1 /*
2  * Copyright (c) 2012-2017 Qualcomm Atheros, Inc.
3  * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
4  *
5  * Permission to use, copy, modify, and/or distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <linux/etherdevice.h>
19 #include <linux/moduleparam.h>
20 #include <net/netlink.h>
21 #include <net/cfg80211.h>
22 #include "wil6210.h"
23 #include "wmi.h"
24 #include "fw.h"
25 
26 #define WIL_MAX_ROC_DURATION_MS 5000
27 
28 bool disable_ap_sme;
29 module_param(disable_ap_sme, bool, 0444);
30 MODULE_PARM_DESC(disable_ap_sme, " let user space handle AP mode SME");
31 
32 #ifdef CONFIG_PM
33 static struct wiphy_wowlan_support wil_wowlan_support = {
34 	.flags = WIPHY_WOWLAN_ANY | WIPHY_WOWLAN_DISCONNECT,
35 };
36 #endif
37 
38 #define CHAN60G(_channel, _flags) {				\
39 	.band			= NL80211_BAND_60GHZ,		\
40 	.center_freq		= 56160 + (2160 * (_channel)),	\
41 	.hw_value		= (_channel),			\
42 	.flags			= (_flags),			\
43 	.max_antenna_gain	= 0,				\
44 	.max_power		= 40,				\
45 }
46 
47 static struct ieee80211_channel wil_60ghz_channels[] = {
48 	CHAN60G(1, 0),
49 	CHAN60G(2, 0),
50 	CHAN60G(3, 0),
51 	CHAN60G(4, 0),
52 };
53 
54 static void
55 wil_memdup_ie(u8 **pdst, size_t *pdst_len, const u8 *src, size_t src_len)
56 {
57 	kfree(*pdst);
58 	*pdst = NULL;
59 	*pdst_len = 0;
60 	if (src_len > 0) {
61 		*pdst = kmemdup(src, src_len, GFP_KERNEL);
62 		if (*pdst)
63 			*pdst_len = src_len;
64 	}
65 }
66 
67 static int wil_num_supported_channels(struct wil6210_priv *wil)
68 {
69 	int num_channels = ARRAY_SIZE(wil_60ghz_channels);
70 
71 	if (!test_bit(WMI_FW_CAPABILITY_CHANNEL_4, wil->fw_capabilities))
72 		num_channels--;
73 
74 	return num_channels;
75 }
76 
77 void update_supported_bands(struct wil6210_priv *wil)
78 {
79 	struct wiphy *wiphy = wil_to_wiphy(wil);
80 
81 	wil_dbg_misc(wil, "update supported bands");
82 
83 	wiphy->bands[NL80211_BAND_60GHZ]->n_channels =
84 						wil_num_supported_channels(wil);
85 }
86 
87 /* Vendor id to be used in vendor specific command and events
88  * to user space.
89  * NOTE: The authoritative place for definition of QCA_NL80211_VENDOR_ID,
90  * vendor subcmd definitions prefixed with QCA_NL80211_VENDOR_SUBCMD, and
91  * qca_wlan_vendor_attr is open source file src/common/qca-vendor.h in
92  * git://w1.fi/srv/git/hostap.git; the values here are just a copy of that
93  */
94 
95 #define QCA_NL80211_VENDOR_ID	0x001374
96 
97 #define WIL_MAX_RF_SECTORS (128)
98 #define WIL_CID_ALL (0xff)
99 
100 enum qca_wlan_vendor_attr_rf_sector {
101 	QCA_ATTR_MAC_ADDR = 6,
102 	QCA_ATTR_PAD = 13,
103 	QCA_ATTR_TSF = 29,
104 	QCA_ATTR_DMG_RF_SECTOR_INDEX = 30,
105 	QCA_ATTR_DMG_RF_SECTOR_TYPE = 31,
106 	QCA_ATTR_DMG_RF_MODULE_MASK = 32,
107 	QCA_ATTR_DMG_RF_SECTOR_CFG = 33,
108 	QCA_ATTR_DMG_RF_SECTOR_MAX,
109 };
110 
111 enum qca_wlan_vendor_attr_dmg_rf_sector_type {
112 	QCA_ATTR_DMG_RF_SECTOR_TYPE_RX,
113 	QCA_ATTR_DMG_RF_SECTOR_TYPE_TX,
114 	QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX
115 };
116 
117 enum qca_wlan_vendor_attr_dmg_rf_sector_cfg {
118 	QCA_ATTR_DMG_RF_SECTOR_CFG_INVALID = 0,
119 	QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
120 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
121 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
122 	QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
123 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
124 	QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
125 	QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
126 
127 	/* keep last */
128 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST,
129 	QCA_ATTR_DMG_RF_SECTOR_CFG_MAX =
130 	QCA_ATTR_DMG_RF_SECTOR_CFG_AFTER_LAST - 1
131 };
132 
133 static const struct
134 nla_policy wil_rf_sector_policy[QCA_ATTR_DMG_RF_SECTOR_MAX + 1] = {
135 	[QCA_ATTR_MAC_ADDR] = { .len = ETH_ALEN },
136 	[QCA_ATTR_DMG_RF_SECTOR_INDEX] = { .type = NLA_U16 },
137 	[QCA_ATTR_DMG_RF_SECTOR_TYPE] = { .type = NLA_U8 },
138 	[QCA_ATTR_DMG_RF_MODULE_MASK] = { .type = NLA_U32 },
139 	[QCA_ATTR_DMG_RF_SECTOR_CFG] = { .type = NLA_NESTED },
140 };
141 
142 static const struct
143 nla_policy wil_rf_sector_cfg_policy[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1] = {
144 	[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] = { .type = NLA_U8 },
145 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] = { .type = NLA_U32 },
146 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] = { .type = NLA_U32 },
147 	[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] = { .type = NLA_U32 },
148 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] = { .type = NLA_U32 },
149 	[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] = { .type = NLA_U32 },
150 	[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16] = { .type = NLA_U32 },
151 };
152 
153 enum qca_nl80211_vendor_subcmds {
154 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG = 139,
155 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG = 140,
156 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR = 141,
157 	QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR = 142,
158 };
159 
160 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
161 				 struct wireless_dev *wdev,
162 				 const void *data, int data_len);
163 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
164 				 struct wireless_dev *wdev,
165 				 const void *data, int data_len);
166 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
167 				      struct wireless_dev *wdev,
168 				      const void *data, int data_len);
169 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
170 				      struct wireless_dev *wdev,
171 				      const void *data, int data_len);
172 
173 /* vendor specific commands */
174 static const struct wiphy_vendor_command wil_nl80211_vendor_commands[] = {
175 	{
176 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
177 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SECTOR_CFG,
178 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
179 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
180 		.policy = wil_rf_sector_policy,
181 		.doit = wil_rf_sector_get_cfg
182 	},
183 	{
184 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
185 		.info.subcmd = QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SECTOR_CFG,
186 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
187 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
188 		.policy = wil_rf_sector_policy,
189 		.doit = wil_rf_sector_set_cfg
190 	},
191 	{
192 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
193 		.info.subcmd =
194 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_GET_SELECTED_SECTOR,
195 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
196 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
197 		.policy = wil_rf_sector_policy,
198 		.doit = wil_rf_sector_get_selected
199 	},
200 	{
201 		.info.vendor_id = QCA_NL80211_VENDOR_ID,
202 		.info.subcmd =
203 			QCA_NL80211_VENDOR_SUBCMD_DMG_RF_SET_SELECTED_SECTOR,
204 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
205 			 WIPHY_VENDOR_CMD_NEED_RUNNING,
206 		.policy = wil_rf_sector_policy,
207 		.doit = wil_rf_sector_set_selected
208 	},
209 };
210 
211 static struct ieee80211_supported_band wil_band_60ghz = {
212 	.channels = wil_60ghz_channels,
213 	.n_channels = ARRAY_SIZE(wil_60ghz_channels),
214 	.ht_cap = {
215 		.ht_supported = true,
216 		.cap = 0, /* TODO */
217 		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
218 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
219 		.mcs = {
220 				/* MCS 1..12 - SC PHY */
221 			.rx_mask = {0xfe, 0x1f}, /* 1..12 */
222 			.tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
223 		},
224 	},
225 };
226 
227 static const struct ieee80211_txrx_stypes
228 wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
229 	[NL80211_IFTYPE_STATION] = {
230 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
231 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
232 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
233 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
234 	},
235 	[NL80211_IFTYPE_AP] = {
236 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
237 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4) |
238 		BIT(IEEE80211_STYPE_ASSOC_RESP >> 4) |
239 		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
240 		BIT(IEEE80211_STYPE_AUTH >> 4) |
241 		BIT(IEEE80211_STYPE_REASSOC_RESP >> 4),
242 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
243 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
244 		BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
245 		BIT(IEEE80211_STYPE_DISASSOC >> 4) |
246 		BIT(IEEE80211_STYPE_AUTH >> 4) |
247 		BIT(IEEE80211_STYPE_DEAUTH >> 4) |
248 		BIT(IEEE80211_STYPE_REASSOC_REQ >> 4)
249 	},
250 	[NL80211_IFTYPE_P2P_CLIENT] = {
251 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
