drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
  18
  19 #include <linux/kernel.h>
  20 #include <linux/etherdevice.h>
  21 #include <linux/module.h>
  22 #include <linux/vmalloc.h>
  23 #include <net/cfg80211.h>
  24 #include <net/netlink.h>
  25
  26 #include <brcmu_utils.h>
  27 #include <defs.h>
  28 #include <brcmu_wifi.h>
  29 #include "core.h"
  30 #include "debug.h"
  31 #include "tracepoint.h"
  32 #include "fwil_types.h"
  33 #include "p2p.h"
  34 #include "btcoex.h"
  35 #include "cfg80211.h"
  36 #include "feature.h"
  37 #include "fwil.h"
  38 #include "proto.h"
  39 #include "vendor.h"
  40 #include "bus.h"
  41 #include "common.h"
  42
  43 #define BRCMF_SCAN_IE_LEN_MAX           2048
  44 #define BRCMF_PNO_VERSION               2
  45 #define BRCMF_PNO_TIME                  30
  46 #define BRCMF_PNO_REPEAT                4
  47 #define BRCMF_PNO_FREQ_EXPO_MAX         3
  48 #define BRCMF_PNO_MAX_PFN_COUNT         16
  49 #define BRCMF_PNO_ENABLE_ADAPTSCAN_BIT  6
  50 #define BRCMF_PNO_HIDDEN_BIT            2
  51 #define BRCMF_PNO_WPA_AUTH_ANY          0xFFFFFFFF
  52 #define BRCMF_PNO_SCAN_COMPLETE         1
  53 #define BRCMF_PNO_SCAN_INCOMPLETE       0
  54
  55 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
  56 #define WPA_OUI_TYPE                    1
  57 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
  58 #define WME_OUI_TYPE                    2
  59 #define WPS_OUI_TYPE                    4
  60
  61 #define VS_IE_FIXED_HDR_LEN             6
  62 #define WPA_IE_VERSION_LEN              2
  63 #define WPA_IE_MIN_OUI_LEN              4
  64 #define WPA_IE_SUITE_COUNT_LEN          2
  65
  66 #define WPA_CIPHER_NONE                 0       /* None */
  67 #define WPA_CIPHER_WEP_40               1       /* WEP (40-bit) */
  68 #define WPA_CIPHER_TKIP                 2       /* TKIP: default for WPA */
  69 #define WPA_CIPHER_AES_CCM              4       /* AES (CCM) */
  70 #define WPA_CIPHER_WEP_104              5       /* WEP (104-bit) */
  71
  72 #define RSN_AKM_NONE                    0       /* None (IBSS) */
  73 #define RSN_AKM_UNSPECIFIED             1       /* Over 802.1x */
  74 #define RSN_AKM_PSK                     2       /* Pre-shared Key */
  75 #define RSN_AKM_SHA256_1X               5       /* SHA256, 802.1X */
  76 #define RSN_AKM_SHA256_PSK              6       /* SHA256, Pre-shared Key */
  77 #define RSN_CAP_LEN                     2       /* Length of RSN capabilities */
  78 #define RSN_CAP_PTK_REPLAY_CNTR_MASK    (BIT(2) | BIT(3))
  79 #define RSN_CAP_MFPR_MASK               BIT(6)
  80 #define RSN_CAP_MFPC_MASK               BIT(7)
  81 #define RSN_PMKID_COUNT_LEN             2
  82
  83 #define VNDR_IE_CMD_LEN                 4       /* length of the set command
  84                                                  * string :"add", "del" (+ NUL)
  85                                                  */
  86 #define VNDR_IE_COUNT_OFFSET            4
  87 #define VNDR_IE_PKTFLAG_OFFSET          8
  88 #define VNDR_IE_VSIE_OFFSET             12
  89 #define VNDR_IE_HDR_SIZE                12
  90 #define VNDR_IE_PARSE_LIMIT             5
  91
  92 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
  93 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
  94
  95 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
  96 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
  97 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
  98
  99 #define BRCMF_SCAN_CHANNEL_TIME         40
 100 #define BRCMF_SCAN_UNASSOC_TIME         40
 101 #define BRCMF_SCAN_PASSIVE_TIME         120
 102
 103 #define BRCMF_ND_INFO_TIMEOUT           msecs_to_jiffies(2000)
 104
 105 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
 106         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 107
 108 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
 109 {
 110         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
 111                 brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
 112                           vif->sme_state);
 113                 return false;
 114         }
 115         return true;
 116 }
 117
 118 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
 119 #define RATETAB_ENT(_rateid, _flags) \
 120         {                                                               \
 121                 .bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
 122                 .hw_value       = (_rateid),                            \
 123                 .flags          = (_flags),                             \
 124         }
 125
 126 static struct ieee80211_rate __wl_rates[] = {
 127         RATETAB_ENT(BRCM_RATE_1M, 0),
 128         RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
 129         RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
 130         RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
 131         RATETAB_ENT(BRCM_RATE_6M, 0),
 132         RATETAB_ENT(BRCM_RATE_9M, 0),
 133         RATETAB_ENT(BRCM_RATE_12M, 0),
 134         RATETAB_ENT(BRCM_RATE_18M, 0),
 135         RATETAB_ENT(BRCM_RATE_24M, 0),
 136         RATETAB_ENT(BRCM_RATE_36M, 0),
 137         RATETAB_ENT(BRCM_RATE_48M, 0),
 138         RATETAB_ENT(BRCM_RATE_54M, 0),
 139 };
 140
 141 #define wl_g_rates              (__wl_rates + 0)
 142 #define wl_g_rates_size         ARRAY_SIZE(__wl_rates)
 143 #define wl_a_rates              (__wl_rates + 4)
 144 #define wl_a_rates_size         (wl_g_rates_size - 4)
 145
 146 #define CHAN2G(_channel, _freq) {                               \
 147         .band                   = NL80211_BAND_2GHZ,            \
 148         .center_freq            = (_freq),                      \
 149         .hw_value               = (_channel),                   \
 150         .max_antenna_gain       = 0,                            \
 151         .max_power              = 30,                           \
 152 }
 153
 154 #define CHAN5G(_channel) {                                      \
 155         .band                   = NL80211_BAND_5GHZ,            \
 156         .center_freq            = 5000 + (5 * (_channel)),      \
 157         .hw_value               = (_channel),                   \
 158         .max_antenna_gain       = 0,                            \
 159         .max_power              = 30,                           \
 160 }
 161
 162 static struct ieee80211_channel __wl_2ghz_channels[] = {
 163         CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
 164         CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
 165         CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
 166         CHAN2G(13, 2472), CHAN2G(14, 2484)
 167 };
 168
 169 static struct ieee80211_channel __wl_5ghz_channels[] = {
 170         CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
 171         CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
 172         CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
 173         CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
 174         CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
 175         CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
 176 };
 177
 178 /* Band templates duplicated per wiphy. The channel info
 179  * above is added to the band during setup.
 180  */
 181 static const struct ieee80211_supported_band __wl_band_2ghz = {
 182         .band = NL80211_BAND_2GHZ,
 183         .bitrates = wl_g_rates,
 184         .n_bitrates = wl_g_rates_size,
 185 };
 186
 187 static const struct ieee80211_supported_band __wl_band_5ghz = {
 188         .band = NL80211_BAND_5GHZ,
 189         .bitrates = wl_a_rates,
 190         .n_bitrates = wl_a_rates_size,
 191 };
 192
 193 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
 194  * By default world regulatory domain defined in reg.c puts the flags
 195  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
 196  * With respect to these flags, wpa_supplicant doesn't * start p2p
 197  * operations on 5GHz channels. All the changes in world regulatory
 198  * domain are to be done here.
 199  */
 200 static const struct ieee80211_regdomain brcmf_regdom = {
 201         .n_reg_rules = 4,
 202         .alpha2 =  "99",
 203         .reg_rules = {
 204                 /* IEEE 802.11b/g, channels 1..11 */
 205                 REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
 206                 /* If any */
 207                 /* IEEE 802.11 channel 14 - Only JP enables
 208                  * this and for 802.11b only
 209                  */
 210                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
 211                 /* IEEE 802.11a, channel 36..64 */
 212                 REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
 213                 /* IEEE 802.11a, channel 100..165 */
 214                 REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 215 };
 216
 217 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
 218  * are supported. A pointer to this array and the number of entries is passed
 219  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
 220  * So the cipher suite AES_CMAC has to be the last one in the array, and when
 221  * device does not support MFP then the number of suites will be decreased by 1
 222  */
 223 static const u32 brcmf_cipher_suites[] = {
 224         WLAN_CIPHER_SUITE_WEP40,
 225         WLAN_CIPHER_SUITE_WEP104,
 226         WLAN_CIPHER_SUITE_TKIP,
 227         WLAN_CIPHER_SUITE_CCMP,
 228         /* Keep as last entry: */
 229         WLAN_CIPHER_SUITE_AES_CMAC
 230 };
 231
 232 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 233 struct brcmf_vs_tlv {
 234         u8 id;
 235         u8 len;
 236         u8 oui[3];
 237         u8 oui_type;
 238 };
 239
 240 struct parsed_vndr_ie_info {
 241         u8 *ie_ptr;
 242         u32 ie_len;     /* total length including id & length field */
 243         struct brcmf_vs_tlv vndrie;
 244 };
 245
 246 struct parsed_vndr_ies {
 247         u32 count;
 248         struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 249 };
 250
 251 static u8 nl80211_band_to_fwil(enum nl80211_band band)
 252 {
 253         switch (band) {
 254         case NL80211_BAND_2GHZ:
 255                 return WLC_BAND_2G;
 256         case NL80211_BAND_5GHZ:
 257                 return WLC_BAND_5G;
 258         default:
 259                 WARN_ON(1);
 260                 break;
 261         }
 262         return 0;
 263 }
 264
 265 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
 266                                struct cfg80211_chan_def *ch)
 267 {
 268         struct brcmu_chan ch_inf;
 269         s32 primary_offset;
 270
 271         brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
 272                   ch->chan->center_freq, ch->center_freq1, ch->width);
 273         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
 274         primary_offset = ch->chan->center_freq - ch->center_freq1;
 275         switch (ch->width) {
 276         case NL80211_CHAN_WIDTH_20:
 277         case NL80211_CHAN_WIDTH_20_NOHT:
 278                 ch_inf.bw = BRCMU_CHAN_BW_20;
 279                 WARN_ON(primary_offset != 0);
 280                 break;
 281         case NL80211_CHAN_WIDTH_40:
 282                 ch_inf.bw = BRCMU_CHAN_BW_40;
 283                 if (primary_offset > 0)
 284                         ch_inf.sb = BRCMU_CHAN_SB_U;
 285                 else
 286                         ch_inf.sb = BRCMU_CHAN_SB_L;
 287                 break;
 288         case NL80211_CHAN_WIDTH_80:
 289                 ch_inf.bw = BRCMU_CHAN_BW_80;
 290                 if (primary_offset == -30)
 291                         ch_inf.sb = BRCMU_CHAN_SB_LL;
 292                 else if (primary_offset == -10)
 293                         ch_inf.sb = BRCMU_CHAN_SB_LU;
 294                 else if (primary_offset == 10)
 295                         ch_inf.sb = BRCMU_CHAN_SB_UL;
 296                 else
 297                         ch_inf.sb = BRCMU_CHAN_SB_UU;
 298                 break;
 299         case NL80211_CHAN_WIDTH_80P80:
 300         case NL80211_CHAN_WIDTH_160:
 301         case NL80211_CHAN_WIDTH_5:
 302         case NL80211_CHAN_WIDTH_10:
 303         default:
 304                 WARN_ON_ONCE(1);
 305         }
 306         switch (ch->chan->band) {
 307         case NL80211_BAND_2GHZ:
 308                 ch_inf.band = BRCMU_CHAN_BAND_2G;
 309                 break;
 310         case NL80211_BAND_5GHZ:
 311                 ch_inf.band = BRCMU_CHAN_BAND_5G;
 312                 break;
 313         case NL80211_BAND_60GHZ:
 314         default:
 315                 WARN_ON_ONCE(1);
 316         }
 317         d11inf->encchspec(&ch_inf);
 318
 319         return ch_inf.chspec;
 320 }
 321
 322 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
 323                         struct ieee80211_channel *ch)
 324 {
 325         struct brcmu_chan ch_inf;
 326
 327         ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
 328         ch_inf.bw = BRCMU_CHAN_BW_20;
 329         d11inf->encchspec(&ch_inf);
 330
 331         return ch_inf.chspec;
 332 }
 333
 334 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
 335  * triples, returning a pointer to the substring whose first element
 336  * matches tag
 337  */
 338 const struct brcmf_tlv *
 339 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
 340 {
 341         const struct brcmf_tlv *elt = buf;
 342         int totlen = buflen;
 343
 344         /* find tagged parameter */
 345         while (totlen >= TLV_HDR_LEN) {
 346                 int len = elt->len;
 347
 348                 /* validate remaining totlen */
 349                 if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
 350                         return elt;
 351
 352                 elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
 353                 totlen -= (len + TLV_HDR_LEN);
 354         }
 355
 356         return NULL;
 357 }
 358
 359 /* Is any of the tlvs the expected entry? If
 360  * not update the tlvs buffer pointer/length.
 361  */
 362 static bool
 363 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
 364                  const u8 *oui, u32 oui_len, u8 type)
 365 {
 366         /* If the contents match the OUI and the type */
 367         if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
 368             !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
 369             type == ie[TLV_BODY_OFF + oui_len]) {
 370                 return true;
 371         }
 372
 373         if (tlvs == NULL)
 374                 return false;
 375         /* point to the next ie */
 376         ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
 377         /* calculate the length of the rest of the buffer */
 378         *tlvs_len -= (int)(ie - *tlvs);
 379         /* update the pointer to the start of the buffer */
 380         *tlvs = ie;
 381
 382         return false;
 383 }
 384
 385 static struct brcmf_vs_tlv *
 386 brcmf_find_wpaie(const u8 *parse, u32 len)
 387 {
 388         const struct brcmf_tlv *ie;
 389
 390         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 391                 if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
 392                                      WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
 393                         return (struct brcmf_vs_tlv *)ie;
 394         }
 395         return NULL;
 396 }
 397
 398 static struct brcmf_vs_tlv *
 399 brcmf_find_wpsie(const u8 *parse, u32 len)
 400 {
 401         const struct brcmf_tlv *ie;
 402
 403         while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
 404                 if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
 405                                      WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
 406                         return (struct brcmf_vs_tlv *)ie;
 407         }
 408         return NULL;
 409 }
 410
 411 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
 412                                      struct brcmf_cfg80211_vif *vif,
 413                                      enum nl80211_iftype new_type)
 414 {
 415         int iftype_num[NUM_NL80211_IFTYPES];
 416         struct brcmf_cfg80211_vif *pos;
 417         bool check_combos = false;
 418         int ret = 0;
 419
 420         memset(&iftype_num[0], 0, sizeof(iftype_num));
 421         list_for_each_entry(pos, &cfg->vif_list, list)
 422                 if (pos == vif) {
 423                         iftype_num[new_type]++;
 424                 } else {
 425                         /* concurrent interfaces so need check combinations */
 426                         check_combos = true;
 427                         iftype_num[pos->wdev.iftype]++;
 428                 }
 429
 430         if (check_combos)
 431                 ret = cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 432
 433         return ret;
 434 }
 435
 436 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
 437                                   enum nl80211_iftype new_type)
 438 {
 439         int iftype_num[NUM_NL80211_IFTYPES];
 440         struct brcmf_cfg80211_vif *pos;
 441
 442         memset(&iftype_num[0], 0, sizeof(iftype_num));
 443         list_for_each_entry(pos, &cfg->vif_list, list)
 444                 iftype_num[pos->wdev.iftype]++;
 445
 446         iftype_num[new_type]++;
 447         return cfg80211_check_combinations(cfg->wiphy, 1, 0, iftype_num);
 448 }
 449
 450 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 451                                  struct brcmf_wsec_key_le *key_le)
 452 {
 453         key_le->index = cpu_to_le32(key->index);
 454         key_le->len = cpu_to_le32(key->len);
 455         key_le->algo = cpu_to_le32(key->algo);
 456         key_le->flags = cpu_to_le32(key->flags);
 457         key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
 458         key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
 459         key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
 460         memcpy(key_le->data, key->data, sizeof(key->data));
 461         memcpy(key_le->ea, key->ea, sizeof(key->ea));
 462 }
 463
 464 static int
 465 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 466 {
 467         int err;
 468         struct brcmf_wsec_key_le key_le;
 469
 470         convert_key_from_CPU(key, &key_le);
 471
 472         brcmf_netdev_wait_pend8021x(ifp);
 473
 474         err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
 475                                         sizeof(key_le));
 476
 477         if (err)
 478                 brcmf_err("wsec_key error (%d)\n", err);
 479         return err;
 480 }
 481
 482 static s32
 483 brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
 484 {
 485         s32 err;
 486         u32 mode;
 487
 488         if (enable)
 489                 mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
 490         else
 491                 mode = 0;
 492
 493         /* Try to set and enable ARP offload feature, this may fail, then it  */
 494         /* is simply not supported and err 0 will be returned                 */
 495         err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
 496         if (err) {
 497                 brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
 498                           mode, err);
 499                 err = 0;
 500         } else {
 501                 err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
 502                 if (err) {
 503                         brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
 504                                   enable, err);
 505                         err = 0;
 506                 } else
 507                         brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
 508                                   enable, mode);
 509         }
 510
 511         err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
 512         if (err) {
 513                 brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
 514                           enable, err);
 515                 err = 0;
 516         } else
 517                 brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
 518                           enable, mode);
 519
 520         return err;
 521 }
 522
 523 static void
 524 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
 525 {
 526         struct brcmf_cfg80211_vif *vif;
 527         struct brcmf_if *ifp;
 528
 529         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 530         ifp = vif->ifp;
 531
 532         if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
 533             (wdev->iftype == NL80211_IFTYPE_AP) ||
 534             (wdev->iftype == NL80211_IFTYPE_P2P_GO))
 535                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 536                                                 ADDR_DIRECT);
 537         else
 538                 brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
 539                                                 ADDR_INDIRECT);
 540 }
 541
 542 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
 543 {
 544         int bsscfgidx;
 545
 546         for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
 547                 /* bsscfgidx 1 is reserved for legacy P2P */
 548                 if (bsscfgidx == 1)
 549                         continue;
 550                 if (!drvr->iflist[bsscfgidx])
 551                         return bsscfgidx;
 552         }
 553
 554         return -ENOMEM;
 555 }
 556
 557 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
 558 {
 559         struct brcmf_mbss_ssid_le mbss_ssid_le;
 560         int bsscfgidx;
 561         int err;
 562
 563         memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
 564         bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
 565         if (bsscfgidx < 0)
 566                 return bsscfgidx;
 567
 568         mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
 569         mbss_ssid_le.SSID_len = cpu_to_le32(5);
 570         sprintf(mbss_ssid_le.SSID, "ssid%d" , bsscfgidx);
 571
 572         err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
 573                                         sizeof(mbss_ssid_le));
 574         if (err < 0)
 575                 brcmf_err("setting ssid failed %d\n", err);
 576
 577         return err;
 578 }
 579
 580 /**
 581  * brcmf_ap_add_vif() - create a new AP virtual interface for multiple BSS
 582  *
 583  * @wiphy: wiphy device of new interface.
 584  * @name: name of the new interface.
 585  * @flags: not used.
 586  * @params: contains mac address for AP device.
 587  */
 588 static
 589 struct wireless_dev *brcmf_ap_add_vif(struct wiphy *wiphy, const char *name,
 590                                       u32 *flags, struct vif_params *params)
 591 {
 592         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 593         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
 594         struct brcmf_cfg80211_vif *vif;
 595         int err;
 596
 597         if (brcmf_cfg80211_vif_event_armed(cfg))
 598                 return ERR_PTR(-EBUSY);
 599
 600         brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
 601
 602         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_AP);
 603         if (IS_ERR(vif))
 604                 return (struct wireless_dev *)vif;
 605
 606         brcmf_cfg80211_arm_vif_event(cfg, vif);
 607
 608         err = brcmf_cfg80211_request_ap_if(ifp);
 609         if (err) {
 610                 brcmf_cfg80211_arm_vif_event(cfg, NULL);
 611                 goto fail;
 612         }
 613
 614         /* wait for firmware event */
 615         err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
 616                                             BRCMF_VIF_EVENT_TIMEOUT);
 617         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 618         if (!err) {
 619                 brcmf_err("timeout occurred\n");
 620                 err = -EIO;
 621                 goto fail;
 622         }
 623
 624         /* interface created in firmware */
 625         ifp = vif->ifp;
 626         if (!ifp) {
 627                 brcmf_err("no if pointer provided\n");
 628                 err = -ENOENT;
 629                 goto fail;
 630         }
 631
 632         strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
 633         err = brcmf_net_attach(ifp, true);
 634         if (err) {
 635                 brcmf_err("Registering netdevice failed\n");
 636                 goto fail;
 637         }
 638
 639         return &ifp->vif->wdev;
 640
 641 fail:
 642         brcmf_free_vif(vif);
 643         return ERR_PTR(err);
 644 }
 645
 646 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
 647 {
 648         enum nl80211_iftype iftype;
 649
 650         iftype = vif->wdev.iftype;
 651         return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
 652 }
 653
 654 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 655 {
 656         return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
 657 }
 658
 659 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
 660                                                      const char *name,
 661                                                      unsigned char name_assign_type,
 662                                                      enum nl80211_iftype type,
 663                                                      u32 *flags,
 664                                                      struct vif_params *params)
 665 {
 666         struct wireless_dev *wdev;
 667         int err;
 668
 669         brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
 670         err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
 671         if (err) {
 672                 brcmf_err("iface validation failed: err=%d\n", err);
 673                 return ERR_PTR(err);
 674         }
 675         switch (type) {
 676         case NL80211_IFTYPE_ADHOC:
 677         case NL80211_IFTYPE_STATION:
 678         case NL80211_IFTYPE_AP_VLAN:
 679         case NL80211_IFTYPE_WDS:
 680         case NL80211_IFTYPE_MONITOR:
 681         case NL80211_IFTYPE_MESH_POINT:
 682                 return ERR_PTR(-EOPNOTSUPP);
 683         case NL80211_IFTYPE_AP:
 684                 wdev = brcmf_ap_add_vif(wiphy, name, flags, params);
 685                 break;
 686         case NL80211_IFTYPE_P2P_CLIENT:
 687         case NL80211_IFTYPE_P2P_GO:
 688         case NL80211_IFTYPE_P2P_DEVICE:
 689                 wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, flags, params);
 690                 break;
 691         case NL80211_IFTYPE_UNSPECIFIED:
 692         default:
 693                 return ERR_PTR(-EINVAL);
 694         }
 695
 696         if (IS_ERR(wdev))
 697                 brcmf_err("add iface %s type %d failed: err=%d\n",
 698                           name, type, (int)PTR_ERR(wdev));
 699         else
 700                 brcmf_cfg80211_update_proto_addr_mode(wdev);
 701
 702         return wdev;
 703 }
 704
 705 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
 706 {
 707         if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
 708                 brcmf_set_mpc(ifp, mpc);
 709 }
 710
 711 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
 712 {
 713         s32 err = 0;
 714
 715         if (check_vif_up(ifp->vif)) {
 716                 err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
 717                 if (err) {
 718                         brcmf_err("fail to set mpc\n");
 719                         return;
 720                 }
 721                 brcmf_dbg(INFO, "MPC : %d\n", mpc);
 722         }
 723 }
 724
 725 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
 726                                 struct brcmf_if *ifp, bool aborted,
 727                                 bool fw_abort)
 728 {
 729         struct brcmf_scan_params_le params_le;
 730         struct cfg80211_scan_request *scan_request;
 731         s32 err = 0;
 732
 733         brcmf_dbg(SCAN, "Enter\n");
 734
 735         /* clear scan request, because the FW abort can cause a second call */
 736         /* to this functon and might cause a double cfg80211_scan_done      */
 737         scan_request = cfg->scan_request;
 738         cfg->scan_request = NULL;
 739
 740         if (timer_pending(&cfg->escan_timeout))
 741                 del_timer_sync(&cfg->escan_timeout);
 742
 743         if (fw_abort) {
 744                 /* Do a scan abort to stop the driver's scan engine */
 745                 brcmf_dbg(SCAN, "ABORT scan in firmware\n");
 746                 memset(&params_le, 0, sizeof(params_le));
 747                 eth_broadcast_addr(params_le.bssid);
 748                 params_le.bss_type = DOT11_BSSTYPE_ANY;
 749                 params_le.scan_type = 0;
 750                 params_le.channel_num = cpu_to_le32(1);
 751                 params_le.nprobes = cpu_to_le32(1);
 752                 params_le.active_time = cpu_to_le32(-1);
 753                 params_le.passive_time = cpu_to_le32(-1);
 754                 params_le.home_time = cpu_to_le32(-1);
 755                 /* Scan is aborted by setting channel_list[0] to -1 */
 756                 params_le.channel_list[0] = cpu_to_le16(-1);
 757                 /* E-Scan (or anyother type) can be aborted by SCAN */
 758                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
 759                                              &params_le, sizeof(params_le));
 760                 if (err)
 761                         brcmf_err("Scan abort  failed\n");
 762         }
 763
 764         brcmf_scan_config_mpc(ifp, 1);
 765
 766         /*
 767          * e-scan can be initiated by scheduled scan
 768          * which takes precedence.
 769          */
 770         if (cfg->sched_escan) {
 771                 brcmf_dbg(SCAN, "scheduled scan completed\n");
 772                 cfg->sched_escan = false;
 773                 if (!aborted)
 774                         cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
 775         } else if (scan_request) {
 776                 struct cfg80211_scan_info info = {
 777                         .aborted = aborted,
 778                 };
 779
 780                 brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
 781                           aborted ? "Aborted" : "Done");
 782                 cfg80211_scan_done(scan_request, &info);
 783         }
 784         if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
 785                 brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
 786
 787         return err;
 788 }
 789
 790 static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
 791                                        struct wireless_dev *wdev)
 792 {
 793         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 794         struct net_device *ndev = wdev->netdev;
 795         struct brcmf_if *ifp = netdev_priv(ndev);
 796         int ret;
 797         int err;
 798
 799         brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
 800
 801         err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
 802         if (err) {
 803                 brcmf_err("interface_remove failed %d\n", err);
 804                 goto err_unarm;
 805         }
 806
 807         /* wait for firmware event */
 808         ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
 809                                             BRCMF_VIF_EVENT_TIMEOUT);
 810         if (!ret) {
 811                 brcmf_err("timeout occurred\n");
 812                 err = -EIO;
 813                 goto err_unarm;
 814         }
 815
 816         brcmf_remove_interface(ifp, true);
 817
 818 err_unarm:
 819         brcmf_cfg80211_arm_vif_event(cfg, NULL);
 820         return err;
 821 }
 822
 823 static
 824 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 825 {
 826         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 827         struct net_device *ndev = wdev->netdev;
 828
 829         if (ndev && ndev == cfg_to_ndev(cfg))
 830                 return -ENOTSUPP;
 831
 832         /* vif event pending in firmware */
 833         if (brcmf_cfg80211_vif_event_armed(cfg))
 834                 return -EBUSY;
 835
 836         if (ndev) {
 837                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
 838                     cfg->escan_info.ifp == netdev_priv(ndev))
 839                         brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
 840                                                     true, true);
 841
 842                 brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
 843         }
 844
 845         switch (wdev->iftype) {
 846         case NL80211_IFTYPE_ADHOC:
 847         case NL80211_IFTYPE_STATION:
 848         case NL80211_IFTYPE_AP_VLAN:
 849         case NL80211_IFTYPE_WDS:
 850         case NL80211_IFTYPE_MONITOR:
 851         case NL80211_IFTYPE_MESH_POINT:
 852                 return -EOPNOTSUPP;
 853         case NL80211_IFTYPE_AP:
 854                 return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
 855         case NL80211_IFTYPE_P2P_CLIENT:
 856         case NL80211_IFTYPE_P2P_GO:
 857         case NL80211_IFTYPE_P2P_DEVICE:
 858                 return brcmf_p2p_del_vif(wiphy, wdev);
 859         case NL80211_IFTYPE_UNSPECIFIED:
 860         default:
 861                 return -EINVAL;
 862         }
 863         return -EOPNOTSUPP;
 864 }
 865
 866 static s32
 867 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
 868                          enum nl80211_iftype type, u32 *flags,
 869                          struct vif_params *params)
 870 {
 871         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
 872         struct brcmf_if *ifp = netdev_priv(ndev);
 873         struct brcmf_cfg80211_vif *vif = ifp->vif;
 874         s32 infra = 0;
 875         s32 ap = 0;
 876         s32 err = 0;
 877
 878         brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
 879                   type);
 880
 881         /* WAR: There are a number of p2p interface related problems which
 882          * need to be handled initially (before doing the validate).
