1 /*
2  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
3  * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <net/netlink.h>
21 #include <net/cfg80211.h>
22 #include "wil6210.h"
23 #include "wmi.h"
24 #include "fw.h"
25 
26 #define WIL_MAX_ROC_DURATION_MS 5000
27 
28 bool disable_ap_sme;
29 module_param(disable_ap_sme, bool, 0444);
30 MODULE_PARM_DESC(disable_ap_sme, " let user space handle AP mode SME");
31 
32 #ifdef CONFIG_PM
33 static struct wiphy_wowlan_support wil_wowlan_support = {
34 	.flags = WIPHY_WOWLAN_ANY | WIPHY_WOWLAN_DISCONNECT,
35 };
36 #endif
37 
38 #define CHAN60G(_channel, _flags) {				\
39 	.band			= NL80211_BAND_60GHZ,		\
40 	.center_freq		= 56160 + (2160 * (_channel)),	\
41 	.hw_value		= (_channel),			\
42 	.flags			= (_flags),			\
43 	.max_antenna_gain	= 0,				\
44 	.max_power		= 40,				\
45 }
46 
47 static struct ieee80211_channel wil_60ghz_channels[] = {
48 	CHAN60G(1, 0),
49 	CHAN60G(2, 0),
50 	CHAN60G(3, 0),
51 	CHAN60G(4, 0),
52 };
53 
54 static void
55 wil_memdup_ie(u8 **pdst, size_t *pdst_len, const u8 *src, size_t src_len)
56 {
57 	kfree(*pdst);
58 	*pdst = NULL;
59 	*pdst_len = 0;
60 	if (src_len > 0) {
61 		*pdst = kmemdup(src, src_len, GFP_KERNEL);
62 		if (*pdst)
63 			*pdst_len = src_len;
64 	}
65 }
66 
67 static int wil_num_supported_channels(struct wil6210_priv *wil)
68 {
69 	int num_channels = ARRAY_SIZE(wil_60ghz_channels);
70 
71 	if (!test_bit(WMI_FW_CAPABILITY_CHANNEL_4, wil->fw_capabilities))
72 		num_channels--;
73 
74 	return num_channels;
75 }
76 
77 void update_supported_bands(struct wil6210_priv *wil)
78 {
79 	struct wiphy *wiphy = wil_to_wiphy(wil);
80 
81 	wil_dbg_misc(wil, "update supported bands");
82 
83 	wiphy->bands[NL80211_BAND_60GHZ]->n_channels =
84 						wil_num_supported_channels(wil);
85 }
86 
87 /* Vendor id to be used in vendor specific command and events
88  * to user space.
89  * NOTE: The authoritative place for definition of QCA_NL80211_VENDOR_ID,
90  * vendor subcmd definitions prefixed with QCA_NL80211_VENDOR_SUBCMD, and
91  * qca_wlan_vendor_attr is open source file src/common/qca-vendor.h in
92  * git://w1.fi/srv/git/hostap.git; the values here are just a copy of that
93  */
94 
95 #define QCA_NL80211_VENDOR_ID	0x001374
96 
97 #define WIL_MAX_RF_SECTORS (128)
98 #define WIL_CID_ALL (0xff)
99 
100 enum qca_wlan_vendor_attr_rf_sector {
101 	QCA_ATTR_MAC_ADDR = 6,
102 	QCA_ATTR_PAD = 13,
103 	QCA_ATTR_TSF = 29,
104 	QCA_ATTR_DMG_RF_SECTOR_INDEX = 30,
105 	QCA_ATTR_DMG_RF_SECTOR_TYPE = 31,
106 	QCA_ATTR_DMG_RF_MODULE_MASK = 32,
107 	QCA_ATTR_DMG_RF_SECTOR_CFG = 33,
108 	QCA_ATTR_DMG_RF_SECTOR_MAX,
109 };
110 
111 enum qca_wlan_vendor_attr_dmg_rf_sector_type {
112 	QCA_ATTR_DMG_RF_SECTOR_TYPE_RX,
113 	QCA_ATTR_DMG_RF_SECTOR_TYPE_TX,
114 	QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX
115 };
116 
117 enum qca_wlan_vendor_attr_dmg_rf_sector_cfg {
118 	QCA_ATTR_DMG_RF_SECTOR_CFG_INVALID = 0,
119 	QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
120 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
121 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
122 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
123 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
124 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
125 	QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
126 
127 	/* keep last */
128 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST,
129 	QCA_ATTR_DMG_RF_SECTOR_CFG_MAX =
130 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST - 1
131 };
132 
133 static const struct
134 nla_policy wil_rf_sector_policy[QCA_ATTR_DMG_RF_SECTOR_MAX + 1] = {
135 	[QCA_ATTR_MAC_ADDR] = { .len = ETH_ALEN },
136 	[QCA_ATTR_DMG_RF_SECTOR_INDEX] = { .type = NLA_U16 },
137 	[QCA_ATTR_DMG_RF_SECTOR_TYPE] = { .type = NLA_U8 },
138 	[QCA_ATTR_DMG_RF_MODULE_MASK] = { .type = NLA_U32 },
139 	[QCA_ATTR_DMG_RF_SECTOR_CFG] = { .type = NLA_NESTED },
140 };
141 
142 static const struct
143 nla_policy wil_rf_sector_cfg_policy[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1] = {
144 	[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] = { .type = NLA_U8 },
145 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] = { .type = NLA_U32 },
146 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] = { .type = NLA_U32 },
147 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] = { .type = NLA_U32 },
148 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] = { .type = NLA_U32 },
149 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] = { .type = NLA_U32 },
150 	[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16] = { .type = NLA_U32 },
151 };
152 
153 enum qca_nl80211_vendor_subcmds {
154 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG = 139,
155 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG = 140,
156 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR = 141,
157 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR = 142,
158 };
159 
160 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
161 				 struct wireless_dev *wdev,
162 				 const void *data, int data_len);
163 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
164 				 struct wireless_dev *wdev,
165 				 const void *data, int data_len);
166 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
167 				      struct wireless_dev *wdev,
168 				      const void *data, int data_len);
169 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
170 				      struct wireless_dev *wdev,
171 				      const void *data, int data_len);
172 
173 /* vendor specific commands */
174 static const struct wiphy_vendor_command wil_nl80211_vendor_commands[] = {
175 	{
176 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
177 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG,
178 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
179 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
180 		.doit = wil_rf_sector_get_cfg
181 	},
182 	{
183 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
184 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG,
185 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
186 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
187 		.doit = wil_rf_sector_set_cfg
188 	},
189 	{
190 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
191 		.info.subcmd =
192 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR,
193 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
194 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
195 		.doit = wil_rf_sector_get_selected
196 	},
197 	{
198 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
199 		.info.subcmd =
200 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR,
201 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
202 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
203 		.doit = wil_rf_sector_set_selected
204 	},
205 };
206 
207 static struct ieee80211_supported_band wil_band_60ghz = {
208 	.channels = wil_60ghz_channels,
209 	.n_channels = ARRAY_SIZE(wil_60ghz_channels),
210 	.ht_cap = {
211 		.ht_supported = true,
212 		.cap = 0, /* TODO */
213 		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
214 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
215 		.mcs = {
216 				/* MCS 1..12 - SC PHY */
217 			.rx_mask = {0xfe, 0x1f}, /* 1..12 */
218 			.tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
219 		},
220 	},
221 };
222 
223 static const struct ieee80211_txrx_stypes
224 wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
225 	[NL80211_IFTYPE_STATION] = {
226 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
227 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
228 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
229 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
230 	},
231 	[NL80211_IFTYPE_AP] = {
232 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
233 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4) |
234 		BIT(IEEE80211_STYPE_ASSOC_RESP >> 4) |
235 		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
236 		BIT(IEEE80211_STYPE_AUTH >> 4) |
237 		BIT(IEEE80211_STYPE_REASSOC_RESP >> 4),
238 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
239 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
240 		BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
241 		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
242 		BIT(IEEE80211_STYPE_AUTH >> 4) |
243 		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
244 		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4)
245 	},
246 	[NL80211_IFTYPE_P2P_CLIENT] = {
247 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
248 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
249 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
250 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
251 	},
252 	[NL80211_IFTYPE_P2P_GO] = {
253 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
254 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
255 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
256 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
257 	},
258 	[NL80211_IFTYPE_P2P_DEVICE] = {
259 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
260 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
261 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
262 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
263 	},
264 };
265 
266 static const u32 wil_cipher_suites[] = {
267 	WLAN_CIPHER_SUITE_GCMP,
268 };
269 
270 static const char * const key_usage_str[] = {
271 	[WMI_KEY_USE_PAIRWISE]	= "PTK",
272 	[WMI_KEY_USE_RX_GROUP]	= "RX_GTK",
273 	[WMI_KEY_USE_TX_GROUP]	= "TX_GTK",
274 };
275 
276 int wil_iftype_nl2wmi(enum nl80211_iftype type)
277 {
278 	static const struct {
279 		enum nl80211_iftype nl;
280 		enum wmi_network_type wmi;
281 	} __nl2wmi[] = {
282 		{NL80211_IFTYPE_ADHOC,		WMI_NETTYPE_ADHOC},
283 		{NL80211_IFTYPE_STATION,	WMI_NETTYPE_INFRA},
284 		{NL80211_IFTYPE_AP,		WMI_NETTYPE_AP},
285 		{NL80211_IFTYPE_P2P_CLIENT,	WMI_NETTYPE_P2P},
286 		{NL80211_IFTYPE_P2P_GO,		WMI_NETTYPE_P2P},
287 		{NL80211_IFTYPE_MONITOR,	WMI_NETTYPE_ADHOC}, /* FIXME */
288 	};
289 	uint i;
290 
291 	for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
292 		if (__nl2wmi[i].nl == type)
293 			return __nl2wmi[i].wmi;
294 	}
295 
296 	return -EOPNOTSUPP;
297 }
298 
299 int wil_cid_fill_sinfo(struct wil6210_vif *vif, int cid,
300 		       struct station_info *sinfo)
301 {
302 	struct wil6210_priv *wil = vif_to_wil(vif);
303 	struct wmi_notify_req_cmd cmd = {
304 		.cid = cid,
305 		.interval_usec = 0,
306 	};
307 	struct {
308 		struct wmi_cmd_hdr wmi;
309 		struct wmi_notify_req_done_event evt;
310 	} __packed reply;
311 	struct wil_net_stats *stats = &wil->sta[cid].stats;
312 	int rc;
313 
314 	memset(&reply, 0, sizeof(reply));
315 
316 	rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, vif->mid, &cmd, sizeof(cmd),
317 		      WMI_NOTIFY_REQ_DONE_EVENTID, &reply, sizeof(reply),
318 		      WIL_WMI_CALL_GENERAL_TO_MS);
319 	if (rc)
320 		return rc;
321 
322 	wil_dbg_wmi(wil, "Link status for CID %d MID %d: {\n"
323 		    "  MCS %d TSF 0x%016llx\n"
324 		    "  BF status 0x%08x RSSI %d SQI %d%%\n"
325 		    "  Tx Tpt %d goodput %d Rx goodput %d\n"
326 		    "  Sectors(rx:tx) my %d:%d peer %d:%d\n""}\n",
327 		    cid, vif->mid, le16_to_cpu(reply.evt.bf_mcs),
328 		    le64_to_cpu(reply.evt.tsf), reply.evt.status,
329 		    reply.evt.rssi,
330 		    reply.evt.sqi,
331 		    le32_to_cpu(reply.evt.tx_tpt),
332 		    le32_to_cpu(reply.evt.tx_goodput),
333 		    le32_to_cpu(reply.evt.rx_goodput),
334 		    le16_to_cpu(reply.evt.my_rx_sector),
335 		    le16_to_cpu(reply.evt.my_tx_sector),
336 		    le16_to_cpu(reply.evt.other_rx_sector),
337 		    le16_to_cpu(reply.evt.other_tx_sector));
338 
339 	sinfo->generation = wil->sinfo_gen;
340 
341 	sinfo->filled = BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
342 			BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
343 			BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
344 			BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
345 			BIT_ULL(NL80211_STA_INFO_RX_BITRATE) |
346 			BIT_ULL(NL80211_STA_INFO_TX_BITRATE) |
347 			BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
348 			BIT_ULL(NL80211_STA_INFO_TX_FAILED);
349 
350 	sinfo->txrate.flags = RATE_INFO_FLAGS_60G;
351 	sinfo->txrate.mcs = le16_to_cpu(reply.evt.bf_mcs);
352 	sinfo->rxrate.mcs = stats->last_mcs_rx;
353 	sinfo->rx_bytes = stats->rx_bytes;
354 	sinfo->rx_packets = stats->rx_packets;
355 	sinfo->rx_dropped_misc = stats->rx_dropped;
356 	sinfo->tx_bytes = stats->tx_bytes;
357 	sinfo->tx_packets = stats->tx_packets;
358 	sinfo->tx_failed = stats->tx_errors;
359 
360 	if (test_bit(wil_vif_fwconnected, vif->status)) {
361 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
362 		if (test_bit(WMI_FW_CAPABILITY_RSSI_REPORTING,
363 			     wil->fw_capabilities))
364 			sinfo->signal = reply.evt.rssi;
365 		else
366 			sinfo->signal = reply.evt.sqi;
367 	}
368 
369 	return rc;
370 }
371 
372 static int wil_cfg80211_get_station(struct wiphy *wiphy,
373 				    struct net_device *ndev,
374 				    const u8 *mac, struct station_info *sinfo)
375 {
376 	struct wil6210_vif *vif = ndev_to_vif(ndev);
377 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
378 	int rc;
379 
380 	int cid = wil_find_cid(wil, vif->mid, mac);
381 
382 	wil_dbg_misc(wil, "get_station: %pM CID %d MID %d\n", mac, cid,
383 		     vif->mid);
384 	if (!wil_cid_valid(wil, cid))
385 		return -ENOENT;
386 
387 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
388 
389 	return rc;
390 }
391 
392 /*
393  * Find @idx-th active STA for specific MID for station dump.
