
3784                         /* While going to suspend if associated with AP
3785                          * disassociate from AP to save power while system is
3786                          * in suspended state
3787                          */
3788                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3789                         /* Make sure WPA_Supplicant receives all the event
3790                          * generated due to DISASSOC call to the fw to keep
3791                          * the state fw and WPA_Supplicant state consistent
3792                          */
3793                         brcmf_delay(500);
3794                 }
3795                 /* Configure MPC */
3796                 brcmf_set_mpc(ifp, 1);
3797
3798         } else {
3799                 /* Configure WOWL paramaters */
3800                 brcmf_configure_wowl(cfg, ifp, wowl);
3801         }
3802
3803 exit:
3804         brcmf_dbg(TRACE, "Exit\n");
3805         /* clear any scanning activity */
3806         cfg->scan_status = 0;
3807         return 0;
3808 }
3809
3810 static __used s32
3811 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3812 {
3813         struct brcmf_pmk_list_le *pmk_list;
3814         int i;
3815         u32 npmk;
3816         s32 err;
3817
3818         pmk_list = &cfg->pmk_list;
3819         npmk = le32_to_cpu(pmk_list->npmk);
3820
3821         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3822         for (i = 0; i < npmk; i++)
3823                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3824
3825         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3826                                        sizeof(*pmk_list));
3827
3828         return err;
3829 }
3830
3831 static s32
3832 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3833                          struct cfg80211_pmksa *pmksa)
3834 {
3835         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3836         struct brcmf_if *ifp = netdev_priv(ndev);
3837         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3838         s32 err;
3839         u32 npmk, i;
3840
3841         brcmf_dbg(TRACE, "Enter\n");
3842         if (!check_vif_up(ifp->vif))
3843                 return -EIO;
3844
3845         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3846         for (i = 0; i < npmk; i++)
3847                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3848                         break;
3849         if (i < BRCMF_MAXPMKID) {
3850                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3851                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3852                 if (i == npmk) {
3853                         npmk++;
3854                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3855                 }
3856         } else {
3857                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3858                 return -EINVAL;
3859         }
3860
3861         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3862         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3863                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3864                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3865                           pmk[npmk].pmkid[i + 3]);
3866
3867         err = brcmf_update_pmklist(cfg, ifp);
3868
3869         brcmf_dbg(TRACE, "Exit\n");
3870         return err;
3871 }
3872
3873 static s32
3874 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3875                          struct cfg80211_pmksa *pmksa)
3876 {
3877         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3878         struct brcmf_if *ifp = netdev_priv(ndev);
3879         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3880         s32 err;
3881         u32 npmk, i;
3882
3883         brcmf_dbg(TRACE, "Enter\n");
3884         if (!check_vif_up(ifp->vif))
3885                 return -EIO;
3886
3887         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3888
3889         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3890         for (i = 0; i < npmk; i++)
3891                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3892                         break;
3893
3894         if ((npmk > 0) && (i < npmk)) {
3895                 for (; i < (npmk - 1); i++) {
3896                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3897                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3898                                WLAN_PMKID_LEN);
3899                 }
3900                 memset(&pmk[i], 0, sizeof(*pmk));
3901                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3902         } else {
3903                 brcmf_err("Cache entry not found\n");
3904                 return -EINVAL;
3905         }
3906
3907         err = brcmf_update_pmklist(cfg, ifp);
3908
3909         brcmf_dbg(TRACE, "Exit\n");
3910         return err;
3911
3912 }
3913
3914 static s32
3915 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3916 {
3917         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3918         struct brcmf_if *ifp = netdev_priv(ndev);
3919         s32 err;
3920
3921         brcmf_dbg(TRACE, "Enter\n");
3922         if (!check_vif_up(ifp->vif))
3923                 return -EIO;
3924
3925         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3926         err = brcmf_update_pmklist(cfg, ifp);
3927
3928         brcmf_dbg(TRACE, "Exit\n");
3929         return err;
3930
3931 }
3932
3933 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3934 {
3935         s32 err;
3936
3937         /* set auth */
3938         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3939         if (err < 0) {
3940                 brcmf_err("auth error %d\n", err);
3941                 return err;
3942         }
3943         /* set wsec */
3944         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3945         if (err < 0) {
3946                 brcmf_err("wsec error %d\n", err);
3947                 return err;
3948         }
3949         /* set upper-layer auth */
3950         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3951         if (err < 0) {
3952                 brcmf_err("wpa_auth error %d\n", err);
3953                 return err;
3954         }
3955
3956         return 0;
3957 }
3958
3959 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3960 {
3961         if (is_rsn_ie)
3962                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3963
3964         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3965 }
3966
3967 static s32
3968 brcmf_configure_wpaie(struct brcmf_if *ifp,
3969                       const struct brcmf_vs_tlv *wpa_ie,
3970                       bool is_rsn_ie)
3971 {
3972         u32 auth = 0; /* d11 open authentication */
3973         u16 count;
3974         s32 err = 0;
3975         s32 len;
3976         u32 i;
3977         u32 wsec;
3978         u32 pval = 0;
3979         u32 gval = 0;
3980         u32 wpa_auth = 0;
3981         u32 offset;
3982         u8 *data;
3983         u16 rsn_cap;
3984         u32 wme_bss_disable;
3985         u32 mfp;
3986
3987         brcmf_dbg(TRACE, "Enter\n");
3988         if (wpa_ie == NULL)
3989                 goto exit;
3990
3991         len = wpa_ie->len + TLV_HDR_LEN;
3992         data = (u8 *)wpa_ie;
3993         offset = TLV_HDR_LEN;
3994         if (!is_rsn_ie)
3995                 offset += VS_IE_FIXED_HDR_LEN;
3996         else
3997                 offset += WPA_IE_VERSION_LEN;
3998
3999         /* check for multicast cipher suite */
4000         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4001                 err = -EINVAL;
4002                 brcmf_err("no multicast cipher suite\n");
4003                 goto exit;
4004         }
4005
4006         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4007                 err = -EINVAL;
4008                 brcmf_err("ivalid OUI\n");
4009                 goto exit;
4010         }
4011         offset += TLV_OUI_LEN;
4012
4013         /* pick up multicast cipher */
4014         switch (data[offset]) {
4015         case WPA_CIPHER_NONE:
4016                 gval = 0;
4017                 break;
4018         case WPA_CIPHER_WEP_40:
4019         case WPA_CIPHER_WEP_104:
4020                 gval = WEP_ENABLED;
4021                 break;
4022         case WPA_CIPHER_TKIP:
4023                 gval = TKIP_ENABLED;
4024                 break;
4025         case WPA_CIPHER_AES_CCM:
4026                 gval = AES_ENABLED;
4027                 break;
4028         default:
4029                 err = -EINVAL;
4030                 brcmf_err("Invalid multi cast cipher info\n");
4031                 goto exit;
4032         }
4033
4034         offset++;
4035         /* walk thru unicast cipher list and pick up what we recognize */
4036         count = data[offset] + (data[offset + 1] << 8);
4037         offset += WPA_IE_SUITE_COUNT_LEN;
4038         /* Check for unicast suite(s) */
4039         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4040                 err = -EINVAL;
4041                 brcmf_err("no unicast cipher suite\n");
4042                 goto exit;
4043         }
4044         for (i = 0; i < count; i++) {
4045                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4046                         err = -EINVAL;
4047                         brcmf_err("ivalid OUI\n");
4048                         goto exit;
4049                 }
4050                 offset += TLV_OUI_LEN;
4051                 switch (data[offset]) {
4052                 case WPA_CIPHER_NONE:
4053                         break;
4054                 case WPA_CIPHER_WEP_40:
4055                 case WPA_CIPHER_WEP_104:
4056                         pval |= WEP_ENABLED;
4057                         break;
4058                 case WPA_CIPHER_TKIP:
4059                         pval |= TKIP_ENABLED;
4060                         break;
4061                 case WPA_CIPHER_AES_CCM:
4062                         pval |= AES_ENABLED;
4063                         break;
4064                 default:
4065                         brcmf_err("Ivalid unicast security info\n");
4066                 }
4067                 offset++;
4068         }
4069         /* walk thru auth management suite list and pick up what we recognize */
4070         count = data[offset] + (data[offset + 1] << 8);
4071         offset += WPA_IE_SUITE_COUNT_LEN;
4072         /* Check for auth key management suite(s) */
4073         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4074                 err = -EINVAL;
4075                 brcmf_err("no auth key mgmt suite\n");
4076                 goto exit;
4077         }
4078         for (i = 0; i < count; i++) {
4079                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4080                         err = -EINVAL;
4081                         brcmf_err("ivalid OUI\n");
4082                         goto exit;
4083                 }
4084                 offset += TLV_OUI_LEN;
4085                 switch (data[offset]) {
4086                 case RSN_AKM_NONE:
4087                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4088                         wpa_auth |= WPA_AUTH_NONE;
4089                         break;
4090                 case RSN_AKM_UNSPECIFIED:
4091                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4092                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4093                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4094                         break;
4095                 case RSN_AKM_PSK:
4096                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4097                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4098                                     (wpa_auth |= WPA_AUTH_PSK);
4099                         break;
4100                 case RSN_AKM_SHA256_PSK:
4101                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4102                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4103                         break;
4104                 case RSN_AKM_SHA256_1X:
4105                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4106                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4107                         break;
4108                 default:
4109                         brcmf_err("Ivalid key mgmt info\n");
4110                 }
4111                 offset++;
4112         }
4113
4114         mfp = BRCMF_MFP_NONE;
4115         if (is_rsn_ie) {
4116                 wme_bss_disable = 1;
4117                 if ((offset + RSN_CAP_LEN) <= len) {
4118                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4119                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4120                                 wme_bss_disable = 0;
4121                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4122                                 brcmf_dbg(TRACE, "MFP Required\n");
4123                                 mfp = BRCMF_MFP_REQUIRED;
4124                                 /* Firmware only supports mfp required in
4125                                  * combination with WPA2_AUTH_PSK_SHA256 or
4126                                  * WPA2_AUTH_1X_SHA256.
4127                                  */
4128                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4129                                                   WPA2_AUTH_1X_SHA256))) {
4130                                         err = -EINVAL;
4131                                         goto exit;
4132                                 }
4133                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4134                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4135                                  * is to be included in the rsn ie.