 883          * wpa_supplicant tends to do iface changes on p2p device/client/go
 884          * which are not always possible/allowed. However we need to return
 885          * OK otherwise the wpa_supplicant wont start. The situation differs
 886          * on configuration and setup (p2pon=1 module param). The first check
 887          * is to see if the request is a change to station for p2p iface.
 888          */
 889         if ((type == NL80211_IFTYPE_STATION) &&
 890             ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
 891              (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
 892              (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
 893                 brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
 894                 /* Now depending on whether module param p2pon=1 was used the
 895                  * response needs to be either 0 or EOPNOTSUPP. The reason is
 896                  * that if p2pon=1 is used, but a newer supplicant is used then
 897                  * we should return an error, as this combination wont work.
 898                  * In other situations 0 is returned and supplicant will start
 899                  * normally. It will give a trace in cfg80211, but it is the
 900                  * only way to get it working. Unfortunately this will result
 901                  * in situation where we wont support new supplicant in
 902                  * combination with module param p2pon=1, but that is the way
 903                  * it is. If the user tries this then unloading of driver might
 904                  * fail/lock.
 905                  */
 906                 if (cfg->p2p.p2pdev_dynamically)
 907                         return -EOPNOTSUPP;
 908                 else
 909                         return 0;
 910         }
 911         err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
 912         if (err) {
 913                 brcmf_err("iface validation failed: err=%d\n", err);
 914                 return err;
 915         }
 916         switch (type) {
 917         case NL80211_IFTYPE_MONITOR:
 918         case NL80211_IFTYPE_WDS:
 919                 brcmf_err("type (%d) : currently we do not support this type\n",
 920                           type);
 921                 return -EOPNOTSUPP;
 922         case NL80211_IFTYPE_ADHOC:
 923                 infra = 0;
 924                 break;
 925         case NL80211_IFTYPE_STATION:
 926                 infra = 1;
 927                 break;
 928         case NL80211_IFTYPE_AP:
 929         case NL80211_IFTYPE_P2P_GO:
 930                 ap = 1;
 931                 break;
 932         default:
 933                 err = -EINVAL;
 934                 goto done;
 935         }
 936
 937         if (ap) {
 938                 if (type == NL80211_IFTYPE_P2P_GO) {
 939                         brcmf_dbg(INFO, "IF Type = P2P GO\n");
 940                         err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
 941                 }
 942                 if (!err) {
 943                         brcmf_dbg(INFO, "IF Type = AP\n");
 944                 }
 945         } else {
 946                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
 947                 if (err) {
 948                         brcmf_err("WLC_SET_INFRA error (%d)\n", err);
 949                         err = -EAGAIN;
 950                         goto done;
 951                 }
 952                 brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
 953                           "Adhoc" : "Infra");
 954         }
 955         ndev->ieee80211_ptr->iftype = type;
 956
 957         brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
 958
 959 done:
 960         brcmf_dbg(TRACE, "Exit\n");
 961
 962         return err;
 963 }
 964
 965 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
 966                              struct brcmf_scan_params_le *params_le,
 967                              struct cfg80211_scan_request *request)
 968 {
 969         u32 n_ssids;
 970         u32 n_channels;
 971         s32 i;
 972         s32 offset;
 973         u16 chanspec;
 974         char *ptr;
 975         struct brcmf_ssid_le ssid_le;
 976
 977         eth_broadcast_addr(params_le->bssid);
 978         params_le->bss_type = DOT11_BSSTYPE_ANY;
 979         params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
 980         params_le->channel_num = 0;
 981         params_le->nprobes = cpu_to_le32(-1);
 982         params_le->active_time = cpu_to_le32(-1);
 983         params_le->passive_time = cpu_to_le32(-1);
 984         params_le->home_time = cpu_to_le32(-1);
 985         memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
 986
 987         n_ssids = request->n_ssids;
 988         n_channels = request->n_channels;
 989
 990         /* Copy channel array if applicable */
 991         brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
 992                   n_channels);
 993         if (n_channels > 0) {
 994                 for (i = 0; i < n_channels; i++) {
 995                         chanspec = channel_to_chanspec(&cfg->d11inf,
 996                                                        request->channels[i]);
 997                         brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
 998                                   request->channels[i]->hw_value, chanspec);
 999                         params_le->channel_list[i] = cpu_to_le16(chanspec);
1000                 }
1001         } else {
1002                 brcmf_dbg(SCAN, "Scanning all channels\n");
1003         }
1004         /* Copy ssid array if applicable */
1005         brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1006         if (n_ssids > 0) {
1007                 offset = offsetof(struct brcmf_scan_params_le, channel_list) +
1008                                 n_channels * sizeof(u16);
1009                 offset = roundup(offset, sizeof(u32));
1010                 ptr = (char *)params_le + offset;
1011                 for (i = 0; i < n_ssids; i++) {
1012                         memset(&ssid_le, 0, sizeof(ssid_le));
1013                         ssid_le.SSID_len =
1014                                         cpu_to_le32(request->ssids[i].ssid_len);
1015                         memcpy(ssid_le.SSID, request->ssids[i].ssid,
1016                                request->ssids[i].ssid_len);
1017                         if (!ssid_le.SSID_len)
1018                                 brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1019                         else
1020                                 brcmf_dbg(SCAN, "%d: scan for  %s size =%d\n",
1021                                           i, ssid_le.SSID, ssid_le.SSID_len);
1022                         memcpy(ptr, &ssid_le, sizeof(ssid_le));
1023                         ptr += sizeof(ssid_le);
1024                 }
1025         } else {
1026                 brcmf_dbg(SCAN, "Performing passive scan\n");
1027                 params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
1028         }
1029         /* Adding mask to channel numbers */
1030         params_le->channel_num =
1031                 cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1032                         (n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1033 }
1034
1035 static s32
1036 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1037                 struct cfg80211_scan_request *request)
1038 {
1039         s32 params_size = BRCMF_SCAN_PARAMS_FIXED_SIZE +
1040                           offsetof(struct brcmf_escan_params_le, params_le);
1041         struct brcmf_escan_params_le *params;
1042         s32 err = 0;
1043
1044         brcmf_dbg(SCAN, "E-SCAN START\n");
1045
1046         if (request != NULL) {
1047                 /* Allocate space for populating ssids in struct */
1048                 params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1049
1050                 /* Allocate space for populating ssids in struct */
1051                 params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1052         }
1053
1054         params = kzalloc(params_size, GFP_KERNEL);
1055         if (!params) {
1056                 err = -ENOMEM;
1057                 goto exit;
1058         }
1059         BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1060         brcmf_escan_prep(cfg, &params->params_le, request);
1061         params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1062         params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1063         params->sync_id = cpu_to_le16(0x1234);
1064
1065         err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1066         if (err) {
1067                 if (err == -EBUSY)
1068                         brcmf_dbg(INFO, "system busy : escan canceled\n");
1069                 else
1070                         brcmf_err("error (%d)\n", err);
1071         }
1072
1073         kfree(params);
1074 exit:
1075         return err;
1076 }
1077
1078 static s32
1079 brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
1080                struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1081 {
1082         s32 err;
1083         u32 passive_scan;
1084         struct brcmf_scan_results *results;
1085         struct escan_info *escan = &cfg->escan_info;
1086
1087         brcmf_dbg(SCAN, "Enter\n");
1088         escan->ifp = ifp;
1089         escan->wiphy = wiphy;
1090         escan->escan_state = WL_ESCAN_STATE_SCANNING;
1091         passive_scan = cfg->active_scan ? 0 : 1;
1092         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1093                                     passive_scan);
1094         if (err) {
1095                 brcmf_err("error (%d)\n", err);
1096                 return err;
1097         }
1098         brcmf_scan_config_mpc(ifp, 0);
1099         results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1100         results->version = 0;
1101         results->count = 0;
1102         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1103
1104         err = escan->run(cfg, ifp, request);
1105         if (err)
1106                 brcmf_scan_config_mpc(ifp, 1);
1107         return err;
1108 }
1109
1110 static s32
1111 brcmf_cfg80211_escan(struct wiphy *wiphy, struct brcmf_cfg80211_vif *vif,
1112                      struct cfg80211_scan_request *request,
1113                      struct cfg80211_ssid *this_ssid)
1114 {
1115         struct brcmf_if *ifp = vif->ifp;
1116         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1117         struct cfg80211_ssid *ssids;
1118         u32 passive_scan;
1119         bool escan_req;
1120         bool spec_scan;
1121         s32 err;
1122         struct brcmf_ssid_le ssid_le;
1123         u32 SSID_len;
1124
1125         brcmf_dbg(SCAN, "START ESCAN\n");
1126
1127         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1128                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
1129                 return -EAGAIN;
1130         }
1131         if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1132                 brcmf_err("Scanning being aborted: status (%lu)\n",
1133                           cfg->scan_status);
1134                 return -EAGAIN;
1135         }
1136         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1137                 brcmf_err("Scanning suppressed: status (%lu)\n",
1138                           cfg->scan_status);
1139                 return -EAGAIN;
1140         }
1141         if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) {
1142                 brcmf_err("Connecting: status (%lu)\n", ifp->vif->sme_state);
1143                 return -EAGAIN;
1144         }
1145
1146         /* If scan req comes for p2p0, send it over primary I/F */
1147         if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1148                 vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1149
1150         escan_req = false;
1151         if (request) {
1152                 /* scan bss */
1153                 ssids = request->ssids;
1154                 escan_req = true;
1155         } else {
1156                 /* scan in ibss */
1157                 /* we don't do escan in ibss */
1158                 ssids = this_ssid;
1159         }
1160
1161         cfg->scan_request = request;
1162         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1163         if (escan_req) {
1164                 cfg->escan_info.run = brcmf_run_escan;
1165                 err = brcmf_p2p_scan_prep(wiphy, request, vif);
1166                 if (err)
1167                         goto scan_out;
1168
1169                 err = brcmf_do_escan(cfg, wiphy, vif->ifp, request);
1170                 if (err)
1171                         goto scan_out;
1172         } else {
1173                 brcmf_dbg(SCAN, "ssid \"%s\", ssid_len (%d)\n",
1174                           ssids->ssid, ssids->ssid_len);
1175                 memset(&ssid_le, 0, sizeof(ssid_le));
1176                 SSID_len = min_t(u8, sizeof(ssid_le.SSID), ssids->ssid_len);
1177                 ssid_le.SSID_len = cpu_to_le32(0);
1178                 spec_scan = false;
1179                 if (SSID_len) {
1180                         memcpy(ssid_le.SSID, ssids->ssid, SSID_len);
1181                         ssid_le.SSID_len = cpu_to_le32(SSID_len);
1182                         spec_scan = true;
1183                 } else
1184                         brcmf_dbg(SCAN, "Broadcast scan\n");
1185
1186                 passive_scan = cfg->active_scan ? 0 : 1;
1187                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PASSIVE_SCAN,
1188                                             passive_scan);
1189                 if (err) {
1190                         brcmf_err("WLC_SET_PASSIVE_SCAN error (%d)\n", err);
1191                         goto scan_out;
1192                 }
1193                 brcmf_scan_config_mpc(ifp, 0);
1194                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN, &ssid_le,
1195                                              sizeof(ssid_le));
1196                 if (err) {
1197                         if (err == -EBUSY)
1198                                 brcmf_dbg(INFO, "BUSY: scan for \"%s\" canceled\n",
1199                                           ssid_le.SSID);
1200                         else
1201                                 brcmf_err("WLC_SCAN error (%d)\n", err);
1202
1203                         brcmf_scan_config_mpc(ifp, 1);
1204                         goto scan_out;
1205                 }
1206         }
1207
1208         /* Arm scan timeout timer */
1209         mod_timer(&cfg->escan_timeout, jiffies +
1210                         BRCMF_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
1211
1212         return 0;
1213
1214 scan_out:
1215         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1216         cfg->scan_request = NULL;
1217         return err;
1218 }
1219
1220 static s32
1221 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1222 {
1223         struct brcmf_cfg80211_vif *vif;
1224         s32 err = 0;
1225
1226         brcmf_dbg(TRACE, "Enter\n");
1227         vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1228         if (!check_vif_up(vif))
1229                 return -EIO;
1230
1231         err = brcmf_cfg80211_escan(wiphy, vif, request, NULL);
1232
1233         if (err)
1234                 brcmf_err("scan error (%d)\n", err);
1235
1236         brcmf_dbg(TRACE, "Exit\n");
1237         return err;
1238 }
1239
1240 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1241 {
1242         s32 err = 0;
1243
1244         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "rtsthresh",
1245                                       rts_threshold);
1246         if (err)
1247                 brcmf_err("Error (%d)\n", err);
1248
1249         return err;
1250 }
1251
1252 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1253 {
1254         s32 err = 0;
1255
1256         err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "fragthresh",
1257                                       frag_threshold);
1258         if (err)
1259                 brcmf_err("Error (%d)\n", err);
1260
1261         return err;
1262 }
1263
1264 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1265 {
1266         s32 err = 0;
1267         u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1268
1269         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), cmd, retry);
1270         if (err) {
1271                 brcmf_err("cmd (%d) , error (%d)\n", cmd, err);
1272                 return err;
1273         }
1274         return err;
1275 }
1276
1277 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1278 {
1279         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1280         struct net_device *ndev = cfg_to_ndev(cfg);
1281         struct brcmf_if *ifp = netdev_priv(ndev);
1282         s32 err = 0;
1283
1284         brcmf_dbg(TRACE, "Enter\n");
1285         if (!check_vif_up(ifp->vif))
1286                 return -EIO;
1287
1288         if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1289             (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1290                 cfg->conf->rts_threshold = wiphy->rts_threshold;
1291                 err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1292                 if (!err)
1293                         goto done;
1294         }
1295         if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1296             (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1297                 cfg->conf->frag_threshold = wiphy->frag_threshold;
1298                 err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1299                 if (!err)
1300                         goto done;
1301         }
1302         if (changed & WIPHY_PARAM_RETRY_LONG
1303             && (cfg->conf->retry_long != wiphy->retry_long)) {
1304                 cfg->conf->retry_long = wiphy->retry_long;
1305                 err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1306                 if (!err)
1307                         goto done;
1308         }
1309         if (changed & WIPHY_PARAM_RETRY_SHORT
1310             && (cfg->conf->retry_short != wiphy->retry_short)) {
1311                 cfg->conf->retry_short = wiphy->retry_short;
1312                 err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1313                 if (!err)
1314                         goto done;
1315         }
1316
1317 done:
1318         brcmf_dbg(TRACE, "Exit\n");
1319         return err;
1320 }
1321
1322 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1323 {
1324         memset(prof, 0, sizeof(*prof));
1325 }
1326
1327 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1328 {
1329         u16 reason;
1330
1331         switch (e->event_code) {
1332         case BRCMF_E_DEAUTH:
1333         case BRCMF_E_DEAUTH_IND:
1334         case BRCMF_E_DISASSOC_IND:
1335                 reason = e->reason;
1336                 break;
1337         case BRCMF_E_LINK:
1338         default:
1339                 reason = 0;
1340                 break;
1341         }
1342         return reason;
1343 }
1344
1345 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
1346 {
1347         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1348         s32 err = 0;
1349
1350         brcmf_dbg(TRACE, "Enter\n");
1351
1352         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1353                 brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
1354                 err = brcmf_fil_cmd_data_set(vif->ifp,
1355                                              BRCMF_C_DISASSOC, NULL, 0);
1356                 if (err) {
1357                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
1358                 }
1359                 if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1360                     (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1361                         cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1362                                               true, GFP_KERNEL);
1363         }
1364         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1365         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1366         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1367         brcmf_dbg(TRACE, "Exit\n");
1368 }
1369
1370 static s32
1371 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1372                       struct cfg80211_ibss_params *params)
1373 {
1374         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1375         struct brcmf_if *ifp = netdev_priv(ndev);
1376         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1377         struct brcmf_join_params join_params;
1378         size_t join_params_size = 0;
1379         s32 err = 0;
1380         s32 wsec = 0;
1381         s32 bcnprd;
1382         u16 chanspec;
1383         u32 ssid_len;
1384
1385         brcmf_dbg(TRACE, "Enter\n");
1386         if (!check_vif_up(ifp->vif))
1387                 return -EIO;
1388
1389         if (params->ssid)
1390                 brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1391         else {
1392                 brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1393                 return -EOPNOTSUPP;
1394         }
1395
1396         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1397
1398         if (params->bssid)
1399                 brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1400         else
1401                 brcmf_dbg(CONN, "No BSSID specified\n");
1402
1403         if (params->chandef.chan)
1404                 brcmf_dbg(CONN, "channel: %d\n",
1405                           params->chandef.chan->center_freq);
1406         else
1407                 brcmf_dbg(CONN, "no channel specified\n");
1408
1409         if (params->channel_fixed)
1410                 brcmf_dbg(CONN, "fixed channel required\n");
1411         else
1412                 brcmf_dbg(CONN, "no fixed channel required\n");
1413
1414         if (params->ie && params->ie_len)
1415                 brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1416         else
1417                 brcmf_dbg(CONN, "no ie specified\n");
1418
1419         if (params->beacon_interval)
1420                 brcmf_dbg(CONN, "beacon interval: %d\n",
1421                           params->beacon_interval);
1422         else
1423                 brcmf_dbg(CONN, "no beacon interval specified\n");
1424
1425         if (params->basic_rates)
1426                 brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1427         else
1428                 brcmf_dbg(CONN, "no basic rates specified\n");
1429
1430         if (params->privacy)
1431                 brcmf_dbg(CONN, "privacy required\n");
1432         else
1433                 brcmf_dbg(CONN, "no privacy required\n");
1434
1435         /* Configure Privacy for starter */
1436         if (params->privacy)
1437                 wsec |= WEP_ENABLED;
1438
1439         err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1440         if (err) {
1441                 brcmf_err("wsec failed (%d)\n", err);
1442                 goto done;
1443         }
1444
1445         /* Configure Beacon Interval for starter */
1446         if (params->beacon_interval)
1447                 bcnprd = params->beacon_interval;
1448         else
1449                 bcnprd = 100;
1450
1451         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1452         if (err) {
1453                 brcmf_err("WLC_SET_BCNPRD failed (%d)\n", err);
1454                 goto done;
1455         }
1456
1457         /* Configure required join parameter */
1458         memset(&join_params, 0, sizeof(struct brcmf_join_params));
1459
1460         /* SSID */
1461         ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1462         memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1463         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1464         join_params_size = sizeof(join_params.ssid_le);
1465
1466         /* BSSID */
1467         if (params->bssid) {
1468                 memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1469                 join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1470                 memcpy(profile->bssid, params->bssid, ETH_ALEN);
1471         } else {
1472                 eth_broadcast_addr(join_params.params_le.bssid);
1473                 eth_zero_addr(profile->bssid);
1474         }
1475
1476         /* Channel */
1477         if (params->chandef.chan) {
1478                 u32 target_channel;
1479
1480                 cfg->channel =
1481                         ieee80211_frequency_to_channel(
1482                                 params->chandef.chan->center_freq);
1483                 if (params->channel_fixed) {
1484                         /* adding chanspec */
1485                         chanspec = chandef_to_chanspec(&cfg->d11inf,
1486                                                        &params->chandef);
1487                         join_params.params_le.chanspec_list[0] =
1488                                 cpu_to_le16(chanspec);
1489                         join_params.params_le.chanspec_num = cpu_to_le32(1);
1490                         join_params_size += sizeof(join_params.params_le);
1491                 }
1492
1493                 /* set channel for starter */
1494                 target_channel = cfg->channel;
1495                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1496                                             target_channel);
1497                 if (err) {
1498                         brcmf_err("WLC_SET_CHANNEL failed (%d)\n", err);
1499                         goto done;
1500                 }
1501         } else
1502                 cfg->channel = 0;
1503
1504         cfg->ibss_starter = false;
1505
1506
1507         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1508                                      &join_params, join_params_size);
1509         if (err) {
1510                 brcmf_err("WLC_SET_SSID failed (%d)\n", err);
1511                 goto done;
1512         }
1513
1514 done:
1515         if (err)
1516                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1517         brcmf_dbg(TRACE, "Exit\n");
1518         return err;
1519 }
1520
1521 static s32
1522 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1523 {
1524         struct brcmf_if *ifp = netdev_priv(ndev);
1525
1526         brcmf_dbg(TRACE, "Enter\n");
1527         if (!check_vif_up(ifp->vif)) {
1528                 /* When driver is being unloaded, it can end up here. If an
1529                  * error is returned then later on a debug trace in the wireless
1530                  * core module will be printed. To avoid this 0 is returned.