394  */
395 static int wil_find_cid_by_idx(struct wil6210_priv *wil, u8 mid, int idx)
396 {
397 	int i;
398 
399 	for (i = 0; i < wil->max_assoc_sta; i++) {
400 		if (wil->sta[i].status == wil_sta_unused)
401 			continue;
402 		if (wil->sta[i].mid != mid)
403 			continue;
404 		if (idx == 0)
405 			return i;
406 		idx--;
407 	}
408 
409 	return -ENOENT;
410 }
411 
412 static int wil_cfg80211_dump_station(struct wiphy *wiphy,
413 				     struct net_device *dev, int idx,
414 				     u8 *mac, struct station_info *sinfo)
415 {
416 	struct wil6210_vif *vif = ndev_to_vif(dev);
417 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
418 	int rc;
419 	int cid = wil_find_cid_by_idx(wil, vif->mid, idx);
420 
421 	if (!wil_cid_valid(wil, cid))
422 		return -ENOENT;
423 
424 	ether_addr_copy(mac, wil->sta[cid].addr);
425 	wil_dbg_misc(wil, "dump_station: %pM CID %d MID %d\n", mac, cid,
426 		     vif->mid);
427 
428 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
429 
430 	return rc;
431 }
432 
433 static int wil_cfg80211_start_p2p_device(struct wiphy *wiphy,
434 					 struct wireless_dev *wdev)
435 {
436 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
437 
438 	wil_dbg_misc(wil, "start_p2p_device: entered\n");
439 	wil->p2p_dev_started = 1;
440 	return 0;
441 }
442 
443 static void wil_cfg80211_stop_p2p_device(struct wiphy *wiphy,
444 					 struct wireless_dev *wdev)
445 {
446 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
447 
448 	if (!wil->p2p_dev_started)
449 		return;
450 
451 	wil_dbg_misc(wil, "stop_p2p_device: entered\n");
452 	mutex_lock(&wil->mutex);
453 	mutex_lock(&wil->vif_mutex);
454 	wil_p2p_stop_radio_operations(wil);
455 	wil->p2p_dev_started = 0;
456 	mutex_unlock(&wil->vif_mutex);
457 	mutex_unlock(&wil->mutex);
458 }
459 
460 static int wil_cfg80211_validate_add_iface(struct wil6210_priv *wil,
461 					   enum nl80211_iftype new_type)
462 {
463 	int i;
464 	struct wireless_dev *wdev;
465 	struct iface_combination_params params = {
466 		.num_different_channels = 1,
467 	};
468 
469 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
470 		if (wil->vifs[i]) {
471 			wdev = vif_to_wdev(wil->vifs[i]);
472 			params.iftype_num[wdev->iftype]++;
473 		}
474 	}
475 	params.iftype_num[new_type]++;
476 	return cfg80211_check_combinations(wil->wiphy, &params);
477 }
478 
479 static int wil_cfg80211_validate_change_iface(struct wil6210_priv *wil,
480 					      struct wil6210_vif *vif,
481 					      enum nl80211_iftype new_type)
482 {
483 	int i, ret = 0;
484 	struct wireless_dev *wdev;
485 	struct iface_combination_params params = {
486 		.num_different_channels = 1,
487 	};
488 	bool check_combos = false;
489 
490 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
491 		struct wil6210_vif *vif_pos = wil->vifs[i];
492 
493 		if (vif_pos && vif != vif_pos) {
494 			wdev = vif_to_wdev(vif_pos);
495 			params.iftype_num[wdev->iftype]++;
496 			check_combos = true;
497 		}
498 	}
499 
500 	if (check_combos) {
501 		params.iftype_num[new_type]++;
502 		ret = cfg80211_check_combinations(wil->wiphy, &params);
503 	}
504 	return ret;
505 }
506 
507 static struct wireless_dev *
508 wil_cfg80211_add_iface(struct wiphy *wiphy, const char *name,
509 		       unsigned char name_assign_type,
510 		       enum nl80211_iftype type,
511 		       struct vif_params *params)
512 {
513 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
514 	struct net_device *ndev_main = wil->main_ndev, *ndev;
515 	struct wil6210_vif *vif;
516 	struct wireless_dev *p2p_wdev, *wdev;
517 	int rc;
518 
519 	wil_dbg_misc(wil, "add_iface, type %d\n", type);
520 
521 	/* P2P device is not a real virtual interface, it is a management-only
522 	 * interface that shares the main interface.
523 	 * Skip concurrency checks here.
524 	 */
525 	if (type == NL80211_IFTYPE_P2P_DEVICE) {
526 		if (wil->p2p_wdev) {
527 			wil_err(wil, "P2P_DEVICE interface already created\n");
528 			return ERR_PTR(-EINVAL);
529 		}
530 
531 		p2p_wdev = kzalloc(sizeof(*p2p_wdev), GFP_KERNEL);
532 		if (!p2p_wdev)
533 			return ERR_PTR(-ENOMEM);
534 
535 		p2p_wdev->iftype = type;
536 		p2p_wdev->wiphy = wiphy;
537 		/* use our primary ethernet address */
538 		ether_addr_copy(p2p_wdev->address, ndev_main->perm_addr);
539 
540 		wil->p2p_wdev = p2p_wdev;
541 
542 		return p2p_wdev;
543 	}
544 
545 	if (!wil->wiphy->n_iface_combinations) {
546 		wil_err(wil, "virtual interfaces not supported\n");
547 		return ERR_PTR(-EINVAL);
548 	}
549 
550 	rc = wil_cfg80211_validate_add_iface(wil, type);
551 	if (rc) {
552 		wil_err(wil, "iface validation failed, err=%d\n", rc);
553 		return ERR_PTR(rc);
554 	}
555 
556 	vif = wil_vif_alloc(wil, name, name_assign_type, type);
557 	if (IS_ERR(vif))
558 		return ERR_CAST(vif);
559 
560 	ndev = vif_to_ndev(vif);
561 	ether_addr_copy(ndev->perm_addr, ndev_main->perm_addr);
562 	if (is_valid_ether_addr(params->macaddr)) {
563 		ether_addr_copy(ndev->dev_addr, params->macaddr);
564 	} else {
565 		ether_addr_copy(ndev->dev_addr, ndev_main->perm_addr);
566 		ndev->dev_addr[0] = (ndev->dev_addr[0] ^ (1 << vif->mid)) |
567 			0x2; /* locally administered */
568 	}
569 	wdev = vif_to_wdev(vif);
570 	ether_addr_copy(wdev->address, ndev->dev_addr);
571 
572 	rc = wil_vif_add(wil, vif);
573 	if (rc)
574 		goto out;
575 
576 	wil_info(wil, "added VIF, mid %d iftype %d MAC %pM\n",
577 		 vif->mid, type, wdev->address);
578 	return wdev;
579 out:
580 	wil_vif_free(vif);
581 	return ERR_PTR(rc);
582 }
583 
584 int wil_vif_prepare_stop(struct wil6210_vif *vif)
585 {
586 	struct wil6210_priv *wil = vif_to_wil(vif);
587 	struct wireless_dev *wdev = vif_to_wdev(vif);
588 	struct net_device *ndev;
589 	int rc;
590 
591 	if (wdev->iftype != NL80211_IFTYPE_AP)
592 		return 0;
593 
594 	ndev = vif_to_ndev(vif);
595 	if (netif_carrier_ok(ndev)) {
596 		rc = wmi_pcp_stop(vif);
597 		if (rc) {
598 			wil_info(wil, "failed to stop AP, status %d\n",
599 				 rc);
600 			/* continue */
601 		}
602 		wil_bcast_fini(vif);
603 		netif_carrier_off(ndev);
604 	}
605 
606 	return 0;
607 }
608 
609 static int wil_cfg80211_del_iface(struct wiphy *wiphy,
610 				  struct wireless_dev *wdev)
611 {
612 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
613 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
614 	int rc;
615 
616 	wil_dbg_misc(wil, "del_iface\n");
617 
618 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
619 		if (wdev != wil->p2p_wdev) {
620 			wil_err(wil, "delete of incorrect interface 0x%p\n",
621 				wdev);
622 			return -EINVAL;
623 		}
624 
625 		wil_cfg80211_stop_p2p_device(wiphy, wdev);
626 		wil_p2p_wdev_free(wil);
627 		return 0;
628 	}
629 
630 	if (vif->mid == 0) {
631 		wil_err(wil, "cannot remove the main interface\n");
632 		return -EINVAL;
633 	}
634 
635 	rc = wil_vif_prepare_stop(vif);
636 	if (rc)
637 		goto out;
638 
639 	wil_info(wil, "deleted VIF, mid %d iftype %d MAC %pM\n",
640 		 vif->mid, wdev->iftype, wdev->address);
641 
642 	wil_vif_remove(wil, vif->mid);
643 out:
644 	return rc;
645 }
646 
647 static bool wil_is_safe_switch(enum nl80211_iftype from,
648 			       enum nl80211_iftype to)
649 {
650 	if (from == NL80211_IFTYPE_STATION &&
651 	    to == NL80211_IFTYPE_P2P_CLIENT)
652 		return true;
653 
654 	return false;
655 }
656 
657 static int wil_cfg80211_change_iface(struct wiphy *wiphy,
658 				     struct net_device *ndev,
659 				     enum nl80211_iftype type,
660 				     struct vif_params *params)
661 {
662 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
663 	struct wil6210_vif *vif = ndev_to_vif(ndev);
664 	struct wireless_dev *wdev = vif_to_wdev(vif);
665 	int rc;
666 	bool fw_reset = false;
667 
668 	wil_dbg_misc(wil, "change_iface: type=%d\n", type);
669 
670 	if (wiphy->n_iface_combinations) {
671 		rc = wil_cfg80211_validate_change_iface(wil, vif, type);
672 		if (rc) {
673 			wil_err(wil, "iface validation failed, err=%d\n", rc);
674 			return rc;
675 		}
676 	}
677 
678 	/* do not reset FW when there are active VIFs,
679 	 * because it can cause significant disruption
680 	 */
681 	if (!wil_has_other_active_ifaces(wil, ndev, true, false) &&
682 	    netif_running(ndev) && !wil_is_recovery_blocked(wil) &&
683 	    !wil_is_safe_switch(wdev->iftype, type)) {
684 		wil_dbg_misc(wil, "interface is up. resetting...\n");
685 		mutex_lock(&wil->mutex);
686 		__wil_down(wil);
687 		rc = __wil_up(wil);
688 		mutex_unlock(&wil->mutex);
689 
690 		if (rc)
691 			return rc;
692 		fw_reset = true;
693 	}
694 
695 	switch (type) {
696 	case NL80211_IFTYPE_STATION:
697 	case NL80211_IFTYPE_AP:
698 	case NL80211_IFTYPE_P2P_CLIENT:
699 	case NL80211_IFTYPE_P2P_GO:
700 		break;
701 	case NL80211_IFTYPE_MONITOR:
702 		if (params->flags)
703 			wil->monitor_flags = params->flags;
704 		break;
705 	default:
706 		return -EOPNOTSUPP;
707 	}
708 
709 	if (vif->mid != 0 && wil_has_active_ifaces(wil, true, false)) {
710 		if (!fw_reset)
711 			wil_vif_prepare_stop(vif);
712 		rc = wmi_port_delete(wil, vif->mid);
713 		if (rc)
714 			return rc;
715 		rc = wmi_port_allocate(wil, vif->mid, ndev->dev_addr, type);
716 		if (rc)
717 			return rc;
718 	}
719 
720 	wdev->iftype = type;
721 	return 0;
722 }
723 
724 static int wil_cfg80211_scan(struct wiphy *wiphy,
725 			     struct cfg80211_scan_request *request)
726 {
727 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
728 	struct wireless_dev *wdev = request->wdev;
729 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
730 	struct {
731 		struct wmi_start_scan_cmd cmd;
732 		u16 chnl[4];
733 	} __packed cmd;
734 	uint i, n;
735 	int rc;
736 
737 	wil_dbg_misc(wil, "scan: wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
738 
739 	/* scan is supported on client interfaces and on AP interface */
740 	switch (wdev->iftype) {
741 	case NL80211_IFTYPE_STATION:
742 	case NL80211_IFTYPE_P2P_CLIENT:
743 	case NL80211_IFTYPE_P2P_DEVICE:
744 	case NL80211_IFTYPE_AP:
745 		break;
746 	default:
747 		return -EOPNOTSUPP;
748 	}
749 
750 	/* FW don't support scan after connection attempt */
751 	if (test_bit(wil_status_dontscan, wil->status)) {
752 		wil_err(wil, "Can't scan now\n");
753 		return -EBUSY;
754 	}
755 
756 	mutex_lock(&wil->mutex);
757 
758 	mutex_lock(&wil->vif_mutex);
759 	if (vif->scan_request || vif->p2p.discovery_started) {
760 		wil_err(wil, "Already scanning\n");
761 		mutex_unlock(&wil->vif_mutex);
762 		rc = -EAGAIN;
763 		goto out;
764 	}
765 	mutex_unlock(&wil->vif_mutex);
766 
767 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
768 		if (!wil->p2p_dev_started) {
769 			wil_err(wil, "P2P search requested on stopped P2P device\n");
770 			rc = -EIO;
771 			goto out;
772 		}
773 		/* social scan on P2P_DEVICE is handled as p2p search */
774 		if (wil_p2p_is_social_scan(request)) {
775 			vif->scan_request = request;
776 			if (vif->mid == 0)
777 				wil->radio_wdev = wdev;
778 			rc = wil_p2p_search(vif, request);
779 			if (rc) {
780 				if (vif->mid == 0)
781 					wil->radio_wdev =
782 						wil->main_ndev->ieee80211_ptr;
783 				vif->scan_request = NULL;
784 			}
785 			goto out;
786 		}
787 	}
788 
789 	(void)wil_p2p_stop_discovery(vif);
790 
791 	wil_dbg_misc(wil, "Start scan_request 0x%p\n", request);
792 	wil_dbg_misc(wil, "SSID count: %d", request->n_ssids);
793 
794 	for (i = 0; i < request->n_ssids; i++) {
795 		wil_dbg_misc(wil, "SSID[%d]", i);
796 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
797 				  request->ssids[i].ssid,
798 				  request->ssids[i].ssid_len, true);
799 	}
800 
801 	if (request->n_ssids)
802 		rc = wmi_set_ssid(vif, request->ssids[0].ssid_len,
803 				  request->ssids[0].ssid);
804 	else
805 		rc = wmi_set_ssid(vif, 0, NULL);
806 
807 	if (rc) {
808 		wil_err(wil, "set SSID for scan request failed: %d\n", rc);
809 		goto out;
810 	}
811 
812 	vif->scan_request = request;
813 	mod_timer(&vif->scan_timer, jiffies + WIL6210_SCAN_TO);
814 
815 	memset(&cmd, 0, sizeof(cmd));
816 	cmd.cmd.scan_type = WMI_ACTIVE_SCAN;
817 	cmd.cmd.num_channels = 0;
818 	n = min(request->n_channels, 4U);
819 	for (i = 0; i < n; i++) {
820 		int ch = request->channels[i]->hw_value;
821 
822 		if (ch == 0) {
823 			wil_err(wil,
824 				"Scan requested for unknown frequency %dMhz\n",
825 				request->channels[i]->center_freq);
826 			continue;
827 		}
828 		/* 0-based channel indexes */
829 		cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
830 		wil_dbg_misc(wil, "Scan for ch %d  : %d MHz\n", ch,
831 			     request->channels[i]->center_freq);
832 	}
833 
834 	if (request->ie_len)
835 		wil_hex_dump_misc("Scan IE ", DUMP_PREFIX_OFFSET, 16, 1,
836 				  request->ie, request->ie_len, true);
837 	else
838 		wil_dbg_misc(wil, "Scan has no IE's\n");
839 
840 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
841 			request->ie_len, request->ie);
842 	if (rc)
843 		goto out_restore;
844 