4136                                  */
4137                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4138                                         wpa_auth |= WPA2_AUTH_PSK;
4139                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4140                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4141                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4142                                 brcmf_dbg(TRACE, "MFP Capable\n");
4143                                 mfp = BRCMF_MFP_CAPABLE;
4144                         }
4145                 }
4146                 offset += RSN_CAP_LEN;
4147                 /* set wme_bss_disable to sync RSN Capabilities */
4148                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4149                                                wme_bss_disable);
4150                 if (err < 0) {
4151                         brcmf_err("wme_bss_disable error %d\n", err);
4152                         goto exit;
4153                 }
4154
4155                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4156                 offset += RSN_PMKID_COUNT_LEN;
4157
4158                 /* See if there is BIP wpa suite left for MFP */
4159                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4160                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4161                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4162                                                         &data[offset],
4163                                                         WPA_IE_MIN_OUI_LEN);
4164                         if (err < 0) {
4165                                 brcmf_err("bip error %d\n", err);
4166                                 goto exit;
4167                         }
4168                 }
4169         }
4170         /* FOR WPS , set SES_OW_ENABLED */
4171         wsec = (pval | gval | SES_OW_ENABLED);
4172
4173         /* set auth */
4174         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4175         if (err < 0) {
4176                 brcmf_err("auth error %d\n", err);
4177                 goto exit;
4178         }
4179         /* set wsec */
4180         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4181         if (err < 0) {
4182                 brcmf_err("wsec error %d\n", err);
4183                 goto exit;
4184         }
4185         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4186          * will overwrite the values set by MFP
4187          */
4188         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4189                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4190                 if (err < 0) {
4191                         brcmf_err("mfp error %d\n", err);
4192                         goto exit;
4193                 }
4194         }
4195         /* set upper-layer auth */
4196         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4197         if (err < 0) {
4198                 brcmf_err("wpa_auth error %d\n", err);
4199                 goto exit;
4200         }
4201
4202 exit:
4203         return err;
4204 }
4205
4206 static s32
4207 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4208                      struct parsed_vndr_ies *vndr_ies)
4209 {
4210         struct brcmf_vs_tlv *vndrie;
4211         struct brcmf_tlv *ie;
4212         struct parsed_vndr_ie_info *parsed_info;
4213         s32 remaining_len;
4214
4215         remaining_len = (s32)vndr_ie_len;
4216         memset(vndr_ies, 0, sizeof(*vndr_ies));
4217
4218         ie = (struct brcmf_tlv *)vndr_ie_buf;
4219         while (ie) {
4220                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4221                         goto next;
4222                 vndrie = (struct brcmf_vs_tlv *)ie;
4223                 /* len should be bigger than OUI length + one */
4224                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4225                         brcmf_err("invalid vndr ie. length is too small %d\n",
4226                                   vndrie->len);
4227                         goto next;
4228                 }
4229                 /* if wpa or wme ie, do not add ie */
4230                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4231                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4232                     (vndrie->oui_type == WME_OUI_TYPE))) {
4233                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4234                         goto next;
4235                 }
4236
4237                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4238
4239                 /* save vndr ie information */
4240                 parsed_info->ie_ptr = (char *)vndrie;
4241                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4242                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4243
4244                 vndr_ies->count++;
4245
4246                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4247                           parsed_info->vndrie.oui[0],
4248                           parsed_info->vndrie.oui[1],
4249                           parsed_info->vndrie.oui[2],
4250                           parsed_info->vndrie.oui_type);
4251
4252                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4253                         break;
4254 next:
4255                 remaining_len -= (ie->len + TLV_HDR_LEN);
4256                 if (remaining_len <= TLV_HDR_LEN)
4257                         ie = NULL;
4258                 else
4259                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4260                                 TLV_HDR_LEN);
4261         }
4262         return 0;
4263 }
4264
4265 static u32
4266 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4267 {
4268
4269         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4270         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4271
4272         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4273
4274         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4275
4276         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4277
4278         return ie_len + VNDR_IE_HDR_SIZE;
4279 }
4280
4281 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4282                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4283 {
4284         struct brcmf_if *ifp;
4285         struct vif_saved_ie *saved_ie;
4286         s32 err = 0;
4287         u8  *iovar_ie_buf;
4288         u8  *curr_ie_buf;
4289         u8  *mgmt_ie_buf = NULL;
4290         int mgmt_ie_buf_len;
4291         u32 *mgmt_ie_len;
4292         u32 del_add_ie_buf_len = 0;
4293         u32 total_ie_buf_len = 0;
4294         u32 parsed_ie_buf_len = 0;
4295         struct parsed_vndr_ies old_vndr_ies;
4296         struct parsed_vndr_ies new_vndr_ies;
4297         struct parsed_vndr_ie_info *vndrie_info;
4298         s32 i;
4299         u8 *ptr;
4300         int remained_buf_len;
4301
4302         if (!vif)
4303                 return -ENODEV;
4304         ifp = vif->ifp;
4305         saved_ie = &vif->saved_ie;
4306
4307         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4308                   pktflag);
4309         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4310         if (!iovar_ie_buf)
4311                 return -ENOMEM;
4312         curr_ie_buf = iovar_ie_buf;
4313         switch (pktflag) {
4314         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4315                 mgmt_ie_buf = saved_ie->probe_req_ie;
4316                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4317                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4318                 break;
4319         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4320                 mgmt_ie_buf = saved_ie->probe_res_ie;
4321                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4322                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4323                 break;
4324         case BRCMF_VNDR_IE_BEACON_FLAG:
4325                 mgmt_ie_buf = saved_ie->beacon_ie;
4326                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4327                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4328                 break;
4329         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4330                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4331                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4332                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4333                 break;
4334         default:
4335                 err = -EPERM;
4336                 brcmf_err("not suitable type\n");
4337                 goto exit;
4338         }
4339
4340         if (vndr_ie_len > mgmt_ie_buf_len) {
4341                 err = -ENOMEM;
4342                 brcmf_err("extra IE size too big\n");
4343                 goto exit;
4344         }
4345
4346         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4347         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4348                 ptr = curr_ie_buf;
4349                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4350                 for (i = 0; i < new_vndr_ies.count; i++) {
4351                         vndrie_info = &new_vndr_ies.ie_info[i];
4352                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4353                                vndrie_info->ie_len);
4354                         parsed_ie_buf_len += vndrie_info->ie_len;
4355                 }
4356         }
4357
4358         if (mgmt_ie_buf && *mgmt_ie_len) {
4359                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4360                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4361                             parsed_ie_buf_len) == 0)) {
4362                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4363                         goto exit;
4364                 }
4365
4366                 /* parse old vndr_ie */
4367                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4368
4369                 /* make a command to delete old ie */
4370                 for (i = 0; i < old_vndr_ies.count; i++) {
4371                         vndrie_info = &old_vndr_ies.ie_info[i];
4372
4373                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4374                                   vndrie_info->vndrie.id,
4375                                   vndrie_info->vndrie.len,
4376                                   vndrie_info->vndrie.oui[0],
4377                                   vndrie_info->vndrie.oui[1],
4378                                   vndrie_info->vndrie.oui[2]);
4379
4380                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4381                                                            vndrie_info->ie_ptr,
4382                                                            vndrie_info->ie_len,
4383                                                            "del");
4384                         curr_ie_buf += del_add_ie_buf_len;
4385                         total_ie_buf_len += del_add_ie_buf_len;
4386                 }
4387         }
4388
4389         *mgmt_ie_len = 0;
4390         /* Add if there is any extra IE */
4391         if (mgmt_ie_buf && parsed_ie_buf_len) {
4392                 ptr = mgmt_ie_buf;
4393
4394                 remained_buf_len = mgmt_ie_buf_len;
4395
4396                 /* make a command to add new ie */
4397                 for (i = 0; i < new_vndr_ies.count; i++) {
4398                         vndrie_info = &new_vndr_ies.ie_info[i];
4399
4400                         /* verify remained buf size before copy data */
4401                         if (remained_buf_len < (vndrie_info->vndrie.len +
4402                                                         VNDR_IE_VSIE_OFFSET)) {
4403                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4404                                           remained_buf_len);
4405                                 break;
4406                         }
4407                         remained_buf_len -= (vndrie_info->ie_len +
4408                                              VNDR_IE_VSIE_OFFSET);
4409
4410                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4411                                   vndrie_info->vndrie.id,
4412                                   vndrie_info->vndrie.len,
4413                                   vndrie_info->vndrie.oui[0],
4414                                   vndrie_info->vndrie.oui[1],
4415                                   vndrie_info->vndrie.oui[2]);
4416
4417                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4418                                                            vndrie_info->ie_ptr,
4419                                                            vndrie_info->ie_len,
4420                                                            "add");
4421
4422                         /* save the parsed IE in wl struct */
4423                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4424                                vndrie_info->ie_len);
4425                         *mgmt_ie_len += vndrie_info->ie_len;
4426
4427                         curr_ie_buf += del_add_ie_buf_len;
4428                         total_ie_buf_len += del_add_ie_buf_len;
4429                 }
4430         }
4431         if (total_ie_buf_len) {
4432                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4433                                                  total_ie_buf_len);
4434                 if (err)
4435                         brcmf_err("vndr ie set error : %d\n", err);
4436         }
4437
4438 exit:
4439         kfree(iovar_ie_buf);
4440         return err;
4441 }
4442
4443 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4444 {
4445         s32 pktflags[] = {
4446                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4447                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4448                 BRCMF_VNDR_IE_BEACON_FLAG
4449         };
4450         int i;
4451
4452         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4453                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4454
4455         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4456         return 0;
4457 }
4458
4459 static s32
4460 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4461                         struct cfg80211_beacon_data *beacon)
4462 {
4463         s32 err;
4464
4465         /* Set Beacon IEs to FW */
4466         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4467                                     beacon->tail, beacon->tail_len);
4468         if (err) {
4469                 brcmf_err("Set Beacon IE Failed\n");
4470                 return err;
4471         }
4472         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4473
4474         /* Set Probe Response IEs to FW */
4475         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4476                                     beacon->proberesp_ies,
4477                                     beacon->proberesp_ies_len);
4478         if (err)
4479                 brcmf_err("Set Probe Resp IE Failed\n");
4480         else
4481                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4482
4483         return err;
4484 }
4485
4486 static s32
4487 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4488                         struct cfg80211_ap_settings *settings)
4489 {
4490         s32 ie_offset;
4491         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4492         struct brcmf_if *ifp = netdev_priv(ndev);
4493         const struct brcmf_tlv *ssid_ie;
4494         const struct brcmf_tlv *country_ie;
4495         struct brcmf_ssid_le ssid_le;
4496         s32 err = -EPERM;
4497         const struct brcmf_tlv *rsn_ie;
4498         const struct brcmf_vs_tlv *wpa_ie;
4499         struct brcmf_join_params join_params;
4500         enum nl80211_iftype dev_role;
4501         struct brcmf_fil_bss_enable_le bss_enable;
4502         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4503         bool mbss;
4504         int is_11d;
4505
4506         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4507                   settings->chandef.chan->hw_value,
4508                   settings->chandef.center_freq1, settings->chandef.width,
4509                   settings->beacon_interval, settings->dtim_period);
4510         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4511                   settings->ssid, settings->ssid_len, settings->auth_type,
4512                   settings->inactivity_timeout);
4513         dev_role = ifp->vif->wdev.iftype;
4514         mbss = ifp->vif->mbss;
4515
4516         /* store current 11d setting */
4517         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
4518         country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4519                                       settings->beacon.tail_len,
4520                                       WLAN_EID_COUNTRY);
4521         is_11d = country_ie ? 1 : 0;
4522
4523         memset(&ssid_le, 0, sizeof(ssid_le));
4524         if (settings->ssid == NULL || settings->ssid_len == 0) {
4525                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4526                 ssid_ie = brcmf_parse_tlvs(
4527                                 (u8 *)&settings->beacon.head[ie_offset],
4528                                 settings->beacon.head_len - ie_offset,
4529                                 WLAN_EID_SSID);
4530                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4531                         return -EINVAL;
4532
4533                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4534                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4535                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4536         } else {
4537                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4538                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4539         }
4540
4541         if (!mbss) {
4542                 brcmf_set_mpc(ifp, 0);
4543                 brcmf_configure_arp_nd_offload(ifp, false);
4544         }
4545
4546         /* find the RSN_IE */
4547         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4548                                   settings->beacon.tail_len, WLAN_EID_RSN);
4549
4550         /* find the WPA_IE */
4551         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4552                                   settings->beacon.tail_len);
4553
4554         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4555                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4556                 if (wpa_ie != NULL) {
4557                         /* WPA IE */
4558                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4559                         if (err < 0)
4560                                 goto exit;
4561                 } else {
4562                         struct brcmf_vs_tlv *tmp_ie;
4563
4564                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4565
4566                         /* RSN IE */
4567                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4568                         if (err < 0)
4569                                 goto exit;
4570                 }
4571         } else {
4572                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4573                 brcmf_configure_opensecurity(ifp);
4574         }
4575
4576         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4577
4578         /* Parameters shared by all radio interfaces */
4579         if (!mbss) {
4580                 if (is_11d != ifp->vif->is_11d) {
4581                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4582                                                     is_11d);
4583                         if (err < 0) {
4584                                 brcmf_err("Regulatory Set Error, %d\n", err);
4585                                 goto exit;
4586                         }
4587                 }
4588                 if (settings->beacon_interval) {
4589                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4590                                                     settings->beacon_interval);
4591                         if (err < 0) {
4592                                 brcmf_err("Beacon Interval Set Error, %d\n",
4593                                           err);
4594                                 goto exit;
4595                         }
4596                 }
4597                 if (settings->dtim_period) {
4598                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4599                                                     settings->dtim_period);
4600                         if (err < 0) {
4601                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4602                                 goto exit;
4603                         }
4604                 }
4605
4606                 if ((dev_role == NL80211_IFTYPE_AP) &&
4607                     ((ifp->ifidx == 0) ||
4608                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4609                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4610                         if (err < 0) {
4611                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4612                                 goto exit;
4613                         }
4614                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4615                 }
4616
4617                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4618                 if (err < 0) {
4619                         brcmf_err("SET INFRA error %d\n", err);
4620                         goto exit;
4621                 }
4622         } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
4623                 /* Multiple-BSS should use same 11d configuration */
4624                 err = -EINVAL;
4625                 goto exit;
4626         }
4627
4628         /* Interface specific setup */
4629         if (dev_role == NL80211_IFTYPE_AP) {
4630                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4631                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4632
4633                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4634                 if (err < 0) {
4635                         brcmf_err("setting AP mode failed %d\n", err);
4636                         goto exit;
4637                 }
4638                 if (!mbss) {
4639                         /* Firmware 10.x requires setting channel after enabling
4640                          * AP and before bringing interface up.