252 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
253 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
254 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
255 	},
256 	[NL80211_IFTYPE_P2P_GO] = {
257 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
258 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
259 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
260 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
261 	},
262 	[NL80211_IFTYPE_P2P_DEVICE] = {
263 		.tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
264 		BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
265 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
266 		BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
267 	},
268 };
269 
270 static const u32 wil_cipher_suites[] = {
271 	WLAN_CIPHER_SUITE_GCMP,
272 };
273 
274 static const char * const key_usage_str[] = {
275 	[WMI_KEY_USE_PAIRWISE]	= "PTK",
276 	[WMI_KEY_USE_RX_GROUP]	= "RX_GTK",
277 	[WMI_KEY_USE_TX_GROUP]	= "TX_GTK",
278 };
279 
280 int wil_iftype_nl2wmi(enum nl80211_iftype type)
281 {
282 	static const struct {
283 		enum nl80211_iftype nl;
284 		enum wmi_network_type wmi;
285 	} __nl2wmi[] = {
286 		{NL80211_IFTYPE_ADHOC,		WMI_NETTYPE_ADHOC},
287 		{NL80211_IFTYPE_STATION,	WMI_NETTYPE_INFRA},
288 		{NL80211_IFTYPE_AP,		WMI_NETTYPE_AP},
289 		{NL80211_IFTYPE_P2P_CLIENT,	WMI_NETTYPE_P2P},
290 		{NL80211_IFTYPE_P2P_GO,		WMI_NETTYPE_P2P},
291 		{NL80211_IFTYPE_MONITOR,	WMI_NETTYPE_ADHOC}, /* FIXME */
292 	};
293 	uint i;
294 
295 	for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
296 		if (__nl2wmi[i].nl == type)
297 			return __nl2wmi[i].wmi;
298 	}
299 
300 	return -EOPNOTSUPP;
301 }
302 
303 int wil_cid_fill_sinfo(struct wil6210_vif *vif, int cid,
304 		       struct station_info *sinfo)
305 {
306 	struct wil6210_priv *wil = vif_to_wil(vif);
307 	struct wmi_notify_req_cmd cmd = {
308 		.cid = cid,
309 		.interval_usec = 0,
310 	};
311 	struct {
312 		struct wmi_cmd_hdr wmi;
313 		struct wmi_notify_req_done_event evt;
314 	} __packed reply;
315 	struct wil_net_stats *stats = &wil->sta[cid].stats;
316 	int rc;
317 
318 	memset(&reply, 0, sizeof(reply));
319 
320 	rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, vif->mid, &cmd, sizeof(cmd),
321 		      WMI_NOTIFY_REQ_DONE_EVENTID, &reply, sizeof(reply),
322 		      WIL_WMI_CALL_GENERAL_TO_MS);
323 	if (rc)
324 		return rc;
325 
326 	wil_dbg_wmi(wil, "Link status for CID %d MID %d: {\n"
327 		    "  MCS %d TSF 0x%016llx\n"
328 		    "  BF status 0x%08x RSSI %d SQI %d%%\n"
329 		    "  Tx Tpt %d goodput %d Rx goodput %d\n"
330 		    "  Sectors(rx:tx) my %d:%d peer %d:%d\n""}\n",
331 		    cid, vif->mid, le16_to_cpu(reply.evt.bf_mcs),
332 		    le64_to_cpu(reply.evt.tsf), reply.evt.status,
333 		    reply.evt.rssi,
334 		    reply.evt.sqi,
335 		    le32_to_cpu(reply.evt.tx_tpt),
336 		    le32_to_cpu(reply.evt.tx_goodput),
337 		    le32_to_cpu(reply.evt.rx_goodput),
338 		    le16_to_cpu(reply.evt.my_rx_sector),
339 		    le16_to_cpu(reply.evt.my_tx_sector),
340 		    le16_to_cpu(reply.evt.other_rx_sector),
341 		    le16_to_cpu(reply.evt.other_tx_sector));
342 
343 	sinfo->generation = wil->sinfo_gen;
344 
345 	sinfo->filled = BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
346 			BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
347 			BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
348 			BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
349 			BIT_ULL(NL80211_STA_INFO_RX_BITRATE) |
350 			BIT_ULL(NL80211_STA_INFO_TX_BITRATE) |
351 			BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
352 			BIT_ULL(NL80211_STA_INFO_TX_FAILED);
353 
354 	sinfo->txrate.flags = RATE_INFO_FLAGS_60G;
355 	sinfo->txrate.mcs = le16_to_cpu(reply.evt.bf_mcs);
356 	sinfo->rxrate.mcs = stats->last_mcs_rx;
357 	sinfo->rx_bytes = stats->rx_bytes;
358 	sinfo->rx_packets = stats->rx_packets;
359 	sinfo->rx_dropped_misc = stats->rx_dropped;
360 	sinfo->tx_bytes = stats->tx_bytes;
361 	sinfo->tx_packets = stats->tx_packets;
362 	sinfo->tx_failed = stats->tx_errors;
363 
364 	if (test_bit(wil_vif_fwconnected, vif->status)) {
365 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
366 		if (test_bit(WMI_FW_CAPABILITY_RSSI_REPORTING,
367 			     wil->fw_capabilities))
368 			sinfo->signal = reply.evt.rssi;
369 		else
370 			sinfo->signal = reply.evt.sqi;
371 	}
372 
373 	return rc;
374 }
375 
376 static int wil_cfg80211_get_station(struct wiphy *wiphy,
377 				    struct net_device *ndev,
378 				    const u8 *mac, struct station_info *sinfo)
379 {
380 	struct wil6210_vif *vif = ndev_to_vif(ndev);
381 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
382 	int rc;
383 
384 	int cid = wil_find_cid(wil, vif->mid, mac);
385 
386 	wil_dbg_misc(wil, "get_station: %pM CID %d MID %d\n", mac, cid,
387 		     vif->mid);
388 	if (!wil_cid_valid(wil, cid))
389 		return -ENOENT;
390 
391 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
392 
393 	return rc;
394 }
395 
396 /*
397  * Find @idx-th active STA for specific MID for station dump.
398  */
399 static int wil_find_cid_by_idx(struct wil6210_priv *wil, u8 mid, int idx)
400 {
401 	int i;
402 
403 	for (i = 0; i < wil->max_assoc_sta; i++) {
404 		if (wil->sta[i].status == wil_sta_unused)
405 			continue;
406 		if (wil->sta[i].mid != mid)
407 			continue;
408 		if (idx == 0)
409 			return i;
410 		idx--;
411 	}
412 
413 	return -ENOENT;
414 }
415 
416 static int wil_cfg80211_dump_station(struct wiphy *wiphy,
417 				     struct net_device *dev, int idx,
418 				     u8 *mac, struct station_info *sinfo)
419 {
420 	struct wil6210_vif *vif = ndev_to_vif(dev);
421 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
422 	int rc;
423 	int cid = wil_find_cid_by_idx(wil, vif->mid, idx);
424 
425 	if (!wil_cid_valid(wil, cid))
426 		return -ENOENT;
427 
428 	ether_addr_copy(mac, wil->sta[cid].addr);
429 	wil_dbg_misc(wil, "dump_station: %pM CID %d MID %d\n", mac, cid,
430 		     vif->mid);
431 
432 	rc = wil_cid_fill_sinfo(vif, cid, sinfo);
433 
434 	return rc;
435 }
436 
437 static int wil_cfg80211_start_p2p_device(struct wiphy *wiphy,
438 					 struct wireless_dev *wdev)
439 {
440 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
441 
442 	wil_dbg_misc(wil, "start_p2p_device: entered\n");
443 	wil->p2p_dev_started = 1;
444 	return 0;
445 }
446 
447 static void wil_cfg80211_stop_p2p_device(struct wiphy *wiphy,
448 					 struct wireless_dev *wdev)
449 {
450 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
451 
452 	if (!wil->p2p_dev_started)
453 		return;
454 
455 	wil_dbg_misc(wil, "stop_p2p_device: entered\n");
456 	mutex_lock(&wil->mutex);
457 	mutex_lock(&wil->vif_mutex);
458 	wil_p2p_stop_radio_operations(wil);
459 	wil->p2p_dev_started = 0;
460 	mutex_unlock(&wil->vif_mutex);
461 	mutex_unlock(&wil->mutex);
462 }
463 
464 static int wil_cfg80211_validate_add_iface(struct wil6210_priv *wil,
465 					   enum nl80211_iftype new_type)
466 {
467 	int i;
468 	struct wireless_dev *wdev;
469 	struct iface_combination_params params = {
470 		.num_different_channels = 1,
471 	};
472 
473 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
474 		if (wil->vifs[i]) {
475 			wdev = vif_to_wdev(wil->vifs[i]);
476 			params.iftype_num[wdev->iftype]++;
477 		}
478 	}
479 	params.iftype_num[new_type]++;
480 	return cfg80211_check_combinations(wil->wiphy, &params);
481 }
482 
483 static int wil_cfg80211_validate_change_iface(struct wil6210_priv *wil,
484 					      struct wil6210_vif *vif,
485 					      enum nl80211_iftype new_type)
486 {
487 	int i, ret = 0;
488 	struct wireless_dev *wdev;
489 	struct iface_combination_params params = {
490 		.num_different_channels = 1,
491 	};
492 	bool check_combos = false;
493 
494 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
495 		struct wil6210_vif *vif_pos = wil->vifs[i];
496 
497 		if (vif_pos && vif != vif_pos) {
498 			wdev = vif_to_wdev(vif_pos);
499 			params.iftype_num[wdev->iftype]++;
500 			check_combos = true;
501 		}
502 	}
503 
504 	if (check_combos) {
505 		params.iftype_num[new_type]++;
506 		ret = cfg80211_check_combinations(wil->wiphy, &params);
507 	}
508 	return ret;
509 }
510 
511 static struct wireless_dev *
512 wil_cfg80211_add_iface(struct wiphy *wiphy, const char *name,
513 		       unsigned char name_assign_type,
514 		       enum nl80211_iftype type,
515 		       struct vif_params *params)
516 {
517 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
518 	struct net_device *ndev_main = wil->main_ndev, *ndev;
519 	struct wil6210_vif *vif;
520 	struct wireless_dev *p2p_wdev, *wdev;
521 	int rc;
522 
523 	wil_dbg_misc(wil, "add_iface, type %d\n", type);
524 
525 	/* P2P device is not a real virtual interface, it is a management-only
526 	 * interface that shares the main interface.
527 	 * Skip concurrency checks here.