845 	if (wil->discovery_mode && cmd.cmd.scan_type == WMI_ACTIVE_SCAN) {
846 		cmd.cmd.discovery_mode = 1;
847 		wil_dbg_misc(wil, "active scan with discovery_mode=1\n");
848 	}
849 
850 	if (vif->mid == 0)
851 		wil->radio_wdev = wdev;
852 	rc = wmi_send(wil, WMI_START_SCAN_CMDID, vif->mid,
853 		      &cmd, sizeof(cmd.cmd) +
854 		      cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
855 
856 out_restore:
857 	if (rc) {
858 		del_timer_sync(&vif->scan_timer);
859 		if (vif->mid == 0)
860 			wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
861 		vif->scan_request = NULL;
862 	}
863 out:
864 	mutex_unlock(&wil->mutex);
865 	return rc;
866 }
867 
868 static void wil_cfg80211_abort_scan(struct wiphy *wiphy,
869 				    struct wireless_dev *wdev)
870 {
871 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
872 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
873 
874 	wil_dbg_misc(wil, "wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
875 
876 	mutex_lock(&wil->mutex);
877 	mutex_lock(&wil->vif_mutex);
878 
879 	if (!vif->scan_request)
880 		goto out;
881 
882 	if (wdev != vif->scan_request->wdev) {
883 		wil_dbg_misc(wil, "abort scan was called on the wrong iface\n");
884 		goto out;
885 	}
886 
887 	if (wdev == wil->p2p_wdev && wil->radio_wdev == wil->p2p_wdev)
888 		wil_p2p_stop_radio_operations(wil);
889 	else
890 		wil_abort_scan(vif, true);
891 
892 out:
893 	mutex_unlock(&wil->vif_mutex);
894 	mutex_unlock(&wil->mutex);
895 }
896 
897 static void wil_print_crypto(struct wil6210_priv *wil,
898 			     struct cfg80211_crypto_settings *c)
899 {
900 	int i, n;
901 
902 	wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
903 		     c->wpa_versions, c->cipher_group);
904 	wil_dbg_misc(wil, "Pairwise ciphers [%d] {\n", c->n_ciphers_pairwise);
905 	n = min_t(int, c->n_ciphers_pairwise, ARRAY_SIZE(c->ciphers_pairwise));
906 	for (i = 0; i < n; i++)
907 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
908 			     c->ciphers_pairwise[i]);
909 	wil_dbg_misc(wil, "}\n");
910 	wil_dbg_misc(wil, "AKM suites [%d] {\n", c->n_akm_suites);
911 	n = min_t(int, c->n_akm_suites, ARRAY_SIZE(c->akm_suites));
912 	for (i = 0; i < n; i++)
913 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
914 			     c->akm_suites[i]);
915 	wil_dbg_misc(wil, "}\n");
916 	wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
917 		     c->control_port, be16_to_cpu(c->control_port_ethertype),
918 		     c->control_port_no_encrypt);
919 }
920 
921 static const char *
922 wil_get_auth_type_name(enum nl80211_auth_type auth_type)
923 {
924 	switch (auth_type) {
925 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
926 		return "OPEN_SYSTEM";
927 	case NL80211_AUTHTYPE_SHARED_KEY:
928 		return "SHARED_KEY";
929 	case NL80211_AUTHTYPE_FT:
930 		return "FT";
931 	case NL80211_AUTHTYPE_NETWORK_EAP:
932 		return "NETWORK_EAP";
933 	case NL80211_AUTHTYPE_SAE:
934 		return "SAE";
935 	case NL80211_AUTHTYPE_AUTOMATIC:
936 		return "AUTOMATIC";
937 	default:
938 		return "unknown";
939 	}
940 }
941 static void wil_print_connect_params(struct wil6210_priv *wil,
942 				     struct cfg80211_connect_params *sme)
943 {
944 	wil_info(wil, "Connecting to:\n");
945 	if (sme->channel) {
946 		wil_info(wil, "  Channel: %d freq %d\n",
947 			 sme->channel->hw_value, sme->channel->center_freq);
948 	}
949 	if (sme->bssid)
950 		wil_info(wil, "  BSSID: %pM\n", sme->bssid);
951 	if (sme->ssid)
952 		print_hex_dump(KERN_INFO, "  SSID: ", DUMP_PREFIX_OFFSET,
953 			       16, 1, sme->ssid, sme->ssid_len, true);
954 	if (sme->prev_bssid)
955 		wil_info(wil, "  Previous BSSID=%pM\n", sme->prev_bssid);
956 	wil_info(wil, "  Auth Type: %s\n",
957 		 wil_get_auth_type_name(sme->auth_type));
958 	wil_info(wil, "  Privacy: %s\n", sme->privacy ? "secure" : "open");
959 	wil_info(wil, "  PBSS: %d\n", sme->pbss);
960 	wil_print_crypto(wil, &sme->crypto);
961 }
962 
963 static int wil_ft_connect(struct wiphy *wiphy,
964 			  struct net_device *ndev,
965 			  struct cfg80211_connect_params *sme)
966 {
967 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
968 	struct wil6210_vif *vif = ndev_to_vif(ndev);
969 	struct wmi_ft_auth_cmd auth_cmd;
970 	int rc;
971 
972 	if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING, wil->fw_capabilities)) {
973 		wil_err(wil, "FT: FW does not support FT roaming\n");
974 		return -EOPNOTSUPP;
975 	}
976 
977 	if (!sme->prev_bssid) {
978 		wil_err(wil, "FT: prev_bssid was not set\n");
979 		return -EINVAL;
980 	}
981 
982 	if (ether_addr_equal(sme->prev_bssid, sme->bssid)) {
983 		wil_err(wil, "FT: can not roam to same AP\n");
984 		return -EINVAL;
985 	}
986 
987 	if (!test_bit(wil_vif_fwconnected, vif->status)) {
988 		wil_err(wil, "FT: roam while not connected\n");
989 		return -EINVAL;
990 	}
991 
992 	if (vif->privacy != sme->privacy) {
993 		wil_err(wil, "FT: privacy mismatch, current (%d) roam (%d)\n",
994 			vif->privacy, sme->privacy);
995 		return -EINVAL;
996 	}
997 
998 	if (sme->pbss) {
999 		wil_err(wil, "FT: roam is not valid for PBSS\n");
1000 		return -EINVAL;
1001 	}
1002 
1003 	memset(&auth_cmd, 0, sizeof(auth_cmd));
1004 	auth_cmd.channel = sme->channel->hw_value - 1;
1005 	ether_addr_copy(auth_cmd.bssid, sme->bssid);
1006 
1007 	wil_info(wil, "FT: roaming\n");
1008 
1009 	set_bit(wil_vif_ft_roam, vif->status);
1010 	rc = wmi_send(wil, WMI_FT_AUTH_CMDID, vif->mid,
1011 		      &auth_cmd, sizeof(auth_cmd));
1012 	if (rc == 0)
1013 		mod_timer(&vif->connect_timer,
1014 			  jiffies + msecs_to_jiffies(5000));
1015 	else
1016 		clear_bit(wil_vif_ft_roam, vif->status);
1017 
1018 	return rc;
1019 }
1020 
1021 static int wil_cfg80211_connect(struct wiphy *wiphy,
1022 				struct net_device *ndev,
1023 				struct cfg80211_connect_params *sme)
1024 {
1025 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1026 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1027 	struct cfg80211_bss *bss;
1028 	struct wmi_connect_cmd conn;
1029 	const u8 *ssid_eid;
1030 	const u8 *rsn_eid;
1031 	int ch;
1032 	int rc = 0;
1033 	bool is_ft_roam = false;
1034 	u8 network_type;
1035 	enum ieee80211_bss_type bss_type = IEEE80211_BSS_TYPE_ESS;
1036 
1037 	wil_dbg_misc(wil, "connect, mid=%d\n", vif->mid);
1038 	wil_print_connect_params(wil, sme);
1039 
1040 	if (sme->auth_type == NL80211_AUTHTYPE_FT)
1041 		is_ft_roam = true;
1042 	if (sme->auth_type == NL80211_AUTHTYPE_AUTOMATIC &&
1043 	    test_bit(wil_vif_fwconnected, vif->status))
1044 		is_ft_roam = true;
1045 
1046 	if (!is_ft_roam)
1047 		if (test_bit(wil_vif_fwconnecting, vif->status) ||
1048 		    test_bit(wil_vif_fwconnected, vif->status))
1049 			return -EALREADY;
1050 
1051 	if (sme->ie_len > WMI_MAX_IE_LEN) {
1052 		wil_err(wil, "IE too large (%td bytes)\n", sme->ie_len);
1053 		return -ERANGE;
1054 	}
1055 
1056 	rsn_eid = sme->ie ?
1057 			cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
1058 			NULL;
1059 	if (sme->privacy && !rsn_eid) {
1060 		wil_info(wil, "WSC connection\n");
1061 		if (is_ft_roam) {
1062 			wil_err(wil, "No WSC with FT roam\n");
1063 			return -EINVAL;
1064 		}
1065 	}
1066 
1067 	if (sme->pbss)
1068 		bss_type = IEEE80211_BSS_TYPE_PBSS;
1069 
1070 	bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
1071 			       sme->ssid, sme->ssid_len,
1072 			       bss_type, IEEE80211_PRIVACY_ANY);
1073 	if (!bss) {
1074 		wil_err(wil, "Unable to find BSS\n");
1075 		return -ENOENT;
1076 	}
1077 
1078 	ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
1079 	if (!ssid_eid) {
1080 		wil_err(wil, "No SSID\n");
1081 		rc = -ENOENT;
1082 		goto out;
1083 	}
1084 	vif->privacy = sme->privacy;
1085 	vif->pbss = sme->pbss;
1086 
1087 	rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
1088 	if (rc)
1089 		goto out;
1090 
1091 	switch (bss->capability & WLAN_CAPABILITY_DMG_TYPE_MASK) {
1092 	case WLAN_CAPABILITY_DMG_TYPE_AP:
1093 		network_type = WMI_NETTYPE_INFRA;
1094 		break;
1095 	case WLAN_CAPABILITY_DMG_TYPE_PBSS:
1096 		network_type = WMI_NETTYPE_P2P;
1097 		break;
1098 	default:
1099 		wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
1100 			bss->capability);
1101 		rc = -EINVAL;
1102 		goto out;
1103 	}
1104 
1105 	ch = bss->channel->hw_value;
1106 	if (ch == 0) {
1107 		wil_err(wil, "BSS at unknown frequency %dMhz\n",
1108 			bss->channel->center_freq);
1109 		rc = -EOPNOTSUPP;
1110 		goto out;
1111 	}
1112 
1113 	if (is_ft_roam) {
1114 		if (network_type != WMI_NETTYPE_INFRA) {
1115 			wil_err(wil, "FT: Unsupported BSS type, capability= 0x%04x\n",
1116 				bss->capability);
1117 			rc = -EINVAL;
1118 			goto out;
1119 		}
1120 		rc = wil_ft_connect(wiphy, ndev, sme);
1121 		if (rc == 0)
1122 			vif->bss = bss;
1123 		goto out;
1124 	}
1125 
1126 	if (vif->privacy) {
1127 		/* For secure assoc, remove old keys */
1128 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
1129 					WMI_KEY_USE_PAIRWISE);
1130 		if (rc) {
1131 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(PTK) failed\n");
1132 			goto out;
1133 		}
1134 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
1135 					WMI_KEY_USE_RX_GROUP);
1136 		if (rc) {
1137 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(GTK) failed\n");
1138 			goto out;
1139 		}
1140 	}
1141 
1142 	/* WMI_CONNECT_CMD */
1143 	memset(&conn, 0, sizeof(conn));
1144 	conn.network_type = network_type;
1145 	if (vif->privacy) {
1146 		if (rsn_eid) { /* regular secure connection */
1147 			conn.dot11_auth_mode = WMI_AUTH11_SHARED;
1148 			conn.auth_mode = WMI_AUTH_WPA2_PSK;
1149 			conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
1150 			conn.pairwise_crypto_len = 16;
1151 			conn.group_crypto_type = WMI_CRYPT_AES_GCMP;
1152 			conn.group_crypto_len = 16;
1153 		} else { /* WSC */
1154 			conn.dot11_auth_mode = WMI_AUTH11_WSC;
1155 			conn.auth_mode = WMI_AUTH_NONE;
1156 		}
1157 	} else { /* insecure connection */
1158 		conn.dot11_auth_mode = WMI_AUTH11_OPEN;
1159 		conn.auth_mode = WMI_AUTH_NONE;
1160 	}
1161 
1162 	conn.ssid_len = min_t(u8, ssid_eid[1], 32);
1163 	memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
1164 	conn.channel = ch - 1;
1165 
1166 	ether_addr_copy(conn.bssid, bss->bssid);
1167 	ether_addr_copy(conn.dst_mac, bss->bssid);
1168 
1169 	set_bit(wil_vif_fwconnecting, vif->status);
1170 
1171 	rc = wmi_send(wil, WMI_CONNECT_CMDID, vif->mid, &conn, sizeof(conn));
1172 	if (rc == 0) {
1173 		netif_carrier_on(ndev);
1174 		if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1175 			wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1176 		vif->bss = bss;
1177 		/* Connect can take lots of time */
1178 		mod_timer(&vif->connect_timer,
1179 			  jiffies + msecs_to_jiffies(5000));
1180 	} else {
1181 		clear_bit(wil_vif_fwconnecting, vif->status);
1182 	}
1183 
1184  out:
1185 	cfg80211_put_bss(wiphy, bss);
1186 
1187 	return rc;
1188 }
1189 
1190 static int wil_cfg80211_disconnect(struct wiphy *wiphy,
1191 				   struct net_device *ndev,
1192 				   u16 reason_code)
1193 {
1194 	int rc;
1195 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1196 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1197 
1198 	wil_dbg_misc(wil, "disconnect: reason=%d, mid=%d\n",
1199 		     reason_code, vif->mid);
1200 
1201 	if (!(test_bit(wil_vif_fwconnecting, vif->status) ||
1202 	      test_bit(wil_vif_fwconnected, vif->status))) {
1203 		wil_err(wil, "Disconnect was called while disconnected\n");
1204 		return 0;
1205 	}
1206 
1207 	vif->locally_generated_disc = true;
1208 	rc = wmi_call(wil, WMI_DISCONNECT_CMDID, vif->mid, NULL, 0,
1209 		      WMI_DISCONNECT_EVENTID, NULL, 0,
1210 		      WIL6210_DISCONNECT_TO_MS);
1211 	if (rc)
1212 		wil_err(wil, "disconnect error %d\n", rc);
1213 
1214 	return rc;
1215 }
1216 
1217 static int wil_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1218 {
1219 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1220 	int rc;
1221 
1222 	/* these parameters are explicitly not supported */
1223 	if (changed & (WIPHY_PARAM_RETRY_LONG |
1224 		       WIPHY_PARAM_FRAG_THRESHOLD |
1225 		       WIPHY_PARAM_RTS_THRESHOLD))
1226 		return -ENOTSUPP;
1227 
1228 	if (changed & WIPHY_PARAM_RETRY_SHORT) {
1229 		rc = wmi_set_mgmt_retry(wil, wiphy->retry_short);
1230 		if (rc)
1231 			return rc;
1232 	}
1233 
1234 	return 0;
1235 }
1236 
1237 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
1238 			 struct cfg80211_mgmt_tx_params *params,
1239 			 u64 *cookie)
1240 {
1241 	const u8 *buf = params->buf;
1242 	size_t len = params->len;
1243 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1244 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1245 	int rc;
1246 	bool tx_status;
1247 
1248 	wil_dbg_misc(wil, "mgmt_tx: channel %d offchan %d, wait %d\n",
1249 		     params->chan ? params->chan->hw_value : -1,
1250 		     params->offchan,
1251 		     params->wait);
1252 
1253 	/* Note, currently we support the "wait" parameter only on AP mode.