4641                          */
4642                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4643                         if (err < 0) {
4644                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4645                                           chanspec, err);
4646                                 goto exit;
4647                         }
4648                 }
4649                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4650                 if (err < 0) {
4651                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4652                         goto exit;
4653                 }
4654                 /* On DOWN the firmware removes the WEP keys, reconfigure
4655                  * them if they were set.
4656                  */
4657                 brcmf_cfg80211_reconfigure_wep(ifp);
4658
4659                 memset(&join_params, 0, sizeof(join_params));
4660                 /* join parameters starts with ssid */
4661                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4662                 /* create softap */
4663                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4664                                              &join_params, sizeof(join_params));
4665                 if (err < 0) {
4666                         brcmf_err("SET SSID error (%d)\n", err);
4667                         goto exit;
4668                 }
4669
4670                 if (settings->hidden_ssid) {
4671                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4672                         if (err) {
4673                                 brcmf_err("closednet error (%d)\n", err);
4674                                 goto exit;
4675                         }
4676                 }
4677
4678                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4679         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4680                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4681                 if (err < 0) {
4682                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4683                                   chanspec, err);
4684                         goto exit;
4685                 }
4686                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4687                                                 sizeof(ssid_le));
4688                 if (err < 0) {
4689                         brcmf_err("setting ssid failed %d\n", err);
4690                         goto exit;
4691                 }
4692                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4693                 bss_enable.enable = cpu_to_le32(1);
4694                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4695                                                sizeof(bss_enable));
4696                 if (err < 0) {
4697                         brcmf_err("bss_enable config failed %d\n", err);
4698                         goto exit;
4699                 }
4700
4701                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4702         } else {
4703                 WARN_ON(1);
4704         }
4705
4706         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4707         brcmf_net_setcarrier(ifp, true);
4708
4709 exit:
4710         if ((err) && (!mbss)) {
4711                 brcmf_set_mpc(ifp, 1);
4712                 brcmf_configure_arp_nd_offload(ifp, true);
4713         }
4714         return err;
4715 }
4716
4717 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4718 {
4719         struct brcmf_if *ifp = netdev_priv(ndev);
4720         s32 err;
4721         struct brcmf_fil_bss_enable_le bss_enable;
4722         struct brcmf_join_params join_params;
4723
4724         brcmf_dbg(TRACE, "Enter\n");
4725
4726         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4727                 /* Due to most likely deauths outstanding we sleep */
4728                 /* first to make sure they get processed by fw. */
4729                 msleep(400);
4730
4731                 if (ifp->vif->mbss) {
4732                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4733                         return err;
4734                 }
4735
4736                 /* First BSS doesn't get a full reset */
4737                 if (ifp->bsscfgidx == 0)
4738                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4739
4740                 memset(&join_params, 0, sizeof(join_params));
4741                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4742                                              &join_params, sizeof(join_params));
4743                 if (err < 0)
4744                         brcmf_err("SET SSID error (%d)\n", err);
4745                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4746                 if (err < 0)
4747                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4748                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4749                 if (err < 0)
4750                         brcmf_err("setting AP mode failed %d\n", err);
4751                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
4752                 if (err < 0)
4753                         brcmf_err("setting INFRA mode failed %d\n", err);
4754                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4755                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4756                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4757                                             ifp->vif->is_11d);
4758                 if (err < 0)
4759                         brcmf_err("restoring REGULATORY setting failed %d\n",
4760                                   err);
4761                 /* Bring device back up so it can be used again */
4762                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4763                 if (err < 0)
4764                         brcmf_err("BRCMF_C_UP error %d\n", err);
4765         } else {
4766                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4767                 bss_enable.enable = cpu_to_le32(0);
4768                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4769                                                sizeof(bss_enable));
4770                 if (err < 0)
4771                         brcmf_err("bss_enable config failed %d\n", err);
4772         }
4773         brcmf_set_mpc(ifp, 1);
4774         brcmf_configure_arp_nd_offload(ifp, true);
4775         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4776         brcmf_net_setcarrier(ifp, false);
4777
4778         return err;
4779 }
4780
4781 static s32
4782 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4783                              struct cfg80211_beacon_data *info)
4784 {
4785         struct brcmf_if *ifp = netdev_priv(ndev);
4786         s32 err;
4787
4788         brcmf_dbg(TRACE, "Enter\n");
4789
4790         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4791
4792         return err;
4793 }
4794
4795 static int
4796 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4797                            struct station_del_parameters *params)
4798 {
4799         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4800         struct brcmf_scb_val_le scbval;
4801         struct brcmf_if *ifp = netdev_priv(ndev);
4802         s32 err;
4803
4804         if (!params->mac)
4805                 return -EFAULT;
4806
4807         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4808
4809         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4810                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4811         if (!check_vif_up(ifp->vif))
4812                 return -EIO;
4813
4814         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4815         scbval.val = cpu_to_le32(params->reason_code);
4816         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4817                                      &scbval, sizeof(scbval));
4818         if (err)
4819                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4820
4821         brcmf_dbg(TRACE, "Exit\n");
4822         return err;
4823 }
4824
4825 static int
4826 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4827                               const u8 *mac, struct station_parameters *params)
4828 {
4829         struct brcmf_if *ifp = netdev_priv(ndev);
4830         s32 err;
4831
4832         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4833                   params->sta_flags_mask, params->sta_flags_set);
4834
4835         /* Ignore all 00 MAC */
4836         if (is_zero_ether_addr(mac))
4837                 return 0;
4838
4839         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4840                 return 0;
4841
4842         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4843                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4844                                              (void *)mac, ETH_ALEN);
4845         else
4846                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4847                                              (void *)mac, ETH_ALEN);
4848         if (err < 0)
4849                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4850
4851         return err;
4852 }
4853
4854 static void
4855 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4856                                    struct wireless_dev *wdev,
4857                                    u16 frame_type, bool reg)
4858 {
4859         struct brcmf_cfg80211_vif *vif;
4860         u16 mgmt_type;
4861
4862         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4863
4864         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4865         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4866         if (reg)
4867                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4868         else
4869                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4870 }
4871
4872
4873 static int
4874 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4875                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4876 {
4877         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4878         struct ieee80211_channel *chan = params->chan;
4879         const u8 *buf = params->buf;
4880         size_t len = params->len;
4881         const struct ieee80211_mgmt *mgmt;
4882         struct brcmf_cfg80211_vif *vif;
4883         s32 err = 0;
4884         s32 ie_offset;
4885         s32 ie_len;
4886         struct brcmf_fil_action_frame_le *action_frame;
4887         struct brcmf_fil_af_params_le *af_params;
4888         bool ack;
4889         s32 chan_nr;
4890         u32 freq;
4891
4892         brcmf_dbg(TRACE, "Enter\n");
4893
4894         *cookie = 0;
4895
4896         mgmt = (const struct ieee80211_mgmt *)buf;
4897
4898         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4899                 brcmf_err("Driver only allows MGMT packet type\n");
4900                 return -EPERM;
4901         }
4902
4903         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4904
4905         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4906                 /* Right now the only reason to get a probe response */
4907                 /* is for p2p listen response or for p2p GO from     */
4908                 /* wpa_supplicant. Unfortunately the probe is send   */
4909                 /* on primary ndev, while dongle wants it on the p2p */
4910                 /* vif. Since this is only reason for a probe        */
4911                 /* response to be sent, the vif is taken from cfg.   */
4912                 /* If ever desired to send proberesp for non p2p     */
4913                 /* response then data should be checked for          */
4914                 /* "DIRECT-". Note in future supplicant will take    */
4915                 /* dedicated p2p wdev to do this and then this 'hack'*/
4916                 /* is not needed anymore.                            */
4917                 ie_offset =  DOT11_MGMT_HDR_LEN +
4918                              DOT11_BCN_PRB_FIXED_LEN;
4919                 ie_len = len - ie_offset;
4920                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4921                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4922                 err = brcmf_vif_set_mgmt_ie(vif,
4923                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4924                                             &buf[ie_offset],
4925                                             ie_len);
4926                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4927                                         GFP_KERNEL);
4928         } else if (ieee80211_is_action(mgmt->frame_control)) {
4929                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4930                 if (af_params == NULL) {
4931                         brcmf_err("unable to allocate frame\n");
4932                         err = -ENOMEM;
4933                         goto exit;
4934                 }
4935                 action_frame = &af_params->action_frame;
4936                 /* Add the packet Id */
4937                 action_frame->packet_id = cpu_to_le32(*cookie);
4938                 /* Add BSSID */
4939                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4940                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4941                 /* Add the length exepted for 802.11 header  */
4942                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4943                 /* Add the channel. Use the one specified as parameter if any or
4944                  * the current one (got from the firmware) otherwise
4945                  */
4946                 if (chan)
4947                         freq = chan->center_freq;
4948                 else
4949                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4950                                               &freq);
4951                 chan_nr = ieee80211_frequency_to_channel(freq);
4952                 af_params->channel = cpu_to_le32(chan_nr);
4953
4954                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4955                        le16_to_cpu(action_frame->len));
4956
4957                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4958                           *cookie, le16_to_cpu(action_frame->len), freq);
4959
4960                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4961                                                   af_params);
4962
4963                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4964                                         GFP_KERNEL);
4965                 kfree(af_params);
4966         } else {
4967                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4968                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4969         }
4970
4971 exit:
4972         return err;
4973 }
4974
4975
4976 static int
4977 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4978                                         struct wireless_dev *wdev,
4979                                         u64 cookie)
4980 {
4981         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4982         struct brcmf_cfg80211_vif *vif;
4983         int err = 0;
4984
4985         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4986
4987         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4988         if (vif == NULL) {
4989                 brcmf_err("No p2p device available for probe response\n");
4990                 err = -ENODEV;
4991                 goto exit;
4992         }
4993         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
4994 exit:
4995         return err;
4996 }
4997
4998 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
4999                                       struct wireless_dev *wdev,
5000                                       struct cfg80211_chan_def *chandef)
5001 {
5002         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5003         struct net_device *ndev = wdev->netdev;
5004         struct brcmf_if *ifp;
5005         struct brcmu_chan ch;
5006         enum nl80211_band band = 0;
5007         enum nl80211_chan_width width = 0;
5008         u32 chanspec;
5009         int freq, err;
5010
5011         if (!ndev)
5012                 return -ENODEV;