528 	 */
529 	if (type == NL80211_IFTYPE_P2P_DEVICE) {
530 		if (wil->p2p_wdev) {
531 			wil_err(wil, "P2P_DEVICE interface already created\n");
532 			return ERR_PTR(-EINVAL);
533 		}
534 
535 		p2p_wdev = kzalloc(sizeof(*p2p_wdev), GFP_KERNEL);
536 		if (!p2p_wdev)
537 			return ERR_PTR(-ENOMEM);
538 
539 		p2p_wdev->iftype = type;
540 		p2p_wdev->wiphy = wiphy;
541 		/* use our primary ethernet address */
542 		ether_addr_copy(p2p_wdev->address, ndev_main->perm_addr);
543 
544 		wil->p2p_wdev = p2p_wdev;
545 
546 		return p2p_wdev;
547 	}
548 
549 	if (!wil->wiphy->n_iface_combinations) {
550 		wil_err(wil, "virtual interfaces not supported\n");
551 		return ERR_PTR(-EINVAL);
552 	}
553 
554 	rc = wil_cfg80211_validate_add_iface(wil, type);
555 	if (rc) {
556 		wil_err(wil, "iface validation failed, err=%d\n", rc);
557 		return ERR_PTR(rc);
558 	}
559 
560 	vif = wil_vif_alloc(wil, name, name_assign_type, type);
561 	if (IS_ERR(vif))
562 		return ERR_CAST(vif);
563 
564 	ndev = vif_to_ndev(vif);
565 	ether_addr_copy(ndev->perm_addr, ndev_main->perm_addr);
566 	if (is_valid_ether_addr(params->macaddr)) {
567 		ether_addr_copy(ndev->dev_addr, params->macaddr);
568 	} else {
569 		ether_addr_copy(ndev->dev_addr, ndev_main->perm_addr);
570 		ndev->dev_addr[0] = (ndev->dev_addr[0] ^ (1 << vif->mid)) |
571 			0x2; /* locally administered */
572 	}
573 	wdev = vif_to_wdev(vif);
574 	ether_addr_copy(wdev->address, ndev->dev_addr);
575 
576 	rc = wil_vif_add(wil, vif);
577 	if (rc)
578 		goto out;
579 
580 	wil_info(wil, "added VIF, mid %d iftype %d MAC %pM\n",
581 		 vif->mid, type, wdev->address);
582 	return wdev;
583 out:
584 	wil_vif_free(vif);
585 	return ERR_PTR(rc);
586 }
587 
588 int wil_vif_prepare_stop(struct wil6210_vif *vif)
589 {
590 	struct wil6210_priv *wil = vif_to_wil(vif);
591 	struct wireless_dev *wdev = vif_to_wdev(vif);
592 	struct net_device *ndev;
593 	int rc;
594 
595 	if (wdev->iftype != NL80211_IFTYPE_AP)
596 		return 0;
597 
598 	ndev = vif_to_ndev(vif);
599 	if (netif_carrier_ok(ndev)) {
600 		rc = wmi_pcp_stop(vif);
601 		if (rc) {
602 			wil_info(wil, "failed to stop AP, status %d\n",
603 				 rc);
604 			/* continue */
605 		}
606 		wil_bcast_fini(vif);
607 		netif_carrier_off(ndev);
608 	}
609 
610 	return 0;
611 }
612 
613 static int wil_cfg80211_del_iface(struct wiphy *wiphy,
614 				  struct wireless_dev *wdev)
615 {
616 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
617 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
618 	int rc;
619 
620 	wil_dbg_misc(wil, "del_iface\n");
621 
622 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
623 		if (wdev != wil->p2p_wdev) {
624 			wil_err(wil, "delete of incorrect interface 0x%p\n",
625 				wdev);
626 			return -EINVAL;
627 		}
628 
629 		wil_cfg80211_stop_p2p_device(wiphy, wdev);
630 		wil_p2p_wdev_free(wil);
631 		return 0;
632 	}
633 
634 	if (vif->mid == 0) {
635 		wil_err(wil, "cannot remove the main interface\n");
636 		return -EINVAL;
637 	}
638 
639 	rc = wil_vif_prepare_stop(vif);
640 	if (rc)
641 		goto out;
642 
643 	wil_info(wil, "deleted VIF, mid %d iftype %d MAC %pM\n",
644 		 vif->mid, wdev->iftype, wdev->address);
645 
646 	wil_vif_remove(wil, vif->mid);
647 out:
648 	return rc;
649 }
650 
651 static bool wil_is_safe_switch(enum nl80211_iftype from,
652 			       enum nl80211_iftype to)
653 {
654 	if (from == NL80211_IFTYPE_STATION &&
655 	    to == NL80211_IFTYPE_P2P_CLIENT)
656 		return true;
657 
658 	return false;
659 }
660 
661 static int wil_cfg80211_change_iface(struct wiphy *wiphy,
662 				     struct net_device *ndev,
663 				     enum nl80211_iftype type,
664 				     struct vif_params *params)
665 {
666 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
667 	struct wil6210_vif *vif = ndev_to_vif(ndev);
668 	struct wireless_dev *wdev = vif_to_wdev(vif);
669 	int rc;
670 	bool fw_reset = false;
671 
672 	wil_dbg_misc(wil, "change_iface: type=%d\n", type);
673 
674 	if (wiphy->n_iface_combinations) {
675 		rc = wil_cfg80211_validate_change_iface(wil, vif, type);
676 		if (rc) {
677 			wil_err(wil, "iface validation failed, err=%d\n", rc);
678 			return rc;
679 		}
680 	}
681 
682 	/* do not reset FW when there are active VIFs,
683 	 * because it can cause significant disruption
684 	 */
685 	if (!wil_has_other_active_ifaces(wil, ndev, true, false) &&
686 	    netif_running(ndev) && !wil_is_recovery_blocked(wil) &&
687 	    !wil_is_safe_switch(wdev->iftype, type)) {
688 		wil_dbg_misc(wil, "interface is up. resetting...\n");
689 		mutex_lock(&wil->mutex);
690 		__wil_down(wil);
691 		rc = __wil_up(wil);
692 		mutex_unlock(&wil->mutex);
693 
694 		if (rc)
695 			return rc;
696 		fw_reset = true;
697 	}
698 
699 	switch (type) {
700 	case NL80211_IFTYPE_STATION:
701 	case NL80211_IFTYPE_AP:
702 	case NL80211_IFTYPE_P2P_CLIENT:
703 	case NL80211_IFTYPE_P2P_GO:
704 		break;
705 	case NL80211_IFTYPE_MONITOR:
706 		if (params->flags)
707 			wil->monitor_flags = params->flags;
708 		break;
709 	default:
710 		return -EOPNOTSUPP;
711 	}
712 
713 	if (vif->mid != 0 && wil_has_active_ifaces(wil, true, false)) {
714 		if (!fw_reset)
715 			wil_vif_prepare_stop(vif);
716 		rc = wmi_port_delete(wil, vif->mid);
717 		if (rc)
718 			return rc;
719 		rc = wmi_port_allocate(wil, vif->mid, ndev->dev_addr, type);
720 		if (rc)
721 			return rc;
722 	}
723 
724 	wdev->iftype = type;
725 	return 0;
726 }
727 
728 static int wil_cfg80211_scan(struct wiphy *wiphy,
729 			     struct cfg80211_scan_request *request)
730 {
731 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
732 	struct wireless_dev *wdev = request->wdev;
733 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
734 	struct {
735 		struct wmi_start_scan_cmd cmd;
736 		u16 chnl[4];
737 	} __packed cmd;
738 	uint i, n;
739 	int rc;
740 
741 	wil_dbg_misc(wil, "scan: wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
742 
743 	/* scan is supported on client interfaces and on AP interface */
744 	switch (wdev->iftype) {
745 	case NL80211_IFTYPE_STATION:
746 	case NL80211_IFTYPE_P2P_CLIENT:
747 	case NL80211_IFTYPE_P2P_DEVICE:
748 	case NL80211_IFTYPE_AP:
749 		break;
750 	default:
751 		return -EOPNOTSUPP;
752 	}
753 
754 	/* FW don't support scan after connection attempt */
755 	if (test_bit(wil_status_dontscan, wil->status)) {
756 		wil_err(wil, "Can't scan now\n");
757 		return -EBUSY;
758 	}
759 
760 	mutex_lock(&wil->mutex);
761 
762 	mutex_lock(&wil->vif_mutex);
763 	if (vif->scan_request || vif->p2p.discovery_started) {
764 		wil_err(wil, "Already scanning\n");
765 		mutex_unlock(&wil->vif_mutex);
766 		rc = -EAGAIN;
767 		goto out;
768 	}
769 	mutex_unlock(&wil->vif_mutex);
770 
771 	if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE) {
772 		if (!wil->p2p_dev_started) {
773 			wil_err(wil, "P2P search requested on stopped P2P device\n");
774 			rc = -EIO;
775 			goto out;
776 		}
777 		/* social scan on P2P_DEVICE is handled as p2p search */
778 		if (wil_p2p_is_social_scan(request)) {
779 			vif->scan_request = request;
780 			if (vif->mid == 0)
781 				wil->radio_wdev = wdev;
782 			rc = wil_p2p_search(vif, request);
783 			if (rc) {
784 				if (vif->mid == 0)
785 					wil->radio_wdev =
786 						wil->main_ndev->ieee80211_ptr;
787 				vif->scan_request = NULL;
788 			}
789 			goto out;
790 		}
791 	}
792 
793 	(void)wil_p2p_stop_discovery(vif);
794 
795 	wil_dbg_misc(wil, "Start scan_request 0x%p\n", request);
796 	wil_dbg_misc(wil, "SSID count: %d", request->n_ssids);
797 
798 	for (i = 0; i < request->n_ssids; i++) {
799 		wil_dbg_misc(wil, "SSID[%d]", i);
800 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
801 				  request->ssids[i].ssid,
802 				  request->ssids[i].ssid_len, true);
803 	}
804 
805 	if (request->n_ssids)
806 		rc = wmi_set_ssid(vif, request->ssids[0].ssid_len,
807 				  request->ssids[0].ssid);
808 	else
809 		rc = wmi_set_ssid(vif, 0, NULL);
810 
811 	if (rc) {
812 		wil_err(wil, "set SSID for scan request failed: %d\n", rc);
813 		goto out;
814 	}
815 
816 	vif->scan_request = request;
817 	mod_timer(&vif->scan_timer, jiffies + WIL6210_SCAN_TO);
818 
819 	memset(&cmd, 0, sizeof(cmd));
820 	cmd.cmd.scan_type = WMI_ACTIVE_SCAN;
821 	cmd.cmd.num_channels = 0;
822 	n = min(request->n_channels, 4U);
823 	for (i = 0; i < n; i++) {
824 		int ch = request->channels[i]->hw_value;
825 
826 		if (ch == 0) {
827 			wil_err(wil,
828 				"Scan requested for unknown frequency %dMhz\n",
829 				request->channels[i]->center_freq);
830 			continue;
831 		}
832 		/* 0-based channel indexes */
833 		cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
834 		wil_dbg_misc(wil, "Scan for ch %d  : %d MHz\n", ch,
835 			     request->channels[i]->center_freq);
836 	}
837 
838 	if (request->ie_len)
839 		wil_hex_dump_misc("Scan IE ", DUMP_PREFIX_OFFSET, 16, 1,
840 				  request->ie, request->ie_len, true);
841 	else
842 		wil_dbg_misc(wil, "Scan has no IE's\n");
843 
844 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
845 			request->ie_len, request->ie);
846 	if (rc)
847 		goto out_restore;
848 
849 	if (wil->discovery_mode && cmd.cmd.scan_type == WMI_ACTIVE_SCAN) {
850 		cmd.cmd.discovery_mode = 1;
851 		wil_dbg_misc(wil, "active scan with discovery_mode=1\n");
852 	}
853 
854 	if (vif->mid == 0)
855 		wil->radio_wdev = wdev;
856 	rc = wmi_send(wil, WMI_START_SCAN_CMDID, vif->mid,
857 		      &cmd, sizeof(cmd.cmd) +
858 		      cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
859 
860 out_restore:
861 	if (rc) {
862 		del_timer_sync(&vif->scan_timer);
863 		if (vif->mid == 0)
864 			wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
865 		vif->scan_request = NULL;
866 	}
867 out:
868 	mutex_unlock(&wil->mutex);
869 	return rc;
870 }
871 
872 static void wil_cfg80211_abort_scan(struct wiphy *wiphy,
873 				    struct wireless_dev *wdev)
874 {
875 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
876 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
877 
878 	wil_dbg_misc(wil, "wdev=0x%p iftype=%d\n", wdev, wdev->iftype);
879 
880 	mutex_lock(&wil->mutex);
881 	mutex_lock(&wil->vif_mutex);
882 
883 	if (!vif->scan_request)
884 		goto out;
885 
886 	if (wdev != vif->scan_request->wdev) {
887 		wil_dbg_misc(wil, "abort scan was called on the wrong iface\n");
888 		goto out;
889 	}
890 
891 	if (wdev == wil->p2p_wdev && wil->radio_wdev == wil->p2p_wdev)
892 		wil_p2p_stop_radio_operations(wil);
893 	else
894 		wil_abort_scan(vif, true);
895 
896 out:
897 	mutex_unlock(&wil->vif_mutex);
898 	mutex_unlock(&wil->mutex);
899 }
900 
901 static void wil_print_crypto(struct wil6210_priv *wil,
902 			     struct cfg80211_crypto_settings *c)
903 {
904 	int i, n;
905 
906 	wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
907 		     c->wpa_versions, c->cipher_group);
908 	wil_dbg_misc(wil, "Pairwise ciphers [%d] {\n", c->n_ciphers_pairwise);
909 	n = min_t(int, c->n_ciphers_pairwise, ARRAY_SIZE(c->ciphers_pairwise));
910 	for (i = 0; i < n; i++)