1531                  */
1532                 return 0;
1533         }
1534
1535         brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
1536         brcmf_net_setcarrier(ifp, false);
1537
1538         brcmf_dbg(TRACE, "Exit\n");
1539
1540         return 0;
1541 }
1542
1543 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1544                                  struct cfg80211_connect_params *sme)
1545 {
1546         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1547         struct brcmf_cfg80211_security *sec;
1548         s32 val = 0;
1549         s32 err = 0;
1550
1551         if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1552                 val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1553         else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1554                 val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1555         else
1556                 val = WPA_AUTH_DISABLED;
1557         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1558         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1559         if (err) {
1560                 brcmf_err("set wpa_auth failed (%d)\n", err);
1561                 return err;
1562         }
1563         sec = &profile->sec;
1564         sec->wpa_versions = sme->crypto.wpa_versions;
1565         return err;
1566 }
1567
1568 static s32 brcmf_set_auth_type(struct net_device *ndev,
1569                                struct cfg80211_connect_params *sme)
1570 {
1571         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1572         struct brcmf_cfg80211_security *sec;
1573         s32 val = 0;
1574         s32 err = 0;
1575
1576         switch (sme->auth_type) {
1577         case NL80211_AUTHTYPE_OPEN_SYSTEM:
1578                 val = 0;
1579                 brcmf_dbg(CONN, "open system\n");
1580                 break;
1581         case NL80211_AUTHTYPE_SHARED_KEY:
1582                 val = 1;
1583                 brcmf_dbg(CONN, "shared key\n");
1584                 break;
1585         default:
1586                 val = 2;
1587                 brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1588                 break;
1589         }
1590
1591         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1592         if (err) {
1593                 brcmf_err("set auth failed (%d)\n", err);
1594                 return err;
1595         }
1596         sec = &profile->sec;
1597         sec->auth_type = sme->auth_type;
1598         return err;
1599 }
1600
1601 static s32
1602 brcmf_set_wsec_mode(struct net_device *ndev,
1603                     struct cfg80211_connect_params *sme)
1604 {
1605         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1606         struct brcmf_cfg80211_security *sec;
1607         s32 pval = 0;
1608         s32 gval = 0;
1609         s32 wsec;
1610         s32 err = 0;
1611
1612         if (sme->crypto.n_ciphers_pairwise) {
1613                 switch (sme->crypto.ciphers_pairwise[0]) {
1614                 case WLAN_CIPHER_SUITE_WEP40:
1615                 case WLAN_CIPHER_SUITE_WEP104:
1616                         pval = WEP_ENABLED;
1617                         break;
1618                 case WLAN_CIPHER_SUITE_TKIP:
1619                         pval = TKIP_ENABLED;
1620                         break;
1621                 case WLAN_CIPHER_SUITE_CCMP:
1622                         pval = AES_ENABLED;
1623                         break;
1624                 case WLAN_CIPHER_SUITE_AES_CMAC:
1625                         pval = AES_ENABLED;
1626                         break;
1627                 default:
1628                         brcmf_err("invalid cipher pairwise (%d)\n",
1629                                   sme->crypto.ciphers_pairwise[0]);
1630                         return -EINVAL;
1631                 }
1632         }
1633         if (sme->crypto.cipher_group) {
1634                 switch (sme->crypto.cipher_group) {
1635                 case WLAN_CIPHER_SUITE_WEP40:
1636                 case WLAN_CIPHER_SUITE_WEP104:
1637                         gval = WEP_ENABLED;
1638                         break;
1639                 case WLAN_CIPHER_SUITE_TKIP:
1640                         gval = TKIP_ENABLED;
1641                         break;
1642                 case WLAN_CIPHER_SUITE_CCMP:
1643                         gval = AES_ENABLED;
1644                         break;
1645                 case WLAN_CIPHER_SUITE_AES_CMAC:
1646                         gval = AES_ENABLED;
1647                         break;
1648                 default:
1649                         brcmf_err("invalid cipher group (%d)\n",
1650                                   sme->crypto.cipher_group);
1651                         return -EINVAL;
1652                 }
1653         }
1654
1655         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
1656         /* In case of privacy, but no security and WPS then simulate */
1657         /* setting AES. WPS-2.0 allows no security                   */
1658         if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
1659             sme->privacy)
1660                 pval = AES_ENABLED;
1661
1662         wsec = pval | gval;
1663         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", wsec);
1664         if (err) {
1665                 brcmf_err("error (%d)\n", err);
1666                 return err;
1667         }
1668
1669         sec = &profile->sec;
1670         sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
1671         sec->cipher_group = sme->crypto.cipher_group;
1672
1673         return err;
1674 }
1675
1676 static s32
1677 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
1678 {
1679         struct brcmf_if *ifp = netdev_priv(ndev);
1680         s32 val;
1681         s32 err;
1682         const struct brcmf_tlv *rsn_ie;
1683         const u8 *ie;
1684         u32 ie_len;
1685         u32 offset;
1686         u16 rsn_cap;
1687         u32 mfp;
1688         u16 count;
1689
1690         if (!sme->crypto.n_akm_suites)
1691                 return 0;
1692
1693         err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
1694         if (err) {
1695                 brcmf_err("could not get wpa_auth (%d)\n", err);
1696                 return err;
1697         }
1698         if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
1699                 switch (sme->crypto.akm_suites[0]) {
1700                 case WLAN_AKM_SUITE_8021X:
1701                         val = WPA_AUTH_UNSPECIFIED;
1702                         break;
1703                 case WLAN_AKM_SUITE_PSK:
1704                         val = WPA_AUTH_PSK;
1705                         break;
1706                 default:
1707                         brcmf_err("invalid cipher group (%d)\n",
1708                                   sme->crypto.cipher_group);
1709                         return -EINVAL;
1710                 }
1711         } else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
1712                 switch (sme->crypto.akm_suites[0]) {
1713                 case WLAN_AKM_SUITE_8021X:
1714                         val = WPA2_AUTH_UNSPECIFIED;
1715                         break;
1716                 case WLAN_AKM_SUITE_8021X_SHA256:
1717                         val = WPA2_AUTH_1X_SHA256;
1718                         break;
1719                 case WLAN_AKM_SUITE_PSK_SHA256:
1720                         val = WPA2_AUTH_PSK_SHA256;
1721                         break;
1722                 case WLAN_AKM_SUITE_PSK:
1723                         val = WPA2_AUTH_PSK;
1724                         break;
1725                 default:
1726                         brcmf_err("invalid cipher group (%d)\n",
1727                                   sme->crypto.cipher_group);
1728                         return -EINVAL;
1729                 }
1730         }
1731
1732         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
1733                 goto skip_mfp_config;
1734         /* The MFP mode (1 or 2) needs to be determined, parse IEs. The
1735          * IE will not be verified, just a quick search for MFP config
1736          */
1737         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
1738                                   WLAN_EID_RSN);
1739         if (!rsn_ie)
1740                 goto skip_mfp_config;
1741         ie = (const u8 *)rsn_ie;
1742         ie_len = rsn_ie->len + TLV_HDR_LEN;
1743         /* Skip unicast suite */
1744         offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
1745         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1746                 goto skip_mfp_config;
1747         /* Skip multicast suite */
1748         count = ie[offset] + (ie[offset + 1] << 8);
1749         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1750         if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
1751                 goto skip_mfp_config;
1752         /* Skip auth key management suite(s) */
1753         count = ie[offset] + (ie[offset + 1] << 8);
1754         offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
1755         if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
1756                 goto skip_mfp_config;
1757         /* Ready to read capabilities */
1758         mfp = BRCMF_MFP_NONE;
1759         rsn_cap = ie[offset] + (ie[offset + 1] << 8);
1760         if (rsn_cap & RSN_CAP_MFPR_MASK)
1761                 mfp = BRCMF_MFP_REQUIRED;
1762         else if (rsn_cap & RSN_CAP_MFPC_MASK)
1763                 mfp = BRCMF_MFP_CAPABLE;
1764         brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
1765
1766 skip_mfp_config:
1767         brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
1768         err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
1769         if (err) {
1770                 brcmf_err("could not set wpa_auth (%d)\n", err);
1771                 return err;
1772         }
1773
1774         return err;
1775 }
1776
1777 static s32
1778 brcmf_set_sharedkey(struct net_device *ndev,
1779                     struct cfg80211_connect_params *sme)
1780 {
1781         struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1782         struct brcmf_cfg80211_security *sec;
1783         struct brcmf_wsec_key key;
1784         s32 val;
1785         s32 err = 0;
1786
1787         brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
1788
1789         if (sme->key_len == 0)
1790                 return 0;
1791
1792         sec = &profile->sec;
1793         brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
1794                   sec->wpa_versions, sec->cipher_pairwise);
1795
1796         if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2))
1797                 return 0;
1798
1799         if (!(sec->cipher_pairwise &
1800             (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
1801                 return 0;
1802
1803         memset(&key, 0, sizeof(key));
1804         key.len = (u32) sme->key_len;
1805         key.index = (u32) sme->key_idx;
1806         if (key.len > sizeof(key.data)) {
1807                 brcmf_err("Too long key length (%u)\n", key.len);
1808                 return -EINVAL;
1809         }
1810         memcpy(key.data, sme->key, key.len);
1811         key.flags = BRCMF_PRIMARY_KEY;
1812         switch (sec->cipher_pairwise) {
1813         case WLAN_CIPHER_SUITE_WEP40:
1814                 key.algo = CRYPTO_ALGO_WEP1;
1815                 break;
1816         case WLAN_CIPHER_SUITE_WEP104:
1817                 key.algo = CRYPTO_ALGO_WEP128;
1818                 break;
1819         default:
1820                 brcmf_err("Invalid algorithm (%d)\n",
1821                           sme->crypto.ciphers_pairwise[0]);
1822                 return -EINVAL;
1823         }
1824         /* Set the new key/index */
1825         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
1826                   key.len, key.index, key.algo);
1827         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
1828         err = send_key_to_dongle(netdev_priv(ndev), &key);
1829         if (err)
1830                 return err;
1831
1832         if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
1833                 brcmf_dbg(CONN, "set auth_type to shared key\n");
1834                 val = WL_AUTH_SHARED_KEY;       /* shared key */
1835                 err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
1836                 if (err)
1837                         brcmf_err("set auth failed (%d)\n", err);
1838         }
1839         return err;
1840 }
1841
1842 static
1843 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
1844                                            enum nl80211_auth_type type)
1845 {
1846         if (type == NL80211_AUTHTYPE_AUTOMATIC &&
1847             brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
1848                 brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
1849                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1850         }
1851         return type;
1852 }
1853
1854 static void brcmf_set_join_pref(struct brcmf_if *ifp,
1855                                 struct cfg80211_bss_selection *bss_select)
1856 {
1857         struct brcmf_join_pref_params join_pref_params[2];
1858         enum nl80211_band band;
1859         int err, i = 0;
1860
1861         join_pref_params[i].len = 2;
1862         join_pref_params[i].rssi_gain = 0;
1863
1864         if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
1865                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
1866
1867         switch (bss_select->behaviour) {
1868         case __NL80211_BSS_SELECT_ATTR_INVALID:
1869                 brcmf_c_set_joinpref_default(ifp);
1870                 return;
1871         case NL80211_BSS_SELECT_ATTR_BAND_PREF:
1872                 join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
1873                 band = bss_select->param.band_pref;
1874                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1875                 i++;
1876                 break;
1877         case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
1878                 join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
1879                 band = bss_select->param.adjust.band;
1880                 join_pref_params[i].band = nl80211_band_to_fwil(band);
1881                 join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
1882                 i++;
1883                 break;
1884         case NL80211_BSS_SELECT_ATTR_RSSI:
1885         default:
1886                 break;
1887         }
1888         join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
1889         join_pref_params[i].len = 2;
1890         join_pref_params[i].rssi_gain = 0;
1891         join_pref_params[i].band = 0;
1892         err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
1893                                        sizeof(join_pref_params));
1894         if (err)
1895                 brcmf_err("Set join_pref error (%d)\n", err);
1896 }
1897
1898 static s32
1899 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
1900                        struct cfg80211_connect_params *sme)
1901 {
1902         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1903         struct brcmf_if *ifp = netdev_priv(ndev);
1904         struct ieee80211_channel *chan = sme->channel;
1905         struct brcmf_join_params join_params;
1906         size_t join_params_size;
1907         const struct brcmf_tlv *rsn_ie;
1908         const struct brcmf_vs_tlv *wpa_ie;
1909         const void *ie;
1910         u32 ie_len;
1911         struct brcmf_ext_join_params_le *ext_join_params;
1912         u16 chanspec;
1913         s32 err = 0;
1914         u32 ssid_len;
1915
1916         brcmf_dbg(TRACE, "Enter\n");
1917         if (!check_vif_up(ifp->vif))
1918                 return -EIO;
1919
1920         if (!sme->ssid) {
1921                 brcmf_err("Invalid ssid\n");
1922                 return -EOPNOTSUPP;
1923         }
1924
1925         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
1926                 /* A normal (non P2P) connection request setup. */
1927                 ie = NULL;
1928                 ie_len = 0;
1929                 /* find the WPA_IE */
1930                 wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
1931                 if (wpa_ie) {
1932                         ie = wpa_ie;
1933                         ie_len = wpa_ie->len + TLV_HDR_LEN;
1934                 } else {
1935                         /* find the RSN_IE */
1936                         rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
1937                                                   sme->ie_len,
1938                                                   WLAN_EID_RSN);
1939                         if (rsn_ie) {
1940                                 ie = rsn_ie;
1941                                 ie_len = rsn_ie->len + TLV_HDR_LEN;
1942                         }
1943                 }
1944                 brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
1945         }
1946
1947         err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
1948                                     sme->ie, sme->ie_len);
1949         if (err)
1950                 brcmf_err("Set Assoc REQ IE Failed\n");
1951         else
1952                 brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
1953
1954         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1955
1956         if (chan) {
1957                 cfg->channel =
1958                         ieee80211_frequency_to_channel(chan->center_freq);
1959                 chanspec = channel_to_chanspec(&cfg->d11inf, chan);
1960                 brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
1961                           cfg->channel, chan->center_freq, chanspec);
1962         } else {
1963                 cfg->channel = 0;
1964                 chanspec = 0;
1965         }
1966
1967         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
1968
1969         err = brcmf_set_wpa_version(ndev, sme);
1970         if (err) {
1971                 brcmf_err("wl_set_wpa_version failed (%d)\n", err);
1972                 goto done;
1973         }
1974
1975         sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
1976         err = brcmf_set_auth_type(ndev, sme);
1977         if (err) {
1978                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
1979                 goto done;
1980         }
1981
1982         err = brcmf_set_wsec_mode(ndev, sme);
1983         if (err) {
1984                 brcmf_err("wl_set_set_cipher failed (%d)\n", err);
1985                 goto done;
1986         }
1987
1988         err = brcmf_set_key_mgmt(ndev, sme);
1989         if (err) {
1990                 brcmf_err("wl_set_key_mgmt failed (%d)\n", err);
1991                 goto done;
1992         }
1993
1994         err = brcmf_set_sharedkey(ndev, sme);
1995         if (err) {
1996                 brcmf_err("brcmf_set_sharedkey failed (%d)\n", err);
1997                 goto done;
1998         }
1999
2000         /* Join with specific BSSID and cached SSID
2001          * If SSID is zero join based on BSSID only
2002          */
2003         join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2004                 offsetof(struct brcmf_assoc_params_le, chanspec_list);
2005         if (cfg->channel)
2006                 join_params_size += sizeof(u16);
2007         ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
2008         if (ext_join_params == NULL) {
2009                 err = -ENOMEM;
2010                 goto done;
2011         }
2012         ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2013         ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2014         memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2015         if (ssid_len < IEEE80211_MAX_SSID_LEN)
2016                 brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2017                           ext_join_params->ssid_le.SSID, ssid_len);
2018
2019         /* Set up join scan parameters */
2020         ext_join_params->scan_le.scan_type = -1;
2021         ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2022
2023         if (sme->bssid)
2024                 memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2025         else
2026                 eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2027
2028         if (cfg->channel) {
2029                 ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2030
2031                 ext_join_params->assoc_le.chanspec_list[0] =
2032                         cpu_to_le16(chanspec);
2033                 /* Increase dwell time to receive probe response or detect
2034                  * beacon from target AP at a noisy air only during connect
2035                  * command.
2036                  */
2037                 ext_join_params->scan_le.active_time =
2038                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2039                 ext_join_params->scan_le.passive_time =
2040                         cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2041                 /* To sync with presence period of VSDB GO send probe request
2042                  * more frequently. Probe request will be stopped when it gets
2043                  * probe response from target AP/GO.
2044                  */
2045                 ext_join_params->scan_le.nprobes =
2046                         cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2047                                     BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2048         } else {
2049                 ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2050                 ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2051                 ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2052         }
2053
2054         brcmf_set_join_pref(ifp, &sme->bss_select);
2055
2056         err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2057                                          join_params_size);
2058         kfree(ext_join_params);
2059         if (!err)
2060                 /* This is it. join command worked, we are done */
2061                 goto done;
2062
2063         /* join command failed, fallback to set ssid */
2064         memset(&join_params, 0, sizeof(join_params));
2065         join_params_size = sizeof(join_params.ssid_le);
2066
2067         memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2068         join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2069
2070         if (sme->bssid)
2071                 memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2072         else
2073                 eth_broadcast_addr(join_params.params_le.bssid);
2074
2075         if (cfg->channel) {
2076                 join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2077                 join_params.params_le.chanspec_num = cpu_to_le32(1);
2078                 join_params_size += sizeof(join_params.params_le);
2079         }
2080         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2081                                      &join_params, join_params_size);
2082         if (err)
2083                 brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
2084
2085 done:
2086         if (err)
2087                 clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2088         brcmf_dbg(TRACE, "Exit\n");
2089         return err;
2090 }
2091
2092 static s32
2093 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2094                        u16 reason_code)
2095 {
2096         struct brcmf_if *ifp = netdev_priv(ndev);
2097         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2098         struct brcmf_scb_val_le scbval;
2099         s32 err = 0;
2100
2101         brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2102         if (!check_vif_up(ifp->vif))
2103                 return -EIO;
2104
2105         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2106         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2107         cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2108
2109         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2110         scbval.val = cpu_to_le32(reason_code);
2111         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2112                                      &scbval, sizeof(scbval));
2113         if (err)
2114                 brcmf_err("error (%d)\n", err);
2115
2116         brcmf_dbg(TRACE, "Exit\n");
2117         return err;
2118 }
2119
2120 static s32
2121 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2122                             enum nl80211_tx_power_setting type, s32 mbm)
2123 {
2124         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2125         struct net_device *ndev = cfg_to_ndev(cfg);
2126         struct brcmf_if *ifp = netdev_priv(ndev);
2127         s32 err;
2128         s32 disable;
2129         u32 qdbm = 127;
2130
2131         brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2132         if (!check_vif_up(ifp->vif))
2133                 return -EIO;
2134
2135         switch (type) {
2136         case NL80211_TX_POWER_AUTOMATIC:
2137                 break;
2138         case NL80211_TX_POWER_LIMITED:
2139         case NL80211_TX_POWER_FIXED:
2140                 if (mbm < 0) {
2141                         brcmf_err("TX_POWER_FIXED - dbm is negative\n");
2142                         err = -EINVAL;
2143                         goto done;
2144                 }
2145                 qdbm =  MBM_TO_DBM(4 * mbm);
2146                 if (qdbm > 127)
2147                         qdbm = 127;
2148                 qdbm |= WL_TXPWR_OVERRIDE;
2149                 break;
2150         default:
2151                 brcmf_err("Unsupported type %d\n", type);
2152                 err = -EINVAL;
2153                 goto done;
2154         }
2155         /* Make sure radio is off or on as far as software is concerned */
2156         disable = WL_RADIO_SW_DISABLE << 16;
2157         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2158         if (err)
2159                 brcmf_err("WLC_SET_RADIO error (%d)\n", err);
2160
2161         err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2162         if (err)
2163                 brcmf_err("qtxpower error (%d)\n", err);
2164
2165 done:
2166         brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2167         return err;
2168 }
2169
2170 static s32
2171 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2172                             s32 *dbm)
2173 {
2174         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2175         struct net_device *ndev = cfg_to_ndev(cfg);
2176         struct brcmf_if *ifp = netdev_priv(ndev);
2177         s32 qdbm = 0;
2178         s32 err;
2179
2180         brcmf_dbg(TRACE, "Enter\n");
2181         if (!check_vif_up(ifp->vif))
2182                 return -EIO;
2183
2184         err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
2185         if (err) {
2186                 brcmf_err("error (%d)\n", err);
2187                 goto done;
2188         }
2189         *dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2190
2191 done:
2192         brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2193         return err;
2194 }
2195
2196 static s32
2197 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2198                                   u8 key_idx, bool unicast, bool multicast)
2199 {
2200         struct brcmf_if *ifp = netdev_priv(ndev);
2201         u32 index;
2202         u32 wsec;
2203         s32 err = 0;
2204
2205         brcmf_dbg(TRACE, "Enter\n");
2206         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2207         if (!check_vif_up(ifp->vif))
2208                 return -EIO;
2209
2210         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2211         if (err) {
2212                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2213                 goto done;
2214         }
2215
2216         if (wsec & WEP_ENABLED) {
2217                 /* Just select a new current key */
2218                 index = key_idx;
2219                 err = brcmf_fil_cmd_int_set(ifp,
2220                                             BRCMF_C_SET_KEY_PRIMARY, index);
2221                 if (err)
2222                         brcmf_err("error (%d)\n", err);
2223         }
2224 done:
2225         brcmf_dbg(TRACE, "Exit\n");
2226         return err;
2227 }
2228
2229 static s32
2230 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2231                        u8 key_idx, bool pairwise, const u8 *mac_addr)
2232 {
2233         struct brcmf_if *ifp = netdev_priv(ndev);
2234         struct brcmf_wsec_key *key;
2235         s32 err;
2236
2237         brcmf_dbg(TRACE, "Enter\n");
2238         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2239
2240         if (!check_vif_up(ifp->vif))
2241                 return -EIO;
2242
2243         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2244                 /* we ignore this key index in this case */
2245                 return -EINVAL;
2246         }
2247
2248         key = &ifp->vif->profile.key[key_idx];
2249
2250         if (key->algo == CRYPTO_ALGO_OFF) {
2251                 brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2252                 return -EINVAL;
2253         }
2254
2255         memset(key, 0, sizeof(*key));
2256         key->index = (u32)key_idx;
2257         key->flags = BRCMF_PRIMARY_KEY;
2258
2259         /* Clear the key/index */
2260         err = send_key_to_dongle(ifp, key);
2261
2262         brcmf_dbg(TRACE, "Exit\n");
2263         return err;
2264 }
2265
2266 static s32
2267 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2268                        u8 key_idx, bool pairwise, const u8 *mac_addr,
2269                        struct key_params *params)
2270 {
2271         struct brcmf_if *ifp = netdev_priv(ndev);
2272         struct brcmf_wsec_key *key;
2273         s32 val;
2274         s32 wsec;
2275         s32 err;
2276         u8 keybuf[8];
2277         bool ext_key;
2278
2279         brcmf_dbg(TRACE, "Enter\n");
2280         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2281         if (!check_vif_up(ifp->vif))
2282                 return -EIO;
2283
2284         if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2285                 /* we ignore this key index in this case */
2286                 brcmf_err("invalid key index (%d)\n", key_idx);
2287                 return -EINVAL;
2288         }
2289
2290         if (params->key_len == 0)
2291                 return brcmf_cfg80211_del_key(wiphy, ndev, key_idx, pairwise,
2292                                               mac_addr);
2293
2294         if (params->key_len > sizeof(key->data)) {
2295                 brcmf_err("Too long key length (%u)\n", params->key_len);
2296                 return -EINVAL;
2297         }
2298
2299         ext_key = false;
2300         if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2301             (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2302                 brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2303                 ext_key = true;
2304         }
2305
2306         key = &ifp->vif->profile.key[key_idx];
2307         memset(key, 0, sizeof(*key));
2308         if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2309                 memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2310         key->len = params->key_len;
2311         key->index = key_idx;
2312         memcpy(key->data, params->key, key->len);
2313         if (!ext_key)
2314                 key->flags = BRCMF_PRIMARY_KEY;
2315
2316         switch (params->cipher) {
2317         case WLAN_CIPHER_SUITE_WEP40:
2318                 key->algo = CRYPTO_ALGO_WEP1;
2319                 val = WEP_ENABLED;
2320                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2321                 break;
2322         case WLAN_CIPHER_SUITE_WEP104:
2323                 key->algo = CRYPTO_ALGO_WEP128;
2324                 val = WEP_ENABLED;
2325                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2326                 break;
2327         case WLAN_CIPHER_SUITE_TKIP:
2328                 if (!brcmf_is_apmode(ifp->vif)) {
2329                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2330                         memcpy(keybuf, &key->data[24], sizeof(keybuf));
2331                         memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2332                         memcpy(&key->data[16], keybuf, sizeof(keybuf));
2333                 }
2334                 key->algo = CRYPTO_ALGO_TKIP;
2335                 val = TKIP_ENABLED;
2336                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2337                 break;
2338         case WLAN_CIPHER_SUITE_AES_CMAC:
2339                 key->algo = CRYPTO_ALGO_AES_CCM;
2340                 val = AES_ENABLED;
2341                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2342                 break;
2343         case WLAN_CIPHER_SUITE_CCMP:
2344                 key->algo = CRYPTO_ALGO_AES_CCM;
2345                 val = AES_ENABLED;
2346                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2347                 break;
2348         default:
2349                 brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
2350                 err = -EINVAL;
2351                 goto done;
2352         }
2353
2354         err = send_key_to_dongle(ifp, key);
2355         if (ext_key || err)
2356                 goto done;
2357
2358         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2359         if (err) {
2360                 brcmf_err("get wsec error (%d)\n", err);
2361                 goto done;
2362         }
2363         wsec |= val;
2364         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2365         if (err) {
2366                 brcmf_err("set wsec error (%d)\n", err);
2367                 goto done;
2368         }
2369
2370 done:
2371         brcmf_dbg(TRACE, "Exit\n");
2372         return err;
2373 }
2374
2375 static s32
2376 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev, u8 key_idx,
2377                        bool pairwise, const u8 *mac_addr, void *cookie,
2378                        void (*callback)(void *cookie,
2379                                         struct key_params *params))
2380 {
2381         struct key_params params;
2382         struct brcmf_if *ifp = netdev_priv(ndev);
2383         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2384         struct brcmf_cfg80211_security *sec;
2385         s32 wsec;
2386         s32 err = 0;
2387
2388         brcmf_dbg(TRACE, "Enter\n");
2389         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2390         if (!check_vif_up(ifp->vif))
2391                 return -EIO;
2392
2393         memset(&params, 0, sizeof(params));
2394
2395         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2396         if (err) {
2397                 brcmf_err("WLC_GET_WSEC error (%d)\n", err);
2398                 /* Ignore this error, may happen during DISASSOC */
2399                 err = -EAGAIN;
2400                 goto done;
2401         }
2402         if (wsec & WEP_ENABLED) {
2403                 sec = &profile->sec;
2404                 if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2405                         params.cipher = WLAN_CIPHER_SUITE_WEP40;
2406                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2407                 } else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2408                         params.cipher = WLAN_CIPHER_SUITE_WEP104;
2409                         brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2410                 }
2411         } else if (wsec & TKIP_ENABLED) {
2412                 params.cipher = WLAN_CIPHER_SUITE_TKIP;
2413                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2414         } else if (wsec & AES_ENABLED) {
2415                 params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2416                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2417         } else  {
2418                 brcmf_err("Invalid algo (0x%x)\n", wsec);
2419                 err = -EINVAL;
2420                 goto done;
2421         }
2422         callback(cookie, &params);
2423
2424 done:
2425         brcmf_dbg(TRACE, "Exit\n");
2426         return err;
2427 }
2428
2429 static s32
2430 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2431                                        struct net_device *ndev, u8 key_idx)
2432 {
2433         struct brcmf_if *ifp = netdev_priv(ndev);
2434
2435         brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2436
2437         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2438                 return 0;
2439
2440         brcmf_dbg(INFO, "Not supported\n");
2441
2442         return -EOPNOTSUPP;
2443 }
2444
2445 static void
2446 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2447 {
2448         s32 err;
2449         u8 key_idx;
2450         struct brcmf_wsec_key *key;
2451         s32 wsec;
2452
2453         for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2454                 key = &ifp->vif->profile.key[key_idx];
2455                 if ((key->algo == CRYPTO_ALGO_WEP1) ||
2456                     (key->algo == CRYPTO_ALGO_WEP128))
2457                         break;
2458         }
2459         if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2460                 return;
2461
2462         err = send_key_to_dongle(ifp, key);
2463         if (err) {
2464                 brcmf_err("Setting WEP key failed (%d)\n", err);
2465                 return;
2466         }
2467         err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2468         if (err) {
2469                 brcmf_err("get wsec error (%d)\n", err);
2470                 return;
2471         }
2472         wsec |= WEP_ENABLED;
2473         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2474         if (err)
2475                 brcmf_err("set wsec error (%d)\n", err);
2476 }
2477
2478 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
2479 {
2480         struct nl80211_sta_flag_update *sfu;
2481
2482         brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
2483         si->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
2484         sfu = &si->sta_flags;
2485         sfu->mask = BIT(NL80211_STA_FLAG_WME) |
2486                     BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2487                     BIT(NL80211_STA_FLAG_ASSOCIATED) |
2488                     BIT(NL80211_STA_FLAG_AUTHORIZED);
2489         if (fw_sta_flags & BRCMF_STA_WME)
2490                 sfu->set |= BIT(NL80211_STA_FLAG_WME);
2491         if (fw_sta_flags & BRCMF_STA_AUTHE)
2492                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
2493         if (fw_sta_flags & BRCMF_STA_ASSOC)
2494                 sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
2495         if (fw_sta_flags & BRCMF_STA_AUTHO)
2496                 sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
2497 }
2498
2499 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
2500 {
2501         struct {
2502                 __le32 len;
2503                 struct brcmf_bss_info_le bss_le;
2504         } *buf;
2505         u16 capability;
2506         int err;
2507
2508         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2509         if (!buf)
2510                 return;
2511
2512         buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
2513         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
2514                                      WL_BSS_INFO_MAX);
2515         if (err) {
2516                 brcmf_err("Failed to get bss info (%d)\n", err);
2517                 goto out_kfree;
2518         }
2519         si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
2520         si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