5013         ifp = netdev_priv(ndev);
5014
5015         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5016         if (err) {
5017                 brcmf_err("chanspec failed (%d)\n", err);
5018                 return err;
5019         }
5020
5021         ch.chspec = chanspec;
5022         cfg->d11inf.decchspec(&ch);
5023
5024         switch (ch.band) {
5025         case BRCMU_CHAN_BAND_2G:
5026                 band = NL80211_BAND_2GHZ;
5027                 break;
5028         case BRCMU_CHAN_BAND_5G:
5029                 band = NL80211_BAND_5GHZ;
5030                 break;
5031         }
5032
5033         switch (ch.bw) {
5034         case BRCMU_CHAN_BW_80:
5035                 width = NL80211_CHAN_WIDTH_80;
5036                 break;
5037         case BRCMU_CHAN_BW_40:
5038                 width = NL80211_CHAN_WIDTH_40;
5039                 break;
5040         case BRCMU_CHAN_BW_20:
5041                 width = NL80211_CHAN_WIDTH_20;
5042                 break;
5043         case BRCMU_CHAN_BW_80P80:
5044                 width = NL80211_CHAN_WIDTH_80P80;
5045                 break;
5046         case BRCMU_CHAN_BW_160:
5047                 width = NL80211_CHAN_WIDTH_160;
5048                 break;
5049         }
5050
5051         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5052         chandef->chan = ieee80211_get_channel(wiphy, freq);
5053         chandef->width = width;
5054         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5055         chandef->center_freq2 = 0;
5056
5057         return 0;
5058 }
5059
5060 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5061                                            struct wireless_dev *wdev,
5062                                            enum nl80211_crit_proto_id proto,
5063                                            u16 duration)
5064 {
5065         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5066         struct brcmf_cfg80211_vif *vif;
5067
5068         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5069
5070         /* only DHCP support for now */
5071         if (proto != NL80211_CRIT_PROTO_DHCP)
5072                 return -EINVAL;
5073
5074         /* suppress and abort scanning */
5075         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5076         brcmf_abort_scanning(cfg);
5077
5078         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5079 }
5080
5081 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5082                                            struct wireless_dev *wdev)
5083 {
5084         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5085         struct brcmf_cfg80211_vif *vif;
5086
5087         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5088
5089         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5090         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5091 }
5092
5093 static s32
5094 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5095                              const struct brcmf_event_msg *e, void *data)
5096 {
5097         switch (e->reason) {
5098         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5099                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5100                 break;
5101         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5102                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5103                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5104                 break;
5105         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5106                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5107                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5108                 break;
5109         }
5110
5111         return 0;
5112 }
5113
5114 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5115 {
5116         int ret;
5117
5118         switch (oper) {
5119         case NL80211_TDLS_DISCOVERY_REQ:
5120                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5121                 break;
5122         case NL80211_TDLS_SETUP:
5123                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5124                 break;
5125         case NL80211_TDLS_TEARDOWN:
5126                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5127                 break;
5128         default:
5129                 brcmf_err("unsupported operation: %d\n", oper);
5130                 ret = -EOPNOTSUPP;
5131         }
5132         return ret;
5133 }
5134
5135 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5136                                     struct net_device *ndev, const u8 *peer,
5137                                     enum nl80211_tdls_operation oper)
5138 {
5139         struct brcmf_if *ifp;
5140         struct brcmf_tdls_iovar_le info;
5141         int ret = 0;
5142
5143         ret = brcmf_convert_nl80211_tdls_oper(oper);
5144         if (ret < 0)
5145                 return ret;
5146
5147         ifp = netdev_priv(ndev);
5148         memset(&info, 0, sizeof(info));
5149         info.mode = (u8)ret;
5150         if (peer)
5151                 memcpy(info.ea, peer, ETH_ALEN);
5152
5153         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5154                                        &info, sizeof(info));
5155         if (ret < 0)
5156                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5157
5158         return ret;
5159 }
5160
5161 #ifdef CONFIG_PM
5162 static int
5163 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5164                               struct cfg80211_gtk_rekey_data *gtk)
5165 {
5166         struct brcmf_if *ifp = netdev_priv(ndev);
5167         struct brcmf_gtk_keyinfo_le gtk_le;
5168         int ret;
5169
5170         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5171
5172         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5173         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5174         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5175                sizeof(gtk_le.replay_counter));
5176
5177         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5178                                        sizeof(gtk_le));
5179         if (ret < 0)
5180                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5181
5182         return ret;
5183 }
5184 #endif
5185
5186 static struct cfg80211_ops brcmf_cfg80211_ops = {
5187         .add_virtual_intf = brcmf_cfg80211_add_iface,
5188         .del_virtual_intf = brcmf_cfg80211_del_iface,
5189         .change_virtual_intf = brcmf_cfg80211_change_iface,
5190         .scan = brcmf_cfg80211_scan,
5191         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5192         .join_ibss = brcmf_cfg80211_join_ibss,
5193         .leave_ibss = brcmf_cfg80211_leave_ibss,
5194         .get_station = brcmf_cfg80211_get_station,
5195         .dump_station = brcmf_cfg80211_dump_station,
5196         .set_tx_power = brcmf_cfg80211_set_tx_power,
5197         .get_tx_power = brcmf_cfg80211_get_tx_power,
5198         .add_key = brcmf_cfg80211_add_key,
5199         .del_key = brcmf_cfg80211_del_key,
5200         .get_key = brcmf_cfg80211_get_key,
5201         .set_default_key = brcmf_cfg80211_config_default_key,
5202         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5203         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5204         .connect = brcmf_cfg80211_connect,
5205         .disconnect = brcmf_cfg80211_disconnect,
5206         .suspend = brcmf_cfg80211_suspend,
5207         .resume = brcmf_cfg80211_resume,
5208         .set_pmksa = brcmf_cfg80211_set_pmksa,
5209         .del_pmksa = brcmf_cfg80211_del_pmksa,
5210         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5211         .start_ap = brcmf_cfg80211_start_ap,
5212         .stop_ap = brcmf_cfg80211_stop_ap,
5213         .change_beacon = brcmf_cfg80211_change_beacon,
5214         .del_station = brcmf_cfg80211_del_station,
5215         .change_station = brcmf_cfg80211_change_station,
5216         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5217         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5218         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5219         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5220         .remain_on_channel = brcmf_p2p_remain_on_channel,
5221         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5222         .get_channel = brcmf_cfg80211_get_channel,
5223         .start_p2p_device = brcmf_p2p_start_device,
5224         .stop_p2p_device = brcmf_p2p_stop_device,
5225         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5226         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5227         .tdls_oper = brcmf_cfg80211_tdls_oper,
5228 };
5229
5230 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5231                                            enum nl80211_iftype type)
5232 {
5233         struct brcmf_cfg80211_vif *vif_walk;
5234         struct brcmf_cfg80211_vif *vif;
5235         bool mbss;
5236
5237         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5238                   sizeof(*vif));
5239         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5240         if (!vif)
5241                 return ERR_PTR(-ENOMEM);
5242
5243         vif->wdev.wiphy = cfg->wiphy;
5244         vif->wdev.iftype = type;
5245
5246         brcmf_init_prof(&vif->profile);
5247
5248         if (type == NL80211_IFTYPE_AP) {
5249                 mbss = false;
5250                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5251                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5252                                 mbss = true;
5253                                 break;
5254                         }
5255                 }
5256                 vif->mbss = mbss;
5257         }
5258
5259         list_add_tail(&vif->list, &cfg->vif_list);
5260         return vif;
5261 }
5262
5263 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5264 {
5265         list_del(&vif->list);
5266         kfree(vif);
5267 }
5268
5269 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5270 {
5271         struct brcmf_cfg80211_vif *vif;
5272         struct brcmf_if *ifp;
5273
5274         ifp = netdev_priv(ndev);
5275         vif = ifp->vif;
5276
5277         if (vif)
5278                 brcmf_free_vif(vif);
5279         free_netdev(ndev);
5280 }
5281
5282 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
5283 {
5284         u32 event = e->event_code;
5285         u32 status = e->status;
5286
5287         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5288                 brcmf_dbg(CONN, "Processing set ssid\n");
5289                 return true;
5290         }
5291
5292         return false;
5293 }
5294
5295 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5296 {
5297         u32 event = e->event_code;
5298         u16 flags = e->flags;
5299
5300         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5301             (event == BRCMF_E_DISASSOC_IND) ||
5302             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5303                 brcmf_dbg(CONN, "Processing link down\n");
5304                 return true;
5305         }
5306         return false;
5307 }
5308
5309 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5310                                const struct brcmf_event_msg *e)
5311 {
5312         u32 event = e->event_code;
5313         u32 status = e->status;
5314
5315         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5316                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5317                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5318                 return true;
5319         }
5320
5321         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5322                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5323                 return true;
5324         }
5325
5326         return false;
5327 }
5328
5329 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5330 {
5331         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5332
5333         kfree(conn_info->req_ie);
5334         conn_info->req_ie = NULL;
5335         conn_info->req_ie_len = 0;
5336         kfree(conn_info->resp_ie);
5337         conn_info->resp_ie = NULL;
5338         conn_info->resp_ie_len = 0;
5339 }
5340
5341 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5342                                struct brcmf_if *ifp)
5343 {
5344         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5345         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5346         u32 req_len;
5347         u32 resp_len;
5348         s32 err = 0;
5349
5350         brcmf_clear_assoc_ies(cfg);
5351
5352         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5353                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5354         if (err) {
5355                 brcmf_err("could not get assoc info (%d)\n", err);
5356                 return err;
5357         }
5358         assoc_info =
5359                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5360         req_len = le32_to_cpu(assoc_info->req_len);
5361         resp_len = le32_to_cpu(assoc_info->resp_len);
5362         if (req_len) {
5363                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5364                                                cfg->extra_buf,
5365                                                WL_ASSOC_INFO_MAX);
5366                 if (err) {
5367                         brcmf_err("could not get assoc req (%d)\n", err);
5368                         return err;
5369                 }
5370                 conn_info->req_ie_len = req_len;
5371                 conn_info->req_ie =
5372                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5373                             GFP_KERNEL);
5374         } else {
5375                 conn_info->req_ie_len = 0;
5376                 conn_info->req_ie = NULL;
5377         }
5378         if (resp_len) {
5379                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5380                                                cfg->extra_buf,
5381                                                WL_ASSOC_INFO_MAX);
5382                 if (err) {
5383                         brcmf_err("could not get assoc resp (%d)\n", err);
5384                         return err;
5385                 }
5386                 conn_info->resp_ie_len = resp_len;
5387                 conn_info->resp_ie =
5388                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5389                             GFP_KERNEL);
5390         } else {
5391                 conn_info->resp_ie_len = 0;
5392                 conn_info->resp_ie = NULL;
5393         }
5394         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5395                   conn_info->req_ie_len, conn_info->resp_ie_len);
5396
5397         return err;
5398 }
5399
5400 static s32
5401 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5402                        struct net_device *ndev,
5403                        const struct brcmf_event_msg *e)
5404 {
5405         struct brcmf_if *ifp = netdev_priv(ndev);
5406         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5407         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5408         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5409         struct ieee80211_channel *notify_channel = NULL;
5410         struct ieee80211_supported_band *band;
5411         struct brcmf_bss_info_le *bi;
5412         struct brcmu_chan ch;
5413         u32 freq;
5414         s32 err = 0;
5415         u8 *buf;
5416
5417         brcmf_dbg(TRACE, "Enter\n");
5418
5419         brcmf_get_assoc_ies(cfg, ifp);
5420         memcpy(profile->bssid, e->addr, ETH_ALEN);
5421         brcmf_update_bss_info(cfg, ifp);
5422
5423         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5424         if (buf == NULL) {
5425                 err = -ENOMEM;
5426                 goto done;
5427         }
5428
5429         /* data sent to dongle has to be little endian */
5430         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5431         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5432                                      buf, WL_BSS_INFO_MAX);
5433
5434         if (err)
5435                 goto done;
5436