911 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
912 			     c->ciphers_pairwise[i]);
913 	wil_dbg_misc(wil, "}\n");
914 	wil_dbg_misc(wil, "AKM suites [%d] {\n", c->n_akm_suites);
915 	n = min_t(int, c->n_akm_suites, ARRAY_SIZE(c->akm_suites));
916 	for (i = 0; i < n; i++)
917 		wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
918 			     c->akm_suites[i]);
919 	wil_dbg_misc(wil, "}\n");
920 	wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
921 		     c->control_port, be16_to_cpu(c->control_port_ethertype),
922 		     c->control_port_no_encrypt);
923 }
924 
925 static const char *
926 wil_get_auth_type_name(enum nl80211_auth_type auth_type)
927 {
928 	switch (auth_type) {
929 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
930 		return "OPEN_SYSTEM";
931 	case NL80211_AUTHTYPE_SHARED_KEY:
932 		return "SHARED_KEY";
933 	case NL80211_AUTHTYPE_FT:
934 		return "FT";
935 	case NL80211_AUTHTYPE_NETWORK_EAP:
936 		return "NETWORK_EAP";
937 	case NL80211_AUTHTYPE_SAE:
938 		return "SAE";
939 	case NL80211_AUTHTYPE_AUTOMATIC:
940 		return "AUTOMATIC";
941 	default:
942 		return "unknown";
943 	}
944 }
945 static void wil_print_connect_params(struct wil6210_priv *wil,
946 				     struct cfg80211_connect_params *sme)
947 {
948 	wil_info(wil, "Connecting to:\n");
949 	if (sme->channel) {
950 		wil_info(wil, "  Channel: %d freq %d\n",
951 			 sme->channel->hw_value, sme->channel->center_freq);
952 	}
953 	if (sme->bssid)
954 		wil_info(wil, "  BSSID: %pM\n", sme->bssid);
955 	if (sme->ssid)
956 		print_hex_dump(KERN_INFO, "  SSID: ", DUMP_PREFIX_OFFSET,
957 			       16, 1, sme->ssid, sme->ssid_len, true);
958 	if (sme->prev_bssid)
959 		wil_info(wil, "  Previous BSSID=%pM\n", sme->prev_bssid);
960 	wil_info(wil, "  Auth Type: %s\n",
961 		 wil_get_auth_type_name(sme->auth_type));
962 	wil_info(wil, "  Privacy: %s\n", sme->privacy ? "secure" : "open");
963 	wil_info(wil, "  PBSS: %d\n", sme->pbss);
964 	wil_print_crypto(wil, &sme->crypto);
965 }
966 
967 static int wil_ft_connect(struct wiphy *wiphy,
968 			  struct net_device *ndev,
969 			  struct cfg80211_connect_params *sme)
970 {
971 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
972 	struct wil6210_vif *vif = ndev_to_vif(ndev);
973 	struct wmi_ft_auth_cmd auth_cmd;
974 	int rc;
975 
976 	if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING, wil->fw_capabilities)) {
977 		wil_err(wil, "FT: FW does not support FT roaming\n");
978 		return -EOPNOTSUPP;
979 	}
980 
981 	if (!sme->prev_bssid) {
982 		wil_err(wil, "FT: prev_bssid was not set\n");
983 		return -EINVAL;
984 	}
985 
986 	if (ether_addr_equal(sme->prev_bssid, sme->bssid)) {
987 		wil_err(wil, "FT: can not roam to same AP\n");
988 		return -EINVAL;
989 	}
990 
991 	if (!test_bit(wil_vif_fwconnected, vif->status)) {
992 		wil_err(wil, "FT: roam while not connected\n");
993 		return -EINVAL;
994 	}
995 
996 	if (vif->privacy != sme->privacy) {
997 		wil_err(wil, "FT: privacy mismatch, current (%d) roam (%d)\n",
998 			vif->privacy, sme->privacy);
999 		return -EINVAL;
1000 	}
1001 
1002 	if (sme->pbss) {
1003 		wil_err(wil, "FT: roam is not valid for PBSS\n");
1004 		return -EINVAL;
1005 	}
1006 
1007 	memset(&auth_cmd, 0, sizeof(auth_cmd));
1008 	auth_cmd.channel = sme->channel->hw_value - 1;
1009 	ether_addr_copy(auth_cmd.bssid, sme->bssid);
1010 
1011 	wil_info(wil, "FT: roaming\n");
1012 
1013 	set_bit(wil_vif_ft_roam, vif->status);
1014 	rc = wmi_send(wil, WMI_FT_AUTH_CMDID, vif->mid,
1015 		      &auth_cmd, sizeof(auth_cmd));
1016 	if (rc == 0)
1017 		mod_timer(&vif->connect_timer,
1018 			  jiffies + msecs_to_jiffies(5000));
1019 	else
1020 		clear_bit(wil_vif_ft_roam, vif->status);
1021 
1022 	return rc;
1023 }
1024 
1025 static int wil_cfg80211_connect(struct wiphy *wiphy,
1026 				struct net_device *ndev,
1027 				struct cfg80211_connect_params *sme)
1028 {
1029 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1030 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1031 	struct cfg80211_bss *bss;
1032 	struct wmi_connect_cmd conn;
1033 	const u8 *ssid_eid;
1034 	const u8 *rsn_eid;
1035 	int ch;
1036 	int rc = 0;
1037 	bool is_ft_roam = false;
1038 	u8 network_type;
1039 	enum ieee80211_bss_type bss_type = IEEE80211_BSS_TYPE_ESS;
1040 
1041 	wil_dbg_misc(wil, "connect, mid=%d\n", vif->mid);
1042 	wil_print_connect_params(wil, sme);
1043 
1044 	if (sme->auth_type == NL80211_AUTHTYPE_FT)
1045 		is_ft_roam = true;
1046 	if (sme->auth_type == NL80211_AUTHTYPE_AUTOMATIC &&
1047 	    test_bit(wil_vif_fwconnected, vif->status))
1048 		is_ft_roam = true;
1049 
1050 	if (!is_ft_roam)
1051 		if (test_bit(wil_vif_fwconnecting, vif->status) ||
1052 		    test_bit(wil_vif_fwconnected, vif->status))
1053 			return -EALREADY;
1054 
1055 	if (sme->ie_len > WMI_MAX_IE_LEN) {
1056 		wil_err(wil, "IE too large (%td bytes)\n", sme->ie_len);
1057 		return -ERANGE;
1058 	}
1059 
1060 	rsn_eid = sme->ie ?
1061 			cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
1062 			NULL;
1063 	if (sme->privacy && !rsn_eid) {
1064 		wil_info(wil, "WSC connection\n");
1065 		if (is_ft_roam) {
1066 			wil_err(wil, "No WSC with FT roam\n");
1067 			return -EINVAL;
1068 		}
1069 	}
1070 
1071 	if (sme->pbss)
1072 		bss_type = IEEE80211_BSS_TYPE_PBSS;
1073 
1074 	bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
1075 			       sme->ssid, sme->ssid_len,
1076 			       bss_type, IEEE80211_PRIVACY_ANY);
1077 	if (!bss) {
1078 		wil_err(wil, "Unable to find BSS\n");
1079 		return -ENOENT;
1080 	}
1081 
1082 	ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
1083 	if (!ssid_eid) {
1084 		wil_err(wil, "No SSID\n");
1085 		rc = -ENOENT;
1086 		goto out;
1087 	}
1088 	vif->privacy = sme->privacy;
1089 	vif->pbss = sme->pbss;
1090 
1091 	rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
1092 	if (rc)
1093 		goto out;
1094 
1095 	switch (bss->capability & WLAN_CAPABILITY_DMG_TYPE_MASK) {
1096 	case WLAN_CAPABILITY_DMG_TYPE_AP:
1097 		network_type = WMI_NETTYPE_INFRA;
1098 		break;
1099 	case WLAN_CAPABILITY_DMG_TYPE_PBSS:
1100 		network_type = WMI_NETTYPE_P2P;
1101 		break;
1102 	default:
1103 		wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
1104 			bss->capability);
1105 		rc = -EINVAL;
1106 		goto out;
1107 	}
1108 
1109 	ch = bss->channel->hw_value;
1110 	if (ch == 0) {
1111 		wil_err(wil, "BSS at unknown frequency %dMhz\n",
1112 			bss->channel->center_freq);
1113 		rc = -EOPNOTSUPP;
1114 		goto out;
1115 	}
1116 
1117 	if (is_ft_roam) {
1118 		if (network_type != WMI_NETTYPE_INFRA) {
1119 			wil_err(wil, "FT: Unsupported BSS type, capability= 0x%04x\n",
1120 				bss->capability);
1121 			rc = -EINVAL;
1122 			goto out;
1123 		}
1124 		rc = wil_ft_connect(wiphy, ndev, sme);
1125 		if (rc == 0)
1126 			vif->bss = bss;
1127 		goto out;
1128 	}
1129 
1130 	if (vif->privacy) {
1131 		/* For secure assoc, remove old keys */
1132 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
1133 					WMI_KEY_USE_PAIRWISE);
1134 		if (rc) {
1135 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(PTK) failed\n");
1136 			goto out;
1137 		}
1138 		rc = wmi_del_cipher_key(vif, 0, bss->bssid,
1139 					WMI_KEY_USE_RX_GROUP);
1140 		if (rc) {
1141 			wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD(GTK) failed\n");
1142 			goto out;
1143 		}
1144 	}
1145 
1146 	/* WMI_CONNECT_CMD */
1147 	memset(&conn, 0, sizeof(conn));
1148 	conn.network_type = network_type;
1149 	if (vif->privacy) {
1150 		if (rsn_eid) { /* regular secure connection */
1151 			conn.dot11_auth_mode = WMI_AUTH11_SHARED;
1152 			conn.auth_mode = WMI_AUTH_WPA2_PSK;
1153 			conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
1154 			conn.pairwise_crypto_len = 16;
1155 			conn.group_crypto_type = WMI_CRYPT_AES_GCMP;
1156 			conn.group_crypto_len = 16;
1157 		} else { /* WSC */
1158 			conn.dot11_auth_mode = WMI_AUTH11_WSC;
1159 			conn.auth_mode = WMI_AUTH_NONE;
1160 		}
1161 	} else { /* insecure connection */
1162 		conn.dot11_auth_mode = WMI_AUTH11_OPEN;
1163 		conn.auth_mode = WMI_AUTH_NONE;
1164 	}
1165 
1166 	conn.ssid_len = min_t(u8, ssid_eid[1], 32);
1167 	memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
1168 	conn.channel = ch - 1;
1169 
1170 	ether_addr_copy(conn.bssid, bss->bssid);
1171 	ether_addr_copy(conn.dst_mac, bss->bssid);
1172 
1173 	set_bit(wil_vif_fwconnecting, vif->status);
1174 
1175 	rc = wmi_send(wil, WMI_CONNECT_CMDID, vif->mid, &conn, sizeof(conn));
1176 	if (rc == 0) {
1177 		netif_carrier_on(ndev);
1178 		if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1179 			wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1180 		vif->bss = bss;
1181 		/* Connect can take lots of time */
1182 		mod_timer(&vif->connect_timer,
1183 			  jiffies + msecs_to_jiffies(5000));
1184 	} else {
1185 		clear_bit(wil_vif_fwconnecting, vif->status);
1186 	}
1187 
1188  out:
1189 	cfg80211_put_bss(wiphy, bss);
1190 
1191 	return rc;
1192 }
1193 
1194 static int wil_cfg80211_disconnect(struct wiphy *wiphy,
1195 				   struct net_device *ndev,
1196 				   u16 reason_code)
1197 {
1198 	int rc;
1199 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1200 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1201 
1202 	wil_dbg_misc(wil, "disconnect: reason=%d, mid=%d\n",
1203 		     reason_code, vif->mid);
1204 
1205 	if (!(test_bit(wil_vif_fwconnecting, vif->status) ||
1206 	      test_bit(wil_vif_fwconnected, vif->status))) {
1207 		wil_err(wil, "Disconnect was called while disconnected\n");
1208 		return 0;
1209 	}
1210 
1211 	vif->locally_generated_disc = true;
1212 	rc = wmi_call(wil, WMI_DISCONNECT_CMDID, vif->mid, NULL, 0,
1213 		      WMI_DISCONNECT_EVENTID, NULL, 0,
1214 		      WIL6210_DISCONNECT_TO_MS);
1215 	if (rc)
1216 		wil_err(wil, "disconnect error %d\n", rc);
1217 
1218 	return rc;
1219 }
1220 
1221 static int wil_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1222 {
1223 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1224 	int rc;
1225 
1226 	/* these parameters are explicitly not supported */
1227 	if (changed & (WIPHY_PARAM_RETRY_LONG |
1228 		       WIPHY_PARAM_FRAG_THRESHOLD |
1229 		       WIPHY_PARAM_RTS_THRESHOLD))
1230 		return -ENOTSUPP;
1231 
1232 	if (changed & WIPHY_PARAM_RETRY_SHORT) {
1233 		rc = wmi_set_mgmt_retry(wil, wiphy->retry_short);
1234 		if (rc)
1235 			return rc;
1236 	}
1237 
1238 	return 0;
1239 }
1240 
1241 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
1242 			 struct cfg80211_mgmt_tx_params *params,
1243 			 u64 *cookie)
1244 {
1245 	const u8 *buf = params->buf;
1246 	size_t len = params->len;
1247 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1248 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1249 	int rc;
1250 	bool tx_status;
1251 
1252 	wil_dbg_misc(wil, "mgmt_tx: channel %d offchan %d, wait %d\n",
1253 		     params->chan ? params->chan->hw_value : -1,
1254 		     params->offchan,
1255 		     params->wait);
1256 
1257 	/* Note, currently we support the "wait" parameter only on AP mode.