1254 	 * In other modes, user-space must call remain_on_channel before
1255 	 * mgmt_tx or listen on a channel other than active one.
1256 	 */
1257 
1258 	if (params->chan && params->chan->hw_value == 0) {
1259 		wil_err(wil, "invalid channel\n");
1260 		return -EINVAL;
1261 	}
1262 
1263 	if (wdev->iftype != NL80211_IFTYPE_AP) {
1264 		wil_dbg_misc(wil,
1265 			     "send WMI_SW_TX_REQ_CMDID on non-AP interfaces\n");
1266 		rc = wmi_mgmt_tx(vif, buf, len);
1267 		goto out;
1268 	}
1269 
1270 	if (!params->chan || params->chan->hw_value == vif->channel) {
1271 		wil_dbg_misc(wil,
1272 			     "send WMI_SW_TX_REQ_CMDID for on-channel\n");
1273 		rc = wmi_mgmt_tx(vif, buf, len);
1274 		goto out;
1275 	}
1276 
1277 	if (params->offchan == 0) {
1278 		wil_err(wil,
1279 			"invalid channel params: current %d requested %d, off-channel not allowed\n",
1280 			vif->channel, params->chan->hw_value);
1281 		return -EBUSY;
1282 	}
1283 
1284 	/* use the wmi_mgmt_tx_ext only on AP mode and off-channel */
1285 	rc = wmi_mgmt_tx_ext(vif, buf, len, params->chan->hw_value,
1286 			     params->wait);
1287 
1288 out:
1289 	/* when the sent packet was not acked by receiver(ACK=0), rc will
1290 	 * be -EAGAIN. In this case this function needs to return success,
1291 	 * the ACK=0 will be reflected in tx_status.
1292 	 */
1293 	tx_status = (rc == 0);
1294 	rc = (rc == -EAGAIN) ? 0 : rc;
1295 	cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
1296 				tx_status, GFP_KERNEL);
1297 
1298 	return rc;
1299 }
1300 
1301 static int wil_cfg80211_set_channel(struct wiphy *wiphy,
1302 				    struct cfg80211_chan_def *chandef)
1303 {
1304 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1305 
1306 	wil->monitor_chandef = *chandef;
1307 
1308 	return 0;
1309 }
1310 
1311 static enum wmi_key_usage wil_detect_key_usage(struct wireless_dev *wdev,
1312 					       bool pairwise)
1313 {
1314 	struct wil6210_priv *wil = wdev_to_wil(wdev);
1315 	enum wmi_key_usage rc;
1316 
1317 	if (pairwise) {
1318 		rc = WMI_KEY_USE_PAIRWISE;
1319 	} else {
1320 		switch (wdev->iftype) {
1321 		case NL80211_IFTYPE_STATION:
1322 		case NL80211_IFTYPE_P2P_CLIENT:
1323 			rc = WMI_KEY_USE_RX_GROUP;
1324 			break;
1325 		case NL80211_IFTYPE_AP:
1326 		case NL80211_IFTYPE_P2P_GO:
1327 			rc = WMI_KEY_USE_TX_GROUP;
1328 			break;
1329 		default:
1330 			/* TODO: Rx GTK or Tx GTK? */
1331 			wil_err(wil, "Can't determine GTK type\n");
1332 			rc = WMI_KEY_USE_RX_GROUP;
1333 			break;
1334 		}
1335 	}
1336 	wil_dbg_misc(wil, "detect_key_usage: -> %s\n", key_usage_str[rc]);
1337 
1338 	return rc;
1339 }
1340 
1341 static struct wil_sta_info *
1342 wil_find_sta_by_key_usage(struct wil6210_priv *wil, u8 mid,
1343 			  enum wmi_key_usage key_usage, const u8 *mac_addr)
1344 {
1345 	int cid = -EINVAL;
1346 
1347 	if (key_usage == WMI_KEY_USE_TX_GROUP)
1348 		return NULL; /* not needed */
1349 
1350 	/* supplicant provides Rx group key in STA mode with NULL MAC address */
1351 	if (mac_addr)
1352 		cid = wil_find_cid(wil, mid, mac_addr);
1353 	else if (key_usage == WMI_KEY_USE_RX_GROUP)
1354 		cid = wil_find_cid_by_idx(wil, mid, 0);
1355 	if (cid < 0) {
1356 		wil_err(wil, "No CID for %pM %s\n", mac_addr,
1357 			key_usage_str[key_usage]);
1358 		return ERR_PTR(cid);
1359 	}
1360 
1361 	return &wil->sta[cid];
1362 }
1363 
1364 void wil_set_crypto_rx(u8 key_index, enum wmi_key_usage key_usage,
1365 		       struct wil_sta_info *cs,
1366 		       struct key_params *params)
1367 {
1368 	struct wil_tid_crypto_rx_single *cc;
1369 	int tid;
1370 
1371 	if (!cs)
1372 		return;
1373 
1374 	switch (key_usage) {
1375 	case WMI_KEY_USE_PAIRWISE:
1376 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1377 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1378 			if (params->seq)
1379 				memcpy(cc->pn, params->seq,
1380 				       IEEE80211_GCMP_PN_LEN);
1381 			else
1382 				memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1383 			cc->key_set = true;
1384 		}
1385 		break;
1386 	case WMI_KEY_USE_RX_GROUP:
1387 		cc = &cs->group_crypto_rx.key_id[key_index];
1388 		if (params->seq)
1389 			memcpy(cc->pn, params->seq, IEEE80211_GCMP_PN_LEN);
1390 		else
1391 			memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1392 		cc->key_set = true;
1393 		break;
1394 	default:
1395 		break;
1396 	}
1397 }
1398 
1399 static void wil_del_rx_key(u8 key_index, enum wmi_key_usage key_usage,
1400 			   struct wil_sta_info *cs)
1401 {
1402 	struct wil_tid_crypto_rx_single *cc;
1403 	int tid;
1404 
1405 	if (!cs)
1406 		return;
1407 
1408 	switch (key_usage) {
1409 	case WMI_KEY_USE_PAIRWISE:
1410 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1411 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1412 			cc->key_set = false;
1413 		}
1414 		break;
1415 	case WMI_KEY_USE_RX_GROUP:
1416 		cc = &cs->group_crypto_rx.key_id[key_index];
1417 		cc->key_set = false;
1418 		break;
1419 	default:
1420 		break;
1421 	}
1422 }
1423 
1424 static int wil_cfg80211_add_key(struct wiphy *wiphy,
1425 				struct net_device *ndev,
1426 				u8 key_index, bool pairwise,
1427 				const u8 *mac_addr,
1428 				struct key_params *params)
1429 {
1430 	int rc;
1431 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1432 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1433 	struct wireless_dev *wdev = vif_to_wdev(vif);
1434 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1435 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1436 							    key_usage,
1437 							    mac_addr);
1438 
1439 	if (!params) {
1440 		wil_err(wil, "NULL params\n");
1441 		return -EINVAL;
1442 	}
1443 
1444 	wil_dbg_misc(wil, "add_key: %pM %s[%d] PN %*phN\n",
1445 		     mac_addr, key_usage_str[key_usage], key_index,
1446 		     params->seq_len, params->seq);
1447 
1448 	if (IS_ERR(cs)) {
1449 		/* in FT, sta info may not be available as add_key may be
1450 		 * sent by host before FW sends WMI_CONNECT_EVENT
1451 		 */
1452 		if (!test_bit(wil_vif_ft_roam, vif->status)) {
1453 			wil_err(wil, "Not connected, %pM %s[%d] PN %*phN\n",
1454 				mac_addr, key_usage_str[key_usage], key_index,
1455 				params->seq_len, params->seq);
1456 			return -EINVAL;
1457 		}
1458 	}
1459 
1460 	if (!IS_ERR(cs))
1461 		wil_del_rx_key(key_index, key_usage, cs);
1462 
1463 	if (params->seq && params->seq_len != IEEE80211_GCMP_PN_LEN) {
1464 		wil_err(wil,
1465 			"Wrong PN len %d, %pM %s[%d] PN %*phN\n",
1466 			params->seq_len, mac_addr,
1467 			key_usage_str[key_usage], key_index,
1468 			params->seq_len, params->seq);
1469 		return -EINVAL;
1470 	}
1471 
1472 	rc = wmi_add_cipher_key(vif, key_index, mac_addr, params->key_len,
1473 				params->key, key_usage);
1474 	if (!rc && !IS_ERR(cs)) {
1475 		/* update local storage used for AP recovery */
1476 		if (key_usage == WMI_KEY_USE_TX_GROUP && params->key &&
1477 		    params->key_len <= WMI_MAX_KEY_LEN) {
1478 			vif->gtk_index = key_index;
1479 			memcpy(vif->gtk, params->key, params->key_len);
1480 			vif->gtk_len = params->key_len;
1481 		}
1482 		/* in FT set crypto will take place upon receiving
1483 		 * WMI_RING_EN_EVENTID event
1484 		 */
1485 		wil_set_crypto_rx(key_index, key_usage, cs, params);
1486 	}
1487 
1488 	return rc;
1489 }
1490 
1491 static int wil_cfg80211_del_key(struct wiphy *wiphy,
1492 				struct net_device *ndev,
1493 				u8 key_index, bool pairwise,
1494 				const u8 *mac_addr)
1495 {
1496 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1497 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1498 	struct wireless_dev *wdev = vif_to_wdev(vif);
1499 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1500 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1501 							    key_usage,
1502 							    mac_addr);
1503 
1504 	wil_dbg_misc(wil, "del_key: %pM %s[%d]\n", mac_addr,
1505 		     key_usage_str[key_usage], key_index);
1506 
1507 	if (IS_ERR(cs))
1508 		wil_info(wil, "Not connected, %pM %s[%d]\n",
1509 			 mac_addr, key_usage_str[key_usage], key_index);
1510 
1511 	if (!IS_ERR_OR_NULL(cs))
1512 		wil_del_rx_key(key_index, key_usage, cs);
1513 
1514 	return wmi_del_cipher_key(vif, key_index, mac_addr, key_usage);
1515 }
1516 
1517 /* Need to be present or wiphy_new() will WARN */
1518 static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
1519 					struct net_device *ndev,
1520 					u8 key_index, bool unicast,
1521 					bool multicast)
1522 {
1523 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1524 
1525 	wil_dbg_misc(wil, "set_default_key: entered\n");
1526 	return 0;
1527 }
1528 
1529 static int wil_remain_on_channel(struct wiphy *wiphy,
1530 				 struct wireless_dev *wdev,
1531 				 struct ieee80211_channel *chan,
1532 				 unsigned int duration,
1533 				 u64 *cookie)
1534 {
1535 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1536 	int rc;
1537 
1538 	wil_dbg_misc(wil,
1539 		     "remain_on_channel: center_freq=%d, duration=%d iftype=%d\n",
1540 		     chan->center_freq, duration, wdev->iftype);
1541 
1542 	rc = wil_p2p_listen(wil, wdev, duration, chan, cookie);
1543 	return rc;
1544 }
1545 
1546 static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
1547 					struct wireless_dev *wdev,
1548 					u64 cookie)
1549 {
1550 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1551 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1552 
1553 	wil_dbg_misc(wil, "cancel_remain_on_channel\n");
1554 
1555 	return wil_p2p_cancel_listen(vif, cookie);
1556 }
1557 
1558 /**
1559  * find a specific IE in a list of IEs
1560  * return a pointer to the beginning of IE in the list
1561  * or NULL if not found
1562  */
1563 static const u8 *_wil_cfg80211_find_ie(const u8 *ies, u16 ies_len, const u8 *ie,
1564 				       u16 ie_len)
1565 {
1566 	struct ieee80211_vendor_ie *vie;
1567 	u32 oui;
1568 
1569 	/* IE tag at offset 0, length at offset 1 */
1570 	if (ie_len < 2 || 2 + ie[1] > ie_len)
1571 		return NULL;
1572 
1573 	if (ie[0] != WLAN_EID_VENDOR_SPECIFIC)
1574 		return cfg80211_find_ie(ie[0], ies, ies_len);
1575 
1576 	/* make sure there is room for 3 bytes OUI + 1 byte OUI type */
1577 	if (ie[1] < 4)
1578 		return NULL;
1579 	vie = (struct ieee80211_vendor_ie *)ie;
1580 	oui = vie->oui[0] << 16 | vie->oui[1] << 8 | vie->oui[2];
1581 	return cfg80211_find_vendor_ie(oui, vie->oui_type, ies,
1582 				       ies_len);
1583 }
1584 
1585 /**
1586  * merge the IEs in two lists into a single list.