5437         bi = (struct brcmf_bss_info_le *)(buf + 4);
5438         ch.chspec = le16_to_cpu(bi->chanspec);
5439         cfg->d11inf.decchspec(&ch);
5440
5441         if (ch.band == BRCMU_CHAN_BAND_2G)
5442                 band = wiphy->bands[NL80211_BAND_2GHZ];
5443         else
5444                 band = wiphy->bands[NL80211_BAND_5GHZ];
5445
5446         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5447         notify_channel = ieee80211_get_channel(wiphy, freq);
5448
5449 done:
5450         kfree(buf);
5451         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
5452                         conn_info->req_ie, conn_info->req_ie_len,
5453                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
5454         brcmf_dbg(CONN, "Report roaming result\n");
5455
5456         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5457         brcmf_dbg(TRACE, "Exit\n");
5458         return err;
5459 }
5460
5461 static s32
5462 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5463                        struct net_device *ndev, const struct brcmf_event_msg *e,
5464                        bool completed)
5465 {
5466         struct brcmf_if *ifp = netdev_priv(ndev);
5467         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5468         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5469
5470         brcmf_dbg(TRACE, "Enter\n");
5471
5472         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5473                                &ifp->vif->sme_state)) {
5474                 if (completed) {
5475                         brcmf_get_assoc_ies(cfg, ifp);
5476                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5477                         brcmf_update_bss_info(cfg, ifp);
5478                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5479                                 &ifp->vif->sme_state);
5480                 }
5481                 cfg80211_connect_result(ndev,
5482                                         (u8 *)profile->bssid,
5483                                         conn_info->req_ie,
5484                                         conn_info->req_ie_len,
5485                                         conn_info->resp_ie,
5486                                         conn_info->resp_ie_len,
5487                                         completed ? WLAN_STATUS_SUCCESS :
5488                                                     WLAN_STATUS_AUTH_TIMEOUT,
5489                                         GFP_KERNEL);
5490                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5491                           completed ? "succeeded" : "failed");
5492         }
5493         brcmf_dbg(TRACE, "Exit\n");
5494         return 0;
5495 }
5496
5497 static s32
5498 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5499                                struct net_device *ndev,
5500                                const struct brcmf_event_msg *e, void *data)
5501 {
5502         static int generation;
5503         u32 event = e->event_code;
5504         u32 reason = e->reason;
5505         struct station_info sinfo;
5506
5507         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
5508         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5509             ndev != cfg_to_ndev(cfg)) {
5510                 brcmf_dbg(CONN, "AP mode link down\n");
5511                 complete(&cfg->vif_disabled);
5512                 return 0;
5513         }
5514
5515         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5516             (reason == BRCMF_E_STATUS_SUCCESS)) {
5517                 memset(&sinfo, 0, sizeof(sinfo));
5518                 if (!data) {
5519                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5520                         return -EINVAL;
5521                 }
5522                 sinfo.assoc_req_ies = data;
5523                 sinfo.assoc_req_ies_len = e->datalen;
5524                 generation++;
5525                 sinfo.generation = generation;
5526                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5527         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5528                    (event == BRCMF_E_DEAUTH_IND) ||
5529                    (event == BRCMF_E_DEAUTH)) {
5530                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5531         }
5532         return 0;
5533 }
5534
5535 static s32
5536 brcmf_notify_connect_status(struct brcmf_if *ifp,
5537                             const struct brcmf_event_msg *e, void *data)
5538 {
5539         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5540         struct net_device *ndev = ifp->ndev;
5541         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5542         struct ieee80211_channel *chan;
5543         s32 err = 0;
5544
5545         if ((e->event_code == BRCMF_E_DEAUTH) ||
5546             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5547             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5548             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5549                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5550         }
5551
5552         if (brcmf_is_apmode(ifp->vif)) {
5553                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5554         } else if (brcmf_is_linkup(e)) {
5555                 brcmf_dbg(CONN, "Linkup\n");
5556                 if (brcmf_is_ibssmode(ifp->vif)) {
5557                         brcmf_inform_ibss(cfg, ndev, e->addr);
5558                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5559                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5560                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5561                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5562                                   &ifp->vif->sme_state);
5563                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5564                                 &ifp->vif->sme_state);
5565                 } else
5566                         brcmf_bss_connect_done(cfg, ndev, e, true);
5567                 brcmf_net_setcarrier(ifp, true);
5568         } else if (brcmf_is_linkdown(e)) {
5569                 brcmf_dbg(CONN, "Linkdown\n");
5570                 if (!brcmf_is_ibssmode(ifp->vif)) {
5571                         brcmf_bss_connect_done(cfg, ndev, e, false);
5572                         brcmf_link_down(ifp->vif,
5573                                         brcmf_map_fw_linkdown_reason(e));
5574                         brcmf_init_prof(ndev_to_prof(ndev));
5575                         if (ndev != cfg_to_ndev(cfg))
5576                                 complete(&cfg->vif_disabled);
5577                         brcmf_net_setcarrier(ifp, false);
5578                 }
5579         } else if (brcmf_is_nonetwork(cfg, e)) {
5580                 if (brcmf_is_ibssmode(ifp->vif))
5581                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5582                                   &ifp->vif->sme_state);
5583                 else
5584                         brcmf_bss_connect_done(cfg, ndev, e, false);
5585         }
5586
5587         return err;
5588 }
5589
5590 static s32
5591 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5592                             const struct brcmf_event_msg *e, void *data)
5593 {
5594         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5595         u32 event = e->event_code;
5596         u32 status = e->status;
5597
5598         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5599                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5600                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5601                 else
5602                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5603         }
5604
5605         return 0;
5606 }
5607
5608 static s32
5609 brcmf_notify_mic_status(struct brcmf_if *ifp,
5610                         const struct brcmf_event_msg *e, void *data)
5611 {
5612         u16 flags = e->flags;
5613         enum nl80211_key_type key_type;
5614
5615         if (flags & BRCMF_EVENT_MSG_GROUP)
5616                 key_type = NL80211_KEYTYPE_GROUP;
5617         else
5618                 key_type = NL80211_KEYTYPE_PAIRWISE;
5619
5620         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5621                                      NULL, GFP_KERNEL);
5622
5623         return 0;
5624 }
5625
5626 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5627                                   const struct brcmf_event_msg *e, void *data)
5628 {
5629         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5630         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5631         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5632         struct brcmf_cfg80211_vif *vif;
5633
5634         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5635                   ifevent->action, ifevent->flags, ifevent->ifidx,
5636                   ifevent->bsscfgidx);
5637
5638         spin_lock(&event->vif_event_lock);
5639         event->action = ifevent->action;
5640         vif = event->vif;
5641
5642         switch (ifevent->action) {
5643         case BRCMF_E_IF_ADD:
5644                 /* waiting process may have timed out */
5645                 if (!cfg->vif_event.vif) {
5646                         spin_unlock(&event->vif_event_lock);
5647                         return -EBADF;
5648                 }
5649
5650                 ifp->vif = vif;
5651                 vif->ifp = ifp;
5652                 if (ifp->ndev) {
5653                         vif->wdev.netdev = ifp->ndev;
5654                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5655                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5656                 }
5657                 spin_unlock(&event->vif_event_lock);
5658                 wake_up(&event->vif_wq);
5659                 return 0;
5660
5661         case BRCMF_E_IF_DEL:
5662                 spin_unlock(&event->vif_event_lock);
5663                 /* event may not be upon user request */
5664                 if (brcmf_cfg80211_vif_event_armed(cfg))
5665                         wake_up(&event->vif_wq);
5666                 return 0;
5667
5668         case BRCMF_E_IF_CHANGE:
5669                 spin_unlock(&event->vif_event_lock);
5670                 wake_up(&event->vif_wq);
5671                 return 0;
5672
5673         default:
5674                 spin_unlock(&event->vif_event_lock);
5675                 break;
5676         }
5677         return -EINVAL;
5678 }
5679
5680 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5681 {
5682         conf->frag_threshold = (u32)-1;
5683         conf->rts_threshold = (u32)-1;
5684         conf->retry_short = (u32)-1;
5685         conf->retry_long = (u32)-1;
5686 }
5687
5688 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5689 {
5690         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5691                             brcmf_notify_connect_status);
5692         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5693                             brcmf_notify_connect_status);
5694         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5695                             brcmf_notify_connect_status);
5696         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5697                             brcmf_notify_connect_status);
5698         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5699                             brcmf_notify_connect_status);
5700         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5701                             brcmf_notify_connect_status);
5702         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5703                             brcmf_notify_roaming_status);
5704         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5705                             brcmf_notify_mic_status);
5706         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5707                             brcmf_notify_connect_status);
5708         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5709                             brcmf_notify_sched_scan_results);
5710         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5711                             brcmf_notify_vif_event);
5712         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5713                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5714         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5715                             brcmf_p2p_notify_listen_complete);
5716         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5717                             brcmf_p2p_notify_action_frame_rx);
5718         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5719                             brcmf_p2p_notify_action_tx_complete);
5720         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5721                             brcmf_p2p_notify_action_tx_complete);
5722 }
5723
5724 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5725 {
5726         kfree(cfg->conf);
5727         cfg->conf = NULL;
5728         kfree(cfg->extra_buf);
5729         cfg->extra_buf = NULL;
5730         kfree(cfg->wowl.nd);
5731         cfg->wowl.nd = NULL;
5732         kfree(cfg->wowl.nd_info);
5733         cfg->wowl.nd_info = NULL;
5734         kfree(cfg->escan_info.escan_buf);
5735         cfg->escan_info.escan_buf = NULL;
5736 }
5737
5738 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5739 {
5740         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5741         if (!cfg->conf)
5742                 goto init_priv_mem_out;
5743         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5744         if (!cfg->extra_buf)
5745                 goto init_priv_mem_out;
5746         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5747         if (!cfg->wowl.nd)
5748                 goto init_priv_mem_out;
5749         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5750                                     sizeof(struct cfg80211_wowlan_nd_match *),
5751                                     GFP_KERNEL);
5752         if (!cfg->wowl.nd_info)
5753                 goto init_priv_mem_out;
5754         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5755         if (!cfg->escan_info.escan_buf)
5756                 goto init_priv_mem_out;
5757
5758         return 0;
5759
5760 init_priv_mem_out:
5761         brcmf_deinit_priv_mem(cfg);
5762
5763         return -ENOMEM;
5764 }
5765
5766 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5767 {
5768         s32 err = 0;
5769
5770         cfg->scan_request = NULL;
5771         cfg->pwr_save = true;
5772         cfg->active_scan = true;        /* we do active scan per default */
5773         cfg->dongle_up = false;         /* dongle is not up yet */
5774         err = brcmf_init_priv_mem(cfg);
5775         if (err)
5776                 return err;
5777         brcmf_register_event_handlers(cfg);
5778         mutex_init(&cfg->usr_sync);
5779         brcmf_init_escan(cfg);
5780         brcmf_init_conf(cfg->conf);
5781         init_completion(&cfg->vif_disabled);
5782         return err;
5783 }
5784
5785 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5786 {
5787         cfg->dongle_up = false; /* dongle down */
5788         brcmf_abort_scanning(cfg);
5789         brcmf_deinit_priv_mem(cfg);
5790 }
5791
5792 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5793 {
5794         init_waitqueue_head(&event->vif_wq);
5795         spin_lock_init(&event->vif_event_lock);
5796 }
5797
5798 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5799 {
5800         s32 err;
5801         u32 bcn_timeout;
5802         __le32 roamtrigger[2];
5803         __le32 roam_delta[2];
5804
5805         /* Configure beacon timeout value based upon roaming setting */
5806         if (ifp->drvr->settings->roamoff)
5807                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5808         else
5809                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5810         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5811         if (err) {
5812                 brcmf_err("bcn_timeout error (%d)\n", err);
5813                 goto roam_setup_done;
5814         }
5815
5816         /* Enable/Disable built-in roaming to allow supplicant to take care of
5817          * roaming.