1258 	 * In other modes, user-space must call remain_on_channel before
1259 	 * mgmt_tx or listen on a channel other than active one.
1260 	 */
1261 
1262 	if (params->chan && params->chan->hw_value == 0) {
1263 		wil_err(wil, "invalid channel\n");
1264 		return -EINVAL;
1265 	}
1266 
1267 	if (wdev->iftype != NL80211_IFTYPE_AP) {
1268 		wil_dbg_misc(wil,
1269 			     "send WMI_SW_TX_REQ_CMDID on non-AP interfaces\n");
1270 		rc = wmi_mgmt_tx(vif, buf, len);
1271 		goto out;
1272 	}
1273 
1274 	if (!params->chan || params->chan->hw_value == vif->channel) {
1275 		wil_dbg_misc(wil,
1276 			     "send WMI_SW_TX_REQ_CMDID for on-channel\n");
1277 		rc = wmi_mgmt_tx(vif, buf, len);
1278 		goto out;
1279 	}
1280 
1281 	if (params->offchan == 0) {
1282 		wil_err(wil,
1283 			"invalid channel params: current %d requested %d, off-channel not allowed\n",
1284 			vif->channel, params->chan->hw_value);
1285 		return -EBUSY;
1286 	}
1287 
1288 	/* use the wmi_mgmt_tx_ext only on AP mode and off-channel */
1289 	rc = wmi_mgmt_tx_ext(vif, buf, len, params->chan->hw_value,
1290 			     params->wait);
1291 
1292 out:
1293 	/* when the sent packet was not acked by receiver(ACK=0), rc will
1294 	 * be -EAGAIN. In this case this function needs to return success,
1295 	 * the ACK=0 will be reflected in tx_status.
1296 	 */
1297 	tx_status = (rc == 0);
1298 	rc = (rc == -EAGAIN) ? 0 : rc;
1299 	cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
1300 				tx_status, GFP_KERNEL);
1301 
1302 	return rc;
1303 }
1304 
1305 static int wil_cfg80211_set_channel(struct wiphy *wiphy,
1306 				    struct cfg80211_chan_def *chandef)
1307 {
1308 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1309 
1310 	wil->monitor_chandef = *chandef;
1311 
1312 	return 0;
1313 }
1314 
1315 static enum wmi_key_usage wil_detect_key_usage(struct wireless_dev *wdev,
1316 					       bool pairwise)
1317 {
1318 	struct wil6210_priv *wil = wdev_to_wil(wdev);
1319 	enum wmi_key_usage rc;
1320 
1321 	if (pairwise) {
1322 		rc = WMI_KEY_USE_PAIRWISE;
1323 	} else {
1324 		switch (wdev->iftype) {
1325 		case NL80211_IFTYPE_STATION:
1326 		case NL80211_IFTYPE_P2P_CLIENT:
1327 			rc = WMI_KEY_USE_RX_GROUP;
1328 			break;
1329 		case NL80211_IFTYPE_AP:
1330 		case NL80211_IFTYPE_P2P_GO:
1331 			rc = WMI_KEY_USE_TX_GROUP;
1332 			break;
1333 		default:
1334 			/* TODO: Rx GTK or Tx GTK? */
1335 			wil_err(wil, "Can't determine GTK type\n");
1336 			rc = WMI_KEY_USE_RX_GROUP;
1337 			break;
1338 		}
1339 	}
1340 	wil_dbg_misc(wil, "detect_key_usage: -> %s\n", key_usage_str[rc]);
1341 
1342 	return rc;
1343 }
1344 
1345 static struct wil_sta_info *
1346 wil_find_sta_by_key_usage(struct wil6210_priv *wil, u8 mid,
1347 			  enum wmi_key_usage key_usage, const u8 *mac_addr)
1348 {
1349 	int cid = -EINVAL;
1350 
1351 	if (key_usage == WMI_KEY_USE_TX_GROUP)
1352 		return NULL; /* not needed */
1353 
1354 	/* supplicant provides Rx group key in STA mode with NULL MAC address */
1355 	if (mac_addr)
1356 		cid = wil_find_cid(wil, mid, mac_addr);
1357 	else if (key_usage == WMI_KEY_USE_RX_GROUP)
1358 		cid = wil_find_cid_by_idx(wil, mid, 0);
1359 	if (cid < 0) {
1360 		wil_err(wil, "No CID for %pM %s\n", mac_addr,
1361 			key_usage_str[key_usage]);
1362 		return ERR_PTR(cid);
1363 	}
1364 
1365 	return &wil->sta[cid];
1366 }
1367 
1368 void wil_set_crypto_rx(u8 key_index, enum wmi_key_usage key_usage,
1369 		       struct wil_sta_info *cs,
1370 		       struct key_params *params)
1371 {
1372 	struct wil_tid_crypto_rx_single *cc;
1373 	int tid;
1374 
1375 	if (!cs)
1376 		return;
1377 
1378 	switch (key_usage) {
1379 	case WMI_KEY_USE_PAIRWISE:
1380 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1381 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1382 			if (params->seq)
1383 				memcpy(cc->pn, params->seq,
1384 				       IEEE80211_GCMP_PN_LEN);
1385 			else
1386 				memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1387 			cc->key_set = true;
1388 		}
1389 		break;
1390 	case WMI_KEY_USE_RX_GROUP:
1391 		cc = &cs->group_crypto_rx.key_id[key_index];
1392 		if (params->seq)
1393 			memcpy(cc->pn, params->seq, IEEE80211_GCMP_PN_LEN);
1394 		else
1395 			memset(cc->pn, 0, IEEE80211_GCMP_PN_LEN);
1396 		cc->key_set = true;
1397 		break;
1398 	default:
1399 		break;
1400 	}
1401 }
1402 
1403 static void wil_del_rx_key(u8 key_index, enum wmi_key_usage key_usage,
1404 			   struct wil_sta_info *cs)
1405 {
1406 	struct wil_tid_crypto_rx_single *cc;
1407 	int tid;
1408 
1409 	if (!cs)
1410 		return;
1411 
1412 	switch (key_usage) {
1413 	case WMI_KEY_USE_PAIRWISE:
1414 		for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
1415 			cc = &cs->tid_crypto_rx[tid].key_id[key_index];
1416 			cc->key_set = false;
1417 		}
1418 		break;
1419 	case WMI_KEY_USE_RX_GROUP:
1420 		cc = &cs->group_crypto_rx.key_id[key_index];
1421 		cc->key_set = false;
1422 		break;
1423 	default:
1424 		break;
1425 	}
1426 }
1427 
1428 static int wil_cfg80211_add_key(struct wiphy *wiphy,
1429 				struct net_device *ndev,
1430 				u8 key_index, bool pairwise,
1431 				const u8 *mac_addr,
1432 				struct key_params *params)
1433 {
1434 	int rc;
1435 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1436 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1437 	struct wireless_dev *wdev = vif_to_wdev(vif);
1438 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1439 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1440 							    key_usage,
1441 							    mac_addr);
1442 
1443 	if (!params) {
1444 		wil_err(wil, "NULL params\n");
1445 		return -EINVAL;
1446 	}
1447 
1448 	wil_dbg_misc(wil, "add_key: %pM %s[%d] PN %*phN\n",
1449 		     mac_addr, key_usage_str[key_usage], key_index,
1450 		     params->seq_len, params->seq);
1451 
1452 	if (IS_ERR(cs)) {
1453 		/* in FT, sta info may not be available as add_key may be
1454 		 * sent by host before FW sends WMI_CONNECT_EVENT
1455 		 */
1456 		if (!test_bit(wil_vif_ft_roam, vif->status)) {
1457 			wil_err(wil, "Not connected, %pM %s[%d] PN %*phN\n",
1458 				mac_addr, key_usage_str[key_usage], key_index,
1459 				params->seq_len, params->seq);
1460 			return -EINVAL;
1461 		}
1462 	}
1463 
1464 	if (!IS_ERR(cs))
1465 		wil_del_rx_key(key_index, key_usage, cs);
1466 
1467 	if (params->seq && params->seq_len != IEEE80211_GCMP_PN_LEN) {
1468 		wil_err(wil,
1469 			"Wrong PN len %d, %pM %s[%d] PN %*phN\n",
1470 			params->seq_len, mac_addr,
1471 			key_usage_str[key_usage], key_index,
1472 			params->seq_len, params->seq);
1473 		return -EINVAL;
1474 	}
1475 
1476 	rc = wmi_add_cipher_key(vif, key_index, mac_addr, params->key_len,
1477 				params->key, key_usage);
1478 	if (!rc && !IS_ERR(cs)) {
1479 		/* update local storage used for AP recovery */
1480 		if (key_usage == WMI_KEY_USE_TX_GROUP && params->key &&
1481 		    params->key_len <= WMI_MAX_KEY_LEN) {
1482 			vif->gtk_index = key_index;
1483 			memcpy(vif->gtk, params->key, params->key_len);
1484 			vif->gtk_len = params->key_len;
1485 		}
1486 		/* in FT set crypto will take place upon receiving
1487 		 * WMI_RING_EN_EVENTID event
1488 		 */
1489 		wil_set_crypto_rx(key_index, key_usage, cs, params);
1490 	}
1491 
1492 	return rc;
1493 }
1494 
1495 static int wil_cfg80211_del_key(struct wiphy *wiphy,
1496 				struct net_device *ndev,
1497 				u8 key_index, bool pairwise,
1498 				const u8 *mac_addr)
1499 {
1500 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1501 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1502 	struct wireless_dev *wdev = vif_to_wdev(vif);
1503 	enum wmi_key_usage key_usage = wil_detect_key_usage(wdev, pairwise);
1504 	struct wil_sta_info *cs = wil_find_sta_by_key_usage(wil, vif->mid,
1505 							    key_usage,
1506 							    mac_addr);
1507 
1508 	wil_dbg_misc(wil, "del_key: %pM %s[%d]\n", mac_addr,
1509 		     key_usage_str[key_usage], key_index);
1510 
1511 	if (IS_ERR(cs))
1512 		wil_info(wil, "Not connected, %pM %s[%d]\n",
1513 			 mac_addr, key_usage_str[key_usage], key_index);
1514 
1515 	if (!IS_ERR_OR_NULL(cs))