1587  * do not include IEs from the second list which exist in the first list.
1588  * add only vendor specific IEs from second list to keep
1589  * the merged list sorted (since vendor-specific IE has the
1590  * highest tag number)
1591  * caller must free the allocated memory for merged IEs
1592  */
1593 static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
1594 					 const u8 *ies2, u16 ies2_len,
1595 					 u8 **merged_ies, u16 *merged_len)
1596 {
1597 	u8 *buf, *dpos;
1598 	const u8 *spos;
1599 
1600 	if (!ies1)
1601 		ies1_len = 0;
1602 
1603 	if (!ies2)
1604 		ies2_len = 0;
1605 
1606 	if (ies1_len == 0 && ies2_len == 0) {
1607 		*merged_ies = NULL;
1608 		*merged_len = 0;
1609 		return 0;
1610 	}
1611 
1612 	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
1613 	if (!buf)
1614 		return -ENOMEM;
1615 	if (ies1)
1616 		memcpy(buf, ies1, ies1_len);
1617 	dpos = buf + ies1_len;
1618 	spos = ies2;
1619 	while (spos && (spos + 1 < ies2 + ies2_len)) {
1620 		/* IE tag at offset 0, length at offset 1 */
1621 		u16 ielen = 2 + spos[1];
1622 
1623 		if (spos + ielen > ies2 + ies2_len)
1624 			break;
1625 		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
1626 		    (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
1627 						     spos, ielen))) {
1628 			memcpy(dpos, spos, ielen);
1629 			dpos += ielen;
1630 		}
1631 		spos += ielen;
1632 	}
1633 
1634 	*merged_ies = buf;
1635 	*merged_len = dpos - buf;
1636 	return 0;
1637 }
1638 
1639 static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
1640 {
1641 	wil_hex_dump_misc("head     ", DUMP_PREFIX_OFFSET, 16, 1,
1642 			  b->head, b->head_len, true);
1643 	wil_hex_dump_misc("tail     ", DUMP_PREFIX_OFFSET, 16, 1,
1644 			  b->tail, b->tail_len, true);
1645 	wil_hex_dump_misc("BCON IE  ", DUMP_PREFIX_OFFSET, 16, 1,
1646 			  b->beacon_ies, b->beacon_ies_len, true);
1647 	wil_hex_dump_misc("PROBE    ", DUMP_PREFIX_OFFSET, 16, 1,
1648 			  b->probe_resp, b->probe_resp_len, true);
1649 	wil_hex_dump_misc("PROBE IE ", DUMP_PREFIX_OFFSET, 16, 1,
1650 			  b->proberesp_ies, b->proberesp_ies_len, true);
1651 	wil_hex_dump_misc("ASSOC IE ", DUMP_PREFIX_OFFSET, 16, 1,
1652 			  b->assocresp_ies, b->assocresp_ies_len, true);
1653 }
1654 
1655 /* internal functions for device reset and starting AP */
1656 static u8 *
1657 _wil_cfg80211_get_proberesp_ies(const u8 *proberesp, u16 proberesp_len,
1658 				u16 *ies_len)
1659 {
1660 	u8 *ies = NULL;
1661 
1662 	if (proberesp) {
1663 		struct ieee80211_mgmt *f =
1664 			(struct ieee80211_mgmt *)proberesp;
1665 		size_t hlen = offsetof(struct ieee80211_mgmt,
1666 				       u.probe_resp.variable);
1667 
1668 		ies = f->u.probe_resp.variable;
1669 		if (ies_len)
1670 			*ies_len = proberesp_len - hlen;
1671 	}
1672 
1673 	return ies;
1674 }
1675 
1676 static int _wil_cfg80211_set_ies(struct wil6210_vif *vif,
1677 				 struct cfg80211_beacon_data *bcon)
1678 {
1679 	int rc;
1680 	u16 len = 0, proberesp_len = 0;
1681 	u8 *ies = NULL, *proberesp;
1682 
1683 	/* update local storage used for AP recovery */
1684 	wil_memdup_ie(&vif->proberesp, &vif->proberesp_len, bcon->probe_resp,
1685 		      bcon->probe_resp_len);
1686 	wil_memdup_ie(&vif->proberesp_ies, &vif->proberesp_ies_len,
1687 		      bcon->proberesp_ies, bcon->proberesp_ies_len);
1688 	wil_memdup_ie(&vif->assocresp_ies, &vif->assocresp_ies_len,
1689 		      bcon->assocresp_ies, bcon->assocresp_ies_len);
1690 
1691 	proberesp = _wil_cfg80211_get_proberesp_ies(bcon->probe_resp,
1692 						    bcon->probe_resp_len,
1693 						    &proberesp_len);
1694 	rc = _wil_cfg80211_merge_extra_ies(proberesp,
1695 					   proberesp_len,
1696 					   bcon->proberesp_ies,
1697 					   bcon->proberesp_ies_len,
1698 					   &ies, &len);
1699 
1700 	if (rc)
1701 		goto out;
1702 
1703 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_RESP, len, ies);
1704 	if (rc)
1705 		goto out;
1706 
1707 	if (bcon->assocresp_ies)
1708 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP,
1709 				bcon->assocresp_ies_len, bcon->assocresp_ies);
1710 	else
1711 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP, len, ies);
1712 #if 0 /* to use beacon IE's, remove this #if 0 */
1713 	if (rc)
1714 		goto out;
1715 
1716 	rc = wmi_set_ie(vif, WMI_FRAME_BEACON,
1717 			bcon->tail_len, bcon->tail);
1718 #endif
1719 out:
1720 	kfree(ies);
1721 	return rc;
1722 }
1723 
1724 static int _wil_cfg80211_start_ap(struct wiphy *wiphy,
1725 				  struct net_device *ndev,
1726 				  const u8 *ssid, size_t ssid_len, u32 privacy,
1727 				  int bi, u8 chan,
1728 				  struct cfg80211_beacon_data *bcon,
1729 				  u8 hidden_ssid, u32 pbss)
1730 {
1731 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1732 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1733 	int rc;
1734 	struct wireless_dev *wdev = ndev->ieee80211_ptr;
1735 	u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
1736 	u8 is_go = (wdev->iftype == NL80211_IFTYPE_P2P_GO);
1737 	u16 proberesp_len = 0;
1738 	u8 *proberesp;
1739 	bool ft = false;
1740 
1741 	if (pbss)
1742 		wmi_nettype = WMI_NETTYPE_P2P;
1743 
1744 	wil_dbg_misc(wil, "start_ap: mid=%d, is_go=%d\n", vif->mid, is_go);
1745 	if (is_go && !pbss) {
1746 		wil_err(wil, "P2P GO must be in PBSS\n");
1747 		return -ENOTSUPP;
1748 	}
1749 
1750 	wil_set_recovery_state(wil, fw_recovery_idle);
1751 
1752 	proberesp = _wil_cfg80211_get_proberesp_ies(bcon->probe_resp,
1753 						    bcon->probe_resp_len,
1754 						    &proberesp_len);
1755 	/* check that the probe response IEs has a MDE */
1756 	if ((proberesp && proberesp_len > 0 &&
1757 	     cfg80211_find_ie(WLAN_EID_MOBILITY_DOMAIN,
1758 			      proberesp,
1759 			      proberesp_len)))
1760 		ft = true;
1761 
1762 	if (ft) {
1763 		if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING,
1764 			      wil->fw_capabilities)) {
1765 			wil_err(wil, "FW does not support FT roaming\n");
1766 			return -ENOTSUPP;
1767 		}
1768 		set_bit(wil_vif_ft_roam, vif->status);
1769 	}
1770 
1771 	mutex_lock(&wil->mutex);
1772 
1773 	if (!wil_has_other_active_ifaces(wil, ndev, true, false)) {
1774 		__wil_down(wil);
1775 		rc = __wil_up(wil);
1776 		if (rc)
1777 			goto out;
1778 	}
1779 
1780 	rc = wmi_set_ssid(vif, ssid_len, ssid);
1781 	if (rc)
1782 		goto out;
1783 
1784 	rc = _wil_cfg80211_set_ies(vif, bcon);
1785 	if (rc)
1786 		goto out;
1787 
1788 	vif->privacy = privacy;
1789 	vif->channel = chan;
1790 	vif->hidden_ssid = hidden_ssid;
1791 	vif->pbss = pbss;
1792 	vif->bi = bi;
1793 	memcpy(vif->ssid, ssid, ssid_len);
1794 	vif->ssid_len = ssid_len;
1795 
1796 	netif_carrier_on(ndev);
1797 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1798 		wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1799 
1800 	rc = wmi_pcp_start(vif, bi, wmi_nettype, chan, hidden_ssid, is_go);
1801 	if (rc)
1802 		goto err_pcp_start;
1803 
1804 	rc = wil_bcast_init(vif);
1805 	if (rc)
1806 		goto err_bcast;
1807 
1808 	goto out; /* success */
1809 
1810 err_bcast:
1811 	wmi_pcp_stop(vif);
1812 err_pcp_start:
1813 	netif_carrier_off(ndev);
1814 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1815 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1816 out:
1817 	mutex_unlock(&wil->mutex);
1818 	return rc;
1819 }
1820 
1821 void wil_cfg80211_ap_recovery(struct wil6210_priv *wil)
1822 {
1823 	int rc, i;
1824 	struct wiphy *wiphy = wil_to_wiphy(wil);
1825 
1826 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
1827 		struct wil6210_vif *vif = wil->vifs[i];
1828 		struct net_device *ndev;
1829 		struct cfg80211_beacon_data bcon = {};
1830 		struct key_params key_params = {};
1831 
1832 		if (!vif || vif->ssid_len == 0)
1833 			continue;
1834 
1835 		ndev = vif_to_ndev(vif);
1836 		bcon.proberesp_ies = vif->proberesp_ies;
1837 		bcon.assocresp_ies = vif->assocresp_ies;
1838 		bcon.probe_resp = vif->proberesp;
1839 		bcon.proberesp_ies_len = vif->proberesp_ies_len;
1840 		bcon.assocresp_ies_len = vif->assocresp_ies_len;
1841 		bcon.probe_resp_len = vif->proberesp_len;
1842 
1843 		wil_info(wil,
1844 			 "AP (vif %d) recovery: privacy %d, bi %d, channel %d, hidden %d, pbss %d\n",
1845 			 i, vif->privacy, vif->bi, vif->channel,
1846 			 vif->hidden_ssid, vif->pbss);
1847 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1848 				  vif->ssid, vif->ssid_len, true);
1849 		rc = _wil_cfg80211_start_ap(wiphy, ndev,
1850 					    vif->ssid, vif->ssid_len,
1851 					    vif->privacy, vif->bi,
1852 					    vif->channel, &bcon,
1853 					    vif->hidden_ssid, vif->pbss);
1854 		if (rc) {
1855 			wil_err(wil, "vif %d recovery failed (%d)\n", i, rc);
1856 			continue;
1857 		}
1858 
1859 		if (!vif->privacy || vif->gtk_len == 0)
1860 			continue;
1861 
1862 		key_params.key = vif->gtk;
1863 		key_params.key_len = vif->gtk_len;
1864 		key_params.seq_len = IEEE80211_GCMP_PN_LEN;
1865 		rc = wil_cfg80211_add_key(wiphy, ndev, vif->gtk_index, false,
1866 					  NULL, &key_params);
1867 		if (rc)
1868 			wil_err(wil, "vif %d recovery add key failed (%d)\n",
1869 				i, rc);
1870 	}
1871 }
1872 
1873 static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
1874 				      struct net_device *ndev,
1875 				      struct cfg80211_beacon_data *bcon)
1876 {
1877 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1878 	struct wireless_dev *wdev = ndev->ieee80211_ptr;
1879 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1880 	int rc;
1881 	u32 privacy = 0;
1882 
1883 	wil_dbg_misc(wil, "change_beacon, mid=%d\n", vif->mid);
1884 	wil_print_bcon_data(bcon);
1885 
1886 	if (bcon->tail &&
1887 	    cfg80211_find_ie(WLAN_EID_RSN, bcon->tail,
1888 			     bcon->tail_len))
1889 		privacy = 1;
1890 
1891 	memcpy(vif->ssid, wdev->ssid, wdev->ssid_len);
1892 	vif->ssid_len = wdev->ssid_len;
1893 
1894 	/* in case privacy has changed, need to restart the AP */
1895 	if (vif->privacy != privacy) {
1896 		wil_dbg_misc(wil, "privacy changed %d=>%d. Restarting AP\n",
1897 			     vif->privacy, privacy);
1898 
1899 		rc = _wil_cfg80211_start_ap(wiphy, ndev, vif->ssid,
1900 					    vif->ssid_len, privacy,
1901 					    wdev->beacon_interval,
1902 					    vif->channel, bcon,
1903 					    vif->hidden_ssid,
1904 					    vif->pbss);
1905 	} else {
1906 		rc = _wil_cfg80211_set_ies(vif, bcon);
1907 	}
1908 
1909 	return rc;
1910 }
1911 
1912 static int wil_cfg80211_start_ap(struct wiphy *wiphy,
1913 				 struct net_device *ndev,
1914 				 struct cfg80211_ap_settings *info)
1915 {
1916 	int rc;
1917 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1918 	struct ieee80211_channel *channel = info->chandef.chan;
1919 	struct cfg80211_beacon_data *bcon = &info->beacon;
1920 	struct cfg80211_crypto_settings *crypto = &info->crypto;
1921 	u8 hidden_ssid;
1922 
1923 	wil_dbg_misc(wil, "start_ap\n");
1924 
1925 	if (!channel) {
1926 		wil_err(wil, "AP: No channel???\n");
1927 		return -EINVAL;
1928 	}
1929 
1930 	switch (info->hidden_ssid) {
1931 	case NL80211_HIDDEN_SSID_NOT_IN_USE:
1932 		hidden_ssid = WMI_HIDDEN_SSID_DISABLED;
1933 		break;
1934 
1935 	case NL80211_HIDDEN_SSID_ZERO_LEN:
1936 		hidden_ssid = WMI_HIDDEN_SSID_SEND_EMPTY;
1937 		break;
1938 
1939 	case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
1940 		hidden_ssid = WMI_HIDDEN_SSID_CLEAR;
1941 		break;
1942 
1943 	default:
1944 		wil_err(wil, "AP: Invalid hidden SSID %d\n", info->hidden_ssid);
1945 		return -EOPNOTSUPP;
1946 	}
1947 	wil_dbg_misc(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
1948 		     channel->center_freq, info->privacy ? "secure" : "open");
1949 	wil_dbg_misc(wil, "Privacy: %d auth_type %d\n",
1950 		     info->privacy, info->auth_type);
1951 	wil_dbg_misc(wil, "Hidden SSID mode: %d\n",
1952 		     info->hidden_ssid);
1953 	wil_dbg_misc(wil, "BI %d DTIM %d\n", info->beacon_interval,
1954 		     info->dtim_period);