2521         si->bss_param.dtim_period = buf->bss_le.dtim_period;
2522         capability = le16_to_cpu(buf->bss_le.capability);
2523         if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
2524                 si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
2525         if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2526                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
2527         if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2528                 si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
2529
2530 out_kfree:
2531         kfree(buf);
2532 }
2533
2534 static s32
2535 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
2536                                 struct station_info *sinfo)
2537 {
2538         struct brcmf_scb_val_le scbval;
2539         struct brcmf_pktcnt_le pktcnt;
2540         s32 err;
2541         u32 rate;
2542         u32 rssi;
2543
2544         /* Get the current tx rate */
2545         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
2546         if (err < 0) {
2547                 brcmf_err("BRCMF_C_GET_RATE error (%d)\n", err);
2548                 return err;
2549         }
2550         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2551         sinfo->txrate.legacy = rate * 5;
2552
2553         memset(&scbval, 0, sizeof(scbval));
2554         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
2555                                      sizeof(scbval));
2556         if (err) {
2557                 brcmf_err("BRCMF_C_GET_RSSI error (%d)\n", err);
2558                 return err;
2559         }
2560         rssi = le32_to_cpu(scbval.val);
2561         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2562         sinfo->signal = rssi;
2563
2564         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
2565                                      sizeof(pktcnt));
2566         if (err) {
2567                 brcmf_err("BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
2568                 return err;
2569         }
2570         sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
2571                          BIT(NL80211_STA_INFO_RX_DROP_MISC) |
2572                          BIT(NL80211_STA_INFO_TX_PACKETS) |
2573                          BIT(NL80211_STA_INFO_TX_FAILED);
2574         sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
2575         sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
2576         sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
2577         sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
2578
2579         return 0;
2580 }
2581
2582 static s32
2583 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
2584                            const u8 *mac, struct station_info *sinfo)
2585 {
2586         struct brcmf_if *ifp = netdev_priv(ndev);
2587         struct brcmf_scb_val_le scb_val;
2588         s32 err = 0;
2589         struct brcmf_sta_info_le sta_info_le;
2590         u32 sta_flags;
2591         u32 is_tdls_peer;
2592         s32 total_rssi;
2593         s32 count_rssi;
2594         int rssi;
2595         u32 i;
2596
2597         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
2598         if (!check_vif_up(ifp->vif))
2599                 return -EIO;
2600
2601         if (brcmf_is_ibssmode(ifp->vif))
2602                 return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
2603
2604         memset(&sta_info_le, 0, sizeof(sta_info_le));
2605         memcpy(&sta_info_le, mac, ETH_ALEN);
2606         err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
2607                                        &sta_info_le,
2608                                        sizeof(sta_info_le));
2609         is_tdls_peer = !err;
2610         if (err) {
2611                 err = brcmf_fil_iovar_data_get(ifp, "sta_info",
2612                                                &sta_info_le,
2613                                                sizeof(sta_info_le));
2614                 if (err < 0) {
2615                         brcmf_err("GET STA INFO failed, %d\n", err);
2616                         goto done;
2617                 }
2618         }
2619         brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
2620         sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
2621         sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
2622         sta_flags = le32_to_cpu(sta_info_le.flags);
2623         brcmf_convert_sta_flags(sta_flags, sinfo);
2624         sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2625         if (is_tdls_peer)
2626                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
2627         else
2628                 sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
2629         if (sta_flags & BRCMF_STA_ASSOC) {
2630                 sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
2631                 sinfo->connected_time = le32_to_cpu(sta_info_le.in);
2632                 brcmf_fill_bss_param(ifp, sinfo);
2633         }
2634         if (sta_flags & BRCMF_STA_SCBSTATS) {
2635                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
2636                 sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
2637                 sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
2638                 sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
2639                 sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
2640                 sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
2641                 sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
2642                 sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
2643                 if (sinfo->tx_packets) {
2644                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
2645                         sinfo->txrate.legacy =
2646                                 le32_to_cpu(sta_info_le.tx_rate) / 100;
2647                 }
2648                 if (sinfo->rx_packets) {
2649                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
2650                         sinfo->rxrate.legacy =
2651                                 le32_to_cpu(sta_info_le.rx_rate) / 100;
2652                 }
2653                 if (le16_to_cpu(sta_info_le.ver) >= 4) {
2654                         sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES);
2655                         sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
2656                         sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES);
2657                         sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
2658                 }
2659                 total_rssi = 0;
2660                 count_rssi = 0;
2661                 for (i = 0; i < BRCMF_ANT_MAX; i++) {
2662                         if (sta_info_le.rssi[i]) {
2663                                 sinfo->chain_signal_avg[count_rssi] =
2664                                         sta_info_le.rssi[i];
2665                                 sinfo->chain_signal[count_rssi] =
2666                                         sta_info_le.rssi[i];
2667                                 total_rssi += sta_info_le.rssi[i];
2668                                 count_rssi++;
2669                         }
2670                 }
2671                 if (count_rssi) {
2672                         sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL);
2673                         sinfo->chains = count_rssi;
2674
2675                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2676                         total_rssi /= count_rssi;
2677                         sinfo->signal = total_rssi;
2678                 } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
2679                         &ifp->vif->sme_state)) {
2680                         memset(&scb_val, 0, sizeof(scb_val));
2681                         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
2682                                                      &scb_val, sizeof(scb_val));
2683                         if (err) {
2684                                 brcmf_err("Could not get rssi (%d)\n", err);
2685                                 goto done;
2686                         } else {
2687                                 rssi = le32_to_cpu(scb_val.val);
2688                                 sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
2689                                 sinfo->signal = rssi;
2690                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
2691                         }
2692                 }
2693         }
2694 done:
2695         brcmf_dbg(TRACE, "Exit\n");
2696         return err;
2697 }
2698
2699 static int
2700 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
2701                             int idx, u8 *mac, struct station_info *sinfo)
2702 {
2703         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2704         struct brcmf_if *ifp = netdev_priv(ndev);
2705         s32 err;
2706
2707         brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
2708
2709         if (idx == 0) {
2710                 cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
2711                 err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
2712                                              &cfg->assoclist,
2713                                              sizeof(cfg->assoclist));
2714                 if (err) {
2715                         brcmf_err("BRCMF_C_GET_ASSOCLIST unsupported, err=%d\n",
2716                                   err);
2717                         cfg->assoclist.count = 0;
2718                         return -EOPNOTSUPP;
2719                 }
2720         }
2721         if (idx < le32_to_cpu(cfg->assoclist.count)) {
2722                 memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
2723                 return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
2724         }
2725         return -ENOENT;
2726 }
2727
2728 static s32
2729 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
2730                            bool enabled, s32 timeout)
2731 {
2732         s32 pm;
2733         s32 err = 0;
2734         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2735         struct brcmf_if *ifp = netdev_priv(ndev);
2736
2737         brcmf_dbg(TRACE, "Enter\n");
2738
2739         /*
2740          * Powersave enable/disable request is coming from the
2741          * cfg80211 even before the interface is up. In that
2742          * scenario, driver will be storing the power save
2743          * preference in cfg struct to apply this to
2744          * FW later while initializing the dongle
2745          */
2746         cfg->pwr_save = enabled;
2747         if (!check_vif_up(ifp->vif)) {
2748
2749                 brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
2750                 goto done;
2751         }
2752
2753         pm = enabled ? PM_FAST : PM_OFF;
2754         /* Do not enable the power save after assoc if it is a p2p interface */
2755         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
2756                 brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
2757                 pm = PM_OFF;
2758         }
2759         brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
2760
2761         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
2762         if (err) {
2763                 if (err == -ENODEV)
2764                         brcmf_err("net_device is not ready yet\n");
2765                 else
2766                         brcmf_err("error (%d)\n", err);
2767         }
2768 done:
2769         brcmf_dbg(TRACE, "Exit\n");
2770         return err;
2771 }
2772
2773 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
2774                                    struct brcmf_bss_info_le *bi)
2775 {
2776         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2777         struct ieee80211_channel *notify_channel;
2778         struct cfg80211_bss *bss;
2779         struct ieee80211_supported_band *band;
2780         struct brcmu_chan ch;
2781         u16 channel;
2782         u32 freq;
2783         u16 notify_capability;
2784         u16 notify_interval;
2785         u8 *notify_ie;
2786         size_t notify_ielen;
2787         s32 notify_signal;
2788
2789         if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
2790                 brcmf_err("Bss info is larger than buffer. Discarding\n");
2791                 return 0;
2792         }
2793
2794         if (!bi->ctl_ch) {
2795                 ch.chspec = le16_to_cpu(bi->chanspec);
2796                 cfg->d11inf.decchspec(&ch);
2797                 bi->ctl_ch = ch.control_ch_num;
2798         }
2799         channel = bi->ctl_ch;
2800
2801         if (channel <= CH_MAX_2G_CHANNEL)
2802                 band = wiphy->bands[NL80211_BAND_2GHZ];
2803         else
2804                 band = wiphy->bands[NL80211_BAND_5GHZ];
2805
2806         freq = ieee80211_channel_to_frequency(channel, band->band);
2807         notify_channel = ieee80211_get_channel(wiphy, freq);
2808
2809         notify_capability = le16_to_cpu(bi->capability);
2810         notify_interval = le16_to_cpu(bi->beacon_period);
2811         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2812         notify_ielen = le32_to_cpu(bi->ie_length);
2813         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2814
2815         brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
2816         brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
2817         brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
2818         brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
2819         brcmf_dbg(CONN, "Signal: %d\n", notify_signal);
2820
2821         bss = cfg80211_inform_bss(wiphy, notify_channel,
2822                                   CFG80211_BSS_FTYPE_UNKNOWN,
2823                                   (const u8 *)bi->BSSID,
2824                                   0, notify_capability,
2825                                   notify_interval, notify_ie,
2826                                   notify_ielen, notify_signal,
2827                                   GFP_KERNEL);
2828
2829         if (!bss)
2830                 return -ENOMEM;
2831
2832         cfg80211_put_bss(wiphy, bss);
2833
2834         return 0;
2835 }
2836
2837 static struct brcmf_bss_info_le *
2838 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
2839 {
2840         if (bss == NULL)
2841                 return list->bss_info_le;
2842         return (struct brcmf_bss_info_le *)((unsigned long)bss +
2843                                             le32_to_cpu(bss->length));
2844 }
2845
2846 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
2847 {
2848         struct brcmf_scan_results *bss_list;
2849         struct brcmf_bss_info_le *bi = NULL;    /* must be initialized */
2850         s32 err = 0;
2851         int i;
2852
2853         bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
2854         if (bss_list->count != 0 &&
2855             bss_list->version != BRCMF_BSS_INFO_VERSION) {
2856                 brcmf_err("Version %d != WL_BSS_INFO_VERSION\n",
2857                           bss_list->version);
2858                 return -EOPNOTSUPP;
2859         }
2860         brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
2861         for (i = 0; i < bss_list->count; i++) {
2862                 bi = next_bss_le(bss_list, bi);
2863                 err = brcmf_inform_single_bss(cfg, bi);
2864                 if (err)
2865                         break;
2866         }
2867         return err;
2868 }
2869
2870 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
2871                              struct net_device *ndev, const u8 *bssid)
2872 {
2873         struct wiphy *wiphy = cfg_to_wiphy(cfg);
2874         struct ieee80211_channel *notify_channel;
2875         struct brcmf_bss_info_le *bi = NULL;
2876         struct ieee80211_supported_band *band;
2877         struct cfg80211_bss *bss;
2878         struct brcmu_chan ch;
2879         u8 *buf = NULL;
2880         s32 err = 0;
2881         u32 freq;
2882         u16 notify_capability;
2883         u16 notify_interval;
2884         u8 *notify_ie;
2885         size_t notify_ielen;
2886         s32 notify_signal;
2887
2888         brcmf_dbg(TRACE, "Enter\n");
2889
2890         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
2891         if (buf == NULL) {
2892                 err = -ENOMEM;
2893                 goto CleanUp;
2894         }
2895
2896         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
2897
2898         err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
2899                                      buf, WL_BSS_INFO_MAX);
2900         if (err) {
2901                 brcmf_err("WLC_GET_BSS_INFO failed: %d\n", err);
2902                 goto CleanUp;
2903         }
2904
2905         bi = (struct brcmf_bss_info_le *)(buf + 4);
2906
2907         ch.chspec = le16_to_cpu(bi->chanspec);
2908         cfg->d11inf.decchspec(&ch);
2909
2910         if (ch.band == BRCMU_CHAN_BAND_2G)
2911                 band = wiphy->bands[NL80211_BAND_2GHZ];
2912         else
2913                 band = wiphy->bands[NL80211_BAND_5GHZ];
2914
2915         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
2916         cfg->channel = freq;
2917         notify_channel = ieee80211_get_channel(wiphy, freq);
2918
2919         notify_capability = le16_to_cpu(bi->capability);
2920         notify_interval = le16_to_cpu(bi->beacon_period);
2921         notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
2922         notify_ielen = le32_to_cpu(bi->ie_length);
2923         notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
2924
2925         brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
2926         brcmf_dbg(CONN, "capability: %X\n", notify_capability);
2927         brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
2928         brcmf_dbg(CONN, "signal: %d\n", notify_signal);
2929
2930         bss = cfg80211_inform_bss(wiphy, notify_channel,
2931                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
2932                                   notify_capability, notify_interval,
2933                                   notify_ie, notify_ielen, notify_signal,
2934                                   GFP_KERNEL);
2935
2936         if (!bss) {
2937                 err = -ENOMEM;
2938                 goto CleanUp;
2939         }
2940
2941         cfg80211_put_bss(wiphy, bss);
2942
2943 CleanUp:
2944
2945         kfree(buf);
2946
2947         brcmf_dbg(TRACE, "Exit\n");
2948
2949         return err;
2950 }
2951
2952 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
2953                                  struct brcmf_if *ifp)
2954 {
2955         struct brcmf_bss_info_le *bi;
2956         const struct brcmf_tlv *tim;
2957         u16 beacon_interval;
2958         u8 dtim_period;
2959         size_t ie_len;
2960         u8 *ie;
2961         s32 err = 0;
2962
2963         brcmf_dbg(TRACE, "Enter\n");
2964         if (brcmf_is_ibssmode(ifp->vif))
2965                 return err;
2966
2967         *(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
2968         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
2969                                      cfg->extra_buf, WL_EXTRA_BUF_MAX);
2970         if (err) {
2971                 brcmf_err("Could not get bss info %d\n", err);
2972                 goto update_bss_info_out;
2973         }
2974
2975         bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
2976         err = brcmf_inform_single_bss(cfg, bi);
2977         if (err)
2978                 goto update_bss_info_out;
2979
2980         ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
2981         ie_len = le32_to_cpu(bi->ie_length);
2982         beacon_interval = le16_to_cpu(bi->beacon_period);
2983
2984         tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
2985         if (tim)
2986                 dtim_period = tim->data[1];
2987         else {
2988                 /*
2989                 * active scan was done so we could not get dtim
2990                 * information out of probe response.
2991                 * so we speficially query dtim information to dongle.
2992                 */
2993                 u32 var;
2994                 err = brcmf_fil_iovar_int_get(ifp, "dtim_assoc", &var);
2995                 if (err) {
2996                         brcmf_err("wl dtim_assoc failed (%d)\n", err);
2997                         goto update_bss_info_out;
2998                 }
2999                 dtim_period = (u8)var;
3000         }
3001
3002 update_bss_info_out:
3003         brcmf_dbg(TRACE, "Exit");
3004         return err;
3005 }
3006
3007 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3008 {
3009         struct escan_info *escan = &cfg->escan_info;
3010
3011         set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3012         if (cfg->scan_request) {
3013                 escan->escan_state = WL_ESCAN_STATE_IDLE;
3014                 brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3015         }
3016         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3017         clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3018 }
3019
3020 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3021 {
3022         struct brcmf_cfg80211_info *cfg =
3023                         container_of(work, struct brcmf_cfg80211_info,
3024                                      escan_timeout_work);
3025
3026         brcmf_inform_bss(cfg);
3027         brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3028 }
3029
3030 static void brcmf_escan_timeout(unsigned long data)
3031 {
3032         struct brcmf_cfg80211_info *cfg =
3033                         (struct brcmf_cfg80211_info *)data;
3034
3035         if (cfg->scan_request) {
3036                 brcmf_err("timer expired\n");
3037                 schedule_work(&cfg->escan_timeout_work);
3038         }
3039 }
3040
3041 static s32
3042 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3043                               struct brcmf_bss_info_le *bss,
3044                               struct brcmf_bss_info_le *bss_info_le)
3045 {
3046         struct brcmu_chan ch_bss, ch_bss_info_le;
3047
3048         ch_bss.chspec = le16_to_cpu(bss->chanspec);
3049         cfg->d11inf.decchspec(&ch_bss);
3050         ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3051         cfg->d11inf.decchspec(&ch_bss_info_le);
3052
3053         if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3054                 ch_bss.band == ch_bss_info_le.band &&
3055                 bss_info_le->SSID_len == bss->SSID_len &&
3056                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3057                 if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3058                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3059                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
3060                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3061
3062                         /* preserve max RSSI if the measurements are
3063                         * both on-channel or both off-channel
3064                         */
3065                         if (bss_info_rssi > bss_rssi)
3066                                 bss->RSSI = bss_info_le->RSSI;
3067                 } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3068                         (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3069                         /* preserve the on-channel rssi measurement
3070                         * if the new measurement is off channel
3071                         */
3072                         bss->RSSI = bss_info_le->RSSI;
3073                         bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3074                 }
3075                 return 1;
3076         }
3077         return 0;
3078 }
3079
3080 static s32
3081 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3082                              const struct brcmf_event_msg *e, void *data)
3083 {
3084         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3085         s32 status;
3086         struct brcmf_escan_result_le *escan_result_le;
3087         u32 escan_buflen;
3088         struct brcmf_bss_info_le *bss_info_le;
3089         struct brcmf_bss_info_le *bss = NULL;
3090         u32 bi_length;
3091         struct brcmf_scan_results *list;
3092         u32 i;
3093         bool aborted;
3094
3095         status = e->status;
3096
3097         if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3098                 brcmf_err("scan not ready, bsscfgidx=%d\n", ifp->bsscfgidx);
3099                 return -EPERM;
3100         }
3101
3102         if (status == BRCMF_E_STATUS_PARTIAL) {
3103                 brcmf_dbg(SCAN, "ESCAN Partial result\n");
3104                 if (e->datalen < sizeof(*escan_result_le)) {
3105                         brcmf_err("invalid event data length\n");
3106                         goto exit;
3107                 }
3108                 escan_result_le = (struct brcmf_escan_result_le *) data;
3109                 if (!escan_result_le) {
3110                         brcmf_err("Invalid escan result (NULL pointer)\n");
3111                         goto exit;
3112                 }
3113                 escan_buflen = le32_to_cpu(escan_result_le->buflen);
3114                 if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3115                     escan_buflen > e->datalen ||
3116                     escan_buflen < sizeof(*escan_result_le)) {
3117                         brcmf_err("Invalid escan buffer length: %d\n",
3118                                   escan_buflen);
3119                         goto exit;
3120                 }
3121                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3122                         brcmf_err("Invalid bss_count %d: ignoring\n",
3123                                   escan_result_le->bss_count);
3124                         goto exit;
3125                 }
3126                 bss_info_le = &escan_result_le->bss_info_le;
3127
3128                 if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3129                         goto exit;
3130
3131                 if (!cfg->scan_request) {
3132                         brcmf_dbg(SCAN, "result without cfg80211 request\n");
3133                         goto exit;
3134                 }
3135
3136                 bi_length = le32_to_cpu(bss_info_le->length);
3137                 if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
3138                         brcmf_err("Ignoring invalid bss_info length: %d\n",
3139                                   bi_length);
3140                         goto exit;
3141                 }
3142
3143                 if (!(cfg_to_wiphy(cfg)->interface_modes &
3144                                         BIT(NL80211_IFTYPE_ADHOC))) {
3145                         if (le16_to_cpu(bss_info_le->capability) &
3146                                                 WLAN_CAPABILITY_IBSS) {
3147                                 brcmf_err("Ignoring IBSS result\n");
3148                                 goto exit;
3149                         }
3150                 }
3151
3152                 list = (struct brcmf_scan_results *)
3153                                 cfg->escan_info.escan_buf;
3154                 if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3155                         brcmf_err("Buffer is too small: ignoring\n");
3156                         goto exit;
3157                 }
3158
3159                 for (i = 0; i < list->count; i++) {
3160                         bss = bss ? (struct brcmf_bss_info_le *)
3161                                 ((unsigned char *)bss +
3162                                 le32_to_cpu(bss->length)) : list->bss_info_le;
3163                         if (brcmf_compare_update_same_bss(cfg, bss,
3164                                                           bss_info_le))
3165                                 goto exit;
3166                 }
3167                 memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3168                        bi_length);
3169                 list->version = le32_to_cpu(bss_info_le->version);
3170                 list->buflen += bi_length;
3171                 list->count++;
3172         } else {
3173                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3174                 if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3175                         goto exit;
3176                 if (cfg->scan_request) {
3177                         brcmf_inform_bss(cfg);
3178                         aborted = status != BRCMF_E_STATUS_SUCCESS;
3179                         brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3180                 } else
3181                         brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3182                                   status);
3183         }
3184 exit:
3185         return 0;
3186 }
3187
3188 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3189 {
3190         brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3191                             brcmf_cfg80211_escan_handler);
3192         cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3193         /* Init scan_timeout timer */
3194         init_timer(&cfg->escan_timeout);
3195         cfg->escan_timeout.data = (unsigned long) cfg;
3196         cfg->escan_timeout.function = brcmf_escan_timeout;
3197         INIT_WORK(&cfg->escan_timeout_work,
3198                   brcmf_cfg80211_escan_timeout_worker);
3199 }
3200
3201 /* PFN result doesn't have all the info which are required by the supplicant
3202  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3203  * via wl_inform_single_bss in the required format. Escan does require the
3204  * scan request in the form of cfg80211_scan_request. For timebeing, create
3205  * cfg80211_scan_request one out of the received PNO event.
3206  */
3207 static s32
3208 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3209                                 const struct brcmf_event_msg *e, void *data)
3210 {
3211         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3212         struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3213         struct cfg80211_scan_request *request = NULL;
3214         struct cfg80211_ssid *ssid = NULL;
3215         struct ieee80211_channel *channel = NULL;
3216         struct wiphy *wiphy = cfg_to_wiphy(cfg);
3217         int err = 0;
3218         int channel_req = 0;
3219         int band = 0;
3220         struct brcmf_pno_scanresults_le *pfn_result;
3221         u32 result_count;
3222         u32 status;
3223         u32 datalen;
3224
3225         brcmf_dbg(SCAN, "Enter\n");
3226
3227         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3228                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3229                 return 0;
3230         }
3231
3232         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3233                 brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3234                 return 0;
3235         }
3236
3237         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3238         result_count = le32_to_cpu(pfn_result->count);
3239         status = le32_to_cpu(pfn_result->status);
3240
3241         /* PFN event is limited to fit 512 bytes so we may get
3242          * multiple NET_FOUND events. For now place a warning here.
3243          */
3244         WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3245         brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3246         if (result_count > 0) {
3247                 int i;
3248
3249                 data += sizeof(struct brcmf_pno_scanresults_le);
3250                 netinfo_start = (struct brcmf_pno_net_info_le *)data;
3251                 datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3252                 if (datalen < result_count * sizeof(*netinfo)) {
3253                         brcmf_err("insufficient event data\n");
3254                         goto out_err;
3255                 }
3256
3257                 request = kzalloc(sizeof(*request), GFP_KERNEL);
3258                 ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL);
3259                 channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL);
3260                 if (!request || !ssid || !channel) {
3261                         err = -ENOMEM;
3262                         goto out_err;
3263                 }
3264
3265                 request->wiphy = wiphy;
3266                 for (i = 0; i < result_count; i++) {
3267                         netinfo = &netinfo_start[i];
3268                         if (!netinfo) {
3269                                 brcmf_err("Invalid netinfo ptr. index: %d\n",
3270                                           i);
3271                                 err = -EINVAL;
3272                                 goto out_err;
3273                         }
3274
3275                         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3276                                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3277                         brcmf_dbg(SCAN, "SSID:%s Channel:%d\n",
3278                                   netinfo->SSID, netinfo->channel);
3279                         memcpy(ssid[i].ssid, netinfo->SSID, netinfo->SSID_len);
3280                         ssid[i].ssid_len = netinfo->SSID_len;
3281                         request->n_ssids++;
3282
3283                         channel_req = netinfo->channel;
3284                         if (channel_req <= CH_MAX_2G_CHANNEL)
3285                                 band = NL80211_BAND_2GHZ;
3286                         else
3287                                 band = NL80211_BAND_5GHZ;
3288                         channel[i].center_freq =
3289                                 ieee80211_channel_to_frequency(channel_req,
3290                                                                band);
3291                         channel[i].band = band;
3292                         channel[i].flags |= IEEE80211_CHAN_NO_HT40;
3293                         request->channels[i] = &channel[i];
3294                         request->n_channels++;
3295                 }
3296
3297                 /* assign parsed ssid array */
3298                 if (request->n_ssids)
3299                         request->ssids = &ssid[0];
3300
3301                 if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3302                         /* Abort any on-going scan */
3303                         brcmf_abort_scanning(cfg);
3304                 }
3305
3306                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3307                 cfg->escan_info.run = brcmf_run_escan;
3308                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
3309                 if (err) {
3310                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3311                         goto out_err;
3312                 }
3313                 cfg->sched_escan = true;
3314                 cfg->scan_request = request;
3315         } else {
3316                 brcmf_err("FALSE PNO Event. (pfn_count == 0)\n");
3317                 goto out_err;
3318         }
3319
3320         kfree(ssid);
3321         kfree(channel);
3322         kfree(request);
3323         return 0;
3324
3325 out_err:
3326         kfree(ssid);
3327         kfree(channel);
3328         kfree(request);
3329         cfg80211_sched_scan_stopped(wiphy);
3330         return err;
3331 }
3332
3333 static int brcmf_dev_pno_clean(struct net_device *ndev)
3334 {
3335         int ret;
3336
3337         /* Disable pfn */
3338         ret = brcmf_fil_iovar_int_set(netdev_priv(ndev), "pfn", 0);
3339         if (ret == 0) {
3340                 /* clear pfn */
3341                 ret = brcmf_fil_iovar_data_set(netdev_priv(ndev), "pfnclear",
3342                                                NULL, 0);
3343         }
3344         if (ret < 0)
3345                 brcmf_err("failed code %d\n", ret);
3346
3347         return ret;
3348 }
3349
3350 static int brcmf_dev_pno_config(struct brcmf_if *ifp,
3351                                 struct cfg80211_sched_scan_request *request)
3352 {
3353         struct brcmf_pno_param_le pfn_param;
3354         struct brcmf_pno_macaddr_le pfn_mac;
3355         s32 err;
3356         u8 *mac_mask;
3357         int i;
3358
3359         memset(&pfn_param, 0, sizeof(pfn_param));
3360         pfn_param.version = cpu_to_le32(BRCMF_PNO_VERSION);
3361
3362         /* set extra pno params */
3363         pfn_param.flags = cpu_to_le16(1 << BRCMF_PNO_ENABLE_ADAPTSCAN_BIT);
3364         pfn_param.repeat = BRCMF_PNO_REPEAT;
3365         pfn_param.exp = BRCMF_PNO_FREQ_EXPO_MAX;
3366
3367         /* set up pno scan fr */
3368         pfn_param.scan_freq = cpu_to_le32(BRCMF_PNO_TIME);
3369
3370         err = brcmf_fil_iovar_data_set(ifp, "pfn_set", &pfn_param,
3371                                        sizeof(pfn_param));
3372         if (err) {
3373                 brcmf_err("pfn_set failed, err=%d\n", err);
3374                 return err;
3375         }
3376
3377         /* Find out if mac randomization should be turned on */
3378         if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR))
3379                 return 0;
3380
3381         pfn_mac.version = BRCMF_PFN_MACADDR_CFG_VER;
3382         pfn_mac.flags = BRCMF_PFN_MAC_OUI_ONLY | BRCMF_PFN_SET_MAC_UNASSOC;
3383
3384         memcpy(pfn_mac.mac, request->mac_addr, ETH_ALEN);
3385         mac_mask = request->mac_addr_mask;
3386         for (i = 0; i < ETH_ALEN; i++) {
3387                 pfn_mac.mac[i] &= mac_mask[i];
3388                 pfn_mac.mac[i] |= get_random_int() & ~(mac_mask[i]);
3389         }
3390         /* Clear multi bit */
3391         pfn_mac.mac[0] &= 0xFE;
3392         /* Set locally administered */
3393         pfn_mac.mac[0] |= 0x02;
3394
3395         err = brcmf_fil_iovar_data_set(ifp, "pfn_macaddr", &pfn_mac,
3396                                        sizeof(pfn_mac));
3397         if (err)
3398                 brcmf_err("pfn_macaddr failed, err=%d\n", err);
3399
3400         return err;
3401 }
3402
3403 static int
3404 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3405                                 struct net_device *ndev,
3406                                 struct cfg80211_sched_scan_request *request)
3407 {
3408         struct brcmf_if *ifp = netdev_priv(ndev);
3409         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
3410         struct brcmf_pno_net_param_le pfn;
3411         int i;
3412         int ret = 0;
3413
3414         brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
3415                   request->n_match_sets, request->n_ssids);
3416         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3417                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
3418                 return -EAGAIN;
3419         }
3420         if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3421                 brcmf_err("Scanning suppressed: status (%lu)\n",
3422                           cfg->scan_status);
3423                 return -EAGAIN;
3424         }
3425
3426         if (!request->n_ssids || !request->n_match_sets) {
3427                 brcmf_dbg(SCAN, "Invalid sched scan req!! n_ssids:%d\n",
3428                           request->n_ssids);
3429                 return -EINVAL;
3430         }
3431
3432         if (request->n_ssids > 0) {
3433                 for (i = 0; i < request->n_ssids; i++) {
3434                         /* Active scan req for ssids */
3435                         brcmf_dbg(SCAN, ">>> Active scan req for ssid (%s)\n",
3436                                   request->ssids[i].ssid);
3437
3438                         /* match_set ssids is a supert set of n_ssid list,
3439                          * so we need not add these set separately.