1516 		wil_del_rx_key(key_index, key_usage, cs);
1517 
1518 	return wmi_del_cipher_key(vif, key_index, mac_addr, key_usage);
1519 }
1520 
1521 /* Need to be present or wiphy_new() will WARN */
1522 static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
1523 					struct net_device *ndev,
1524 					u8 key_index, bool unicast,
1525 					bool multicast)
1526 {
1527 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1528 
1529 	wil_dbg_misc(wil, "set_default_key: entered\n");
1530 	return 0;
1531 }
1532 
1533 static int wil_remain_on_channel(struct wiphy *wiphy,
1534 				 struct wireless_dev *wdev,
1535 				 struct ieee80211_channel *chan,
1536 				 unsigned int duration,
1537 				 u64 *cookie)
1538 {
1539 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1540 	int rc;
1541 
1542 	wil_dbg_misc(wil,
1543 		     "remain_on_channel: center_freq=%d, duration=%d iftype=%d\n",
1544 		     chan->center_freq, duration, wdev->iftype);
1545 
1546 	rc = wil_p2p_listen(wil, wdev, duration, chan, cookie);
1547 	return rc;
1548 }
1549 
1550 static int wil_cancel_remain_on_channel(struct wiphy *wiphy,
1551 					struct wireless_dev *wdev,
1552 					u64 cookie)
1553 {
1554 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1555 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
1556 
1557 	wil_dbg_misc(wil, "cancel_remain_on_channel\n");
1558 
1559 	return wil_p2p_cancel_listen(vif, cookie);
1560 }
1561 
1562 /**
1563  * find a specific IE in a list of IEs
1564  * return a pointer to the beginning of IE in the list
1565  * or NULL if not found
1566  */
1567 static const u8 *_wil_cfg80211_find_ie(const u8 *ies, u16 ies_len, const u8 *ie,
1568 				       u16 ie_len)
1569 {
1570 	struct ieee80211_vendor_ie *vie;
1571 	u32 oui;
1572 
1573 	/* IE tag at offset 0, length at offset 1 */
1574 	if (ie_len < 2 || 2 + ie[1] > ie_len)
1575 		return NULL;
1576 
1577 	if (ie[0] != WLAN_EID_VENDOR_SPECIFIC)
1578 		return cfg80211_find_ie(ie[0], ies, ies_len);
1579 
1580 	/* make sure there is room for 3 bytes OUI + 1 byte OUI type */
1581 	if (ie[1] < 4)
1582 		return NULL;
1583 	vie = (struct ieee80211_vendor_ie *)ie;
1584 	oui = vie->oui[0] << 16 | vie->oui[1] << 8 | vie->oui[2];
1585 	return cfg80211_find_vendor_ie(oui, vie->oui_type, ies,
1586 				       ies_len);
1587 }
1588 
1589 /**
1590  * merge the IEs in two lists into a single list.
1591  * do not include IEs from the second list which exist in the first list.
1592  * add only vendor specific IEs from second list to keep
1593  * the merged list sorted (since vendor-specific IE has the
1594  * highest tag number)
1595  * caller must free the allocated memory for merged IEs
1596  */
1597 static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
1598 					 const u8 *ies2, u16 ies2_len,
1599 					 u8 **merged_ies, u16 *merged_len)
1600 {
1601 	u8 *buf, *dpos;
1602 	const u8 *spos;
1603 
1604 	if (!ies1)
1605 		ies1_len = 0;
1606 
1607 	if (!ies2)
1608 		ies2_len = 0;
1609 
1610 	if (ies1_len == 0 && ies2_len == 0) {
1611 		*merged_ies = NULL;
1612 		*merged_len = 0;
1613 		return 0;
1614 	}
1615 
1616 	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
1617 	if (!buf)
1618 		return -ENOMEM;
1619 	if (ies1)
1620 		memcpy(buf, ies1, ies1_len);
1621 	dpos = buf + ies1_len;
1622 	spos = ies2;
1623 	while (spos && (spos + 1 < ies2 + ies2_len)) {
1624 		/* IE tag at offset 0, length at offset 1 */
1625 		u16 ielen = 2 + spos[1];
1626 
1627 		if (spos + ielen > ies2 + ies2_len)
1628 			break;
1629 		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
1630 		    (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
1631 						     spos, ielen))) {
1632 			memcpy(dpos, spos, ielen);
1633 			dpos += ielen;
1634 		}
1635 		spos += ielen;
1636 	}
1637 
1638 	*merged_ies = buf;
1639 	*merged_len = dpos - buf;
1640 	return 0;
1641 }
1642 
1643 static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
1644 {
1645 	wil_hex_dump_misc("head     ", DUMP_PREFIX_OFFSET, 16, 1,
1646 			  b->head, b->head_len, true);
1647 	wil_hex_dump_misc("tail     ", DUMP_PREFIX_OFFSET, 16, 1,
1648 			  b->tail, b->tail_len, true);
1649 	wil_hex_dump_misc("BCON IE  ", DUMP_PREFIX_OFFSET, 16, 1,
1650 			  b->beacon_ies, b->beacon_ies_len, true);
1651 	wil_hex_dump_misc("PROBE    ", DUMP_PREFIX_OFFSET, 16, 1,
1652 			  b->probe_resp, b->probe_resp_len, true);
1653 	wil_hex_dump_misc("PROBE IE ", DUMP_PREFIX_OFFSET, 16, 1,
1654 			  b->proberesp_ies, b->proberesp_ies_len, true);
1655 	wil_hex_dump_misc("ASSOC IE ", DUMP_PREFIX_OFFSET, 16, 1,
1656 			  b->assocresp_ies, b->assocresp_ies_len, true);
1657 }
1658 
1659 /* internal functions for device reset and starting AP */
1660 static u8 *
1661 _wil_cfg80211_get_proberesp_ies(const u8 *proberesp, u16 proberesp_len,
1662 				u16 *ies_len)
1663 {
1664 	u8 *ies = NULL;
1665 
1666 	if (proberesp) {
1667 		struct ieee80211_mgmt *f =
1668 			(struct ieee80211_mgmt *)proberesp;
1669 		size_t hlen = offsetof(struct ieee80211_mgmt,
1670 				       u.probe_resp.variable);
1671 
1672 		ies = f->u.probe_resp.variable;
1673 		if (ies_len)
1674 			*ies_len = proberesp_len - hlen;
1675 	}
1676 
1677 	return ies;
1678 }
1679 
1680 static int _wil_cfg80211_set_ies(struct wil6210_vif *vif,
1681 				 struct cfg80211_beacon_data *bcon)
1682 {
1683 	int rc;
1684 	u16 len = 0, proberesp_len = 0;
1685 	u8 *ies = NULL, *proberesp;
1686 
1687 	/* update local storage used for AP recovery */
1688 	wil_memdup_ie(&vif->proberesp, &vif->proberesp_len, bcon->probe_resp,
1689 		      bcon->probe_resp_len);
1690 	wil_memdup_ie(&vif->proberesp_ies, &vif->proberesp_ies_len,
1691 		      bcon->proberesp_ies, bcon->proberesp_ies_len);
1692 	wil_memdup_ie(&vif->assocresp_ies, &vif->assocresp_ies_len,
1693 		      bcon->assocresp_ies, bcon->assocresp_ies_len);
1694 
1695 	proberesp = _wil_cfg80211_get_proberesp_ies(bcon->probe_resp,
1696 						    bcon->probe_resp_len,
1697 						    &proberesp_len);
1698 	rc = _wil_cfg80211_merge_extra_ies(proberesp,
1699 					   proberesp_len,
1700 					   bcon->proberesp_ies,
1701 					   bcon->proberesp_ies_len,
1702 					   &ies, &len);
1703 
1704 	if (rc)
1705 		goto out;
1706 
1707 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_RESP, len, ies);
1708 	if (rc)
1709 		goto out;
1710 
1711 	if (bcon->assocresp_ies)
1712 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP,
1713 				bcon->assocresp_ies_len, bcon->assocresp_ies);
1714 	else
1715 		rc = wmi_set_ie(vif, WMI_FRAME_ASSOC_RESP, len, ies);
1716 #if 0 /* to use beacon IE's, remove this #if 0 */
1717 	if (rc)
1718 		goto out;
1719 
1720 	rc = wmi_set_ie(vif, WMI_FRAME_BEACON,
1721 			bcon->tail_len, bcon->tail);
1722 #endif
1723 out:
1724 	kfree(ies);
1725 	return rc;
1726 }
1727 
1728 static int _wil_cfg80211_start_ap(struct wiphy *wiphy,
1729 				  struct net_device *ndev,
1730 				  const u8 *ssid, size_t ssid_len, u32 privacy,
1731 				  int bi, u8 chan,
1732 				  struct cfg80211_beacon_data *bcon,
1733 				  u8 hidden_ssid, u32 pbss)
1734 {
1735 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1736 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1737 	int rc;
1738 	struct wireless_dev *wdev = ndev->ieee80211_ptr;
1739 	u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
1740 	u8 is_go = (wdev->iftype == NL80211_IFTYPE_P2P_GO);
1741 	u16 proberesp_len = 0;
1742 	u8 *proberesp;
1743 	bool ft = false;
1744 
1745 	if (pbss)
1746 		wmi_nettype = WMI_NETTYPE_P2P;
1747 
1748 	wil_dbg_misc(wil, "start_ap: mid=%d, is_go=%d\n", vif->mid, is_go);
1749 	if (is_go && !pbss) {
1750 		wil_err(wil, "P2P GO must be in PBSS\n");
1751 		return -ENOTSUPP;
1752 	}
1753 
1754 	wil_set_recovery_state(wil, fw_recovery_idle);
1755 
1756 	proberesp = _wil_cfg80211_get_proberesp_ies(bcon->probe_resp,
1757 						    bcon->probe_resp_len,
1758 						    &proberesp_len);
1759 	/* check that the probe response IEs has a MDE */
1760 	if ((proberesp && proberesp_len > 0 &&
1761 	     cfg80211_find_ie(WLAN_EID_MOBILITY_DOMAIN,
1762 			      proberesp,
1763 			      proberesp_len)))
1764 		ft = true;