5818          */
5819         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5820                   ifp->drvr->settings->roamoff ? "Off" : "On");
5821         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5822                                       ifp->drvr->settings->roamoff);
5823         if (err) {
5824                 brcmf_err("roam_off error (%d)\n", err);
5825                 goto roam_setup_done;
5826         }
5827
5828         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5829         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5830         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5831                                      (void *)roamtrigger, sizeof(roamtrigger));
5832         if (err) {
5833                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5834                 goto roam_setup_done;
5835         }
5836
5837         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5838         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5839         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5840                                      (void *)roam_delta, sizeof(roam_delta));
5841         if (err) {
5842                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5843                 goto roam_setup_done;
5844         }
5845
5846 roam_setup_done:
5847         return err;
5848 }
5849
5850 static s32
5851 brcmf_dongle_scantime(struct brcmf_if *ifp)
5852 {
5853         s32 err = 0;
5854
5855         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5856                                     BRCMF_SCAN_CHANNEL_TIME);
5857         if (err) {
5858                 brcmf_err("Scan assoc time error (%d)\n", err);
5859                 goto dongle_scantime_out;
5860         }
5861         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5862                                     BRCMF_SCAN_UNASSOC_TIME);
5863         if (err) {
5864                 brcmf_err("Scan unassoc time error (%d)\n", err);
5865                 goto dongle_scantime_out;
5866         }
5867
5868         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5869                                     BRCMF_SCAN_PASSIVE_TIME);
5870         if (err) {
5871                 brcmf_err("Scan passive time error (%d)\n", err);
5872                 goto dongle_scantime_out;
5873         }
5874
5875 dongle_scantime_out:
5876         return err;
5877 }
5878
5879 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5880                                            struct brcmu_chan *ch)
5881 {
5882         u32 ht40_flag;
5883
5884         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5885         if (ch->sb == BRCMU_CHAN_SB_U) {
5886                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5887                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5888                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5889         } else {
5890                 /* It should be one of
5891                  * IEEE80211_CHAN_NO_HT40 or
5892                  * IEEE80211_CHAN_NO_HT40PLUS
5893                  */
5894                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5895                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5896                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5897         }
5898 }
5899
5900 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5901                                     u32 bw_cap[])
5902 {
5903         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5904         struct ieee80211_supported_band *band;
5905         struct ieee80211_channel *channel;
5906         struct wiphy *wiphy;
5907         struct brcmf_chanspec_list *list;
5908         struct brcmu_chan ch;
5909         int err;
5910         u8 *pbuf;
5911         u32 i, j;
5912         u32 total;
5913         u32 chaninfo;
5914         u32 index;
5915
5916         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5917
5918         if (pbuf == NULL)
5919                 return -ENOMEM;
5920
5921         list = (struct brcmf_chanspec_list *)pbuf;
5922
5923         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5924                                        BRCMF_DCMD_MEDLEN);
5925         if (err) {
5926                 brcmf_err("get chanspecs error (%d)\n", err);
5927                 goto fail_pbuf;
5928         }
5929
5930         wiphy = cfg_to_wiphy(cfg);
5931         band = wiphy->bands[NL80211_BAND_2GHZ];
5932         if (band)
5933                 for (i = 0; i < band->n_channels; i++)
5934                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5935         band = wiphy->bands[NL80211_BAND_5GHZ];
5936         if (band)
5937                 for (i = 0; i < band->n_channels; i++)
5938                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5939
5940         total = le32_to_cpu(list->count);
5941         for (i = 0; i < total; i++) {
5942                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5943                 cfg->d11inf.decchspec(&ch);
5944
5945                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5946                         band = wiphy->bands[NL80211_BAND_2GHZ];
5947                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5948                         band = wiphy->bands[NL80211_BAND_5GHZ];
5949                 } else {
5950                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5951                         continue;
5952                 }
5953                 if (!band)
5954                         continue;
5955                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5956                     ch.bw == BRCMU_CHAN_BW_40)
5957                         continue;
5958                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5959                     ch.bw == BRCMU_CHAN_BW_80)
5960                         continue;
5961
5962                 channel = band->channels;
5963                 index = band->n_channels;
5964                 for (j = 0; j < band->n_channels; j++) {
5965                         if (channel[j].hw_value == ch.control_ch_num) {
5966                                 index = j;
5967                                 break;
5968                         }
5969                 }
5970                 channel[index].center_freq =
5971                         ieee80211_channel_to_frequency(ch.control_ch_num,
5972                                                        band->band);
5973                 channel[index].hw_value = ch.control_ch_num;
5974
5975                 /* assuming the chanspecs order is HT20,
5976                  * HT40 upper, HT40 lower, and VHT80.
5977                  */
5978                 if (ch.bw == BRCMU_CHAN_BW_80) {
5979                         channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
5980                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
5981                         brcmf_update_bw40_channel_flag(&channel[index], &ch);
5982                 } else {
5983                         /* enable the channel and disable other bandwidths
5984                          * for now as mentioned order assure they are enabled
5985                          * for subsequent chanspecs.
5986                          */
5987                         channel[index].flags = IEEE80211_CHAN_NO_HT40 |
5988                                                IEEE80211_CHAN_NO_80MHZ;
5989                         ch.bw = BRCMU_CHAN_BW_20;
5990                         cfg->d11inf.encchspec(&ch);
5991                         chaninfo = ch.chspec;
5992                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
5993                                                        &chaninfo);
5994                         if (!err) {
5995                                 if (chaninfo & WL_CHAN_RADAR)
5996                                         channel[index].flags |=
5997                                                 (IEEE80211_CHAN_RADAR |
5998                                                  IEEE80211_CHAN_NO_IR);
5999                                 if (chaninfo & WL_CHAN_PASSIVE)
6000                                         channel[index].flags |=
6001                                                 IEEE80211_CHAN_NO_IR;
6002                         }
6003                 }
6004         }
6005
6006 fail_pbuf:
6007         kfree(pbuf);
6008         return err;
6009 }
6010
6011 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6012 {
6013         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6014         struct ieee80211_supported_band *band;
6015         struct brcmf_fil_bwcap_le band_bwcap;
6016         struct brcmf_chanspec_list *list;
6017         u8 *pbuf;
6018         u32 val;
6019         int err;
6020         struct brcmu_chan ch;
6021         u32 num_chan;
6022         int i, j;
6023
6024         /* verify support for bw_cap command */
6025         val = WLC_BAND_5G;
6026         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6027
6028         if (!err) {
6029                 /* only set 2G bandwidth using bw_cap command */
6030                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6031                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6032                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6033                                                sizeof(band_bwcap));
6034         } else {
6035                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6036                 val = WLC_N_BW_40ALL;
6037                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6038         }
6039
6040         if (!err) {
6041                 /* update channel info in 2G band */
6042                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6043
6044                 if (pbuf == NULL)
6045                         return -ENOMEM;
6046
6047                 ch.band = BRCMU_CHAN_BAND_2G;
6048                 ch.bw = BRCMU_CHAN_BW_40;
6049                 ch.sb = BRCMU_CHAN_SB_NONE;
6050                 ch.chnum = 0;
6051                 cfg->d11inf.encchspec(&ch);
6052
6053                 /* pass encoded chanspec in query */
6054                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6055
6056                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6057                                                BRCMF_DCMD_MEDLEN);
6058                 if (err) {
6059                         brcmf_err("get chanspecs error (%d)\n", err);
6060                         kfree(pbuf);
6061                         return err;
6062                 }
6063
6064                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6065                 list = (struct brcmf_chanspec_list *)pbuf;
6066                 num_chan = le32_to_cpu(list->count);
6067                 for (i = 0; i < num_chan; i++) {
6068                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6069                         cfg->d11inf.decchspec(&ch);
6070                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6071                                 continue;
6072                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6073                                 continue;
6074                         for (j = 0; j < band->n_channels; j++) {
6075                                 if (band->channels[j].hw_value == ch.control_ch_num)
6076                                         break;
6077                         }
6078                         if (WARN_ON(j == band->n_channels))
6079                                 continue;
6080
6081                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6082                 }
6083                 kfree(pbuf);
6084         }
6085         return err;
6086 }
6087
6088 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6089 {
6090         u32 band, mimo_bwcap;
6091         int err;
6092
6093         band = WLC_BAND_2G;
6094         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6095         if (!err) {
6096                 bw_cap[NL80211_BAND_2GHZ] = band;
6097                 band = WLC_BAND_5G;
6098                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6099                 if (!err) {
6100                         bw_cap[NL80211_BAND_5GHZ] = band;
6101                         return;
6102                 }
6103                 WARN_ON(1);
6104                 return;
6105         }
6106         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6107         mimo_bwcap = 0;
6108         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6109         if (err)
6110                 /* assume 20MHz if firmware does not give a clue */
6111                 mimo_bwcap = WLC_N_BW_20ALL;
6112
6113         switch (mimo_bwcap) {
6114         case WLC_N_BW_40ALL:
6115                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6116                 /* fall-thru */
6117         case WLC_N_BW_20IN2G_40IN5G:
6118                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6119                 /* fall-thru */
6120         case WLC_N_BW_20ALL:
6121                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6122                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6123                 break;
6124         default:
6125                 brcmf_err("invalid mimo_bw_cap value\n");
6126         }
6127 }
6128
6129 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6130                                 u32 bw_cap[2], u32 nchain)
6131 {
6132         band->ht_cap.ht_supported = true;
6133         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6134                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6135                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6136         }
6137         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6138         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6139         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6140         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6141         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6142         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6143 }
6144
6145 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6146 {
6147         u16 mcs_map;
6148         int i;
6149
6150         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6151                 mcs_map = (mcs_map << 2) | supp;
6152
6153         return cpu_to_le16(mcs_map);
6154 }
6155
6156 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6157                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6158                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6159 {
6160         __le16 mcs_map;
6161
6162         /* not allowed in 2.4G band */
6163         if (band->band == NL80211_BAND_2GHZ)
6164                 return;
6165
6166         band->vht_cap.vht_supported = true;
6167         /* 80MHz is mandatory */
6168         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6169         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6170                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6171                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6172         }
6173         /* all support 256-QAM */
6174         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6175         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6176         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6177
6178         /* Beamforming support information */
6179         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6180                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6181         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6182                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6183         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6184                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6185         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6186                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6187
6188         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6189                 band->vht_cap.cap |=
6190                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6191                 band->vht_cap.cap |= ((txstreams - 1) <<
6192                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6193                 band->vht_cap.cap |=
6194                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6195         }
6196 }
6197
6198 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6199 {
6200         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6201         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6202         u32 nmode = 0;
6203         u32 vhtmode = 0;
6204         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6205         u32 rxchain;
6206         u32 nchain;
6207         int err;
6208         s32 i;
6209         struct ieee80211_supported_band *band;
6210         u32 txstreams = 0;
6211         u32 txbf_bfe_cap = 0;
6212         u32 txbf_bfr_cap = 0;
6213
6214         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6215         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6216         if (err) {
6217                 brcmf_err("nmode error (%d)\n", err);
6218         } else {
6219                 brcmf_get_bwcap(ifp, bw_cap);
6220         }
6221         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6222                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6223                   bw_cap[NL80211_BAND_5GHZ]);
6224
6225         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6226         if (err) {
6227                 brcmf_err("rxchain error (%d)\n", err);
6228                 nchain = 1;
6229         } else {
6230                 for (nchain = 0; rxchain; nchain++)
6231                         rxchain = rxchain & (rxchain - 1);
6232         }
6233         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6234
6235         err = brcmf_construct_chaninfo(cfg, bw_cap);
6236         if (err) {
6237                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6238                 return err;
6239         }
6240
6241         if (vhtmode) {
6242                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6243                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6244                                               &txbf_bfe_cap);
6245                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6246                                               &txbf_bfr_cap);
6247         }
6248
6249         wiphy = cfg_to_wiphy(cfg);
6250         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6251                 band = wiphy->bands[i];
6252                 if (band == NULL)
6253                         continue;
6254
6255                 if (nmode)
6256                         brcmf_update_ht_cap(band, bw_cap, nchain);
6257                 if (vhtmode)
6258                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6259                                              txbf_bfe_cap, txbf_bfr_cap);
6260         }
6261
6262         return 0;
6263 }
6264
6265 static const struct ieee80211_txrx_stypes
6266 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6267         [NL80211_IFTYPE_STATION] = {
6268                 .tx = 0xffff,
6269                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6270                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6271         },
6272         [NL80211_IFTYPE_P2P_CLIENT] = {
6273                 .tx = 0xffff,
6274                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6275                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6276         },
6277         [NL80211_IFTYPE_P2P_GO] = {
6278                 .tx = 0xffff,
6279                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6280                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6281                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6282                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6283                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6284                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6285                       BIT(IEEE80211_STYPE_ACTION >> 4)
6286         },
6287         [NL80211_IFTYPE_P2P_DEVICE] = {
6288                 .tx = 0xffff,
6289                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6290                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6291         }
6292 };
6293
6294 /**
6295  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6296  *
6297  * @wiphy: wiphy object.