3440                          */
3441                 }
3442         }
3443
3444         if (request->n_match_sets > 0) {
3445                 /* clean up everything */
3446                 ret = brcmf_dev_pno_clean(ndev);
3447                 if  (ret < 0) {
3448                         brcmf_err("failed error=%d\n", ret);
3449                         return ret;
3450                 }
3451
3452                 /* configure pno */
3453                 if (brcmf_dev_pno_config(ifp, request))
3454                         return -EINVAL;
3455
3456                 /* configure each match set */
3457                 for (i = 0; i < request->n_match_sets; i++) {
3458                         struct cfg80211_ssid *ssid;
3459                         u32 ssid_len;
3460
3461                         ssid = &request->match_sets[i].ssid;
3462                         ssid_len = ssid->ssid_len;
3463
3464                         if (!ssid_len) {
3465                                 brcmf_err("skip broadcast ssid\n");
3466                                 continue;
3467                         }
3468                         pfn.auth = cpu_to_le32(WLAN_AUTH_OPEN);
3469                         pfn.wpa_auth = cpu_to_le32(BRCMF_PNO_WPA_AUTH_ANY);
3470                         pfn.wsec = cpu_to_le32(0);
3471                         pfn.infra = cpu_to_le32(1);
3472                         pfn.flags = cpu_to_le32(1 << BRCMF_PNO_HIDDEN_BIT);
3473                         pfn.ssid.SSID_len = cpu_to_le32(ssid_len);
3474                         memcpy(pfn.ssid.SSID, ssid->ssid, ssid_len);
3475                         ret = brcmf_fil_iovar_data_set(ifp, "pfn_add", &pfn,
3476                                                        sizeof(pfn));
3477                         brcmf_dbg(SCAN, ">>> PNO filter %s for ssid (%s)\n",
3478                                   ret == 0 ? "set" : "failed", ssid->ssid);
3479                 }
3480                 /* Enable the PNO */
3481                 if (brcmf_fil_iovar_int_set(ifp, "pfn", 1) < 0) {
3482                         brcmf_err("PNO enable failed!! ret=%d\n", ret);
3483                         return -EINVAL;
3484                 }
3485         } else {
3486                 return -EINVAL;
3487         }
3488
3489         return 0;
3490 }
3491
3492 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3493                                           struct net_device *ndev)
3494 {
3495         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3496
3497         brcmf_dbg(SCAN, "enter\n");
3498         brcmf_dev_pno_clean(ndev);
3499         if (cfg->sched_escan)
3500                 brcmf_notify_escan_complete(cfg, netdev_priv(ndev), true, true);
3501         return 0;
3502 }
3503
3504 static __always_inline void brcmf_delay(u32 ms)
3505 {
3506         if (ms < 1000 / HZ) {
3507                 cond_resched();
3508                 mdelay(ms);
3509         } else {
3510                 msleep(ms);
3511         }
3512 }
3513
3514 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3515                                      u8 *pattern, u32 patternsize, u8 *mask,
3516                                      u32 packet_offset)
3517 {
3518         struct brcmf_fil_wowl_pattern_le *filter;
3519         u32 masksize;
3520         u32 patternoffset;
3521         u8 *buf;
3522         u32 bufsize;
3523         s32 ret;
3524
3525         masksize = (patternsize + 7) / 8;
3526         patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3527
3528         bufsize = sizeof(*filter) + patternsize + masksize;
3529         buf = kzalloc(bufsize, GFP_KERNEL);
3530         if (!buf)
3531                 return -ENOMEM;
3532         filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3533
3534         memcpy(filter->cmd, cmd, 4);
3535         filter->masksize = cpu_to_le32(masksize);
3536         filter->offset = cpu_to_le32(packet_offset);
3537         filter->patternoffset = cpu_to_le32(patternoffset);
3538         filter->patternsize = cpu_to_le32(patternsize);
3539         filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
3540
3541         if ((mask) && (masksize))
3542                 memcpy(buf + sizeof(*filter), mask, masksize);
3543         if ((pattern) && (patternsize))
3544                 memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
3545
3546         ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
3547
3548         kfree(buf);
3549         return ret;
3550 }
3551
3552 static s32
3553 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
3554                       void *data)
3555 {
3556         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3557         struct brcmf_pno_scanresults_le *pfn_result;
3558         struct brcmf_pno_net_info_le *netinfo;
3559
3560         brcmf_dbg(SCAN, "Enter\n");
3561
3562         if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3563                 brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3564                 return 0;
3565         }
3566
3567         pfn_result = (struct brcmf_pno_scanresults_le *)data;
3568
3569         if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3570                 brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
3571                 return 0;
3572         }
3573
3574         if (le32_to_cpu(pfn_result->count) < 1) {
3575                 brcmf_err("Invalid result count, expected 1 (%d)\n",
3576                           le32_to_cpu(pfn_result->count));
3577                 return -EINVAL;
3578         }
3579
3580         data += sizeof(struct brcmf_pno_scanresults_le);
3581         netinfo = (struct brcmf_pno_net_info_le *)data;
3582         if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3583                 netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3584         memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
3585         cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
3586         cfg->wowl.nd->n_channels = 1;
3587         cfg->wowl.nd->channels[0] =
3588                 ieee80211_channel_to_frequency(netinfo->channel,
3589                         netinfo->channel <= CH_MAX_2G_CHANNEL ?
3590                                         NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
3591         cfg->wowl.nd_info->n_matches = 1;
3592         cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
3593
3594         /* Inform (the resume task) that the net detect information was recvd */
3595         cfg->wowl.nd_data_completed = true;
3596         wake_up(&cfg->wowl.nd_data_wait);
3597
3598         return 0;
3599 }
3600
3601 #ifdef CONFIG_PM
3602
3603 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3604 {
3605         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3606         struct brcmf_wowl_wakeind_le wake_ind_le;
3607         struct cfg80211_wowlan_wakeup wakeup_data;
3608         struct cfg80211_wowlan_wakeup *wakeup;
3609         u32 wakeind;
3610         s32 err;
3611         int timeout;
3612
3613         err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
3614                                        sizeof(wake_ind_le));
3615         if (err) {
3616                 brcmf_err("Get wowl_wakeind failed, err = %d\n", err);
3617                 return;
3618         }
3619
3620         wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
3621         if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
3622                        BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
3623                        BRCMF_WOWL_PFN_FOUND)) {
3624                 wakeup = &wakeup_data;
3625                 memset(&wakeup_data, 0, sizeof(wakeup_data));
3626                 wakeup_data.pattern_idx = -1;
3627
3628                 if (wakeind & BRCMF_WOWL_MAGIC) {
3629                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
3630                         wakeup_data.magic_pkt = true;
3631                 }
3632                 if (wakeind & BRCMF_WOWL_DIS) {
3633                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
3634                         wakeup_data.disconnect = true;
3635                 }
3636                 if (wakeind & BRCMF_WOWL_BCN) {
3637                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
3638                         wakeup_data.disconnect = true;
3639                 }
3640                 if (wakeind & BRCMF_WOWL_RETR) {
3641                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
3642                         wakeup_data.disconnect = true;
3643                 }
3644                 if (wakeind & BRCMF_WOWL_NET) {
3645                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
3646                         /* For now always map to pattern 0, no API to get
3647                          * correct information available at the moment.
3648                          */
3649                         wakeup_data.pattern_idx = 0;
3650                 }
3651                 if (wakeind & BRCMF_WOWL_PFN_FOUND) {
3652                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
3653                         timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
3654                                 cfg->wowl.nd_data_completed,
3655                                 BRCMF_ND_INFO_TIMEOUT);
3656                         if (!timeout)
3657                                 brcmf_err("No result for wowl net detect\n");
3658                         else
3659                                 wakeup_data.net_detect = cfg->wowl.nd_info;
3660                 }
3661                 if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
3662                         brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
3663                         wakeup_data.gtk_rekey_failure = true;
3664                 }
3665         } else {
3666                 wakeup = NULL;
3667         }
3668         cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
3669 }
3670
3671 #else
3672
3673 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
3674 {
3675 }
3676
3677 #endif /* CONFIG_PM */
3678
3679 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
3680 {
3681         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3682         struct net_device *ndev = cfg_to_ndev(cfg);
3683         struct brcmf_if *ifp = netdev_priv(ndev);
3684
3685         brcmf_dbg(TRACE, "Enter\n");
3686
3687         if (cfg->wowl.active) {
3688                 brcmf_report_wowl_wakeind(wiphy, ifp);
3689                 brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
3690                 brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
3691                 if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3692                         brcmf_configure_arp_nd_offload(ifp, true);
3693                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
3694                                       cfg->wowl.pre_pmmode);
3695                 cfg->wowl.active = false;
3696                 if (cfg->wowl.nd_enabled) {
3697                         brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev);
3698                         brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3699                         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3700                                             brcmf_notify_sched_scan_results);
3701                         cfg->wowl.nd_enabled = false;
3702                 }
3703         }
3704         return 0;
3705 }
3706
3707 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
3708                                  struct brcmf_if *ifp,
3709                                  struct cfg80211_wowlan *wowl)
3710 {
3711         u32 wowl_config;
3712         struct brcmf_wowl_wakeind_le wowl_wakeind;
3713         u32 i;
3714
3715         brcmf_dbg(TRACE, "Suspend, wowl config.\n");
3716
3717         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
3718                 brcmf_configure_arp_nd_offload(ifp, false);
3719         brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
3720         brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
3721
3722         wowl_config = 0;
3723         if (wowl->disconnect)
3724                 wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
3725         if (wowl->magic_pkt)
3726                 wowl_config |= BRCMF_WOWL_MAGIC;
3727         if ((wowl->patterns) && (wowl->n_patterns)) {
3728                 wowl_config |= BRCMF_WOWL_NET;
3729                 for (i = 0; i < wowl->n_patterns; i++) {
3730                         brcmf_config_wowl_pattern(ifp, "add",
3731                                 (u8 *)wowl->patterns[i].pattern,
3732                                 wowl->patterns[i].pattern_len,
3733                                 (u8 *)wowl->patterns[i].mask,
3734                                 wowl->patterns[i].pkt_offset);
3735                 }
3736         }
3737         if (wowl->nd_config) {
3738                 brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
3739                                                 wowl->nd_config);
3740                 wowl_config |= BRCMF_WOWL_PFN_FOUND;
3741
3742                 cfg->wowl.nd_data_completed = false;
3743                 cfg->wowl.nd_enabled = true;
3744                 /* Now reroute the event for PFN to the wowl function. */
3745                 brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
3746                 brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
3747                                     brcmf_wowl_nd_results);
3748         }
3749         if (wowl->gtk_rekey_failure)
3750                 wowl_config |= BRCMF_WOWL_GTK_FAILURE;
3751         if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
3752                 wowl_config |= BRCMF_WOWL_UNASSOC;
3753
3754         memcpy(&wowl_wakeind, "clear", 6);
3755         brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
3756                                  sizeof(wowl_wakeind));
3757         brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
3758         brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
3759         brcmf_bus_wowl_config(cfg->pub->bus_if, true);
3760         cfg->wowl.active = true;
3761 }
3762
3763 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
3764                                   struct cfg80211_wowlan *wowl)
3765 {
3766         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3767         struct net_device *ndev = cfg_to_ndev(cfg);
3768         struct brcmf_if *ifp = netdev_priv(ndev);
3769         struct brcmf_cfg80211_vif *vif;
3770
3771         brcmf_dbg(TRACE, "Enter\n");
3772
3773         /* if the primary net_device is not READY there is nothing
3774          * we can do but pray resume goes smoothly.
3775          */
3776         if (!check_vif_up(ifp->vif))
3777                 goto exit;
3778
3779         /* Stop scheduled scan */
3780         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
3781                 brcmf_cfg80211_sched_scan_stop(wiphy, ndev);
3782
3783         /* end any scanning */
3784         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
3785                 brcmf_abort_scanning(cfg);
3786
3787         if (wowl == NULL) {
3788                 brcmf_bus_wowl_config(cfg->pub->bus_if, false);
3789                 list_for_each_entry(vif, &cfg->vif_list, list) {
3790                         if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
3791                                 continue;
3792                         /* While going to suspend if associated with AP
3793                          * disassociate from AP to save power while system is
3794                          * in suspended state
3795                          */
3796                         brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
3797                         /* Make sure WPA_Supplicant receives all the event
3798                          * generated due to DISASSOC call to the fw to keep
3799                          * the state fw and WPA_Supplicant state consistent
3800                          */
3801                         brcmf_delay(500);
3802                 }
3803                 /* Configure MPC */
3804                 brcmf_set_mpc(ifp, 1);
3805
3806         } else {
3807                 /* Configure WOWL paramaters */
3808                 brcmf_configure_wowl(cfg, ifp, wowl);
3809         }
3810
3811 exit:
3812         brcmf_dbg(TRACE, "Exit\n");
3813         /* clear any scanning activity */
3814         cfg->scan_status = 0;
3815         return 0;
3816 }
3817
3818 static __used s32
3819 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
3820 {
3821         struct brcmf_pmk_list_le *pmk_list;
3822         int i;
3823         u32 npmk;
3824         s32 err;
3825
3826         pmk_list = &cfg->pmk_list;
3827         npmk = le32_to_cpu(pmk_list->npmk);
3828
3829         brcmf_dbg(CONN, "No of elements %d\n", npmk);
3830         for (i = 0; i < npmk; i++)
3831                 brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
3832
3833         err = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
3834                                        sizeof(*pmk_list));
3835
3836         return err;
3837 }
3838
3839 static s32
3840 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3841                          struct cfg80211_pmksa *pmksa)
3842 {
3843         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3844         struct brcmf_if *ifp = netdev_priv(ndev);
3845         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3846         s32 err;
3847         u32 npmk, i;
3848
3849         brcmf_dbg(TRACE, "Enter\n");
3850         if (!check_vif_up(ifp->vif))
3851                 return -EIO;
3852
3853         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3854         for (i = 0; i < npmk; i++)
3855                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3856                         break;
3857         if (i < BRCMF_MAXPMKID) {
3858                 memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
3859                 memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
3860                 if (i == npmk) {
3861                         npmk++;
3862                         cfg->pmk_list.npmk = cpu_to_le32(npmk);
3863                 }
3864         } else {
3865                 brcmf_err("Too many PMKSA entries cached %d\n", npmk);
3866                 return -EINVAL;
3867         }
3868
3869         brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmk[npmk].bssid);
3870         for (i = 0; i < WLAN_PMKID_LEN; i += 4)
3871                 brcmf_dbg(CONN, "%02x %02x %02x %02x\n", pmk[npmk].pmkid[i],
3872                           pmk[npmk].pmkid[i + 1], pmk[npmk].pmkid[i + 2],
3873                           pmk[npmk].pmkid[i + 3]);
3874
3875         err = brcmf_update_pmklist(cfg, ifp);
3876
3877         brcmf_dbg(TRACE, "Exit\n");
3878         return err;
3879 }
3880
3881 static s32
3882 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
3883                          struct cfg80211_pmksa *pmksa)
3884 {
3885         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3886         struct brcmf_if *ifp = netdev_priv(ndev);
3887         struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
3888         s32 err;
3889         u32 npmk, i;
3890
3891         brcmf_dbg(TRACE, "Enter\n");
3892         if (!check_vif_up(ifp->vif))
3893                 return -EIO;
3894
3895         brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
3896
3897         npmk = le32_to_cpu(cfg->pmk_list.npmk);
3898         for (i = 0; i < npmk; i++)
3899                 if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
3900                         break;
3901
3902         if ((npmk > 0) && (i < npmk)) {
3903                 for (; i < (npmk - 1); i++) {
3904                         memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
3905                         memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
3906                                WLAN_PMKID_LEN);
3907                 }
3908                 memset(&pmk[i], 0, sizeof(*pmk));
3909                 cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
3910         } else {
3911                 brcmf_err("Cache entry not found\n");
3912                 return -EINVAL;
3913         }
3914
3915         err = brcmf_update_pmklist(cfg, ifp);
3916
3917         brcmf_dbg(TRACE, "Exit\n");
3918         return err;
3919
3920 }
3921
3922 static s32
3923 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
3924 {
3925         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3926         struct brcmf_if *ifp = netdev_priv(ndev);
3927         s32 err;
3928
3929         brcmf_dbg(TRACE, "Enter\n");
3930         if (!check_vif_up(ifp->vif))
3931                 return -EIO;
3932
3933         memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
3934         err = brcmf_update_pmklist(cfg, ifp);
3935
3936         brcmf_dbg(TRACE, "Exit\n");
3937         return err;
3938
3939 }
3940
3941 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
3942 {
3943         s32 err;
3944
3945         /* set auth */
3946         err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
3947         if (err < 0) {
3948                 brcmf_err("auth error %d\n", err);
3949                 return err;
3950         }
3951         /* set wsec */
3952         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
3953         if (err < 0) {
3954                 brcmf_err("wsec error %d\n", err);
3955                 return err;
3956         }
3957         /* set upper-layer auth */
3958         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", WPA_AUTH_NONE);
3959         if (err < 0) {
3960                 brcmf_err("wpa_auth error %d\n", err);
3961                 return err;
3962         }
3963
3964         return 0;
3965 }
3966
3967 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
3968 {
3969         if (is_rsn_ie)
3970                 return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
3971
3972         return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
3973 }
3974
3975 static s32
3976 brcmf_configure_wpaie(struct brcmf_if *ifp,
3977                       const struct brcmf_vs_tlv *wpa_ie,
3978                       bool is_rsn_ie)
3979 {
3980         u32 auth = 0; /* d11 open authentication */
3981         u16 count;
3982         s32 err = 0;
3983         s32 len;
3984         u32 i;
3985         u32 wsec;
3986         u32 pval = 0;
3987         u32 gval = 0;
3988         u32 wpa_auth = 0;
3989         u32 offset;
3990         u8 *data;
3991         u16 rsn_cap;
3992         u32 wme_bss_disable;
3993         u32 mfp;
3994
3995         brcmf_dbg(TRACE, "Enter\n");
3996         if (wpa_ie == NULL)
3997                 goto exit;
3998
3999         len = wpa_ie->len + TLV_HDR_LEN;
4000         data = (u8 *)wpa_ie;
4001         offset = TLV_HDR_LEN;
4002         if (!is_rsn_ie)
4003                 offset += VS_IE_FIXED_HDR_LEN;
4004         else
4005                 offset += WPA_IE_VERSION_LEN;
4006
4007         /* check for multicast cipher suite */
4008         if (offset + WPA_IE_MIN_OUI_LEN > len) {
4009                 err = -EINVAL;
4010                 brcmf_err("no multicast cipher suite\n");
4011                 goto exit;
4012         }
4013
4014         if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4015                 err = -EINVAL;
4016                 brcmf_err("ivalid OUI\n");
4017                 goto exit;
4018         }
4019         offset += TLV_OUI_LEN;
4020
4021         /* pick up multicast cipher */
4022         switch (data[offset]) {
4023         case WPA_CIPHER_NONE:
4024                 gval = 0;
4025                 break;
4026         case WPA_CIPHER_WEP_40:
4027         case WPA_CIPHER_WEP_104:
4028                 gval = WEP_ENABLED;
4029                 break;
4030         case WPA_CIPHER_TKIP:
4031                 gval = TKIP_ENABLED;
4032                 break;
4033         case WPA_CIPHER_AES_CCM:
4034                 gval = AES_ENABLED;
4035                 break;
4036         default:
4037                 err = -EINVAL;
4038                 brcmf_err("Invalid multi cast cipher info\n");
4039                 goto exit;
4040         }
4041
4042         offset++;
4043         /* walk thru unicast cipher list and pick up what we recognize */
4044         count = data[offset] + (data[offset + 1] << 8);
4045         offset += WPA_IE_SUITE_COUNT_LEN;
4046         /* Check for unicast suite(s) */
4047         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4048                 err = -EINVAL;
4049                 brcmf_err("no unicast cipher suite\n");
4050                 goto exit;
4051         }
4052         for (i = 0; i < count; i++) {
4053                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4054                         err = -EINVAL;
4055                         brcmf_err("ivalid OUI\n");
4056                         goto exit;
4057                 }
4058                 offset += TLV_OUI_LEN;
4059                 switch (data[offset]) {
4060                 case WPA_CIPHER_NONE:
4061                         break;
4062                 case WPA_CIPHER_WEP_40:
4063                 case WPA_CIPHER_WEP_104:
4064                         pval |= WEP_ENABLED;
4065                         break;
4066                 case WPA_CIPHER_TKIP:
4067                         pval |= TKIP_ENABLED;
4068                         break;
4069                 case WPA_CIPHER_AES_CCM:
4070                         pval |= AES_ENABLED;
4071                         break;
4072                 default:
4073                         brcmf_err("Ivalid unicast security info\n");
4074                 }
4075                 offset++;
4076         }
4077         /* walk thru auth management suite list and pick up what we recognize */
4078         count = data[offset] + (data[offset + 1] << 8);
4079         offset += WPA_IE_SUITE_COUNT_LEN;
4080         /* Check for auth key management suite(s) */
4081         if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4082                 err = -EINVAL;
4083                 brcmf_err("no auth key mgmt suite\n");
4084                 goto exit;
4085         }
4086         for (i = 0; i < count; i++) {
4087                 if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4088                         err = -EINVAL;
4089                         brcmf_err("ivalid OUI\n");
4090                         goto exit;
4091                 }
4092                 offset += TLV_OUI_LEN;
4093                 switch (data[offset]) {
4094                 case RSN_AKM_NONE:
4095                         brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4096                         wpa_auth |= WPA_AUTH_NONE;
4097                         break;
4098                 case RSN_AKM_UNSPECIFIED:
4099                         brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4100                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4101                                     (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4102                         break;
4103                 case RSN_AKM_PSK:
4104                         brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4105                         is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4106                                     (wpa_auth |= WPA_AUTH_PSK);
4107                         break;
4108                 case RSN_AKM_SHA256_PSK:
4109                         brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4110                         wpa_auth |= WPA2_AUTH_PSK_SHA256;
4111                         break;
4112                 case RSN_AKM_SHA256_1X:
4113                         brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4114                         wpa_auth |= WPA2_AUTH_1X_SHA256;
4115                         break;
4116                 default:
4117                         brcmf_err("Ivalid key mgmt info\n");
4118                 }
4119                 offset++;
4120         }
4121
4122         mfp = BRCMF_MFP_NONE;
4123         if (is_rsn_ie) {
4124                 wme_bss_disable = 1;
4125                 if ((offset + RSN_CAP_LEN) <= len) {
4126                         rsn_cap = data[offset] + (data[offset + 1] << 8);
4127                         if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4128                                 wme_bss_disable = 0;
4129                         if (rsn_cap & RSN_CAP_MFPR_MASK) {
4130                                 brcmf_dbg(TRACE, "MFP Required\n");
4131                                 mfp = BRCMF_MFP_REQUIRED;
4132                                 /* Firmware only supports mfp required in
4133                                  * combination with WPA2_AUTH_PSK_SHA256 or
4134                                  * WPA2_AUTH_1X_SHA256.
4135                                  */
4136                                 if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4137                                                   WPA2_AUTH_1X_SHA256))) {
4138                                         err = -EINVAL;
4139                                         goto exit;
4140                                 }
4141                                 /* Firmware has requirement that WPA2_AUTH_PSK/
4142                                  * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4143                                  * is to be included in the rsn ie.