1765 
1766 	if (ft) {
1767 		if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING,
1768 			      wil->fw_capabilities)) {
1769 			wil_err(wil, "FW does not support FT roaming\n");
1770 			return -ENOTSUPP;
1771 		}
1772 		set_bit(wil_vif_ft_roam, vif->status);
1773 	}
1774 
1775 	mutex_lock(&wil->mutex);
1776 
1777 	if (!wil_has_other_active_ifaces(wil, ndev, true, false)) {
1778 		__wil_down(wil);
1779 		rc = __wil_up(wil);
1780 		if (rc)
1781 			goto out;
1782 	}
1783 
1784 	rc = wmi_set_ssid(vif, ssid_len, ssid);
1785 	if (rc)
1786 		goto out;
1787 
1788 	rc = _wil_cfg80211_set_ies(vif, bcon);
1789 	if (rc)
1790 		goto out;
1791 
1792 	vif->privacy = privacy;
1793 	vif->channel = chan;
1794 	vif->hidden_ssid = hidden_ssid;
1795 	vif->pbss = pbss;
1796 	vif->bi = bi;
1797 	memcpy(vif->ssid, ssid, ssid_len);
1798 	vif->ssid_len = ssid_len;
1799 
1800 	netif_carrier_on(ndev);
1801 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1802 		wil6210_bus_request(wil, WIL_MAX_BUS_REQUEST_KBPS);
1803 
1804 	rc = wmi_pcp_start(vif, bi, wmi_nettype, chan, hidden_ssid, is_go);
1805 	if (rc)
1806 		goto err_pcp_start;
1807 
1808 	rc = wil_bcast_init(vif);
1809 	if (rc)
1810 		goto err_bcast;
1811 
1812 	goto out; /* success */
1813 
1814 err_bcast:
1815 	wmi_pcp_stop(vif);
1816 err_pcp_start:
1817 	netif_carrier_off(ndev);
1818 	if (!wil_has_other_active_ifaces(wil, ndev, false, true))
1819 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1820 out:
1821 	mutex_unlock(&wil->mutex);
1822 	return rc;
1823 }
1824 
1825 void wil_cfg80211_ap_recovery(struct wil6210_priv *wil)
1826 {
1827 	int rc, i;
1828 	struct wiphy *wiphy = wil_to_wiphy(wil);
1829 
1830 	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
1831 		struct wil6210_vif *vif = wil->vifs[i];
1832 		struct net_device *ndev;
1833 		struct cfg80211_beacon_data bcon = {};
1834 		struct key_params key_params = {};
1835 
1836 		if (!vif || vif->ssid_len == 0)
1837 			continue;
1838 
1839 		ndev = vif_to_ndev(vif);
1840 		bcon.proberesp_ies = vif->proberesp_ies;
1841 		bcon.assocresp_ies = vif->assocresp_ies;
1842 		bcon.probe_resp = vif->proberesp;
1843 		bcon.proberesp_ies_len = vif->proberesp_ies_len;
1844 		bcon.assocresp_ies_len = vif->assocresp_ies_len;
1845 		bcon.probe_resp_len = vif->proberesp_len;
1846 
1847 		wil_info(wil,
1848 			 "AP (vif %d) recovery: privacy %d, bi %d, channel %d, hidden %d, pbss %d\n",
1849 			 i, vif->privacy, vif->bi, vif->channel,
1850 			 vif->hidden_ssid, vif->pbss);
1851 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1852 				  vif->ssid, vif->ssid_len, true);
1853 		rc = _wil_cfg80211_start_ap(wiphy, ndev,
1854 					    vif->ssid, vif->ssid_len,
1855 					    vif->privacy, vif->bi,
1856 					    vif->channel, &bcon,
1857 					    vif->hidden_ssid, vif->pbss);
1858 		if (rc) {
1859 			wil_err(wil, "vif %d recovery failed (%d)\n", i, rc);
1860 			continue;
1861 		}
1862 
1863 		if (!vif->privacy || vif->gtk_len == 0)
1864 			continue;
1865 
1866 		key_params.key = vif->gtk;
1867 		key_params.key_len = vif->gtk_len;
1868 		key_params.seq_len = IEEE80211_GCMP_PN_LEN;
1869 		rc = wil_cfg80211_add_key(wiphy, ndev, vif->gtk_index, false,
1870 					  NULL, &key_params);
1871 		if (rc)
1872 			wil_err(wil, "vif %d recovery add key failed (%d)\n",
1873 				i, rc);
1874 	}
1875 }
1876 
1877 static int wil_cfg80211_change_beacon(struct wiphy *wiphy,
1878 				      struct net_device *ndev,
1879 				      struct cfg80211_beacon_data *bcon)
1880 {
1881 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1882 	struct wireless_dev *wdev = ndev->ieee80211_ptr;
1883 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1884 	int rc;
1885 	u32 privacy = 0;
1886 
1887 	wil_dbg_misc(wil, "change_beacon, mid=%d\n", vif->mid);
1888 	wil_print_bcon_data(bcon);
1889 
1890 	if (bcon->tail &&
1891 	    cfg80211_find_ie(WLAN_EID_RSN, bcon->tail,
1892 			     bcon->tail_len))
1893 		privacy = 1;
1894 
1895 	memcpy(vif->ssid, wdev->ssid, wdev->ssid_len);
1896 	vif->ssid_len = wdev->ssid_len;
1897 
1898 	/* in case privacy has changed, need to restart the AP */
1899 	if (vif->privacy != privacy) {
1900 		wil_dbg_misc(wil, "privacy changed %d=>%d. Restarting AP\n",
1901 			     vif->privacy, privacy);
1902 
1903 		rc = _wil_cfg80211_start_ap(wiphy, ndev, vif->ssid,
1904 					    vif->ssid_len, privacy,
1905 					    wdev->beacon_interval,
1906 					    vif->channel, bcon,
1907 					    vif->hidden_ssid,
1908 					    vif->pbss);
1909 	} else {
1910 		rc = _wil_cfg80211_set_ies(vif, bcon);
1911 	}
1912 
1913 	return rc;
1914 }
1915 
1916 static int wil_cfg80211_start_ap(struct wiphy *wiphy,
1917 				 struct net_device *ndev,
1918 				 struct cfg80211_ap_settings *info)
1919 {
1920 	int rc;
1921 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1922 	struct ieee80211_channel *channel = info->chandef.chan;
1923 	struct cfg80211_beacon_data *bcon = &info->beacon;
1924 	struct cfg80211_crypto_settings *crypto = &info->crypto;
1925 	u8 hidden_ssid;
1926 
1927 	wil_dbg_misc(wil, "start_ap\n");
1928 
1929 	if (!channel) {
1930 		wil_err(wil, "AP: No channel???\n");
1931 		return -EINVAL;
1932 	}
1933 
1934 	switch (info->hidden_ssid) {
1935 	case NL80211_HIDDEN_SSID_NOT_IN_USE:
1936 		hidden_ssid = WMI_HIDDEN_SSID_DISABLED;
1937 		break;
1938 
1939 	case NL80211_HIDDEN_SSID_ZERO_LEN:
1940 		hidden_ssid = WMI_HIDDEN_SSID_SEND_EMPTY;
1941 		break;
1942 
1943 	case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
1944 		hidden_ssid = WMI_HIDDEN_SSID_CLEAR;
1945 		break;
1946 
1947 	default:
1948 		wil_err(wil, "AP: Invalid hidden SSID %d\n", info->hidden_ssid);
1949 		return -EOPNOTSUPP;
1950 	}
1951 	wil_dbg_misc(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
1952 		     channel->center_freq, info->privacy ? "secure" : "open");
1953 	wil_dbg_misc(wil, "Privacy: %d auth_type %d\n",
1954 		     info->privacy, info->auth_type);
1955 	wil_dbg_misc(wil, "Hidden SSID mode: %d\n",
1956 		     info->hidden_ssid);
1957 	wil_dbg_misc(wil, "BI %d DTIM %d\n", info->beacon_interval,
1958 		     info->dtim_period);
1959 	wil_dbg_misc(wil, "PBSS %d\n", info->pbss);
1960 	wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
1961 			  info->ssid, info->ssid_len, true);
1962 	wil_print_bcon_data(bcon);
1963 	wil_print_crypto(wil, crypto);
1964 
1965 	rc = _wil_cfg80211_start_ap(wiphy, ndev,
1966 				    info->ssid, info->ssid_len, info->privacy,
1967 				    info->beacon_interval, channel->hw_value,
1968 				    bcon, hidden_ssid, info->pbss);
1969 
1970 	return rc;
1971 }
1972 
1973 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
1974 				struct net_device *ndev)
1975 {
1976 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
1977 	struct wil6210_vif *vif = ndev_to_vif(ndev);
1978 	bool last;
1979 
1980 	wil_dbg_misc(wil, "stop_ap, mid=%d\n", vif->mid);
1981 
1982 	netif_carrier_off(ndev);
1983 	last = !wil_has_other_active_ifaces(wil, ndev, false, true);
1984 	if (last) {
1985 		wil6210_bus_request(wil, WIL_DEFAULT_BUS_REQUEST_KBPS);
1986 		wil_set_recovery_state(wil, fw_recovery_idle);
1987 		set_bit(wil_status_resetting, wil->status);
1988 	}
1989 
1990 	mutex_lock(&wil->mutex);
1991 
1992 	wmi_pcp_stop(vif);
1993 	clear_bit(wil_vif_ft_roam, vif->status);
1994 	vif->ssid_len = 0;
1995 	wil_memdup_ie(&vif->proberesp, &vif->proberesp_len, NULL, 0);
1996 	wil_memdup_ie(&vif->proberesp_ies, &vif->proberesp_ies_len, NULL, 0);
1997 	wil_memdup_ie(&vif->assocresp_ies, &vif->assocresp_ies_len, NULL, 0);
1998 	memset(vif->gtk, 0, WMI_MAX_KEY_LEN);
1999 	vif->gtk_len = 0;
2000 
2001 	if (last)
2002 		__wil_down(wil);
2003 	else
2004 		wil_bcast_fini(vif);
2005 
2006 	mutex_unlock(&wil->mutex);
2007 
2008 	return 0;
2009 }
2010 
2011 static int wil_cfg80211_add_station(struct wiphy *wiphy,
2012 				    struct net_device *dev,
2013 				    const u8 *mac,
2014 				    struct station_parameters *params)
2015 {
2016 	struct wil6210_vif *vif = ndev_to_vif(dev);
2017 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2018 