6298  * @ifp: interface object needed for feat module api.
6299  *
6300  * The interface modes and combinations are determined dynamically here
6301  * based on firmware functionality.
6302  *
6303  * no p2p and no mbss:
6304  *
6305  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6306  *
6307  * no p2p and mbss:
6308  *
6309  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6310  *      #AP <= 4, matching BI, channels = 1, 4 total
6311  *
6312  * p2p, no mchan, and mbss:
6313  *
6314  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6315  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6316  *      #AP <= 4, matching BI, channels = 1, 4 total
6317  *
6318  * p2p, mchan, and mbss:
6319  *
6320  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6321  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6322  *      #AP <= 4, matching BI, channels = 1, 4 total
6323  */
6324 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6325 {
6326         struct ieee80211_iface_combination *combo = NULL;
6327         struct ieee80211_iface_limit *c0_limits = NULL;
6328         struct ieee80211_iface_limit *p2p_limits = NULL;
6329         struct ieee80211_iface_limit *mbss_limits = NULL;
6330         bool mbss, p2p;
6331         int i, c, n_combos;
6332
6333         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6334         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6335
6336         n_combos = 1 + !!p2p + !!mbss;
6337         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6338         if (!combo)
6339                 goto err;
6340
6341         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6342                                  BIT(NL80211_IFTYPE_ADHOC) |
6343                                  BIT(NL80211_IFTYPE_AP);
6344
6345         c = 0;
6346         i = 0;
6347         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6348         if (!c0_limits)
6349                 goto err;
6350         c0_limits[i].max = 1;
6351         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6352         if (p2p) {
6353                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6354                         combo[c].num_different_channels = 2;
6355                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6356                                           BIT(NL80211_IFTYPE_P2P_GO) |
6357                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6358                 c0_limits[i].max = 1;
6359                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6360                 c0_limits[i].max = 1;
6361                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6362                                        BIT(NL80211_IFTYPE_P2P_GO);
6363         } else {
6364                 c0_limits[i].max = 1;
6365                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6366         }
6367         combo[c].num_different_channels = 1;
6368         combo[c].max_interfaces = i;
6369         combo[c].n_limits = i;
6370         combo[c].limits = c0_limits;
6371
6372         if (p2p) {
6373                 c++;
6374                 i = 0;
6375                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6376                 if (!p2p_limits)
6377                         goto err;
6378                 p2p_limits[i].max = 1;
6379                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6380                 p2p_limits[i].max = 1;
6381                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6382                 p2p_limits[i].max = 1;
6383                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6384                 p2p_limits[i].max = 1;
6385                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6386                 combo[c].num_different_channels = 1;
6387                 combo[c].max_interfaces = i;
6388                 combo[c].n_limits = i;
6389                 combo[c].limits = p2p_limits;
6390         }
6391
6392         if (mbss) {
6393                 c++;
6394                 i = 0;
6395                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6396                 if (!mbss_limits)
6397                         goto err;
6398                 mbss_limits[i].max = 4;
6399                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6400                 combo[c].beacon_int_infra_match = true;
6401                 combo[c].num_different_channels = 1;
6402                 combo[c].max_interfaces = 4;
6403                 combo[c].n_limits = i;
6404                 combo[c].limits = mbss_limits;
6405         }
6406
6407         wiphy->n_iface_combinations = n_combos;
6408         wiphy->iface_combinations = combo;
6409         return 0;
6410
6411 err:
6412         kfree(c0_limits);
6413         kfree(p2p_limits);
6414         kfree(mbss_limits);
6415         kfree(combo);
6416         return -ENOMEM;
6417 }
6418
6419 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
6420 {
6421         /* scheduled scan settings */
6422         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
6423         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6424         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6425         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
6426 }
6427
6428 #ifdef CONFIG_PM
6429 static struct wiphy_wowlan_support brcmf_wowlan_support = {
6430         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6431         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6432         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6433         .pattern_min_len = 1,
6434         .max_pkt_offset = 1500,
6435 };
6436 #endif
6437
6438 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6439 {
6440 #ifdef CONFIG_PM
6441         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6442
6443         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6444                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6445                         brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
6446                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6447                 }
6448         }
6449         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6450                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6451                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6452         }
6453
6454         wiphy->wowlan = &brcmf_wowlan_support;
6455 #endif
6456 }
6457
6458 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6459 {
6460         struct brcmf_pub *drvr = ifp->drvr;
6461         const struct ieee80211_iface_combination *combo;
6462         struct ieee80211_supported_band *band;
6463         u16 max_interfaces = 0;
6464         __le32 bandlist[3];
6465         u32 n_bands;
6466         int err, i;
6467
6468         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6469         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6470         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6471
6472         err = brcmf_setup_ifmodes(wiphy, ifp);
6473         if (err)
6474                 return err;
6475
6476         for (i = 0, combo = wiphy->iface_combinations;
6477              i < wiphy->n_iface_combinations; i++, combo++) {
6478                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6479         }
6480
6481         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6482              i++) {
6483                 u8 *addr = drvr->addresses[i].addr;
6484
6485                 memcpy(addr, drvr->mac, ETH_ALEN);
6486                 if (i) {
6487                         addr[0] |= BIT(1);
6488                         addr[ETH_ALEN - 1] ^= i;
6489                 }
6490         }
6491         wiphy->addresses = drvr->addresses;
6492         wiphy->n_addresses = i;
6493
6494         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6495         wiphy->cipher_suites = brcmf_cipher_suites;
6496         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6497         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6498                 wiphy->n_cipher_suites--;
6499         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6500                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6501                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6502
6503         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
6504                         WIPHY_FLAG_OFFCHAN_TX |
6505                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6506         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6507                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6508         if (!ifp->drvr->settings->roamoff)
6509                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6510         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6511         wiphy->max_remain_on_channel_duration = 5000;
6512         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
6513                 brcmf_wiphy_pno_params(wiphy);
6514
6515         /* vendor commands/events support */
6516         wiphy->vendor_commands = brcmf_vendor_cmds;
6517         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6518
6519         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6520                 brcmf_wiphy_wowl_params(wiphy, ifp);
6521         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6522                                      sizeof(bandlist));
6523         if (err) {
6524                 brcmf_err("could not obtain band info: err=%d\n", err);
6525                 return err;
6526         }
6527         /* first entry in bandlist is number of bands */
6528         n_bands = le32_to_cpu(bandlist[0]);
6529         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6530                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6531                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6532                                        GFP_KERNEL);
6533                         if (!band)
6534                                 return -ENOMEM;
6535
6536                         band->channels = kmemdup(&__wl_2ghz_channels,
6537                                                  sizeof(__wl_2ghz_channels),
6538                                                  GFP_KERNEL);
6539                         if (!band->channels) {
6540                                 kfree(band);
6541                                 return -ENOMEM;
6542                         }
6543
6544                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6545                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6546                 }
6547                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6548                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6549                                        GFP_KERNEL);
6550                         if (!band)
6551                                 return -ENOMEM;
6552
6553                         band->channels = kmemdup(&__wl_5ghz_channels,
6554                                                  sizeof(__wl_5ghz_channels),
6555                                                  GFP_KERNEL);
6556                         if (!band->channels) {
6557                                 kfree(band);
6558                                 return -ENOMEM;
6559                         }
6560
6561                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6562                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6563                 }
6564         }
6565         err = brcmf_setup_wiphybands(wiphy);
6566         return err;
6567 }
6568
6569 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6570 {
6571         struct net_device *ndev;
6572         struct wireless_dev *wdev;
6573         struct brcmf_if *ifp;
6574         s32 power_mode;
6575         s32 err = 0;
6576
6577         if (cfg->dongle_up)
6578                 return err;
6579
6580         ndev = cfg_to_ndev(cfg);
6581         wdev = ndev->ieee80211_ptr;
6582         ifp = netdev_priv(ndev);
6583
6584         /* make sure RF is ready for work */
6585         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6586
6587         brcmf_dongle_scantime(ifp);
6588
6589         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6590         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6591         if (err)
6592                 goto default_conf_out;
6593         brcmf_dbg(INFO, "power save set to %s\n",
6594                   (power_mode ? "enabled" : "disabled"));
6595
6596         err = brcmf_dongle_roam(ifp);
6597         if (err)
6598                 goto default_conf_out;
6599         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6600                                           NULL, NULL);
6601         if (err)
6602                 goto default_conf_out;
6603
6604         brcmf_configure_arp_nd_offload(ifp, true);
6605
6606         cfg->dongle_up = true;
6607 default_conf_out:
6608
6609         return err;
6610
6611 }
6612
6613 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6614 {
6615         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6616
6617         return brcmf_config_dongle(ifp->drvr->config);
6618 }
6619
6620 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6621 {
6622         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6623
6624         /*
6625          * While going down, if associated with AP disassociate
6626          * from AP to save power
6627          */
6628         if (check_vif_up(ifp->vif)) {
6629                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6630
6631                 /* Make sure WPA_Supplicant receives all the event
6632                    generated due to DISASSOC call to the fw to keep
6633                    the state fw and WPA_Supplicant state consistent
6634                  */
6635                 brcmf_delay(500);
6636         }
6637
6638         brcmf_abort_scanning(cfg);
6639         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6640