1955 	wil_dbg_misc(wil, "PBSS %d\n", info->pbss);
1956 	wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1957 			  info->ssid, info->ssid_len, true);
1958 	wil_print_bcon_data(bcon);
1959 	wil_print_crypto(wil, crypto);
1960 
1961 	rc = _wil_cfg80211_start_ap(wiphy, ndev,
1962 				    info->ssid, info->ssid_len, info->privacy,
1963 				    info->beacon_interval, channel->hw_value,
1964 				    bcon, hidden_ssid, info->pbss);
1965 
1966 	return rc;
1967 }
1968 
1969 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
1970 				struct net_device *ndev)
1971 {
1972 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1973 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1974 	bool last;
1975 
1976 	wil_dbg_misc(wil, "stop_ap, mid=%d\n", vif->mid);
1977 
1978 	netif_carrier_off(ndev);
1979 	last = !wil_has_other_active_ifaces(wil, ndev, false, true);
1980 	if (last) {
1981 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1982 		wil_set_recovery_state(wil, fw_recovery_idle);
1983 		set_bit(wil_status_resetting, wil->status);
1984 	}
1985 
1986 	mutex_lock(&wil->mutex);
1987 
1988 	wmi_pcp_stop(vif);
1989 	clear_bit(wil_vif_ft_roam, vif->status);
1990 	vif->ssid_len = 0;
1991 	wil_memdup_ie(&vif->proberesp, &vif->proberesp_len, NULL, 0);
1992 	wil_memdup_ie(&vif->proberesp_ies, &vif->proberesp_ies_len, NULL, 0);
1993 	wil_memdup_ie(&vif->assocresp_ies, &vif->assocresp_ies_len, NULL, 0);
1994 	memset(vif->gtk, 0, WMI_MAX_KEY_LEN);
1995 	vif->gtk_len = 0;
1996 
1997 	if (last)
1998 		__wil_down(wil);
1999 	else
2000 		wil_bcast_fini(vif);
2001 
2002 	mutex_unlock(&wil->mutex);
2003 
2004 	return 0;
2005 }
2006 
2007 static int wil_cfg80211_add_station(struct wiphy *wiphy,
2008 				    struct net_device *dev,
2009 				    const u8 *mac,
2010 				    struct station_parameters *params)
2011 {
2012 	struct wil6210_vif *vif = ndev_to_vif(dev);
2013 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2014 
2015 	wil_dbg_misc(wil, "add station %pM aid %d mid %d mask 0x%x set 0x%x\n",
2016 		     mac, params->aid, vif->mid,
2017 		     params->sta_flags_mask, params->sta_flags_set);
2018 
2019 	if (!disable_ap_sme) {
2020 		wil_err(wil, "not supported with AP SME enabled\n");
2021 		return -EOPNOTSUPP;
2022 	}
2023 
2024 	if (params->aid > WIL_MAX_DMG_AID) {
2025 		wil_err(wil, "invalid aid\n");
2026 		return -EINVAL;
2027 	}
2028 
2029 	return wmi_new_sta(vif, mac, params->aid);
2030 }
2031 
2032 static int wil_cfg80211_del_station(struct wiphy *wiphy,
2033 				    struct net_device *dev,
2034 				    struct station_del_parameters *params)
2035 {
2036 	struct wil6210_vif *vif = ndev_to_vif(dev);
2037 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2038 
2039 	wil_dbg_misc(wil, "del_station: %pM, reason=%d mid=%d\n",
2040 		     params->mac, params->reason_code, vif->mid);
2041 
2042 	mutex_lock(&wil->mutex);
2043 	wil6210_disconnect(vif, params->mac, params->reason_code);
2044 	mutex_unlock(&wil->mutex);
2045 
2046 	return 0;
2047 }
2048 
2049 static int wil_cfg80211_change_station(struct wiphy *wiphy,
2050 				       struct net_device *dev,
2051 				       const u8 *mac,
2052 				       struct station_parameters *params)
2053 {
2054 	struct wil6210_vif *vif = ndev_to_vif(dev);
2055 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2056 	int authorize;
2057 	int cid, i;
2058 	struct wil_ring_tx_data *txdata = NULL;
2059 
2060 	wil_dbg_misc(wil, "change station %pM mask 0x%x set 0x%x mid %d\n",
2061 		     mac, params->sta_flags_mask, params->sta_flags_set,
2062 		     vif->mid);
2063 
2064 	if (!disable_ap_sme) {
2065 		wil_dbg_misc(wil, "not supported with AP SME enabled\n");
2066 		return -EOPNOTSUPP;
2067 	}
2068 
2069 	if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
2070 		return 0;
2071 
2072 	cid = wil_find_cid(wil, vif->mid, mac);
2073 	if (cid < 0) {
2074 		wil_err(wil, "station not found\n");
2075 		return -ENOLINK;
2076 	}
2077 
2078 	for (i = 0; i < ARRAY_SIZE(wil->ring2cid_tid); i++)
2079 		if (wil->ring2cid_tid[i][0] == cid) {
2080 			txdata = &wil->ring_tx_data[i];
2081 			break;
2082 		}
2083 
2084 	if (!txdata) {
2085 		wil_err(wil, "ring data not found\n");
2086 		return -ENOLINK;
2087 	}
2088 
2089 	authorize = params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED);
2090 	txdata->dot1x_open = authorize ? 1 : 0;
2091 	wil_dbg_misc(wil, "cid %d ring %d authorize %d\n", cid, i,
2092 		     txdata->dot1x_open);
2093 
2094 	return 0;
2095 }
2096 
2097 /* probe_client handling */
2098 static void wil_probe_client_handle(struct wil6210_priv *wil,
2099 				    struct wil6210_vif *vif,
2100 				    struct wil_probe_client_req *req)
2101 {
2102 	struct net_device *ndev = vif_to_ndev(vif);
2103 	struct wil_sta_info *sta = &wil->sta[req->cid];
2104 	/* assume STA is alive if it is still connected,
2105 	 * else FW will disconnect it
2106 	 */
2107 	bool alive = (sta->status == wil_sta_connected);
2108 
2109 	cfg80211_probe_status(ndev, sta->addr, req->cookie, alive,
2110 			      0, false, GFP_KERNEL);
2111 }
2112 
2113 static struct list_head *next_probe_client(struct wil6210_vif *vif)
2114 {
2115 	struct list_head *ret = NULL;
2116 
2117 	mutex_lock(&vif->probe_client_mutex);
2118 
2119 	if (!list_empty(&vif->probe_client_pending)) {
2120 		ret = vif->probe_client_pending.next;
2121 		list_del(ret);
2122 	}
2123 
2124 	mutex_unlock(&vif->probe_client_mutex);
2125 
2126 	return ret;
2127 }
2128 
2129 void wil_probe_client_worker(struct work_struct *work)
2130 {
2131 	struct wil6210_vif *vif = container_of(work, struct wil6210_vif,
2132 					       probe_client_worker);
2133 	struct wil6210_priv *wil = vif_to_wil(vif);
2134 	struct wil_probe_client_req *req;
2135 	struct list_head *lh;
2136 
2137 	while ((lh = next_probe_client(vif)) != NULL) {
2138 		req = list_entry(lh, struct wil_probe_client_req, list);
2139 
2140 		wil_probe_client_handle(wil, vif, req);
2141 		kfree(req);
2142 	}
2143 }
2144 
2145 void wil_probe_client_flush(struct wil6210_vif *vif)
2146 {
2147 	struct wil_probe_client_req *req, *t;
2148 	struct wil6210_priv *wil = vif_to_wil(vif);
2149 
2150 	wil_dbg_misc(wil, "probe_client_flush\n");
2151 
2152 	mutex_lock(&vif->probe_client_mutex);
2153 
2154 	list_for_each_entry_safe(req, t, &vif->probe_client_pending, list) {
2155 		list_del(&req->list);
2156 		kfree(req);
2157 	}
2158 
2159 	mutex_unlock(&vif->probe_client_mutex);
2160 }
2161 
2162 static int wil_cfg80211_probe_client(struct wiphy *wiphy,
2163 				     struct net_device *dev,
2164 				     const u8 *peer, u64 *cookie)
2165 {
2166 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2167 	struct wil6210_vif *vif = ndev_to_vif(dev);
2168 	struct wil_probe_client_req *req;
2169 	int cid = wil_find_cid(wil, vif->mid, peer);
2170 
2171 	wil_dbg_misc(wil, "probe_client: %pM => CID %d MID %d\n",
2172 		     peer, cid, vif->mid);
2173 
2174 	if (cid < 0)
2175 		return -ENOLINK;
2176 
2177 	req = kzalloc(sizeof(*req), GFP_KERNEL);
2178 	if (!req)
2179 		return -ENOMEM;
2180 
2181 	req->cid = cid;
2182 	req->cookie = cid;
2183 
2184 	mutex_lock(&vif->probe_client_mutex);
2185 	list_add_tail(&req->list, &vif->probe_client_pending);
2186 	mutex_unlock(&vif->probe_client_mutex);
2187 
2188 	*cookie = req->cookie;
2189 	queue_work(wil->wq_service, &vif->probe_client_worker);
2190 	return 0;
2191 }
2192 
2193 static int wil_cfg80211_change_bss(struct wiphy *wiphy,
2194 				   struct net_device *dev,
2195 				   struct bss_parameters *params)
2196 {
2197 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2198 	struct wil6210_vif *vif = ndev_to_vif(dev);
2199 
2200 	if (params->ap_isolate >= 0) {
2201 		wil_dbg_misc(wil, "change_bss: ap_isolate MID %d, %d => %d\n",
2202 			     vif->mid, vif->ap_isolate, params->ap_isolate);
2203 		vif->ap_isolate = params->ap_isolate;
2204 	}
2205 
2206 	return 0;
2207 }
2208 
2209 static int wil_cfg80211_set_power_mgmt(struct wiphy *wiphy,
2210 				       struct net_device *dev,
2211 				       bool enabled, int timeout)
2212 {
2213 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2214 	enum wmi_ps_profile_type ps_profile;
2215 
2216 	wil_dbg_misc(wil, "enabled=%d, timeout=%d\n",
2217 		     enabled, timeout);
2218 
2219 	if (enabled)
2220 		ps_profile = WMI_PS_PROFILE_TYPE_DEFAULT;
2221 	else
2222 		ps_profile = WMI_PS_PROFILE_TYPE_PS_DISABLED;
2223 
2224 	return wil_ps_update(wil, ps_profile);
2225 }
2226 
2227 static int wil_cfg80211_suspend(struct wiphy *wiphy,
2228 				struct cfg80211_wowlan *wow)
2229 {
2230 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2231 	int rc;
2232 
2233 	/* Setting the wakeup trigger based on wow is TBD */
2234 
2235 	if (test_bit(wil_status_suspended, wil->status)) {
2236 		wil_dbg_pm(wil, "trying to suspend while suspended\n");
2237 		return 0;
2238 	}
2239 
2240 	rc = wil_can_suspend(wil, false);
2241 	if (rc)
2242 		goto out;
2243 
2244 	wil_dbg_pm(wil, "suspending\n");
2245 
2246 	mutex_lock(&wil->mutex);
2247 	mutex_lock(&wil->vif_mutex);
2248 	wil_p2p_stop_radio_operations(wil);
2249 	wil_abort_scan_all_vifs(wil, true);
2250 	mutex_unlock(&wil->vif_mutex);
2251 	mutex_unlock(&wil->mutex);
2252 
2253 out:
2254 	return rc;
2255 }
2256 
2257 static int wil_cfg80211_resume(struct wiphy *wiphy)
2258 {
2259 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2260 
2261 	wil_dbg_pm(wil, "resuming\n");
2262 
2263 	return 0;
2264 }
2265 
2266 static int
2267 wil_cfg80211_sched_scan_start(struct wiphy *wiphy,
2268 			      struct net_device *dev,
2269 			      struct cfg80211_sched_scan_request *request)
2270 {
2271 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2272 	struct wil6210_vif *vif = ndev_to_vif(dev);
2273 	int i, rc;
2274 
2275 	if (vif->mid != 0)
2276 		return -EOPNOTSUPP;
2277 
2278 	wil_dbg_misc(wil,
2279 		     "sched scan start: n_ssids %d, ie_len %zu, flags 0x%x\n",
2280 		     request->n_ssids, request->ie_len, request->flags);
2281 	for (i = 0; i < request->n_ssids; i++) {
2282 		wil_dbg_misc(wil, "SSID[%d]:", i);
2283 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
2284 				  request->ssids[i].ssid,
2285 				  request->ssids[i].ssid_len, true);
2286 	}
2287 	wil_dbg_misc(wil, "channels:");
2288 	for (i = 0; i < request->n_channels; i++)
2289 		wil_dbg_misc(wil, " %d%s", request->channels[i]->hw_value,
2290 			     i == request->n_channels - 1 ? "\n" : "");
2291 	wil_dbg_misc(wil, "n_match_sets %d, min_rssi_thold %d, delay %d\n",
2292 		     request->n_match_sets, request->min_rssi_thold,
2293 		     request->delay);
2294 	for (i = 0; i < request->n_match_sets; i++) {
2295 		struct cfg80211_match_set *ms = &request->match_sets[i];
2296 
2297 		wil_dbg_misc(wil, "MATCHSET[%d]: rssi_thold %d\n",
2298 			     i, ms->rssi_thold);
2299 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
2300 				  ms->ssid.ssid,
2301 				  ms->ssid.ssid_len, true);
2302 	}
2303 	wil_dbg_misc(wil, "n_scan_plans %d\n", request->n_scan_plans);
2304 	for (i = 0; i < request->n_scan_plans; i++) {
2305 		struct cfg80211_sched_scan_plan *sp = &request->scan_plans[i];
2306 
2307 		wil_dbg_misc(wil, "SCAN PLAN[%d]: interval %d iterations %d\n",
2308 			     i, sp->interval, sp->iterations);
2309 	}
2310 
2311 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
2312 			request->ie_len, request->ie);
2313 	if (rc)
2314 		return rc;
2315 	return wmi_start_sched_scan(wil, request);
2316 }
2317 
2318 static int
2319 wil_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev,
2320 			     u64 reqid)
2321 {
2322 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2323 	struct wil6210_vif *vif = ndev_to_vif(dev);
2324 	int rc;
2325 
2326 	if (vif->mid != 0)
2327 		return -EOPNOTSUPP;
2328 
2329 	rc = wmi_stop_sched_scan(wil);
2330 	/* device would return error if it thinks PNO is already stopped.