4144                                  */
4145                                 if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4146                                         wpa_auth |= WPA2_AUTH_PSK;
4147                                 else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4148                                         wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4149                         } else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4150                                 brcmf_dbg(TRACE, "MFP Capable\n");
4151                                 mfp = BRCMF_MFP_CAPABLE;
4152                         }
4153                 }
4154                 offset += RSN_CAP_LEN;
4155                 /* set wme_bss_disable to sync RSN Capabilities */
4156                 err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4157                                                wme_bss_disable);
4158                 if (err < 0) {
4159                         brcmf_err("wme_bss_disable error %d\n", err);
4160                         goto exit;
4161                 }
4162
4163                 /* Skip PMKID cnt as it is know to be 0 for AP. */
4164                 offset += RSN_PMKID_COUNT_LEN;
4165
4166                 /* See if there is BIP wpa suite left for MFP */
4167                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4168                     ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4169                         err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4170                                                         &data[offset],
4171                                                         WPA_IE_MIN_OUI_LEN);
4172                         if (err < 0) {
4173                                 brcmf_err("bip error %d\n", err);
4174                                 goto exit;
4175                         }
4176                 }
4177         }
4178         /* FOR WPS , set SES_OW_ENABLED */
4179         wsec = (pval | gval | SES_OW_ENABLED);
4180
4181         /* set auth */
4182         err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4183         if (err < 0) {
4184                 brcmf_err("auth error %d\n", err);
4185                 goto exit;
4186         }
4187         /* set wsec */
4188         err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4189         if (err < 0) {
4190                 brcmf_err("wsec error %d\n", err);
4191                 goto exit;
4192         }
4193         /* Configure MFP, this needs to go after wsec otherwise the wsec command
4194          * will overwrite the values set by MFP
4195          */
4196         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4197                 err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4198                 if (err < 0) {
4199                         brcmf_err("mfp error %d\n", err);
4200                         goto exit;
4201                 }
4202         }
4203         /* set upper-layer auth */
4204         err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4205         if (err < 0) {
4206                 brcmf_err("wpa_auth error %d\n", err);
4207                 goto exit;
4208         }
4209
4210 exit:
4211         return err;
4212 }
4213
4214 static s32
4215 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4216                      struct parsed_vndr_ies *vndr_ies)
4217 {
4218         struct brcmf_vs_tlv *vndrie;
4219         struct brcmf_tlv *ie;
4220         struct parsed_vndr_ie_info *parsed_info;
4221         s32 remaining_len;
4222
4223         remaining_len = (s32)vndr_ie_len;
4224         memset(vndr_ies, 0, sizeof(*vndr_ies));
4225
4226         ie = (struct brcmf_tlv *)vndr_ie_buf;
4227         while (ie) {
4228                 if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4229                         goto next;
4230                 vndrie = (struct brcmf_vs_tlv *)ie;
4231                 /* len should be bigger than OUI length + one */
4232                 if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4233                         brcmf_err("invalid vndr ie. length is too small %d\n",
4234                                   vndrie->len);
4235                         goto next;
4236                 }
4237                 /* if wpa or wme ie, do not add ie */
4238                 if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4239                     ((vndrie->oui_type == WPA_OUI_TYPE) ||
4240                     (vndrie->oui_type == WME_OUI_TYPE))) {
4241                         brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4242                         goto next;
4243                 }
4244
4245                 parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4246
4247                 /* save vndr ie information */
4248                 parsed_info->ie_ptr = (char *)vndrie;
4249                 parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4250                 memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4251
4252                 vndr_ies->count++;
4253
4254                 brcmf_dbg(TRACE, "** OUI %02x %02x %02x, type 0x%02x\n",
4255                           parsed_info->vndrie.oui[0],
4256                           parsed_info->vndrie.oui[1],
4257                           parsed_info->vndrie.oui[2],
4258                           parsed_info->vndrie.oui_type);
4259
4260                 if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4261                         break;
4262 next:
4263                 remaining_len -= (ie->len + TLV_HDR_LEN);
4264                 if (remaining_len <= TLV_HDR_LEN)
4265                         ie = NULL;
4266                 else
4267                         ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4268                                 TLV_HDR_LEN);
4269         }
4270         return 0;
4271 }
4272
4273 static u32
4274 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4275 {
4276
4277         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
4278         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
4279
4280         put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4281
4282         put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4283
4284         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4285
4286         return ie_len + VNDR_IE_HDR_SIZE;
4287 }
4288
4289 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4290                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
4291 {
4292         struct brcmf_if *ifp;
4293         struct vif_saved_ie *saved_ie;
4294         s32 err = 0;
4295         u8  *iovar_ie_buf;
4296         u8  *curr_ie_buf;
4297         u8  *mgmt_ie_buf = NULL;
4298         int mgmt_ie_buf_len;
4299         u32 *mgmt_ie_len;
4300         u32 del_add_ie_buf_len = 0;
4301         u32 total_ie_buf_len = 0;
4302         u32 parsed_ie_buf_len = 0;
4303         struct parsed_vndr_ies old_vndr_ies;
4304         struct parsed_vndr_ies new_vndr_ies;
4305         struct parsed_vndr_ie_info *vndrie_info;
4306         s32 i;
4307         u8 *ptr;
4308         int remained_buf_len;
4309
4310         if (!vif)
4311                 return -ENODEV;
4312         ifp = vif->ifp;
4313         saved_ie = &vif->saved_ie;
4314
4315         brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4316                   pktflag);
4317         iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4318         if (!iovar_ie_buf)
4319                 return -ENOMEM;
4320         curr_ie_buf = iovar_ie_buf;
4321         switch (pktflag) {
4322         case BRCMF_VNDR_IE_PRBREQ_FLAG:
4323                 mgmt_ie_buf = saved_ie->probe_req_ie;
4324                 mgmt_ie_len = &saved_ie->probe_req_ie_len;
4325                 mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4326                 break;
4327         case BRCMF_VNDR_IE_PRBRSP_FLAG:
4328                 mgmt_ie_buf = saved_ie->probe_res_ie;
4329                 mgmt_ie_len = &saved_ie->probe_res_ie_len;
4330                 mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4331                 break;
4332         case BRCMF_VNDR_IE_BEACON_FLAG:
4333                 mgmt_ie_buf = saved_ie->beacon_ie;
4334                 mgmt_ie_len = &saved_ie->beacon_ie_len;
4335                 mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4336                 break;
4337         case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4338                 mgmt_ie_buf = saved_ie->assoc_req_ie;
4339                 mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4340                 mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4341                 break;
4342         default:
4343                 err = -EPERM;
4344                 brcmf_err("not suitable type\n");
4345                 goto exit;
4346         }
4347
4348         if (vndr_ie_len > mgmt_ie_buf_len) {
4349                 err = -ENOMEM;
4350                 brcmf_err("extra IE size too big\n");
4351                 goto exit;
4352         }
4353
4354         /* parse and save new vndr_ie in curr_ie_buff before comparing it */
4355         if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4356                 ptr = curr_ie_buf;
4357                 brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4358                 for (i = 0; i < new_vndr_ies.count; i++) {
4359                         vndrie_info = &new_vndr_ies.ie_info[i];
4360                         memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4361                                vndrie_info->ie_len);
4362                         parsed_ie_buf_len += vndrie_info->ie_len;
4363                 }
4364         }
4365
4366         if (mgmt_ie_buf && *mgmt_ie_len) {
4367                 if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4368                     (memcmp(mgmt_ie_buf, curr_ie_buf,
4369                             parsed_ie_buf_len) == 0)) {
4370                         brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4371                         goto exit;
4372                 }
4373
4374                 /* parse old vndr_ie */
4375                 brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4376
4377                 /* make a command to delete old ie */
4378                 for (i = 0; i < old_vndr_ies.count; i++) {
4379                         vndrie_info = &old_vndr_ies.ie_info[i];
4380
4381                         brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%02x:%02x:%02x\n",
4382                                   vndrie_info->vndrie.id,
4383                                   vndrie_info->vndrie.len,
4384                                   vndrie_info->vndrie.oui[0],
4385                                   vndrie_info->vndrie.oui[1],
4386                                   vndrie_info->vndrie.oui[2]);
4387
4388                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4389                                                            vndrie_info->ie_ptr,
4390                                                            vndrie_info->ie_len,
4391                                                            "del");
4392                         curr_ie_buf += del_add_ie_buf_len;
4393                         total_ie_buf_len += del_add_ie_buf_len;
4394                 }
4395         }
4396
4397         *mgmt_ie_len = 0;
4398         /* Add if there is any extra IE */
4399         if (mgmt_ie_buf && parsed_ie_buf_len) {
4400                 ptr = mgmt_ie_buf;
4401
4402                 remained_buf_len = mgmt_ie_buf_len;
4403
4404                 /* make a command to add new ie */
4405                 for (i = 0; i < new_vndr_ies.count; i++) {
4406                         vndrie_info = &new_vndr_ies.ie_info[i];
4407
4408                         /* verify remained buf size before copy data */
4409                         if (remained_buf_len < (vndrie_info->vndrie.len +
4410                                                         VNDR_IE_VSIE_OFFSET)) {
4411                                 brcmf_err("no space in mgmt_ie_buf: len left %d",
4412                                           remained_buf_len);
4413                                 break;
4414                         }
4415                         remained_buf_len -= (vndrie_info->ie_len +
4416                                              VNDR_IE_VSIE_OFFSET);
4417
4418                         brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
4419                                   vndrie_info->vndrie.id,
4420                                   vndrie_info->vndrie.len,
4421                                   vndrie_info->vndrie.oui[0],
4422                                   vndrie_info->vndrie.oui[1],
4423                                   vndrie_info->vndrie.oui[2]);
4424
4425                         del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4426                                                            vndrie_info->ie_ptr,
4427                                                            vndrie_info->ie_len,
4428                                                            "add");
4429
4430                         /* save the parsed IE in wl struct */
4431                         memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4432                                vndrie_info->ie_len);
4433                         *mgmt_ie_len += vndrie_info->ie_len;
4434
4435                         curr_ie_buf += del_add_ie_buf_len;
4436                         total_ie_buf_len += del_add_ie_buf_len;
4437                 }
4438         }
4439         if (total_ie_buf_len) {
4440                 err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4441                                                  total_ie_buf_len);
4442                 if (err)
4443                         brcmf_err("vndr ie set error : %d\n", err);
4444         }
4445
4446 exit:
4447         kfree(iovar_ie_buf);
4448         return err;
4449 }
4450
4451 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4452 {
4453         s32 pktflags[] = {
4454                 BRCMF_VNDR_IE_PRBREQ_FLAG,
4455                 BRCMF_VNDR_IE_PRBRSP_FLAG,
4456                 BRCMF_VNDR_IE_BEACON_FLAG
4457         };
4458         int i;
4459
4460         for (i = 0; i < ARRAY_SIZE(pktflags); i++)
4461                 brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
4462
4463         memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
4464         return 0;
4465 }
4466
4467 static s32
4468 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
4469                         struct cfg80211_beacon_data *beacon)
4470 {
4471         s32 err;
4472
4473         /* Set Beacon IEs to FW */
4474         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
4475                                     beacon->tail, beacon->tail_len);
4476         if (err) {
4477                 brcmf_err("Set Beacon IE Failed\n");
4478                 return err;
4479         }
4480         brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
4481
4482         /* Set Probe Response IEs to FW */
4483         err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
4484                                     beacon->proberesp_ies,
4485                                     beacon->proberesp_ies_len);
4486         if (err)
4487                 brcmf_err("Set Probe Resp IE Failed\n");
4488         else
4489                 brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
4490
4491         return err;
4492 }
4493
4494 static s32
4495 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
4496                         struct cfg80211_ap_settings *settings)
4497 {
4498         s32 ie_offset;
4499         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4500         struct brcmf_if *ifp = netdev_priv(ndev);
4501         const struct brcmf_tlv *ssid_ie;
4502         const struct brcmf_tlv *country_ie;
4503         struct brcmf_ssid_le ssid_le;
4504         s32 err = -EPERM;
4505         const struct brcmf_tlv *rsn_ie;
4506         const struct brcmf_vs_tlv *wpa_ie;
4507         struct brcmf_join_params join_params;
4508         enum nl80211_iftype dev_role;
4509         struct brcmf_fil_bss_enable_le bss_enable;
4510         u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
4511         bool mbss;
4512         int is_11d;
4513         bool supports_11d;
4514
4515         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
4516                   settings->chandef.chan->hw_value,
4517                   settings->chandef.center_freq1, settings->chandef.width,
4518                   settings->beacon_interval, settings->dtim_period);
4519         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
4520                   settings->ssid, settings->ssid_len, settings->auth_type,
4521                   settings->inactivity_timeout);
4522         dev_role = ifp->vif->wdev.iftype;
4523         mbss = ifp->vif->mbss;
4524
4525         /* store current 11d setting */
4526         if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
4527                                   &ifp->vif->is_11d)) {
4528                 is_11d = supports_11d = false;
4529         } else {
4530                 country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4531                                               settings->beacon.tail_len,
4532                                               WLAN_EID_COUNTRY);
4533                 is_11d = country_ie ? 1 : 0;
4534                 supports_11d = true;
4535         }
4536
4537         memset(&ssid_le, 0, sizeof(ssid_le));
4538         if (settings->ssid == NULL || settings->ssid_len == 0) {
4539                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
4540                 ssid_ie = brcmf_parse_tlvs(
4541                                 (u8 *)&settings->beacon.head[ie_offset],
4542                                 settings->beacon.head_len - ie_offset,
4543                                 WLAN_EID_SSID);
4544                 if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
4545                         return -EINVAL;
4546
4547                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
4548                 ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
4549                 brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
4550         } else {
4551                 memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
4552                 ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
4553         }
4554
4555         if (!mbss) {
4556                 brcmf_set_mpc(ifp, 0);
4557                 brcmf_configure_arp_nd_offload(ifp, false);
4558         }
4559
4560         /* find the RSN_IE */
4561         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
4562                                   settings->beacon.tail_len, WLAN_EID_RSN);
4563
4564         /* find the WPA_IE */
4565         wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
4566                                   settings->beacon.tail_len);
4567
4568         if ((wpa_ie != NULL || rsn_ie != NULL)) {
4569                 brcmf_dbg(TRACE, "WPA(2) IE is found\n");
4570                 if (wpa_ie != NULL) {
4571                         /* WPA IE */
4572                         err = brcmf_configure_wpaie(ifp, wpa_ie, false);
4573                         if (err < 0)
4574                                 goto exit;
4575                 } else {
4576                         struct brcmf_vs_tlv *tmp_ie;
4577
4578                         tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
4579
4580                         /* RSN IE */
4581                         err = brcmf_configure_wpaie(ifp, tmp_ie, true);
4582                         if (err < 0)
4583                                 goto exit;
4584                 }
4585         } else {
4586                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
4587                 brcmf_configure_opensecurity(ifp);
4588         }
4589
4590         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
4591
4592         /* Parameters shared by all radio interfaces */
4593         if (!mbss) {
4594                 if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
4595                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4596                                                     is_11d);
4597                         if (err < 0) {
4598                                 brcmf_err("Regulatory Set Error, %d\n", err);
4599                                 goto exit;
4600                         }
4601                 }
4602                 if (settings->beacon_interval) {
4603                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
4604                                                     settings->beacon_interval);
4605                         if (err < 0) {
4606                                 brcmf_err("Beacon Interval Set Error, %d\n",
4607                                           err);
4608                                 goto exit;
4609                         }
4610                 }
4611                 if (settings->dtim_period) {
4612                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
4613                                                     settings->dtim_period);
4614                         if (err < 0) {
4615                                 brcmf_err("DTIM Interval Set Error, %d\n", err);
4616                                 goto exit;
4617                         }
4618                 }
4619
4620                 if ((dev_role == NL80211_IFTYPE_AP) &&
4621                     ((ifp->ifidx == 0) ||
4622                      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB))) {
4623                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4624                         if (err < 0) {
4625                                 brcmf_err("BRCMF_C_DOWN error %d\n", err);
4626                                 goto exit;
4627                         }
4628                         brcmf_fil_iovar_int_set(ifp, "apsta", 0);
4629                 }
4630
4631                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
4632                 if (err < 0) {
4633                         brcmf_err("SET INFRA error %d\n", err);
4634                         goto exit;
4635                 }
4636         } else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
4637                 /* Multiple-BSS should use same 11d configuration */
4638                 err = -EINVAL;
4639                 goto exit;
4640         }
4641
4642         /* Interface specific setup */
4643         if (dev_role == NL80211_IFTYPE_AP) {
4644                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
4645                         brcmf_fil_iovar_int_set(ifp, "mbss", 1);
4646
4647                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
4648                 if (err < 0) {
4649                         brcmf_err("setting AP mode failed %d\n", err);
4650                         goto exit;
4651                 }
4652                 if (!mbss) {
4653                         /* Firmware 10.x requires setting channel after enabling
4654                          * AP and before bringing interface up.
4655                          */
4656                         err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4657                         if (err < 0) {
4658                                 brcmf_err("Set Channel failed: chspec=%d, %d\n",
4659                                           chanspec, err);
4660                                 goto exit;
4661                         }
4662                 }
4663                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4664                 if (err < 0) {
4665                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
4666                         goto exit;
4667                 }
4668                 /* On DOWN the firmware removes the WEP keys, reconfigure
4669                  * them if they were set.
4670                  */
4671                 brcmf_cfg80211_reconfigure_wep(ifp);
4672
4673                 memset(&join_params, 0, sizeof(join_params));
4674                 /* join parameters starts with ssid */
4675                 memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
4676                 /* create softap */
4677                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4678                                              &join_params, sizeof(join_params));
4679                 if (err < 0) {
4680                         brcmf_err("SET SSID error (%d)\n", err);
4681                         goto exit;
4682                 }
4683
4684                 if (settings->hidden_ssid) {
4685                         err = brcmf_fil_iovar_int_set(ifp, "closednet", 1);
4686                         if (err) {
4687                                 brcmf_err("closednet error (%d)\n", err);
4688                                 goto exit;
4689                         }
4690                 }
4691
4692                 brcmf_dbg(TRACE, "AP mode configuration complete\n");
4693         } else if (dev_role == NL80211_IFTYPE_P2P_GO) {
4694                 err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
4695                 if (err < 0) {
4696                         brcmf_err("Set Channel failed: chspec=%d, %d\n",
4697                                   chanspec, err);
4698                         goto exit;
4699                 }
4700                 err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
4701                                                 sizeof(ssid_le));
4702                 if (err < 0) {
4703                         brcmf_err("setting ssid failed %d\n", err);
4704                         goto exit;
4705                 }
4706                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4707                 bss_enable.enable = cpu_to_le32(1);
4708                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4709                                                sizeof(bss_enable));
4710                 if (err < 0) {
4711                         brcmf_err("bss_enable config failed %d\n", err);
4712                         goto exit;
4713                 }
4714
4715                 brcmf_dbg(TRACE, "GO mode configuration complete\n");
4716         } else {
4717                 WARN_ON(1);
4718         }
4719
4720         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4721         brcmf_net_setcarrier(ifp, true);
4722
4723 exit:
4724         if ((err) && (!mbss)) {
4725                 brcmf_set_mpc(ifp, 1);
4726                 brcmf_configure_arp_nd_offload(ifp, true);
4727         }
4728         return err;
4729 }
4730
4731 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
4732 {
4733         struct brcmf_if *ifp = netdev_priv(ndev);
4734         s32 err;
4735         struct brcmf_fil_bss_enable_le bss_enable;
4736         struct brcmf_join_params join_params;
4737
4738         brcmf_dbg(TRACE, "Enter\n");
4739
4740         if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
4741                 /* Due to most likely deauths outstanding we sleep */
4742                 /* first to make sure they get processed by fw. */
4743                 msleep(400);
4744
4745                 if (ifp->vif->mbss) {
4746                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4747                         return err;
4748                 }
4749
4750                 /* First BSS doesn't get a full reset */
4751                 if (ifp->bsscfgidx == 0)
4752                         brcmf_fil_iovar_int_set(ifp, "closednet", 0);
4753
4754                 memset(&join_params, 0, sizeof(join_params));
4755                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
4756                                              &join_params, sizeof(join_params));
4757                 if (err < 0)
4758                         brcmf_err("SET SSID error (%d)\n", err);
4759                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
4760                 if (err < 0)
4761                         brcmf_err("BRCMF_C_DOWN error %d\n", err);
4762                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
4763                 if (err < 0)
4764                         brcmf_err("setting AP mode failed %d\n", err);
4765                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
4766                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
4767                 brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
4768                                       ifp->vif->is_11d);
4769                 /* Bring device back up so it can be used again */
4770                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
4771                 if (err < 0)
4772                         brcmf_err("BRCMF_C_UP error %d\n", err);
4773         } else {
4774                 bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
4775                 bss_enable.enable = cpu_to_le32(0);
4776                 err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
4777                                                sizeof(bss_enable));
4778                 if (err < 0)
4779                         brcmf_err("bss_enable config failed %d\n", err);
4780         }
4781         brcmf_set_mpc(ifp, 1);
4782         brcmf_configure_arp_nd_offload(ifp, true);
4783         clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
4784         brcmf_net_setcarrier(ifp, false);
4785
4786         return err;
4787 }
4788
4789 static s32
4790 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
4791                              struct cfg80211_beacon_data *info)
4792 {
4793         struct brcmf_if *ifp = netdev_priv(ndev);
4794         s32 err;
4795
4796         brcmf_dbg(TRACE, "Enter\n");
4797
4798         err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
4799
4800         return err;
4801 }
4802
4803 static int
4804 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
4805                            struct station_del_parameters *params)
4806 {
4807         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4808         struct brcmf_scb_val_le scbval;
4809         struct brcmf_if *ifp = netdev_priv(ndev);
4810         s32 err;
4811
4812         if (!params->mac)
4813                 return -EFAULT;
4814
4815         brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
4816
4817         if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
4818                 ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
4819         if (!check_vif_up(ifp->vif))
4820                 return -EIO;
4821
4822         memcpy(&scbval.ea, params->mac, ETH_ALEN);
4823         scbval.val = cpu_to_le32(params->reason_code);
4824         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
4825                                      &scbval, sizeof(scbval));
4826         if (err)
4827                 brcmf_err("SCB_DEAUTHENTICATE_FOR_REASON failed %d\n", err);
4828
4829         brcmf_dbg(TRACE, "Exit\n");
4830         return err;
4831 }
4832
4833 static int
4834 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
4835                               const u8 *mac, struct station_parameters *params)
4836 {
4837         struct brcmf_if *ifp = netdev_priv(ndev);
4838         s32 err;
4839
4840         brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
4841                   params->sta_flags_mask, params->sta_flags_set);
4842
4843         /* Ignore all 00 MAC */
4844         if (is_zero_ether_addr(mac))
4845                 return 0;
4846
4847         if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4848                 return 0;
4849
4850         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
4851                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
4852                                              (void *)mac, ETH_ALEN);
4853         else
4854                 err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
4855                                              (void *)mac, ETH_ALEN);
4856         if (err < 0)
4857                 brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
4858
4859         return err;
4860 }
4861
4862 static void
4863 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
4864                                    struct wireless_dev *wdev,
4865                                    u16 frame_type, bool reg)
4866 {
4867         struct brcmf_cfg80211_vif *vif;
4868         u16 mgmt_type;
4869
4870         brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
4871
4872         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
4873         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4874         if (reg)
4875                 vif->mgmt_rx_reg |= BIT(mgmt_type);
4876         else
4877                 vif->mgmt_rx_reg &= ~BIT(mgmt_type);
4878 }
4879
4880
4881 static int
4882 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
4883                        struct cfg80211_mgmt_tx_params *params, u64 *cookie)
4884 {
4885         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4886         struct ieee80211_channel *chan = params->chan;
4887         const u8 *buf = params->buf;
4888         size_t len = params->len;
4889         const struct ieee80211_mgmt *mgmt;
4890         struct brcmf_cfg80211_vif *vif;
4891         s32 err = 0;
4892         s32 ie_offset;
4893         s32 ie_len;
4894         struct brcmf_fil_action_frame_le *action_frame;
4895         struct brcmf_fil_af_params_le *af_params;
4896         bool ack;
4897         s32 chan_nr;
4898         u32 freq;
4899
4900         brcmf_dbg(TRACE, "Enter\n");
4901
4902         *cookie = 0;
4903
4904         mgmt = (const struct ieee80211_mgmt *)buf;
4905
4906         if (!ieee80211_is_mgmt(mgmt->frame_control)) {
4907                 brcmf_err("Driver only allows MGMT packet type\n");
4908                 return -EPERM;
4909         }
4910
4911         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
4912
4913         if (ieee80211_is_probe_resp(mgmt->frame_control)) {
4914                 /* Right now the only reason to get a probe response */
4915                 /* is for p2p listen response or for p2p GO from     */
4916                 /* wpa_supplicant. Unfortunately the probe is send   */
4917                 /* on primary ndev, while dongle wants it on the p2p */
4918                 /* vif. Since this is only reason for a probe        */
4919                 /* response to be sent, the vif is taken from cfg.   */
4920                 /* If ever desired to send proberesp for non p2p     */
4921                 /* response then data should be checked for          */
4922                 /* "DIRECT-". Note in future supplicant will take    */
4923                 /* dedicated p2p wdev to do this and then this 'hack'*/
4924                 /* is not needed anymore.                            */
4925                 ie_offset =  DOT11_MGMT_HDR_LEN +
4926                              DOT11_BCN_PRB_FIXED_LEN;
4927                 ie_len = len - ie_offset;
4928                 if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
4929                         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
4930                 err = brcmf_vif_set_mgmt_ie(vif,
4931                                             BRCMF_VNDR_IE_PRBRSP_FLAG,
4932                                             &buf[ie_offset],
4933                                             ie_len);
4934                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
4935                                         GFP_KERNEL);
4936         } else if (ieee80211_is_action(mgmt->frame_control)) {
4937                 if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
4938                         brcmf_err("invalid action frame length\n");
4939                         err = -EINVAL;
4940                         goto exit;
4941                 }
4942                 af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
4943                 if (af_params == NULL) {
4944                         brcmf_err("unable to allocate frame\n");
4945                         err = -ENOMEM;
4946                         goto exit;
4947                 }
4948                 action_frame = &af_params->action_frame;
4949                 /* Add the packet Id */
4950                 action_frame->packet_id = cpu_to_le32(*cookie);
4951                 /* Add BSSID */
4952                 memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
4953                 memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
4954                 /* Add the length exepted for 802.11 header  */
4955                 action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
4956                 /* Add the channel. Use the one specified as parameter if any or
4957                  * the current one (got from the firmware) otherwise
4958                  */
4959                 if (chan)
4960                         freq = chan->center_freq;
4961                 else
4962                         brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
4963                                               &freq);
4964                 chan_nr = ieee80211_frequency_to_channel(freq);
4965                 af_params->channel = cpu_to_le32(chan_nr);
4966
4967                 memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
4968                        le16_to_cpu(action_frame->len));
4969
4970                 brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
4971                           *cookie, le16_to_cpu(action_frame->len), freq);
4972
4973                 ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
4974                                                   af_params);
4975
4976                 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
4977                                         GFP_KERNEL);
4978                 kfree(af_params);
4979         } else {
4980                 brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
4981                 brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
4982         }
4983
4984 exit:
4985         return err;
4986 }
4987
4988
4989 static int
4990 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
4991                                         struct wireless_dev *wdev,
4992                                         u64 cookie)
4993 {
4994         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4995         struct brcmf_cfg80211_vif *vif;
4996         int err = 0;
4997
4998         brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
4999
5000         vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5001         if (vif == NULL) {
5002                 brcmf_err("No p2p device available for probe response\n");
5003                 err = -ENODEV;
5004                 goto exit;
5005         }
5006         brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5007 exit:
5008         return err;
5009 }
5010
5011 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5012                                       struct wireless_dev *wdev,
5013                                       struct cfg80211_chan_def *chandef)
5014 {
5015         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5016         struct net_device *ndev = wdev->netdev;
5017         struct brcmf_if *ifp;
5018         struct brcmu_chan ch;
5019         enum nl80211_band band = 0;
5020         enum nl80211_chan_width width = 0;
5021         u32 chanspec;
5022         int freq, err;
5023
5024         if (!ndev)
5025                 return -ENODEV;
5026         ifp = netdev_priv(ndev);
5027
5028         err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
5029         if (err) {
5030                 brcmf_err("chanspec failed (%d)\n", err);
5031                 return err;
5032         }
5033
5034         ch.chspec = chanspec;
5035         cfg->d11inf.decchspec(&ch);
5036
5037         switch (ch.band) {
5038         case BRCMU_CHAN_BAND_2G:
5039                 band = NL80211_BAND_2GHZ;
5040                 break;
5041         case BRCMU_CHAN_BAND_5G:
5042                 band = NL80211_BAND_5GHZ;
5043                 break;
5044         }
5045
5046         switch (ch.bw) {
5047         case BRCMU_CHAN_BW_80:
5048                 width = NL80211_CHAN_WIDTH_80;
5049                 break;
5050         case BRCMU_CHAN_BW_40:
5051                 width = NL80211_CHAN_WIDTH_40;
5052                 break;
5053         case BRCMU_CHAN_BW_20:
5054                 width = NL80211_CHAN_WIDTH_20;
5055                 break;
5056         case BRCMU_CHAN_BW_80P80:
5057                 width = NL80211_CHAN_WIDTH_80P80;
5058                 break;
5059         case BRCMU_CHAN_BW_160:
5060                 width = NL80211_CHAN_WIDTH_160;
5061                 break;
5062         }
5063
5064         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5065         chandef->chan = ieee80211_get_channel(wiphy, freq);
5066         chandef->width = width;
5067         chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5068         chandef->center_freq2 = 0;
5069
5070         return 0;
5071 }
5072
5073 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5074                                            struct wireless_dev *wdev,
5075                                            enum nl80211_crit_proto_id proto,
5076                                            u16 duration)
5077 {
5078         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5079         struct brcmf_cfg80211_vif *vif;
5080
5081         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5082
5083         /* only DHCP support for now */
5084         if (proto != NL80211_CRIT_PROTO_DHCP)
5085                 return -EINVAL;
5086
5087         /* suppress and abort scanning */
5088         set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5089         brcmf_abort_scanning(cfg);
5090
5091         return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5092 }
5093
5094 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5095                                            struct wireless_dev *wdev)
5096 {
5097         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5098         struct brcmf_cfg80211_vif *vif;
5099
5100         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5101
5102         brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5103         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5104 }
5105
5106 static s32
5107 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5108                              const struct brcmf_event_msg *e, void *data)
5109 {
5110         switch (e->reason) {
5111         case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5112                 brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5113                 break;
5114         case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5115                 brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5116                 brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5117                 break;
5118         case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5119                 brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5120                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5121                 break;
5122         }
5123
5124         return 0;
5125 }
5126
5127 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5128 {
5129         int ret;
5130
5131         switch (oper) {
5132         case NL80211_TDLS_DISCOVERY_REQ:
5133                 ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5134                 break;
5135         case NL80211_TDLS_SETUP:
5136                 ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5137                 break;
5138         case NL80211_TDLS_TEARDOWN:
5139                 ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5140                 break;
5141         default:
5142                 brcmf_err("unsupported operation: %d\n", oper);
5143                 ret = -EOPNOTSUPP;
5144         }
5145         return ret;
5146 }
5147
5148 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5149                                     struct net_device *ndev, const u8 *peer,
5150                                     enum nl80211_tdls_operation oper)
5151 {
5152         struct brcmf_if *ifp;
5153         struct brcmf_tdls_iovar_le info;
5154         int ret = 0;
5155
5156         ret = brcmf_convert_nl80211_tdls_oper(oper);
5157         if (ret < 0)
5158                 return ret;
5159
5160         ifp = netdev_priv(ndev);
5161         memset(&info, 0, sizeof(info));
5162         info.mode = (u8)ret;
5163         if (peer)
5164                 memcpy(info.ea, peer, ETH_ALEN);
5165
5166         ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5167                                        &info, sizeof(info));
5168         if (ret < 0)
5169                 brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
5170
5171         return ret;
5172 }
5173
5174 #ifdef CONFIG_PM
5175 static int
5176 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5177                               struct cfg80211_gtk_rekey_data *gtk)
5178 {
5179         struct brcmf_if *ifp = netdev_priv(ndev);
5180         struct brcmf_gtk_keyinfo_le gtk_le;
5181         int ret;
5182
5183         brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5184
5185         memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5186         memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5187         memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5188                sizeof(gtk_le.replay_counter));
5189
5190         ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5191                                        sizeof(gtk_le));
5192         if (ret < 0)
5193                 brcmf_err("gtk_key_info iovar failed: ret=%d\n", ret);
5194
5195         return ret;
5196 }
5197 #endif
5198
5199 static struct cfg80211_ops brcmf_cfg80211_ops = {
5200         .add_virtual_intf = brcmf_cfg80211_add_iface,
5201         .del_virtual_intf = brcmf_cfg80211_del_iface,
5202         .change_virtual_intf = brcmf_cfg80211_change_iface,
5203         .scan = brcmf_cfg80211_scan,
5204         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5205         .join_ibss = brcmf_cfg80211_join_ibss,
5206         .leave_ibss = brcmf_cfg80211_leave_ibss,
5207         .get_station = brcmf_cfg80211_get_station,
5208         .dump_station = brcmf_cfg80211_dump_station,
5209         .set_tx_power = brcmf_cfg80211_set_tx_power,
5210         .get_tx_power = brcmf_cfg80211_get_tx_power,
5211         .add_key = brcmf_cfg80211_add_key,
5212         .del_key = brcmf_cfg80211_del_key,
5213         .get_key = brcmf_cfg80211_get_key,
5214         .set_default_key = brcmf_cfg80211_config_default_key,
5215         .set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5216         .set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5217         .connect = brcmf_cfg80211_connect,
5218         .disconnect = brcmf_cfg80211_disconnect,
5219         .suspend = brcmf_cfg80211_suspend,
5220         .resume = brcmf_cfg80211_resume,
5221         .set_pmksa = brcmf_cfg80211_set_pmksa,
5222         .del_pmksa = brcmf_cfg80211_del_pmksa,
5223         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
5224         .start_ap = brcmf_cfg80211_start_ap,
5225         .stop_ap = brcmf_cfg80211_stop_ap,
5226         .change_beacon = brcmf_cfg80211_change_beacon,
5227         .del_station = brcmf_cfg80211_del_station,
5228         .change_station = brcmf_cfg80211_change_station,
5229         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
5230         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5231         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
5232         .mgmt_tx = brcmf_cfg80211_mgmt_tx,
5233         .remain_on_channel = brcmf_p2p_remain_on_channel,
5234         .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5235         .get_channel = brcmf_cfg80211_get_channel,
5236         .start_p2p_device = brcmf_p2p_start_device,
5237         .stop_p2p_device = brcmf_p2p_stop_device,
5238         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
5239         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5240         .tdls_oper = brcmf_cfg80211_tdls_oper,
5241 };
5242
5243 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5244                                            enum nl80211_iftype type)
5245 {
5246         struct brcmf_cfg80211_vif *vif_walk;
5247         struct brcmf_cfg80211_vif *vif;
5248         bool mbss;
5249
5250         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5251                   sizeof(*vif));
5252         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5253         if (!vif)
5254                 return ERR_PTR(-ENOMEM);
5255
5256         vif->wdev.wiphy = cfg->wiphy;
5257         vif->wdev.iftype = type;
5258
5259         brcmf_init_prof(&vif->profile);
5260
5261         if (type == NL80211_IFTYPE_AP) {
5262                 mbss = false;
5263                 list_for_each_entry(vif_walk, &cfg->vif_list, list) {
5264                         if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
5265                                 mbss = true;
5266                                 break;
5267                         }
5268                 }
5269                 vif->mbss = mbss;
5270         }
5271
5272         list_add_tail(&vif->list, &cfg->vif_list);
5273         return vif;
5274 }
5275
5276 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
5277 {
5278         list_del(&vif->list);
5279         kfree(vif);
5280 }
5281
5282 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
5283 {
5284         struct brcmf_cfg80211_vif *vif;
5285         struct brcmf_if *ifp;
5286
5287         ifp = netdev_priv(ndev);
5288         vif = ifp->vif;
5289
5290         if (vif)
5291                 brcmf_free_vif(vif);
5292         free_netdev(ndev);
5293 }
5294
5295 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
5296 {
5297         u32 event = e->event_code;
5298         u32 status = e->status;
5299
5300         if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
5301                 brcmf_dbg(CONN, "Processing set ssid\n");
5302                 return true;
5303         }
5304
5305         return false;
5306 }
5307
5308 static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
5309 {
5310         u32 event = e->event_code;
5311         u16 flags = e->flags;
5312
5313         if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
5314             (event == BRCMF_E_DISASSOC_IND) ||
5315             ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
5316                 brcmf_dbg(CONN, "Processing link down\n");
5317                 return true;
5318         }
5319         return false;
5320 }
5321
5322 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
5323                                const struct brcmf_event_msg *e)
5324 {
5325         u32 event = e->event_code;
5326         u32 status = e->status;
5327
5328         if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
5329                 brcmf_dbg(CONN, "Processing Link %s & no network found\n",
5330                           e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
5331                 return true;
5332         }
5333
5334         if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
5335                 brcmf_dbg(CONN, "Processing connecting & no network found\n");
5336                 return true;
5337         }
5338
5339         return false;
5340 }
5341
5342 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
5343 {
5344         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5345
5346         kfree(conn_info->req_ie);
5347         conn_info->req_ie = NULL;
5348         conn_info->req_ie_len = 0;
5349         kfree(conn_info->resp_ie);
5350         conn_info->resp_ie = NULL;
5351         conn_info->resp_ie_len = 0;
5352 }
5353
5354 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
5355                                struct brcmf_if *ifp)
5356 {
5357         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
5358         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5359         u32 req_len;
5360         u32 resp_len;
5361         s32 err = 0;
5362
5363         brcmf_clear_assoc_ies(cfg);
5364
5365         err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
5366                                        cfg->extra_buf, WL_ASSOC_INFO_MAX);
5367         if (err) {
5368                 brcmf_err("could not get assoc info (%d)\n", err);
5369                 return err;
5370         }
5371         assoc_info =
5372                 (struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5373         req_len = le32_to_cpu(assoc_info->req_len);
5374         resp_len = le32_to_cpu(assoc_info->resp_len);
5375         if (req_len) {
5376                 err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5377                                                cfg->extra_buf,
5378                                                WL_ASSOC_INFO_MAX);
5379                 if (err) {
5380                         brcmf_err("could not get assoc req (%d)\n", err);
5381                         return err;
5382                 }
5383                 conn_info->req_ie_len = req_len;
5384                 conn_info->req_ie =
5385                     kmemdup(cfg->extra_buf, conn_info->req_ie_len,
5386                             GFP_KERNEL);
5387                 if (!conn_info->req_ie)
5388                         conn_info->req_ie_len = 0;
5389         } else {
5390                 conn_info->req_ie_len = 0;
5391                 conn_info->req_ie = NULL;
5392         }
5393         if (resp_len) {
5394                 err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
5395                                                cfg->extra_buf,
5396                                                WL_ASSOC_INFO_MAX);
5397                 if (err) {
5398                         brcmf_err("could not get assoc resp (%d)\n", err);
5399                         return err;
5400                 }
5401                 conn_info->resp_ie_len = resp_len;
5402                 conn_info->resp_ie =
5403                     kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
5404                             GFP_KERNEL);
5405                 if (!conn_info->resp_ie)
5406                         conn_info->resp_ie_len = 0;
5407         } else {
5408                 conn_info->resp_ie_len = 0;
5409                 conn_info->resp_ie = NULL;
5410         }
5411         brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
5412                   conn_info->req_ie_len, conn_info->resp_ie_len);
5413
5414         return err;
5415 }
5416
5417 static s32
5418 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
5419                        struct net_device *ndev,
5420                        const struct brcmf_event_msg *e)
5421 {
5422         struct brcmf_if *ifp = netdev_priv(ndev);
5423         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5424         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5425         struct wiphy *wiphy = cfg_to_wiphy(cfg);
5426         struct ieee80211_channel *notify_channel = NULL;
5427         struct ieee80211_supported_band *band;
5428         struct brcmf_bss_info_le *bi;
5429         struct brcmu_chan ch;
5430         u32 freq;
5431         s32 err = 0;
5432         u8 *buf;
5433
5434         brcmf_dbg(TRACE, "Enter\n");
5435
5436         brcmf_get_assoc_ies(cfg, ifp);
5437         memcpy(profile->bssid, e->addr, ETH_ALEN);
5438         brcmf_update_bss_info(cfg, ifp);
5439
5440         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
5441         if (buf == NULL) {
5442                 err = -ENOMEM;
5443                 goto done;
5444         }
5445
5446         /* data sent to dongle has to be little endian */
5447         *(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
5448         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
5449                                      buf, WL_BSS_INFO_MAX);
5450
5451         if (err)
5452                 goto done;
5453
5454         bi = (struct brcmf_bss_info_le *)(buf + 4);
5455         ch.chspec = le16_to_cpu(bi->chanspec);
5456         cfg->d11inf.decchspec(&ch);
5457
5458         if (ch.band == BRCMU_CHAN_BAND_2G)
5459                 band = wiphy->bands[NL80211_BAND_2GHZ];
5460         else
5461                 band = wiphy->bands[NL80211_BAND_5GHZ];
5462
5463         freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
5464         notify_channel = ieee80211_get_channel(wiphy, freq);
5465
5466 done:
5467         kfree(buf);
5468         cfg80211_roamed(ndev, notify_channel, (u8 *)profile->bssid,
5469                         conn_info->req_ie, conn_info->req_ie_len,
5470                         conn_info->resp_ie, conn_info->resp_ie_len, GFP_KERNEL);
5471         brcmf_dbg(CONN, "Report roaming result\n");
5472
5473         set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
5474         brcmf_dbg(TRACE, "Exit\n");
5475         return err;
5476 }
5477
5478 static s32
5479 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
5480                        struct net_device *ndev, const struct brcmf_event_msg *e,
5481                        bool completed)
5482 {
5483         struct brcmf_if *ifp = netdev_priv(ndev);
5484         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5485         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
5486
5487         brcmf_dbg(TRACE, "Enter\n");
5488
5489         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5490                                &ifp->vif->sme_state)) {
5491                 if (completed) {
5492                         brcmf_get_assoc_ies(cfg, ifp);
5493                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5494                         brcmf_update_bss_info(cfg, ifp);
5495                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5496                                 &ifp->vif->sme_state);
5497                 }
5498                 cfg80211_connect_result(ndev,
5499                                         (u8 *)profile->bssid,
5500                                         conn_info->req_ie,
5501                                         conn_info->req_ie_len,
5502                                         conn_info->resp_ie,
5503                                         conn_info->resp_ie_len,
5504                                         completed ? WLAN_STATUS_SUCCESS :
5505                                                     WLAN_STATUS_AUTH_TIMEOUT,
5506                                         GFP_KERNEL);
5507                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
5508                           completed ? "succeeded" : "failed");
5509         }
5510         brcmf_dbg(TRACE, "Exit\n");
5511         return 0;
5512 }
5513
5514 static s32
5515 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
5516                                struct net_device *ndev,
5517                                const struct brcmf_event_msg *e, void *data)
5518 {
5519         static int generation;
5520         u32 event = e->event_code;
5521         u32 reason = e->reason;
5522         struct station_info sinfo;
5523
5524         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
5525         if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
5526             ndev != cfg_to_ndev(cfg)) {
5527                 brcmf_dbg(CONN, "AP mode link down\n");
5528                 complete(&cfg->vif_disabled);
5529                 return 0;
5530         }
5531
5532         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
5533             (reason == BRCMF_E_STATUS_SUCCESS)) {
5534                 memset(&sinfo, 0, sizeof(sinfo));
5535                 if (!data) {
5536                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
5537                         return -EINVAL;
5538                 }
5539                 sinfo.assoc_req_ies = data;
5540                 sinfo.assoc_req_ies_len = e->datalen;
5541                 generation++;
5542                 sinfo.generation = generation;
5543                 cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
5544         } else if ((event == BRCMF_E_DISASSOC_IND) ||
5545                    (event == BRCMF_E_DEAUTH_IND) ||
5546                    (event == BRCMF_E_DEAUTH)) {
5547                 cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
5548         }
5549         return 0;
5550 }
5551
5552 static s32
5553 brcmf_notify_connect_status(struct brcmf_if *ifp,
5554                             const struct brcmf_event_msg *e, void *data)
5555 {
5556         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5557         struct net_device *ndev = ifp->ndev;
5558         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5559         struct ieee80211_channel *chan;
5560         s32 err = 0;
5561
5562         if ((e->event_code == BRCMF_E_DEAUTH) ||
5563             (e->event_code == BRCMF_E_DEAUTH_IND) ||
5564             (e->event_code == BRCMF_E_DISASSOC_IND) ||
5565             ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
5566                 brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5567         }
5568
5569         if (brcmf_is_apmode(ifp->vif)) {
5570                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
5571         } else if (brcmf_is_linkup(e)) {
5572                 brcmf_dbg(CONN, "Linkup\n");
5573                 if (brcmf_is_ibssmode(ifp->vif)) {
5574                         brcmf_inform_ibss(cfg, ndev, e->addr);
5575                         chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
5576                         memcpy(profile->bssid, e->addr, ETH_ALEN);
5577                         cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
5578                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5579                                   &ifp->vif->sme_state);
5580                         set_bit(BRCMF_VIF_STATUS_CONNECTED,
5581                                 &ifp->vif->sme_state);
5582                 } else
5583                         brcmf_bss_connect_done(cfg, ndev, e, true);
5584                 brcmf_net_setcarrier(ifp, true);
5585         } else if (brcmf_is_linkdown(e)) {
5586                 brcmf_dbg(CONN, "Linkdown\n");
5587                 if (!brcmf_is_ibssmode(ifp->vif)) {
5588                         brcmf_bss_connect_done(cfg, ndev, e, false);
5589                         brcmf_link_down(ifp->vif,
5590                                         brcmf_map_fw_linkdown_reason(e));
5591                         brcmf_init_prof(ndev_to_prof(ndev));
5592                         if (ndev != cfg_to_ndev(cfg))
5593                                 complete(&cfg->vif_disabled);
5594                         brcmf_net_setcarrier(ifp, false);
5595                 }
5596         } else if (brcmf_is_nonetwork(cfg, e)) {
5597                 if (brcmf_is_ibssmode(ifp->vif))
5598                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
5599                                   &ifp->vif->sme_state);
5600                 else
5601                         brcmf_bss_connect_done(cfg, ndev, e, false);
5602         }
5603
5604         return err;
5605 }
5606
5607 static s32
5608 brcmf_notify_roaming_status(struct brcmf_if *ifp,
5609                             const struct brcmf_event_msg *e, void *data)
5610 {
5611         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5612         u32 event = e->event_code;
5613         u32 status = e->status;
5614
5615         if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
5616                 if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
5617                         brcmf_bss_roaming_done(cfg, ifp->ndev, e);
5618                 else
5619                         brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
5620         }
5621
5622         return 0;
5623 }
5624
5625 static s32
5626 brcmf_notify_mic_status(struct brcmf_if *ifp,
5627                         const struct brcmf_event_msg *e, void *data)
5628 {
5629         u16 flags = e->flags;
5630         enum nl80211_key_type key_type;
5631
5632         if (flags & BRCMF_EVENT_MSG_GROUP)
5633                 key_type = NL80211_KEYTYPE_GROUP;
5634         else
5635                 key_type = NL80211_KEYTYPE_PAIRWISE;
5636
5637         cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
5638                                      NULL, GFP_KERNEL);
5639
5640         return 0;
5641 }
5642
5643 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
5644                                   const struct brcmf_event_msg *e, void *data)
5645 {
5646         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
5647         struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
5648         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
5649         struct brcmf_cfg80211_vif *vif;
5650
5651         brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
5652                   ifevent->action, ifevent->flags, ifevent->ifidx,
5653                   ifevent->bsscfgidx);
5654
5655         spin_lock(&event->vif_event_lock);
5656         event->action = ifevent->action;
5657         vif = event->vif;
5658
5659         switch (ifevent->action) {
5660         case BRCMF_E_IF_ADD:
5661                 /* waiting process may have timed out */
5662                 if (!cfg->vif_event.vif) {
5663                         spin_unlock(&event->vif_event_lock);
5664                         return -EBADF;
5665                 }
5666
5667                 ifp->vif = vif;
5668                 vif->ifp = ifp;
5669                 if (ifp->ndev) {
5670                         vif->wdev.netdev = ifp->ndev;
5671                         ifp->ndev->ieee80211_ptr = &vif->wdev;
5672                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
5673                 }
5674                 spin_unlock(&event->vif_event_lock);
5675                 wake_up(&event->vif_wq);
5676                 return 0;
5677
5678         case BRCMF_E_IF_DEL:
5679                 spin_unlock(&event->vif_event_lock);
5680                 /* event may not be upon user request */
5681                 if (brcmf_cfg80211_vif_event_armed(cfg))
5682                         wake_up(&event->vif_wq);
5683                 return 0;
5684
5685         case BRCMF_E_IF_CHANGE:
5686                 spin_unlock(&event->vif_event_lock);
5687                 wake_up(&event->vif_wq);
5688                 return 0;
5689
5690         default:
5691                 spin_unlock(&event->vif_event_lock);
5692                 break;
5693         }
5694         return -EINVAL;
5695 }
5696
5697 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
5698 {
5699         conf->frag_threshold = (u32)-1;
5700         conf->rts_threshold = (u32)-1;
5701         conf->retry_short = (u32)-1;
5702         conf->retry_long = (u32)-1;
5703 }
5704
5705 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
5706 {
5707         brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
5708                             brcmf_notify_connect_status);
5709         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
5710                             brcmf_notify_connect_status);
5711         brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
5712                             brcmf_notify_connect_status);
5713         brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
5714                             brcmf_notify_connect_status);
5715         brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
5716                             brcmf_notify_connect_status);
5717         brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
5718                             brcmf_notify_connect_status);
5719         brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
5720                             brcmf_notify_roaming_status);
5721         brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
5722                             brcmf_notify_mic_status);
5723         brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
5724                             brcmf_notify_connect_status);
5725         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
5726                             brcmf_notify_sched_scan_results);
5727         brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
5728                             brcmf_notify_vif_event);
5729         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
5730                             brcmf_p2p_notify_rx_mgmt_p2p_probereq);
5731         brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
5732                             brcmf_p2p_notify_listen_complete);
5733         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
5734                             brcmf_p2p_notify_action_frame_rx);
5735         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
5736                             brcmf_p2p_notify_action_tx_complete);
5737         brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
5738                             brcmf_p2p_notify_action_tx_complete);
5739 }
5740
5741 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
5742 {
5743         kfree(cfg->conf);
5744         cfg->conf = NULL;
5745         kfree(cfg->extra_buf);
5746         cfg->extra_buf = NULL;
5747         kfree(cfg->wowl.nd);
5748         cfg->wowl.nd = NULL;
5749         kfree(cfg->wowl.nd_info);
5750         cfg->wowl.nd_info = NULL;
5751         kfree(cfg->escan_info.escan_buf);
5752         cfg->escan_info.escan_buf = NULL;
5753 }
5754
5755 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
5756 {
5757         cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
5758         if (!cfg->conf)
5759                 goto init_priv_mem_out;
5760         cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
5761         if (!cfg->extra_buf)
5762                 goto init_priv_mem_out;
5763         cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
5764         if (!cfg->wowl.nd)
5765                 goto init_priv_mem_out;
5766         cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
5767                                     sizeof(struct cfg80211_wowlan_nd_match *),
5768                                     GFP_KERNEL);
5769         if (!cfg->wowl.nd_info)
5770                 goto init_priv_mem_out;
5771         cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
5772         if (!cfg->escan_info.escan_buf)
5773                 goto init_priv_mem_out;
5774
5775         return 0;
5776
5777 init_priv_mem_out:
5778         brcmf_deinit_priv_mem(cfg);
5779
5780         return -ENOMEM;
5781 }
5782
5783 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
5784 {
5785         s32 err = 0;
5786
5787         cfg->scan_request = NULL;
5788         cfg->pwr_save = true;
5789         cfg->active_scan = true;        /* we do active scan per default */
5790         cfg->dongle_up = false;         /* dongle is not up yet */
5791         err = brcmf_init_priv_mem(cfg);
5792         if (err)
5793                 return err;
5794         brcmf_register_event_handlers(cfg);
5795         mutex_init(&cfg->usr_sync);
5796         brcmf_init_escan(cfg);
5797         brcmf_init_conf(cfg->conf);
5798         init_completion(&cfg->vif_disabled);
5799         return err;
5800 }
5801
5802 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
5803 {
5804         cfg->dongle_up = false; /* dongle down */
5805         brcmf_abort_scanning(cfg);
5806         brcmf_deinit_priv_mem(cfg);
5807 }
5808
5809 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
5810 {
5811         init_waitqueue_head(&event->vif_wq);
5812         spin_lock_init(&event->vif_event_lock);
5813 }
5814
5815 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
5816 {
5817         s32 err;
5818         u32 bcn_timeout;
5819         __le32 roamtrigger[2];
5820         __le32 roam_delta[2];
5821
5822         /* Configure beacon timeout value based upon roaming setting */
5823         if (ifp->drvr->settings->roamoff)
5824                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
5825         else
5826                 bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
5827         err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
5828         if (err) {
5829                 brcmf_err("bcn_timeout error (%d)\n", err);
5830                 goto roam_setup_done;
5831         }
5832
5833         /* Enable/Disable built-in roaming to allow supplicant to take care of
5834          * roaming.
5835          */
5836         brcmf_dbg(INFO, "Internal Roaming = %s\n",
5837                   ifp->drvr->settings->roamoff ? "Off" : "On");
5838         err = brcmf_fil_iovar_int_set(ifp, "roam_off",
5839                                       ifp->drvr->settings->roamoff);
5840         if (err) {
5841                 brcmf_err("roam_off error (%d)\n", err);
5842                 goto roam_setup_done;
5843         }
5844
5845         roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
5846         roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
5847         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
5848                                      (void *)roamtrigger, sizeof(roamtrigger));
5849         if (err) {
5850                 brcmf_err("WLC_SET_ROAM_TRIGGER error (%d)\n", err);
5851                 goto roam_setup_done;
5852         }
5853
5854         roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
5855         roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
5856         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
5857                                      (void *)roam_delta, sizeof(roam_delta));
5858         if (err) {
5859                 brcmf_err("WLC_SET_ROAM_DELTA error (%d)\n", err);
5860                 goto roam_setup_done;
5861         }
5862
5863 roam_setup_done:
5864         return err;
5865 }
5866
5867 static s32
5868 brcmf_dongle_scantime(struct brcmf_if *ifp)
5869 {
5870         s32 err = 0;
5871
5872         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
5873                                     BRCMF_SCAN_CHANNEL_TIME);
5874         if (err) {
5875                 brcmf_err("Scan assoc time error (%d)\n", err);
5876                 goto dongle_scantime_out;
5877         }
5878         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
5879                                     BRCMF_SCAN_UNASSOC_TIME);
5880         if (err) {
5881                 brcmf_err("Scan unassoc time error (%d)\n", err);
5882                 goto dongle_scantime_out;
5883         }
5884
5885         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
5886                                     BRCMF_SCAN_PASSIVE_TIME);
5887         if (err) {
5888                 brcmf_err("Scan passive time error (%d)\n", err);
5889                 goto dongle_scantime_out;
5890         }
5891
5892 dongle_scantime_out:
5893         return err;
5894 }
5895
5896 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
5897                                            struct brcmu_chan *ch)
5898 {
5899         u32 ht40_flag;
5900
5901         ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
5902         if (ch->sb == BRCMU_CHAN_SB_U) {
5903                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5904                         channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5905                 channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
5906         } else {
5907                 /* It should be one of
5908                  * IEEE80211_CHAN_NO_HT40 or
5909                  * IEEE80211_CHAN_NO_HT40PLUS
5910                  */
5911                 channel->flags &= ~IEEE80211_CHAN_NO_HT40;
5912                 if (ht40_flag == IEEE80211_CHAN_NO_HT40)
5913                         channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
5914         }
5915 }
5916
5917 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
5918                                     u32 bw_cap[])
5919 {
5920         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
5921         struct ieee80211_supported_band *band;
5922         struct ieee80211_channel *channel;
5923         struct wiphy *wiphy;
5924         struct brcmf_chanspec_list *list;
5925         struct brcmu_chan ch;
5926         int err;
5927         u8 *pbuf;
5928         u32 i, j;
5929         u32 total;
5930         u32 chaninfo;
5931
5932         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
5933
5934         if (pbuf == NULL)
5935                 return -ENOMEM;
5936
5937         list = (struct brcmf_chanspec_list *)pbuf;
5938
5939         err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
5940                                        BRCMF_DCMD_MEDLEN);
5941         if (err) {
5942                 brcmf_err("get chanspecs error (%d)\n", err);
5943                 goto fail_pbuf;
5944         }
5945
5946         wiphy = cfg_to_wiphy(cfg);
5947         band = wiphy->bands[NL80211_BAND_2GHZ];
5948         if (band)
5949                 for (i = 0; i < band->n_channels; i++)
5950                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5951         band = wiphy->bands[NL80211_BAND_5GHZ];
5952         if (band)
5953                 for (i = 0; i < band->n_channels; i++)
5954                         band->channels[i].flags = IEEE80211_CHAN_DISABLED;
5955
5956         total = le32_to_cpu(list->count);
5957         for (i = 0; i < total; i++) {
5958                 ch.chspec = (u16)le32_to_cpu(list->element[i]);
5959                 cfg->d11inf.decchspec(&ch);
5960
5961                 if (ch.band == BRCMU_CHAN_BAND_2G) {
5962                         band = wiphy->bands[NL80211_BAND_2GHZ];
5963                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
5964                         band = wiphy->bands[NL80211_BAND_5GHZ];
5965                 } else {
5966                         brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
5967                         continue;
5968                 }
5969                 if (!band)
5970                         continue;
5971                 if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
5972                     ch.bw == BRCMU_CHAN_BW_40)
5973                         continue;
5974                 if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
5975                     ch.bw == BRCMU_CHAN_BW_80)
5976                         continue;
5977
5978                 channel = NULL;
5979                 for (j = 0; j < band->n_channels; j++) {
5980                         if (band->channels[j].hw_value == ch.control_ch_num) {
5981                                 channel = &band->channels[j];
5982                                 break;
5983                         }
5984                 }
5985                 if (!channel) {
5986                         /* It seems firmware supports some channel we never
5987                          * considered. Something new in IEEE standard?
5988                          */
5989                         brcmf_err("Ignoring unexpected firmware channel %d\n",
5990                                   ch.control_ch_num);
5991                         continue;
5992                 }
5993
5994                 /* assuming the chanspecs order is HT20,
5995                  * HT40 upper, HT40 lower, and VHT80.
5996                  */
5997                 if (ch.bw == BRCMU_CHAN_BW_80) {
5998                         channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
5999                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
6000                         brcmf_update_bw40_channel_flag(channel, &ch);
6001                 } else {
6002                         /* enable the channel and disable other bandwidths
6003                          * for now as mentioned order assure they are enabled
6004                          * for subsequent chanspecs.