6641         return 0;
6642 }
6643
6644 s32 brcmf_cfg80211_up(struct net_device *ndev)
6645 {
6646         struct brcmf_if *ifp = netdev_priv(ndev);
6647         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6648         s32 err = 0;
6649
6650         mutex_lock(&cfg->usr_sync);
6651         err = __brcmf_cfg80211_up(ifp);
6652         mutex_unlock(&cfg->usr_sync);
6653
6654         return err;
6655 }
6656
6657 s32 brcmf_cfg80211_down(struct net_device *ndev)
6658 {
6659         struct brcmf_if *ifp = netdev_priv(ndev);
6660         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6661         s32 err = 0;
6662
6663         mutex_lock(&cfg->usr_sync);
6664         err = __brcmf_cfg80211_down(ifp);
6665         mutex_unlock(&cfg->usr_sync);
6666
6667         return err;
6668 }
6669
6670 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6671 {
6672         struct wireless_dev *wdev = &ifp->vif->wdev;
6673
6674         return wdev->iftype;
6675 }
6676
6677 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6678                              unsigned long state)
6679 {
6680         struct brcmf_cfg80211_vif *vif;
6681
6682         list_for_each_entry(vif, &cfg->vif_list, list) {
6683                 if (test_bit(state, &vif->sme_state))
6684                         return true;
6685         }
6686         return false;
6687 }
6688
6689 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6690                                     u8 action)
6691 {
6692         u8 evt_action;
6693
6694         spin_lock(&event->vif_event_lock);
6695         evt_action = event->action;
6696         spin_unlock(&event->vif_event_lock);
6697         return evt_action == action;
6698 }
6699
6700 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6701                                   struct brcmf_cfg80211_vif *vif)
6702 {
6703         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6704
6705         spin_lock(&event->vif_event_lock);
6706         event->vif = vif;
6707         event->action = 0;
6708         spin_unlock(&event->vif_event_lock);
6709 }
6710
6711 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6712 {
6713         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6714         bool armed;
6715
6716         spin_lock(&event->vif_event_lock);
6717         armed = event->vif != NULL;
6718         spin_unlock(&event->vif_event_lock);
6719
6720         return armed;
6721 }
6722
6723 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6724                                   u8 action, ulong timeout)
6725 {
6726         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6727
6728         return wait_event_timeout(event->vif_wq,
6729                                   vif_event_equals(event, action), timeout);
6730 }
6731
6732 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6733                                         struct brcmf_fil_country_le *ccreq)
6734 {
6735         struct brcmfmac_pd_cc *country_codes;
6736         struct brcmfmac_pd_cc_entry *cc;
6737         s32 found_index;
6738         int i;
6739
6740         country_codes = drvr->settings->country_codes;
6741         if (!country_codes) {
6742                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6743                 return -EINVAL;
6744         }
6745
6746         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6747             (alpha2[1] == ccreq->country_abbrev[1])) {
6748                 brcmf_dbg(TRACE, "Country code already set\n");
6749                 return -EAGAIN;
6750         }
6751
6752         found_index = -1;
6753         for (i = 0; i < country_codes->table_size; i++) {
6754                 cc = &country_codes->table[i];
6755                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6756                         found_index = i;
6757                 if ((cc->iso3166[0] == alpha2[0]) &&
6758                     (cc->iso3166[1] == alpha2[1])) {
6759                         found_index = i;
6760                         break;
6761                 }
6762         }
6763         if (found_index == -1) {
6764                 brcmf_dbg(TRACE, "No country code match found\n");
6765                 return -EINVAL;
6766         }
6767         memset(ccreq, 0, sizeof(*ccreq));
6768         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6769         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6770                BRCMF_COUNTRY_BUF_SZ);
6771         ccreq->country_abbrev[0] = alpha2[0];
6772         ccreq->country_abbrev[1] = alpha2[1];
6773         ccreq->country_abbrev[2] = 0;
6774
6775         return 0;
6776 }
6777
6778 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6779                                         struct regulatory_request *req)
6780 {
6781         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6782         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6783         struct brcmf_fil_country_le ccreq;
6784         s32 err;
6785         int i;
6786
6787         /* ignore non-ISO3166 country codes */
6788         for (i = 0; i < sizeof(req->alpha2); i++)
6789                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6790                         brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
6791                                   req->alpha2[0], req->alpha2[1]);
6792                         return;
6793                 }
6794
6795         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6796                   req->alpha2[0], req->alpha2[1]);
6797
6798         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6799         if (err) {
6800                 brcmf_err("Country code iovar returned err = %d\n", err);
6801                 return;
6802         }
6803
6804         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6805         if (err)
6806                 return;
6807
6808         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6809         if (err) {
6810                 brcmf_err("Firmware rejected country setting\n");
6811                 return;
6812         }
6813         brcmf_setup_wiphybands(wiphy);
6814 }
6815
6816 static void brcmf_free_wiphy(struct wiphy *wiphy)
6817 {
6818         int i;
6819
6820         if (!wiphy)
6821                 return;
6822
6823         if (wiphy->iface_combinations) {
6824                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6825                         kfree(wiphy->iface_combinations[i].limits);
6826         }
6827         kfree(wiphy->iface_combinations);
6828         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6829                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6830                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6831         }
6832         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6833                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6834                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6835         }
6836         wiphy_free(wiphy);
6837 }
6838
6839 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6840                                                   struct device *busdev,
6841                                                   bool p2pdev_forced)
6842 {
6843         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6844         struct brcmf_cfg80211_info *cfg;
6845         struct wiphy *wiphy;
6846         struct cfg80211_ops *ops;
6847         struct brcmf_cfg80211_vif *vif;
6848         struct brcmf_if *ifp;
6849         s32 err = 0;
6850         s32 io_type;
6851         u16 *cap = NULL;
6852
6853         if (!ndev) {
6854                 brcmf_err("ndev is invalid\n");
6855                 return NULL;
6856         }
6857
6858         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6859         if (!ops)
6860                 return NULL;
6861
6862         ifp = netdev_priv(ndev);
6863 #ifdef CONFIG_PM
6864         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6865                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6866 #endif
6867         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
6868         if (!wiphy) {
6869                 brcmf_err("Could not allocate wiphy device\n");
6870                 return NULL;
6871         }
6872         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6873         set_wiphy_dev(wiphy, busdev);
6874
6875         cfg = wiphy_priv(wiphy);
6876         cfg->wiphy = wiphy;
6877         cfg->ops = ops;
6878         cfg->pub = drvr;
6879         init_vif_event(&cfg->vif_event);
6880         INIT_LIST_HEAD(&cfg->vif_list);
6881
6882         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
6883         if (IS_ERR(vif))
6884                 goto wiphy_out;
6885
6886         vif->ifp = ifp;
6887         vif->wdev.netdev = ndev;
6888         ndev->ieee80211_ptr = &vif->wdev;
6889         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6890
6891         err = wl_init_priv(cfg);
6892         if (err) {
6893                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6894                 brcmf_free_vif(vif);
6895                 goto wiphy_out;
6896         }
6897         ifp->vif = vif;
6898
6899         /* determine d11 io type before wiphy setup */
6900         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6901         if (err) {
6902                 brcmf_err("Failed to get D11 version (%d)\n", err);
6903                 goto priv_out;
6904         }
6905         cfg->d11inf.io_type = (u8)io_type;
6906         brcmu_d11_attach(&cfg->d11inf);
6907
6908         err = brcmf_setup_wiphy(wiphy, ifp);
6909         if (err < 0)
6910                 goto priv_out;
6911
6912         brcmf_dbg(INFO, "Registering custom regulatory\n");
6913         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6914         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6915         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6916
6917         /* firmware defaults to 40MHz disabled in 2G band. We signal
6918          * cfg80211 here that we do and have it decide we can enable
6919          * it. But first check if device does support 2G operation.
6920          */
6921         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6922                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6923                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6924         }
6925         err = wiphy_register(wiphy);
6926         if (err < 0) {
6927                 brcmf_err("Could not register wiphy device (%d)\n", err);
6928                 goto priv_out;
6929         }
6930
6931         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6932          * setup 40MHz in 2GHz band and enable OBSS scanning.
6933          */
6934         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6935                 err = brcmf_enable_bw40_2g(cfg);
6936                 if (!err)
6937                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6938                                                       BRCMF_OBSS_COEX_AUTO);
6939                 else
6940                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6941         }
6942         /* p2p might require that "if-events" get processed by fweh. So
6943          * activate the already registered event handlers now and activate
6944          * the rest when initialization has completed. drvr->config needs to
6945          * be assigned before activating events.
6946          */
6947         drvr->config = cfg;
6948         err = brcmf_fweh_activate_events(ifp);
6949         if (err) {
6950                 brcmf_err("FWEH activation failed (%d)\n", err);
6951                 goto wiphy_unreg_out;
6952         }
6953
6954         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6955         if (err) {
6956                 brcmf_err("P2P initilisation failed (%d)\n", err);
6957                 goto wiphy_unreg_out;
6958         }
6959         err = brcmf_btcoex_attach(cfg);
6960         if (err) {
6961                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6962                 brcmf_p2p_detach(&cfg->p2p);
6963                 goto wiphy_unreg_out;
6964         }
6965
6966         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6967                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6968                 if (err) {
6969                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6970                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6971                 } else {
6972                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6973                                             brcmf_notify_tdls_peer_event);
6974                 }
6975         }
6976
6977         /* (re-) activate FWEH event handling */
6978         err = brcmf_fweh_activate_events(ifp);
6979         if (err) {
6980                 brcmf_err("FWEH activation failed (%d)\n", err);
6981                 goto wiphy_unreg_out;
6982         }
6983
6984         /* Fill in some of the advertised nl80211 supported features */
6985         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
6986                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6987 #ifdef CONFIG_PM
6988                 if (wiphy->wowlan &&
6989                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
6990                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6991 #endif
6992         }
6993
6994         return cfg;
6995
6996 wiphy_unreg_out:
6997         wiphy_unregister(cfg->wiphy);
6998 priv_out:
6999         wl_deinit_priv(cfg);
7000         brcmf_free_vif(vif);
7001         ifp->vif = NULL;
7002 wiphy_out:
7003         brcmf_free_wiphy(wiphy);
7004         kfree(ops);
7005         return NULL;
7006 }
7007
7008 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7009 {
7010         if (!cfg)
7011                 return;
7012
7013         brcmf_btcoex_detach(cfg);
7014         wiphy_unregister(cfg->wiphy);
7015         kfree(cfg->ops);
7016         wl_deinit_priv(cfg);
7017         brcmf_free_wiphy(cfg->wiphy);
7018 }