2331 	 * ignore the return code so user space and driver gets back in-sync
2332 	 */
2333 	wil_dbg_misc(wil, "sched scan stopped (%d)\n", rc);
2334 
2335 	return 0;
2336 }
2337 
2338 static int
2339 wil_cfg80211_update_ft_ies(struct wiphy *wiphy, struct net_device *dev,
2340 			   struct cfg80211_update_ft_ies_params *ftie)
2341 {
2342 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2343 	struct wil6210_vif *vif = ndev_to_vif(dev);
2344 	struct cfg80211_bss *bss;
2345 	struct wmi_ft_reassoc_cmd reassoc;
2346 	int rc = 0;
2347 
2348 	wil_dbg_misc(wil, "update ft ies, mid=%d\n", vif->mid);
2349 	wil_hex_dump_misc("FT IE ", DUMP_PREFIX_OFFSET, 16, 1,
2350 			  ftie->ie, ftie->ie_len, true);
2351 
2352 	if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING, wil->fw_capabilities)) {
2353 		wil_err(wil, "FW does not support FT roaming\n");
2354 		return -EOPNOTSUPP;
2355 	}
2356 
2357 	rc = wmi_update_ft_ies(vif, ftie->ie_len, ftie->ie);
2358 	if (rc)
2359 		return rc;
2360 
2361 	if (!test_bit(wil_vif_ft_roam, vif->status))
2362 		/* vif is not roaming */
2363 		return 0;
2364 
2365 	/* wil_vif_ft_roam is set. wil_cfg80211_update_ft_ies is used as
2366 	 * a trigger for reassoc
2367 	 */
2368 
2369 	bss = vif->bss;
2370 	if (!bss) {
2371 		wil_err(wil, "FT: bss is NULL\n");
2372 		return -EINVAL;
2373 	}
2374 
2375 	memset(&reassoc, 0, sizeof(reassoc));
2376 	ether_addr_copy(reassoc.bssid, bss->bssid);
2377 
2378 	rc = wmi_send(wil, WMI_FT_REASSOC_CMDID, vif->mid,
2379 		      &reassoc, sizeof(reassoc));
2380 	if (rc)
2381 		wil_err(wil, "FT: reassoc failed (%d)\n", rc);
2382 
2383 	return rc;
2384 }
2385 
2386 static const struct cfg80211_ops wil_cfg80211_ops = {
2387 	.add_virtual_intf = wil_cfg80211_add_iface,
2388 	.del_virtual_intf = wil_cfg80211_del_iface,
2389 	.scan = wil_cfg80211_scan,
2390 	.abort_scan = wil_cfg80211_abort_scan,
2391 	.connect = wil_cfg80211_connect,
2392 	.disconnect = wil_cfg80211_disconnect,
2393 	.set_wiphy_params = wil_cfg80211_set_wiphy_params,
2394 	.change_virtual_intf = wil_cfg80211_change_iface,
2395 	.get_station = wil_cfg80211_get_station,
2396 	.dump_station = wil_cfg80211_dump_station,
2397 	.remain_on_channel = wil_remain_on_channel,
2398 	.cancel_remain_on_channel = wil_cancel_remain_on_channel,
2399 	.mgmt_tx = wil_cfg80211_mgmt_tx,
2400 	.set_monitor_channel = wil_cfg80211_set_channel,
2401 	.add_key = wil_cfg80211_add_key,
2402 	.del_key = wil_cfg80211_del_key,
2403 	.set_default_key = wil_cfg80211_set_default_key,
2404 	/* AP mode */
2405 	.change_beacon = wil_cfg80211_change_beacon,
2406 	.start_ap = wil_cfg80211_start_ap,
2407 	.stop_ap = wil_cfg80211_stop_ap,
2408 	.add_station = wil_cfg80211_add_station,
2409 	.del_station = wil_cfg80211_del_station,
2410 	.change_station = wil_cfg80211_change_station,
2411 	.probe_client = wil_cfg80211_probe_client,
2412 	.change_bss = wil_cfg80211_change_bss,
2413 	/* P2P device */
2414 	.start_p2p_device = wil_cfg80211_start_p2p_device,
2415 	.stop_p2p_device = wil_cfg80211_stop_p2p_device,
2416 	.set_power_mgmt = wil_cfg80211_set_power_mgmt,
2417 	.suspend = wil_cfg80211_suspend,
2418 	.resume = wil_cfg80211_resume,
2419 	.sched_scan_start = wil_cfg80211_sched_scan_start,
2420 	.sched_scan_stop = wil_cfg80211_sched_scan_stop,
2421 	.update_ft_ies = wil_cfg80211_update_ft_ies,
2422 };
2423 
2424 static void wil_wiphy_init(struct wiphy *wiphy)
2425 {
2426 	wiphy->max_scan_ssids = 1;
2427 	wiphy->max_scan_ie_len = WMI_MAX_IE_LEN;
2428 	wiphy->max_remain_on_channel_duration = WIL_MAX_ROC_DURATION_MS;
2429 	wiphy->max_num_pmkids = 0 /* TODO: */;
2430 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2431 				 BIT(NL80211_IFTYPE_AP) |
2432 				 BIT(NL80211_IFTYPE_P2P_CLIENT) |
2433 				 BIT(NL80211_IFTYPE_P2P_GO) |
2434 				 BIT(NL80211_IFTYPE_P2P_DEVICE) |
2435 				 BIT(NL80211_IFTYPE_MONITOR);
2436 	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
2437 			WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
2438 			WIPHY_FLAG_PS_ON_BY_DEFAULT;
2439 	if (!disable_ap_sme)
2440 		wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
2441 	dev_dbg(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
2442 		__func__, wiphy->flags);
2443 	wiphy->probe_resp_offload =
2444 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
2445 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
2446 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
2447 
2448 	wiphy->bands[NL80211_BAND_60GHZ] = &wil_band_60ghz;
2449 
2450 	/* may change after reading FW capabilities */
2451 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
2452 
2453 	wiphy->cipher_suites = wil_cipher_suites;
2454 	wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
2455 	wiphy->mgmt_stypes = wil_mgmt_stypes;
2456 	wiphy->features |= NL80211_FEATURE_SK_TX_STATUS;
2457 
2458 	wiphy->n_vendor_commands = ARRAY_SIZE(wil_nl80211_vendor_commands);
2459 	wiphy->vendor_commands = wil_nl80211_vendor_commands;
2460 
2461 #ifdef CONFIG_PM
2462 	wiphy->wowlan = &wil_wowlan_support;
2463 #endif
2464 }
2465 
2466 int wil_cfg80211_iface_combinations_from_fw(
2467 	struct wil6210_priv *wil, const struct wil_fw_record_concurrency *conc)
2468 {
2469 	struct wiphy *wiphy = wil_to_wiphy(wil);
2470 	u32 total_limits = 0;
2471 	u16 n_combos;
2472 	const struct wil_fw_concurrency_combo *combo;
2473 	const struct wil_fw_concurrency_limit *limit;
2474 	struct ieee80211_iface_combination *iface_combinations;
2475 	struct ieee80211_iface_limit *iface_limit;
2476 	int i, j;
2477 
2478 	if (wiphy->iface_combinations) {
2479 		wil_dbg_misc(wil, "iface_combinations already set, skipping\n");
2480 		return 0;
2481 	}
2482 
2483 	combo = conc->combos;
2484 	n_combos = le16_to_cpu(conc->n_combos);
2485 	for (i = 0; i < n_combos; i++) {
2486 		total_limits += combo->n_limits;
2487 		limit = combo->limits + combo->n_limits;
2488 		combo = (struct wil_fw_concurrency_combo *)limit;
2489 	}
2490 
2491 	iface_combinations =
2492 		kzalloc(n_combos * sizeof(struct ieee80211_iface_combination) +
2493 			total_limits * sizeof(struct ieee80211_iface_limit),
2494 			GFP_KERNEL);
2495 	if (!iface_combinations)
2496 		return -ENOMEM;
2497 	iface_limit = (struct ieee80211_iface_limit *)(iface_combinations +
2498 						       n_combos);
2499 	combo = conc->combos;
2500 	for (i = 0; i < n_combos; i++) {
2501 		iface_combinations[i].max_interfaces = combo->max_interfaces;
2502 		iface_combinations[i].num_different_channels =
2503 			combo->n_diff_channels;
2504 		iface_combinations[i].beacon_int_infra_match =
2505 			combo->same_bi;
2506 		iface_combinations[i].n_limits = combo->n_limits;
2507 		wil_dbg_misc(wil,
2508 			     "iface_combination %d: max_if %d, num_ch %d, bi_match %d\n",
2509 			     i, iface_combinations[i].max_interfaces,
2510 			     iface_combinations[i].num_different_channels,
2511 			     iface_combinations[i].beacon_int_infra_match);
2512 		limit = combo->limits;
2513 		for (j = 0; j < combo->n_limits; j++) {
2514 			iface_limit[j].max = le16_to_cpu(limit[j].max);
2515 			iface_limit[j].types = le16_to_cpu(limit[j].types);
2516 			wil_dbg_misc(wil,
2517 				     "limit %d: max %d types 0x%x\n", j,
2518 				     iface_limit[j].max, iface_limit[j].types);
2519 		}
2520 		iface_combinations[i].limits = iface_limit;
2521 		iface_limit += combo->n_limits;
2522 		limit += combo->n_limits;
2523 		combo = (struct wil_fw_concurrency_combo *)limit;
2524 	}
2525 
2526 	wil_dbg_misc(wil, "multiple VIFs supported, n_mids %d\n", conc->n_mids);
2527 	wil->max_vifs = conc->n_mids + 1; /* including main interface */
2528 	if (wil->max_vifs > WIL_MAX_VIFS) {
2529 		wil_info(wil, "limited number of VIFs supported(%d, FW %d)\n",
2530 			 WIL_MAX_VIFS, wil->max_vifs);
2531 		wil->max_vifs = WIL_MAX_VIFS;
2532 	}
2533 	wiphy->n_iface_combinations = n_combos;
2534 	wiphy->iface_combinations = iface_combinations;
2535 	return 0;
2536 }
2537 
2538 struct wil6210_priv *wil_cfg80211_init(struct device *dev)
2539 {
2540 	struct wiphy *wiphy;
2541 	struct wil6210_priv *wil;
2542 	struct ieee80211_channel *ch;
2543 
2544 	dev_dbg(dev, "%s()\n", __func__);
2545 
2546 	/* Note: the wireless_dev structure is no longer allocated here.
2547 	 * Instead, it is allocated as part of the net_device structure
2548 	 * for main interface and each VIF.