6005                          */
6006                         channel->flags = IEEE80211_CHAN_NO_HT40 |
6007                                          IEEE80211_CHAN_NO_80MHZ |
6008                                          IEEE80211_CHAN_NO_160MHZ;
6009                         ch.bw = BRCMU_CHAN_BW_20;
6010                         cfg->d11inf.encchspec(&ch);
6011                         chaninfo = ch.chspec;
6012                         err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
6013                                                        &chaninfo);
6014                         if (!err) {
6015                                 if (chaninfo & WL_CHAN_RADAR)
6016                                         channel->flags |=
6017                                                 (IEEE80211_CHAN_RADAR |
6018                                                  IEEE80211_CHAN_NO_IR);
6019                                 if (chaninfo & WL_CHAN_PASSIVE)
6020                                         channel->flags |=
6021                                                 IEEE80211_CHAN_NO_IR;
6022                         }
6023                 }
6024         }
6025
6026 fail_pbuf:
6027         kfree(pbuf);
6028         return err;
6029 }
6030
6031 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
6032 {
6033         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6034         struct ieee80211_supported_band *band;
6035         struct brcmf_fil_bwcap_le band_bwcap;
6036         struct brcmf_chanspec_list *list;
6037         u8 *pbuf;
6038         u32 val;
6039         int err;
6040         struct brcmu_chan ch;
6041         u32 num_chan;
6042         int i, j;
6043
6044         /* verify support for bw_cap command */
6045         val = WLC_BAND_5G;
6046         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
6047
6048         if (!err) {
6049                 /* only set 2G bandwidth using bw_cap command */
6050                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
6051                 band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
6052                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
6053                                                sizeof(band_bwcap));
6054         } else {
6055                 brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
6056                 val = WLC_N_BW_40ALL;
6057                 err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
6058         }
6059
6060         if (!err) {
6061                 /* update channel info in 2G band */
6062                 pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6063
6064                 if (pbuf == NULL)
6065                         return -ENOMEM;
6066
6067                 ch.band = BRCMU_CHAN_BAND_2G;
6068                 ch.bw = BRCMU_CHAN_BW_40;
6069                 ch.sb = BRCMU_CHAN_SB_NONE;
6070                 ch.chnum = 0;
6071                 cfg->d11inf.encchspec(&ch);
6072
6073                 /* pass encoded chanspec in query */
6074                 *(__le16 *)pbuf = cpu_to_le16(ch.chspec);
6075
6076                 err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6077                                                BRCMF_DCMD_MEDLEN);
6078                 if (err) {
6079                         brcmf_err("get chanspecs error (%d)\n", err);
6080                         kfree(pbuf);
6081                         return err;
6082                 }
6083
6084                 band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6085                 list = (struct brcmf_chanspec_list *)pbuf;
6086                 num_chan = le32_to_cpu(list->count);
6087                 for (i = 0; i < num_chan; i++) {
6088                         ch.chspec = (u16)le32_to_cpu(list->element[i]);
6089                         cfg->d11inf.decchspec(&ch);
6090                         if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
6091                                 continue;
6092                         if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
6093                                 continue;
6094                         for (j = 0; j < band->n_channels; j++) {
6095                                 if (band->channels[j].hw_value == ch.control_ch_num)
6096                                         break;
6097                         }
6098                         if (WARN_ON(j == band->n_channels))
6099                                 continue;
6100
6101                         brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
6102                 }
6103                 kfree(pbuf);
6104         }
6105         return err;
6106 }
6107
6108 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
6109 {
6110         u32 band, mimo_bwcap;
6111         int err;
6112
6113         band = WLC_BAND_2G;
6114         err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6115         if (!err) {
6116                 bw_cap[NL80211_BAND_2GHZ] = band;
6117                 band = WLC_BAND_5G;
6118                 err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
6119                 if (!err) {
6120                         bw_cap[NL80211_BAND_5GHZ] = band;
6121                         return;
6122                 }
6123                 WARN_ON(1);
6124                 return;
6125         }
6126         brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
6127         mimo_bwcap = 0;
6128         err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
6129         if (err)
6130                 /* assume 20MHz if firmware does not give a clue */
6131                 mimo_bwcap = WLC_N_BW_20ALL;
6132
6133         switch (mimo_bwcap) {
6134         case WLC_N_BW_40ALL:
6135                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
6136                 /* fall-thru */
6137         case WLC_N_BW_20IN2G_40IN5G:
6138                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
6139                 /* fall-thru */
6140         case WLC_N_BW_20ALL:
6141                 bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
6142                 bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
6143                 break;
6144         default:
6145                 brcmf_err("invalid mimo_bw_cap value\n");
6146         }
6147 }
6148
6149 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
6150                                 u32 bw_cap[2], u32 nchain)
6151 {
6152         band->ht_cap.ht_supported = true;
6153         if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
6154                 band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
6155                 band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6156         }
6157         band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
6158         band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
6159         band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
6160         band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
6161         memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
6162         band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
6163 }
6164
6165 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
6166 {
6167         u16 mcs_map;
6168         int i;
6169
6170         for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
6171                 mcs_map = (mcs_map << 2) | supp;
6172
6173         return cpu_to_le16(mcs_map);
6174 }
6175
6176 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
6177                                  u32 bw_cap[2], u32 nchain, u32 txstreams,
6178                                  u32 txbf_bfe_cap, u32 txbf_bfr_cap)
6179 {
6180         __le16 mcs_map;
6181
6182         /* not allowed in 2.4G band */
6183         if (band->band == NL80211_BAND_2GHZ)
6184                 return;
6185
6186         band->vht_cap.vht_supported = true;
6187         /* 80MHz is mandatory */
6188         band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
6189         if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
6190                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
6191                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
6192         }
6193         /* all support 256-QAM */
6194         mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
6195         band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
6196         band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
6197
6198         /* Beamforming support information */
6199         if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
6200                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
6201         if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
6202                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
6203         if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
6204                 band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
6205         if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
6206                 band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
6207
6208         if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
6209                 band->vht_cap.cap |=
6210                         (2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
6211                 band->vht_cap.cap |= ((txstreams - 1) <<
6212                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
6213                 band->vht_cap.cap |=
6214                         IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
6215         }
6216 }
6217
6218 static int brcmf_setup_wiphybands(struct wiphy *wiphy)
6219 {
6220         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6221         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6222         u32 nmode = 0;
6223         u32 vhtmode = 0;
6224         u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
6225         u32 rxchain;
6226         u32 nchain;
6227         int err;
6228         s32 i;
6229         struct ieee80211_supported_band *band;
6230         u32 txstreams = 0;
6231         u32 txbf_bfe_cap = 0;
6232         u32 txbf_bfr_cap = 0;
6233
6234         (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
6235         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
6236         if (err) {
6237                 brcmf_err("nmode error (%d)\n", err);
6238         } else {
6239                 brcmf_get_bwcap(ifp, bw_cap);
6240         }
6241         brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
6242                   nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
6243                   bw_cap[NL80211_BAND_5GHZ]);
6244
6245         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
6246         if (err) {
6247                 brcmf_err("rxchain error (%d)\n", err);
6248                 nchain = 1;
6249         } else {
6250                 for (nchain = 0; rxchain; nchain++)
6251                         rxchain = rxchain & (rxchain - 1);
6252         }
6253         brcmf_dbg(INFO, "nchain=%d\n", nchain);
6254
6255         err = brcmf_construct_chaninfo(cfg, bw_cap);
6256         if (err) {
6257                 brcmf_err("brcmf_construct_chaninfo failed (%d)\n", err);
6258                 return err;
6259         }
6260
6261         if (vhtmode) {
6262                 (void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
6263                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
6264                                               &txbf_bfe_cap);
6265                 (void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
6266                                               &txbf_bfr_cap);
6267         }
6268
6269         wiphy = cfg_to_wiphy(cfg);
6270         for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
6271                 band = wiphy->bands[i];
6272                 if (band == NULL)
6273                         continue;
6274
6275                 if (nmode)
6276                         brcmf_update_ht_cap(band, bw_cap, nchain);
6277                 if (vhtmode)
6278                         brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
6279                                              txbf_bfe_cap, txbf_bfr_cap);
6280         }
6281
6282         return 0;
6283 }
6284
6285 static const struct ieee80211_txrx_stypes
6286 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
6287         [NL80211_IFTYPE_STATION] = {
6288                 .tx = 0xffff,
6289                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6290                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6291         },
6292         [NL80211_IFTYPE_P2P_CLIENT] = {
6293                 .tx = 0xffff,
6294                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6295                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6296         },
6297         [NL80211_IFTYPE_P2P_GO] = {
6298                 .tx = 0xffff,
6299                 .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
6300                       BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
6301                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
6302                       BIT(IEEE80211_STYPE_DISASSOC >> 4) |
6303                       BIT(IEEE80211_STYPE_AUTH >> 4) |
6304                       BIT(IEEE80211_STYPE_DEAUTH >> 4) |
6305                       BIT(IEEE80211_STYPE_ACTION >> 4)
6306         },
6307         [NL80211_IFTYPE_P2P_DEVICE] = {
6308                 .tx = 0xffff,
6309                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
6310                       BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
6311         }
6312 };
6313
6314 /**
6315  * brcmf_setup_ifmodes() - determine interface modes and combinations.
6316  *
6317  * @wiphy: wiphy object.
6318  * @ifp: interface object needed for feat module api.
6319  *
6320  * The interface modes and combinations are determined dynamically here
6321  * based on firmware functionality.
6322  *
6323  * no p2p and no mbss:
6324  *
6325  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6326  *
6327  * no p2p and mbss:
6328  *
6329  *      #STA <= 1, #AP <= 1, channels = 1, 2 total
6330  *      #AP <= 4, matching BI, channels = 1, 4 total
6331  *
6332  * p2p, no mchan, and mbss:
6333  *
6334  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
6335  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6336  *      #AP <= 4, matching BI, channels = 1, 4 total
6337  *
6338  * p2p, mchan, and mbss:
6339  *
6340  *      #STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
6341  *      #STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
6342  *      #AP <= 4, matching BI, channels = 1, 4 total
6343  */
6344 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
6345 {
6346         struct ieee80211_iface_combination *combo = NULL;
6347         struct ieee80211_iface_limit *c0_limits = NULL;
6348         struct ieee80211_iface_limit *p2p_limits = NULL;
6349         struct ieee80211_iface_limit *mbss_limits = NULL;
6350         bool mbss, p2p;
6351         int i, c, n_combos;
6352
6353         mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
6354         p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
6355
6356         n_combos = 1 + !!p2p + !!mbss;
6357         combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
6358         if (!combo)
6359                 goto err;
6360
6361         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
6362                                  BIT(NL80211_IFTYPE_ADHOC) |
6363                                  BIT(NL80211_IFTYPE_AP);
6364
6365         c = 0;
6366         i = 0;
6367         c0_limits = kcalloc(p2p ? 3 : 2, sizeof(*c0_limits), GFP_KERNEL);
6368         if (!c0_limits)
6369                 goto err;
6370         c0_limits[i].max = 1;
6371         c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6372         if (p2p) {
6373                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
6374                         combo[c].num_different_channels = 2;
6375                 wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
6376                                           BIT(NL80211_IFTYPE_P2P_GO) |
6377                                           BIT(NL80211_IFTYPE_P2P_DEVICE);
6378                 c0_limits[i].max = 1;
6379                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6380                 c0_limits[i].max = 1;
6381                 c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
6382                                        BIT(NL80211_IFTYPE_P2P_GO);
6383         } else {
6384                 c0_limits[i].max = 1;
6385                 c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6386         }
6387         combo[c].num_different_channels = 1;
6388         combo[c].max_interfaces = i;
6389         combo[c].n_limits = i;
6390         combo[c].limits = c0_limits;
6391
6392         if (p2p) {
6393                 c++;
6394                 i = 0;
6395                 p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
6396                 if (!p2p_limits)
6397                         goto err;
6398                 p2p_limits[i].max = 1;
6399                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
6400                 p2p_limits[i].max = 1;
6401                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6402                 p2p_limits[i].max = 1;
6403                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
6404                 p2p_limits[i].max = 1;
6405                 p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
6406                 combo[c].num_different_channels = 1;
6407                 combo[c].max_interfaces = i;
6408                 combo[c].n_limits = i;
6409                 combo[c].limits = p2p_limits;
6410         }
6411
6412         if (mbss) {
6413                 c++;
6414                 i = 0;
6415                 mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
6416                 if (!mbss_limits)
6417                         goto err;
6418                 mbss_limits[i].max = 4;
6419                 mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
6420                 combo[c].beacon_int_infra_match = true;
6421                 combo[c].num_different_channels = 1;
6422                 combo[c].max_interfaces = 4;
6423                 combo[c].n_limits = i;
6424                 combo[c].limits = mbss_limits;
6425         }
6426
6427         wiphy->n_iface_combinations = n_combos;
6428         wiphy->iface_combinations = combo;
6429         return 0;
6430
6431 err:
6432         kfree(c0_limits);
6433         kfree(p2p_limits);
6434         kfree(mbss_limits);
6435         kfree(combo);
6436         return -ENOMEM;
6437 }
6438
6439 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
6440 {
6441         /* scheduled scan settings */
6442         wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
6443         wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
6444         wiphy->max_sched_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6445         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
6446 }
6447
6448 #ifdef CONFIG_PM
6449 static struct wiphy_wowlan_support brcmf_wowlan_support = {
6450         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
6451         .n_patterns = BRCMF_WOWL_MAXPATTERNS,
6452         .pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
6453         .pattern_min_len = 1,
6454         .max_pkt_offset = 1500,
6455 };
6456 #endif
6457
6458 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
6459 {
6460 #ifdef CONFIG_PM
6461         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
6462
6463         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
6464                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
6465                         brcmf_wowlan_support.flags |= WIPHY_WOWLAN_NET_DETECT;
6466                         init_waitqueue_head(&cfg->wowl.nd_data_wait);
6467                 }
6468         }
6469         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
6470                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
6471                 brcmf_wowlan_support.flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
6472         }
6473
6474         wiphy->wowlan = &brcmf_wowlan_support;
6475 #endif
6476 }
6477
6478 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
6479 {
6480         struct brcmf_pub *drvr = ifp->drvr;
6481         const struct ieee80211_iface_combination *combo;
6482         struct ieee80211_supported_band *band;
6483         u16 max_interfaces = 0;
6484         __le32 bandlist[3];
6485         u32 n_bands;
6486         int err, i;
6487
6488         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
6489         wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
6490         wiphy->max_num_pmkids = BRCMF_MAXPMKID;
6491
6492         err = brcmf_setup_ifmodes(wiphy, ifp);
6493         if (err)
6494                 return err;
6495
6496         for (i = 0, combo = wiphy->iface_combinations;
6497              i < wiphy->n_iface_combinations; i++, combo++) {
6498                 max_interfaces = max(max_interfaces, combo->max_interfaces);
6499         }
6500
6501         for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
6502              i++) {
6503                 u8 *addr = drvr->addresses[i].addr;
6504
6505                 memcpy(addr, drvr->mac, ETH_ALEN);
6506                 if (i) {
6507                         addr[0] |= BIT(1);
6508                         addr[ETH_ALEN - 1] ^= i;
6509                 }
6510         }
6511         wiphy->addresses = drvr->addresses;
6512         wiphy->n_addresses = i;
6513
6514         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
6515         wiphy->cipher_suites = brcmf_cipher_suites;
6516         wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
6517         if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
6518                 wiphy->n_cipher_suites--;
6519         wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
6520                                     BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
6521                                     BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
6522
6523         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
6524                         WIPHY_FLAG_OFFCHAN_TX |
6525                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
6526         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
6527                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
6528         if (!ifp->drvr->settings->roamoff)
6529                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
6530         wiphy->mgmt_stypes = brcmf_txrx_stypes;
6531         wiphy->max_remain_on_channel_duration = 5000;
6532         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
6533                 brcmf_wiphy_pno_params(wiphy);
6534
6535         /* vendor commands/events support */
6536         wiphy->vendor_commands = brcmf_vendor_cmds;
6537         wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
6538
6539         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
6540                 brcmf_wiphy_wowl_params(wiphy, ifp);
6541         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
6542                                      sizeof(bandlist));
6543         if (err) {
6544                 brcmf_err("could not obtain band info: err=%d\n", err);
6545                 return err;
6546         }
6547         /* first entry in bandlist is number of bands */
6548         n_bands = le32_to_cpu(bandlist[0]);
6549         for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
6550                 if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
6551                         band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
6552                                        GFP_KERNEL);
6553                         if (!band)
6554                                 return -ENOMEM;
6555
6556                         band->channels = kmemdup(&__wl_2ghz_channels,
6557                                                  sizeof(__wl_2ghz_channels),
6558                                                  GFP_KERNEL);
6559                         if (!band->channels) {
6560                                 kfree(band);
6561                                 return -ENOMEM;
6562                         }
6563
6564                         band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
6565                         wiphy->bands[NL80211_BAND_2GHZ] = band;
6566                 }
6567                 if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
6568                         band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
6569                                        GFP_KERNEL);
6570                         if (!band)
6571                                 return -ENOMEM;
6572
6573                         band->channels = kmemdup(&__wl_5ghz_channels,
6574                                                  sizeof(__wl_5ghz_channels),
6575                                                  GFP_KERNEL);
6576                         if (!band->channels) {
6577                                 kfree(band);
6578                                 return -ENOMEM;
6579                         }
6580
6581                         band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
6582                         wiphy->bands[NL80211_BAND_5GHZ] = band;
6583                 }
6584         }
6585         return 0;
6586 }
6587
6588 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
6589 {
6590         struct net_device *ndev;
6591         struct wireless_dev *wdev;
6592         struct brcmf_if *ifp;
6593         s32 power_mode;
6594         s32 err = 0;
6595
6596         if (cfg->dongle_up)
6597                 return err;
6598
6599         ndev = cfg_to_ndev(cfg);
6600         wdev = ndev->ieee80211_ptr;
6601         ifp = netdev_priv(ndev);
6602
6603         /* make sure RF is ready for work */
6604         brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
6605
6606         brcmf_dongle_scantime(ifp);
6607
6608         power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
6609         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
6610         if (err)
6611                 goto default_conf_out;
6612         brcmf_dbg(INFO, "power save set to %s\n",
6613                   (power_mode ? "enabled" : "disabled"));
6614
6615         err = brcmf_dongle_roam(ifp);
6616         if (err)
6617                 goto default_conf_out;
6618         err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
6619                                           NULL, NULL);
6620         if (err)
6621                 goto default_conf_out;
6622
6623         brcmf_configure_arp_nd_offload(ifp, true);
6624
6625         cfg->dongle_up = true;
6626 default_conf_out:
6627
6628         return err;
6629
6630 }
6631
6632 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
6633 {
6634         set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6635
6636         return brcmf_config_dongle(ifp->drvr->config);
6637 }
6638
6639 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
6640 {
6641         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6642
6643         /*
6644          * While going down, if associated with AP disassociate
6645          * from AP to save power
6646          */
6647         if (check_vif_up(ifp->vif)) {
6648                 brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
6649
6650                 /* Make sure WPA_Supplicant receives all the event
6651                    generated due to DISASSOC call to the fw to keep
6652                    the state fw and WPA_Supplicant state consistent
6653                  */
6654                 brcmf_delay(500);
6655         }
6656
6657         brcmf_abort_scanning(cfg);
6658         clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
6659
6660         return 0;
6661 }
6662
6663 s32 brcmf_cfg80211_up(struct net_device *ndev)
6664 {
6665         struct brcmf_if *ifp = netdev_priv(ndev);
6666         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6667         s32 err = 0;
6668
6669         mutex_lock(&cfg->usr_sync);
6670         err = __brcmf_cfg80211_up(ifp);
6671         mutex_unlock(&cfg->usr_sync);
6672
6673         return err;
6674 }
6675
6676 s32 brcmf_cfg80211_down(struct net_device *ndev)
6677 {
6678         struct brcmf_if *ifp = netdev_priv(ndev);
6679         struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6680         s32 err = 0;
6681
6682         mutex_lock(&cfg->usr_sync);
6683         err = __brcmf_cfg80211_down(ifp);
6684         mutex_unlock(&cfg->usr_sync);
6685
6686         return err;
6687 }
6688
6689 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
6690 {
6691         struct wireless_dev *wdev = &ifp->vif->wdev;
6692
6693         return wdev->iftype;
6694 }
6695
6696 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
6697                              unsigned long state)
6698 {
6699         struct brcmf_cfg80211_vif *vif;
6700
6701         list_for_each_entry(vif, &cfg->vif_list, list) {
6702                 if (test_bit(state, &vif->sme_state))
6703                         return true;
6704         }
6705         return false;
6706 }
6707
6708 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
6709                                     u8 action)
6710 {
6711         u8 evt_action;
6712
6713         spin_lock(&event->vif_event_lock);
6714         evt_action = event->action;
6715         spin_unlock(&event->vif_event_lock);
6716         return evt_action == action;
6717 }
6718
6719 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
6720                                   struct brcmf_cfg80211_vif *vif)
6721 {
6722         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6723
6724         spin_lock(&event->vif_event_lock);
6725         event->vif = vif;
6726         event->action = 0;
6727         spin_unlock(&event->vif_event_lock);
6728 }
6729
6730 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
6731 {
6732         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6733         bool armed;
6734
6735         spin_lock(&event->vif_event_lock);
6736         armed = event->vif != NULL;
6737         spin_unlock(&event->vif_event_lock);
6738
6739         return armed;
6740 }
6741
6742 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
6743                                   u8 action, ulong timeout)
6744 {
6745         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6746
6747         return wait_event_timeout(event->vif_wq,
6748                                   vif_event_equals(event, action), timeout);
6749 }
6750
6751 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
6752                                         struct brcmf_fil_country_le *ccreq)
6753 {
6754         struct brcmfmac_pd_cc *country_codes;
6755         struct brcmfmac_pd_cc_entry *cc;
6756         s32 found_index;
6757         int i;
6758
6759         country_codes = drvr->settings->country_codes;
6760         if (!country_codes) {
6761                 brcmf_dbg(TRACE, "No country codes configured for device\n");
6762                 return -EINVAL;
6763         }
6764
6765         if ((alpha2[0] == ccreq->country_abbrev[0]) &&
6766             (alpha2[1] == ccreq->country_abbrev[1])) {
6767                 brcmf_dbg(TRACE, "Country code already set\n");
6768                 return -EAGAIN;
6769         }
6770
6771         found_index = -1;
6772         for (i = 0; i < country_codes->table_size; i++) {
6773                 cc = &country_codes->table[i];
6774                 if ((cc->iso3166[0] == '\0') && (found_index == -1))
6775                         found_index = i;
6776                 if ((cc->iso3166[0] == alpha2[0]) &&
6777                     (cc->iso3166[1] == alpha2[1])) {
6778                         found_index = i;
6779                         break;
6780                 }
6781         }
6782         if (found_index == -1) {
6783                 brcmf_dbg(TRACE, "No country code match found\n");
6784                 return -EINVAL;
6785         }
6786         memset(ccreq, 0, sizeof(*ccreq));
6787         ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
6788         memcpy(ccreq->ccode, country_codes->table[found_index].cc,
6789                BRCMF_COUNTRY_BUF_SZ);
6790         ccreq->country_abbrev[0] = alpha2[0];
6791         ccreq->country_abbrev[1] = alpha2[1];
6792         ccreq->country_abbrev[2] = 0;
6793
6794         return 0;
6795 }
6796
6797 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
6798                                         struct regulatory_request *req)
6799 {
6800         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
6801         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
6802         struct brcmf_fil_country_le ccreq;
6803         s32 err;
6804         int i;
6805
6806         /* ignore non-ISO3166 country codes */
6807         for (i = 0; i < 2; i++)
6808                 if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
6809                         brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
6810                                   req->alpha2[0], req->alpha2[1]);
6811                         return;
6812                 }
6813
6814         brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
6815                   req->alpha2[0], req->alpha2[1]);
6816
6817         err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
6818         if (err) {
6819                 brcmf_err("Country code iovar returned err = %d\n", err);
6820                 return;
6821         }
6822
6823         err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
6824         if (err)
6825                 return;
6826
6827         err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
6828         if (err) {
6829                 brcmf_err("Firmware rejected country setting\n");
6830                 return;
6831         }
6832         brcmf_setup_wiphybands(wiphy);
6833 }
6834
6835 static void brcmf_free_wiphy(struct wiphy *wiphy)
6836 {
6837         int i;
6838
6839         if (!wiphy)
6840                 return;
6841
6842         if (wiphy->iface_combinations) {
6843                 for (i = 0; i < wiphy->n_iface_combinations; i++)
6844                         kfree(wiphy->iface_combinations[i].limits);
6845         }
6846         kfree(wiphy->iface_combinations);
6847         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6848                 kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
6849                 kfree(wiphy->bands[NL80211_BAND_2GHZ]);
6850         }
6851         if (wiphy->bands[NL80211_BAND_5GHZ]) {
6852                 kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
6853                 kfree(wiphy->bands[NL80211_BAND_5GHZ]);
6854         }
6855         wiphy_free(wiphy);
6856 }
6857
6858 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
6859                                                   struct device *busdev,
6860                                                   bool p2pdev_forced)
6861 {
6862         struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
6863         struct brcmf_cfg80211_info *cfg;
6864         struct wiphy *wiphy;
6865         struct cfg80211_ops *ops;
6866         struct brcmf_cfg80211_vif *vif;
6867         struct brcmf_if *ifp;
6868         s32 err = 0;
6869         s32 io_type;
6870         u16 *cap = NULL;
6871
6872         if (!ndev) {
6873                 brcmf_err("ndev is invalid\n");
6874                 return NULL;
6875         }
6876
6877         ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
6878         if (!ops)
6879                 return NULL;
6880
6881         ifp = netdev_priv(ndev);
6882 #ifdef CONFIG_PM
6883         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
6884                 ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
6885 #endif
6886         wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
6887         if (!wiphy) {
6888                 brcmf_err("Could not allocate wiphy device\n");
6889                 goto ops_out;
6890         }
6891         memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
6892         set_wiphy_dev(wiphy, busdev);
6893
6894         cfg = wiphy_priv(wiphy);
6895         cfg->wiphy = wiphy;
6896         cfg->ops = ops;
6897         cfg->pub = drvr;
6898         init_vif_event(&cfg->vif_event);
6899         INIT_LIST_HEAD(&cfg->vif_list);
6900
6901         vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
6902         if (IS_ERR(vif))
6903                 goto wiphy_out;
6904
6905         vif->ifp = ifp;
6906         vif->wdev.netdev = ndev;
6907         ndev->ieee80211_ptr = &vif->wdev;
6908         SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
6909
6910         err = wl_init_priv(cfg);
6911         if (err) {
6912                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
6913                 brcmf_free_vif(vif);
6914                 goto wiphy_out;
6915         }
6916         ifp->vif = vif;
6917
6918         /* determine d11 io type before wiphy setup */
6919         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
6920         if (err) {
6921                 brcmf_err("Failed to get D11 version (%d)\n", err);
6922                 goto priv_out;
6923         }
6924         cfg->d11inf.io_type = (u8)io_type;
6925         brcmu_d11_attach(&cfg->d11inf);
6926
6927         err = brcmf_setup_wiphy(wiphy, ifp);
6928         if (err < 0)
6929                 goto priv_out;
6930
6931         brcmf_dbg(INFO, "Registering custom regulatory\n");
6932         wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
6933         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
6934         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
6935
6936         /* firmware defaults to 40MHz disabled in 2G band. We signal
6937          * cfg80211 here that we do and have it decide we can enable
6938          * it. But first check if device does support 2G operation.
6939          */
6940         if (wiphy->bands[NL80211_BAND_2GHZ]) {
6941                 cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
6942                 *cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6943         }
6944         err = wiphy_register(wiphy);
6945         if (err < 0) {
6946                 brcmf_err("Could not register wiphy device (%d)\n", err);
6947                 goto priv_out;
6948         }
6949
6950         err = brcmf_setup_wiphybands(wiphy);
6951         if (err) {
6952                 brcmf_err("Setting wiphy bands failed (%d)\n", err);
6953                 goto wiphy_unreg_out;
6954         }
6955
6956         /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
6957          * setup 40MHz in 2GHz band and enable OBSS scanning.
6958          */
6959         if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
6960                 err = brcmf_enable_bw40_2g(cfg);
6961                 if (!err)
6962                         err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
6963                                                       BRCMF_OBSS_COEX_AUTO);
6964                 else
6965                         *cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
6966         }
6967         /* p2p might require that "if-events" get processed by fweh. So
6968          * activate the already registered event handlers now and activate
6969          * the rest when initialization has completed. drvr->config needs to
6970          * be assigned before activating events.
6971          */
6972         drvr->config = cfg;
6973         err = brcmf_fweh_activate_events(ifp);
6974         if (err) {
6975                 brcmf_err("FWEH activation failed (%d)\n", err);
6976                 goto wiphy_unreg_out;
6977         }
6978
6979         err = brcmf_p2p_attach(cfg, p2pdev_forced);
6980         if (err) {
6981                 brcmf_err("P2P initilisation failed (%d)\n", err);
6982                 goto wiphy_unreg_out;
6983         }
6984         err = brcmf_btcoex_attach(cfg);
6985         if (err) {
6986                 brcmf_err("BT-coex initialisation failed (%d)\n", err);
6987                 brcmf_p2p_detach(&cfg->p2p);
6988                 goto wiphy_unreg_out;
6989         }
6990
6991         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
6992                 err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
6993                 if (err) {
6994                         brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
6995                         wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
6996                 } else {
6997                         brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
6998                                             brcmf_notify_tdls_peer_event);
6999                 }
7000         }
7001
7002         /* (re-) activate FWEH event handling */
7003         err = brcmf_fweh_activate_events(ifp);
7004         if (err) {
7005                 brcmf_err("FWEH activation failed (%d)\n", err);
7006                 goto wiphy_unreg_out;
7007         }
7008
7009         /* Fill in some of the advertised nl80211 supported features */
7010         if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
7011                 wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7012 #ifdef CONFIG_PM
7013                 if (wiphy->wowlan &&
7014                     wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
7015                         wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7016 #endif
7017         }
7018
7019         return cfg;
7020
7021 wiphy_unreg_out:
7022         wiphy_unregister(cfg->wiphy);
7023 priv_out:
7024         wl_deinit_priv(cfg);
7025         brcmf_free_vif(vif);
7026         ifp->vif = NULL;
7027 wiphy_out:
7028         brcmf_free_wiphy(wiphy);
7029 ops_out:
7030         kfree(ops);
7031         return NULL;
7032 }
7033
7034 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
7035 {
7036         if (!cfg)
7037                 return;
7038
7039         brcmf_btcoex_detach(cfg);
7040         wiphy_unregister(cfg->wiphy);
7041         kfree(cfg->ops);
7042         wl_deinit_priv(cfg);
7043         brcmf_free_wiphy(cfg->wiphy);
7044 }