2549 	 */
2550 	wiphy = wiphy_new(&wil_cfg80211_ops, sizeof(struct wil6210_priv));
2551 	if (!wiphy)
2552 		return ERR_PTR(-ENOMEM);
2553 
2554 	set_wiphy_dev(wiphy, dev);
2555 	wil_wiphy_init(wiphy);
2556 
2557 	wil = wiphy_to_wil(wiphy);
2558 	wil->wiphy = wiphy;
2559 
2560 	/* default monitor channel */
2561 	ch = wiphy->bands[NL80211_BAND_60GHZ]->channels;
2562 	cfg80211_chandef_create(&wil->monitor_chandef, ch, NL80211_CHAN_NO_HT);
2563 
2564 	return wil;
2565 }
2566 
2567 void wil_cfg80211_deinit(struct wil6210_priv *wil)
2568 {
2569 	struct wiphy *wiphy = wil_to_wiphy(wil);
2570 
2571 	dev_dbg(wil_to_dev(wil), "%s()\n", __func__);
2572 
2573 	if (!wiphy)
2574 		return;
2575 
2576 	kfree(wiphy->iface_combinations);
2577 	wiphy->iface_combinations = NULL;
2578 
2579 	wiphy_free(wiphy);
2580 	/* do not access wil6210_priv after returning from here */
2581 }
2582 
2583 void wil_p2p_wdev_free(struct wil6210_priv *wil)
2584 {
2585 	struct wireless_dev *p2p_wdev;
2586 
2587 	mutex_lock(&wil->vif_mutex);
2588 	p2p_wdev = wil->p2p_wdev;
2589 	wil->p2p_wdev = NULL;
2590 	wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
2591 	mutex_unlock(&wil->vif_mutex);
2592 	if (p2p_wdev) {
2593 		cfg80211_unregister_wdev(p2p_wdev);
2594 		kfree(p2p_wdev);
2595 	}
2596 }
2597 
2598 static int wil_rf_sector_status_to_rc(u8 status)
2599 {
2600 	switch (status) {
2601 	case WMI_RF_SECTOR_STATUS_SUCCESS:
2602 		return 0;
2603 	case WMI_RF_SECTOR_STATUS_BAD_PARAMETERS_ERROR:
2604 		return -EINVAL;
2605 	case WMI_RF_SECTOR_STATUS_BUSY_ERROR:
2606 		return -EAGAIN;
2607 	case WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR:
2608 		return -EOPNOTSUPP;
2609 	default:
2610 		return -EINVAL;
2611 	}
2612 }
2613 
2614 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
2615 				 struct wireless_dev *wdev,
2616 				 const void *data, int data_len)
2617 {
2618 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2619 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2620 	int rc;
2621 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2622 	u16 sector_index;
2623 	u8 sector_type;
2624 	u32 rf_modules_vec;
2625 	struct wmi_get_rf_sector_params_cmd cmd;
2626 	struct {
2627 		struct wmi_cmd_hdr wmi;
2628 		struct wmi_get_rf_sector_params_done_event evt;
2629 	} __packed reply = {
2630 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2631 	};
2632 	struct sk_buff *msg;
2633 	struct nlattr *nl_cfgs, *nl_cfg;
2634 	u32 i;
2635 	struct wmi_rf_sector_info *si;
2636 
2637 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2638 		return -EOPNOTSUPP;
2639 
2640 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2641 				  data_len, wil_rf_sector_policy, NULL);
2642 	if (rc) {
2643 		wil_err(wil, "Invalid rf sector ATTR\n");
2644 		return rc;
2645 	}
2646 
2647 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2648 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2649 	    !tb[QCA_ATTR_DMG_RF_MODULE_MASK]) {
2650 		wil_err(wil, "Invalid rf sector spec\n");
2651 		return -EINVAL;
2652 	}
2653 
2654 	sector_index = nla_get_u16(
2655 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2656 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2657 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2658 		return -EINVAL;
2659 	}
2660 
2661 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2662 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2663 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2664 		return -EINVAL;
2665 	}
2666 
2667 	rf_modules_vec = nla_get_u32(
2668 		tb[QCA_ATTR_DMG_RF_MODULE_MASK]);
2669 	if (rf_modules_vec >= BIT(WMI_MAX_RF_MODULES_NUM)) {
2670 		wil_err(wil, "Invalid rf module mask 0x%x\n", rf_modules_vec);
2671 		return -EINVAL;
2672 	}
2673 
2674 	cmd.sector_idx = cpu_to_le16(sector_index);
2675 	cmd.sector_type = sector_type;
2676 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2677 	rc = wmi_call(wil, WMI_GET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2678 		      &cmd, sizeof(cmd), WMI_GET_RF_SECTOR_PARAMS_DONE_EVENTID,
2679 		      &reply, sizeof(reply),
2680 		      500);
2681 	if (rc)
2682 		return rc;
2683 	if (reply.evt.status) {
2684 		wil_err(wil, "get rf sector cfg failed with status %d\n",
2685 			reply.evt.status);
2686 		return wil_rf_sector_status_to_rc(reply.evt.status);
2687 	}
2688 
2689 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2690 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2691 	if (!msg)
2692 		return -ENOMEM;
2693 
2694 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2695 			      le64_to_cpu(reply.evt.tsf),
2696 			      QCA_ATTR_PAD))
2697 		goto nla_put_failure;
2698 
2699 	nl_cfgs = nla_nest_start_noflag(msg, QCA_ATTR_DMG_RF_SECTOR_CFG);
2700 	if (!nl_cfgs)
2701 		goto nla_put_failure;
2702 	for (i = 0; i < WMI_MAX_RF_MODULES_NUM; i++) {
2703 		if (!(rf_modules_vec & BIT(i)))
2704 			continue;
2705 		nl_cfg = nla_nest_start_noflag(msg, i);
2706 		if (!nl_cfg)
2707 			goto nla_put_failure;
2708 		si = &reply.evt.sectors_info[i];
2709 		if (nla_put_u8(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
2710 			       i) ||
2711 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
2712 				le32_to_cpu(si->etype0)) ||
2713 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
2714 				le32_to_cpu(si->etype1)) ||
2715 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
2716 				le32_to_cpu(si->etype2)) ||
2717 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
2718 				le32_to_cpu(si->psh_hi)) ||
2719 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
2720 				le32_to_cpu(si->psh_lo)) ||
2721 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
2722 				le32_to_cpu(si->dtype_swch_off)))
2723 			goto nla_put_failure;
2724 		nla_nest_end(msg, nl_cfg);
2725 	}
2726 
2727 	nla_nest_end(msg, nl_cfgs);
2728 	rc = cfg80211_vendor_cmd_reply(msg);
2729 	return rc;
2730 nla_put_failure:
2731 	kfree_skb(msg);
2732 	return -ENOBUFS;
2733 }
2734 
2735 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
2736 				 struct wireless_dev *wdev,
2737 				 const void *data, int data_len)
2738 {
2739 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2740 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2741 	int rc, tmp;
2742 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2743 	struct nlattr *tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1];
2744 	u16 sector_index, rf_module_index;
2745 	u8 sector_type;
2746 	u32 rf_modules_vec = 0;
2747 	struct wmi_set_rf_sector_params_cmd cmd;
2748 	struct {
2749 		struct wmi_cmd_hdr wmi;
2750 		struct wmi_set_rf_sector_params_done_event evt;
2751 	} __packed reply = {
2752 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2753 	};
2754 	struct nlattr *nl_cfg;
2755 	struct wmi_rf_sector_info *si;
2756 
2757 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2758 		return -EOPNOTSUPP;
2759 
2760 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2761 				  data_len, wil_rf_sector_policy, NULL);
2762 	if (rc) {
2763 		wil_err(wil, "Invalid rf sector ATTR\n");
2764 		return rc;
2765 	}
2766 
2767 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2768 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2769 	    !tb[QCA_ATTR_DMG_RF_SECTOR_CFG]) {
2770 		wil_err(wil, "Invalid rf sector spec\n");
2771 		return -EINVAL;
2772 	}
2773 
2774 	sector_index = nla_get_u16(
2775 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2776 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2777 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2778 		return -EINVAL;
2779 	}
2780 
2781 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2782 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2783 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2784 		return -EINVAL;
2785 	}
2786 
2787 	memset(&cmd, 0, sizeof(cmd));
2788 
2789 	cmd.sector_idx = cpu_to_le16(sector_index);
2790 	cmd.sector_type = sector_type;
2791 	nla_for_each_nested(nl_cfg, tb[QCA_ATTR_DMG_RF_SECTOR_CFG],
2792 			    tmp) {
2793 		rc = nla_parse_nested_deprecated(tb2,
2794 						 QCA_ATTR_DMG_RF_SECTOR_CFG_MAX,
2795 						 nl_cfg,
2796 						 wil_rf_sector_cfg_policy,
2797 						 NULL);
2798 		if (rc) {
2799 			wil_err(wil, "invalid sector cfg\n");
2800 			return -EINVAL;
2801 		}
2802 
2803 		if (!tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] ||
2804 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] ||
2805 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] ||
2806 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] ||
2807 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] ||
2808 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] ||
2809 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]) {
2810 			wil_err(wil, "missing cfg params\n");
2811 			return -EINVAL;
2812 		}
2813 
2814 		rf_module_index = nla_get_u8(
2815 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX]);
2816 		if (rf_module_index >= WMI_MAX_RF_MODULES_NUM) {
2817 			wil_err(wil, "invalid RF module index %d\n",
2818 				rf_module_index);
2819 			return -EINVAL;
2820 		}
2821 		rf_modules_vec |= BIT(rf_module_index);
2822 		si = &cmd.sectors_info[rf_module_index];
2823 		si->etype0 = cpu_to_le32(nla_get_u32(
2824 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0]));
2825 		si->etype1 = cpu_to_le32(nla_get_u32(
2826 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1]));
2827 		si->etype2 = cpu_to_le32(nla_get_u32(
2828 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2]));
2829 		si->psh_hi = cpu_to_le32(nla_get_u32(
2830 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI]));
2831 		si->psh_lo = cpu_to_le32(nla_get_u32(
2832 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO]));
2833 		si->dtype_swch_off = cpu_to_le32(nla_get_u32(
2834 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]));
2835 	}
2836 
2837 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2838 	rc = wmi_call(wil, WMI_SET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2839 		      &cmd, sizeof(cmd), WMI_SET_RF_SECTOR_PARAMS_DONE_EVENTID,
2840 		      &reply, sizeof(reply),
2841 		      500);
2842 	if (rc)
2843 		return rc;
2844 	return wil_rf_sector_status_to_rc(reply.evt.status);
2845 }
2846 
2847 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
2848 				      struct wireless_dev *wdev,
2849 				      const void *data, int data_len)
2850 {
2851 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2852 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2853 	int rc;
2854 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2855 	u8 sector_type, mac_addr[ETH_ALEN];
2856 	int cid = 0;
2857 	struct wmi_get_selected_rf_sector_index_cmd cmd;
2858 	struct {
2859 		struct wmi_cmd_hdr wmi;
2860 		struct wmi_get_selected_rf_sector_index_done_event evt;
2861 	} __packed reply = {
2862 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2863 	};
2864 	struct sk_buff *msg;
2865 
2866 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2867 		return -EOPNOTSUPP;
2868 
2869 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2870 				  data_len, wil_rf_sector_policy, NULL);
2871 	if (rc) {
2872 		wil_err(wil, "Invalid rf sector ATTR\n");
2873 		return rc;
2874 	}
2875 
2876 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2877 		wil_err(wil, "Invalid rf sector spec\n");
2878 		return -EINVAL;
2879 	}
2880 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2881 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2882 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2883 		return -EINVAL;
2884 	}
2885 
2886 	if (tb[QCA_ATTR_MAC_ADDR]) {
2887 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
2888 		cid = wil_find_cid(wil, vif->mid, mac_addr);
2889 		if (cid < 0) {
2890 			wil_err(wil, "invalid MAC address %pM\n", mac_addr);
2891 			return -ENOENT;
2892 		}
2893 	} else {
2894 		if (test_bit(wil_vif_fwconnected, vif->status)) {
2895 			wil_err(wil, "must specify MAC address when connected\n");
2896 			return -EINVAL;
2897 		}
2898 	}
2899 
2900 	memset(&cmd, 0, sizeof(cmd));
2901 	cmd.cid = (u8)cid;
2902 	cmd.sector_type = sector_type;
2903 	rc = wmi_call(wil, WMI_GET_SELECTED_RF_SECTOR_INDEX_CMDID, vif->mid,
2904 		      &cmd, sizeof(cmd),
2905 		      WMI_GET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2906 		      &reply, sizeof(reply),
2907 		      500);
2908 	if (rc)
2909 		return rc;
2910 	if (reply.evt.status) {
2911 		wil_err(wil, "get rf selected sector cfg failed with status %d\n",
2912 			reply.evt.status);
2913 		return wil_rf_sector_status_to_rc(reply.evt.status);
2914 	}
2915 
2916 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2917 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2918 	if (!msg)
2919 		return -ENOMEM;
2920 
2921 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2922 			      le64_to_cpu(reply.evt.tsf),
2923 			      QCA_ATTR_PAD) ||
2924 	    nla_put_u16(msg, QCA_ATTR_DMG_RF_SECTOR_INDEX,
2925 			le16_to_cpu(reply.evt.sector_idx)))
2926 		goto nla_put_failure;
2927 
2928 	rc = cfg80211_vendor_cmd_reply(msg);
2929 	return rc;
2930 nla_put_failure:
2931 	kfree_skb(msg);
2932 	return -ENOBUFS;
2933 }
2934 
2935 static int wil_rf_sector_wmi_set_selected(struct wil6210_priv *wil,
2936 					  u8 mid, u16 sector_index,
2937 					  u8 sector_type, u8 cid)
2938 {
2939 	struct wmi_set_selected_rf_sector_index_cmd cmd;
2940 	struct {
2941 		struct wmi_cmd_hdr wmi;
2942 		struct wmi_set_selected_rf_sector_index_done_event evt;
2943 	} __packed reply = {
2944 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2945 	};
2946 	int rc;
2947 
2948 	memset(&cmd, 0, sizeof(cmd));
2949 	cmd.sector_idx = cpu_to_le16(sector_index);
2950 	cmd.sector_type = sector_type;
2951 	cmd.cid = (u8)cid;
2952 	rc = wmi_call(wil, WMI_SET_SELECTED_RF_SECTOR_INDEX_CMDID, mid,
2953 		      &cmd, sizeof(cmd),
2954 		      WMI_SET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2955 		      &reply, sizeof(reply),
2956 		      500);
2957 	if (rc)
2958 		return rc;
2959 	return wil_rf_sector_status_to_rc(reply.evt.status);
2960 }
2961 
2962 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
2963 				      struct wireless_dev *wdev,
2964 				      const void *data, int data_len)
2965 {
2966 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2967 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2968 	int rc;
2969 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2970 	u16 sector_index;
2971 	u8 sector_type, mac_addr[ETH_ALEN], i;
2972 	int cid = 0;
2973 
2974 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2975 		return -EOPNOTSUPP;
2976 
2977 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2978 				  data_len, wil_rf_sector_policy, NULL);
2979 	if (rc) {
2980 		wil_err(wil, "Invalid rf sector ATTR\n");
2981 		return rc;
2982 	}
2983 
2984 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2985 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2986 		wil_err(wil, "Invalid rf sector spec\n");
2987 		return -EINVAL;
2988 	}
2989 
2990 	sector_index = nla_get_u16(
2991 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2992 	if (sector_index >= WIL_MAX_RF_SECTORS &&
2993 	    sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
2994 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2995 		return -EINVAL;
2996 	}
2997 
2998 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2999 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
3000 		wil_err(wil, "Invalid sector type %d\n", sector_type);
3001 		return -EINVAL;
3002 	}
3003 
3004 	if (tb[QCA_ATTR_MAC_ADDR]) {
3005 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
3006 		if (!is_broadcast_ether_addr(mac_addr)) {
3007 			cid = wil_find_cid(wil, vif->mid, mac_addr);
3008 			if (cid < 0) {
3009 				wil_err(wil, "invalid MAC address %pM\n",
3010 					mac_addr);
3011 				return -ENOENT;
3012 			}
3013 		} else {
3014 			if (sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
3015 				wil_err(wil, "broadcast MAC valid only with unlocking\n");
3016 				return -EINVAL;
3017 			}
3018 			cid = -1;
3019 		}
3020 	} else {
3021 		if (test_bit(wil_vif_fwconnected, vif->status)) {
3022 			wil_err(wil, "must specify MAC address when connected\n");
3023 			return -EINVAL;
3024 		}
3025 		/* otherwise, using cid=0 for unassociated station */
3026 	}
3027 
3028 	if (cid >= 0) {
3029 		rc = wil_rf_sector_wmi_set_selected(wil, vif->mid, sector_index,
3030 						    sector_type, cid);
3031 	} else {
3032 		/* unlock all cids */
3033 		rc = wil_rf_sector_wmi_set_selected(
3034 			wil, vif->mid, WMI_INVALID_RF_SECTOR_INDEX,
3035 			sector_type, WIL_CID_ALL);
3036 		if (rc == -EINVAL) {
3037 			for (i = 0; i < wil->max_assoc_sta; i++) {
3038 				if (wil->sta[i].mid != vif->mid)
3039 					continue;
3040 				rc = wil_rf_sector_wmi_set_selected(
3041 					wil, vif->mid,
3042 					WMI_INVALID_RF_SECTOR_INDEX,
3043 					sector_type, i);
3044 				/* the FW will silently ignore and return
3045 				 * success for unused cid, so abort the loop
3046 				 * on any other error
3047 				 */
3048 				if (rc) {
3049 					wil_err(wil, "unlock cid %d failed with status %d\n",
3050 						i, rc);
3051 					break;
3052 				}
3053 			}
3054 		}
3055 	}
3056 
3057 	return rc;
3058 }
3059