2019 	wil_dbg_misc(wil, "add station %pM aid %d mid %d mask 0x%x set 0x%x\n",
2020 		     mac, params->aid, vif->mid,
2021 		     params->sta_flags_mask, params->sta_flags_set);
2022 
2023 	if (!disable_ap_sme) {
2024 		wil_err(wil, "not supported with AP SME enabled\n");
2025 		return -EOPNOTSUPP;
2026 	}
2027 
2028 	if (params->aid > WIL_MAX_DMG_AID) {
2029 		wil_err(wil, "invalid aid\n");
2030 		return -EINVAL;
2031 	}
2032 
2033 	return wmi_new_sta(vif, mac, params->aid);
2034 }
2035 
2036 static int wil_cfg80211_del_station(struct wiphy *wiphy,
2037 				    struct net_device *dev,
2038 				    struct station_del_parameters *params)
2039 {
2040 	struct wil6210_vif *vif = ndev_to_vif(dev);
2041 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2042 
2043 	wil_dbg_misc(wil, "del_station: %pM, reason=%d mid=%d\n",
2044 		     params->mac, params->reason_code, vif->mid);
2045 
2046 	mutex_lock(&wil->mutex);
2047 	wil6210_disconnect(vif, params->mac, params->reason_code);
2048 	mutex_unlock(&wil->mutex);
2049 
2050 	return 0;
2051 }
2052 
2053 static int wil_cfg80211_change_station(struct wiphy *wiphy,
2054 				       struct net_device *dev,
2055 				       const u8 *mac,
2056 				       struct station_parameters *params)
2057 {
2058 	struct wil6210_vif *vif = ndev_to_vif(dev);
2059 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2060 	int authorize;
2061 	int cid, i;
2062 	struct wil_ring_tx_data *txdata = NULL;
2063 
2064 	wil_dbg_misc(wil, "change station %pM mask 0x%x set 0x%x mid %d\n",
2065 		     mac, params->sta_flags_mask, params->sta_flags_set,
2066 		     vif->mid);
2067 
2068 	if (!disable_ap_sme) {
2069 		wil_dbg_misc(wil, "not supported with AP SME enabled\n");
2070 		return -EOPNOTSUPP;
2071 	}
2072 
2073 	if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
2074 		return 0;
2075 
2076 	cid = wil_find_cid(wil, vif->mid, mac);
2077 	if (cid < 0) {
2078 		wil_err(wil, "station not found\n");
2079 		return -ENOLINK;
2080 	}
2081 
2082 	for (i = 0; i < ARRAY_SIZE(wil->ring2cid_tid); i++)
2083 		if (wil->ring2cid_tid[i][0] == cid) {
2084 			txdata = &wil->ring_tx_data[i];
2085 			break;
2086 		}
2087 
2088 	if (!txdata) {
2089 		wil_err(wil, "ring data not found\n");
2090 		return -ENOLINK;
2091 	}
2092 
2093 	authorize = params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED);
2094 	txdata->dot1x_open = authorize ? 1 : 0;
2095 	wil_dbg_misc(wil, "cid %d ring %d authorize %d\n", cid, i,
2096 		     txdata->dot1x_open);
2097 
2098 	return 0;
2099 }
2100 
2101 /* probe_client handling */
2102 static void wil_probe_client_handle(struct wil6210_priv *wil,
2103 				    struct wil6210_vif *vif,
2104 				    struct wil_probe_client_req *req)
2105 {
2106 	struct net_device *ndev = vif_to_ndev(vif);
2107 	struct wil_sta_info *sta = &wil->sta[req->cid];
2108 	/* assume STA is alive if it is still connected,
2109 	 * else FW will disconnect it
2110 	 */
2111 	bool alive = (sta->status == wil_sta_connected);
2112 
2113 	cfg80211_probe_status(ndev, sta->addr, req->cookie, alive,
2114 			      0, false, GFP_KERNEL);
2115 }
2116 
2117 static struct list_head *next_probe_client(struct wil6210_vif *vif)
2118 {
2119 	struct list_head *ret = NULL;
2120 
2121 	mutex_lock(&vif->probe_client_mutex);
2122 
2123 	if (!list_empty(&vif->probe_client_pending)) {
2124 		ret = vif->probe_client_pending.next;
2125 		list_del(ret);
2126 	}
2127 
2128 	mutex_unlock(&vif->probe_client_mutex);
2129 
2130 	return ret;
2131 }
2132 
2133 void wil_probe_client_worker(struct work_struct *work)
2134 {
2135 	struct wil6210_vif *vif = container_of(work, struct wil6210_vif,
2136 					       probe_client_worker);
2137 	struct wil6210_priv *wil = vif_to_wil(vif);
2138 	struct wil_probe_client_req *req;
2139 	struct list_head *lh;
2140 
2141 	while ((lh = next_probe_client(vif)) != NULL) {
2142 		req = list_entry(lh, struct wil_probe_client_req, list);
2143 
2144 		wil_probe_client_handle(wil, vif, req);
2145 		kfree(req);
2146 	}
2147 }
2148 
2149 void wil_probe_client_flush(struct wil6210_vif *vif)
2150 {
2151 	struct wil_probe_client_req *req, *t;
2152 	struct wil6210_priv *wil = vif_to_wil(vif);
2153 
2154 	wil_dbg_misc(wil, "probe_client_flush\n");
2155 
2156 	mutex_lock(&vif->probe_client_mutex);
2157 
2158 	list_for_each_entry_safe(req, t, &vif->probe_client_pending, list) {
2159 		list_del(&req->list);
2160 		kfree(req);
2161 	}
2162 
2163 	mutex_unlock(&vif->probe_client_mutex);
2164 }
2165 
2166 static int wil_cfg80211_probe_client(struct wiphy *wiphy,
2167 				     struct net_device *dev,
2168 				     const u8 *peer, u64 *cookie)
2169 {
2170 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2171 	struct wil6210_vif *vif = ndev_to_vif(dev);
2172 	struct wil_probe_client_req *req;
2173 	int cid = wil_find_cid(wil, vif->mid, peer);
2174 
2175 	wil_dbg_misc(wil, "probe_client: %pM => CID %d MID %d\n",
2176 		     peer, cid, vif->mid);
2177 
2178 	if (cid < 0)
2179 		return -ENOLINK;
2180 
2181 	req = kzalloc(sizeof(*req), GFP_KERNEL);
2182 	if (!req)
2183 		return -ENOMEM;
2184 
2185 	req->cid = cid;
2186 	req->cookie = cid;
2187 
2188 	mutex_lock(&vif->probe_client_mutex);
2189 	list_add_tail(&req->list, &vif->probe_client_pending);
2190 	mutex_unlock(&vif->probe_client_mutex);
2191 
2192 	*cookie = req->cookie;
2193 	queue_work(wil->wq_service, &vif->probe_client_worker);
2194 	return 0;
2195 }
2196 
2197 static int wil_cfg80211_change_bss(struct wiphy *wiphy,
2198 				   struct net_device *dev,
2199 				   struct bss_parameters *params)
2200 {
2201 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2202 	struct wil6210_vif *vif = ndev_to_vif(dev);
2203 
2204 	if (params->ap_isolate >= 0) {
2205 		wil_dbg_misc(wil, "change_bss: ap_isolate MID %d, %d => %d\n",
2206 			     vif->mid, vif->ap_isolate, params->ap_isolate);
2207 		vif->ap_isolate = params->ap_isolate;
2208 	}
2209 
2210 	return 0;
2211 }
2212 
2213 static int wil_cfg80211_set_power_mgmt(struct wiphy *wiphy,
2214 				       struct net_device *dev,
2215 				       bool enabled, int timeout)
2216 {
2217 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2218 	enum wmi_ps_profile_type ps_profile;
2219 
2220 	wil_dbg_misc(wil, "enabled=%d, timeout=%d\n",
2221 		     enabled, timeout);
2222 
2223 	if (enabled)
2224 		ps_profile = WMI_PS_PROFILE_TYPE_DEFAULT;
2225 	else
2226 		ps_profile = WMI_PS_PROFILE_TYPE_PS_DISABLED;
2227 
2228 	return wil_ps_update(wil, ps_profile);
2229 }
2230 
2231 static int wil_cfg80211_suspend(struct wiphy *wiphy,
2232 				struct cfg80211_wowlan *wow)
2233 {
2234 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2235 	int rc;
2236 
2237 	/* Setting the wakeup trigger based on wow is TBD */
2238 
2239 	if (test_bit(wil_status_suspended, wil->status)) {
2240 		wil_dbg_pm(wil, "trying to suspend while suspended\n");
2241 		return 0;
2242 	}
2243 
2244 	rc = wil_can_suspend(wil, false);
2245 	if (rc)
2246 		goto out;
2247 
2248 	wil_dbg_pm(wil, "suspending\n");
2249 
2250 	mutex_lock(&wil->mutex);
2251 	mutex_lock(&wil->vif_mutex);
2252 	wil_p2p_stop_radio_operations(wil);
2253 	wil_abort_scan_all_vifs(wil, true);
2254 	mutex_unlock(&wil->vif_mutex);
2255 	mutex_unlock(&wil->mutex);
2256 
2257 out:
2258 	return rc;
2259 }
2260 
2261 static int wil_cfg80211_resume(struct wiphy *wiphy)
2262 {
2263 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2264 
2265 	wil_dbg_pm(wil, "resuming\n");
2266 
2267 	return 0;
2268 }
2269 
2270 static int
2271 wil_cfg80211_sched_scan_start(struct wiphy *wiphy,
2272 			      struct net_device *dev,
2273 			      struct cfg80211_sched_scan_request *request)
2274 {
2275 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2276 	struct wil6210_vif *vif = ndev_to_vif(dev);
2277 	int i, rc;
2278 
2279 	if (vif->mid != 0)
2280 		return -EOPNOTSUPP;
2281 
2282 	wil_dbg_misc(wil,
2283 		     "sched scan start: n_ssids %d, ie_len %zu, flags 0x%x\n",
2284 		     request->n_ssids, request->ie_len, request->flags);
2285 	for (i = 0; i < request->n_ssids; i++) {
2286 		wil_dbg_misc(wil, "SSID[%d]:", i);
2287 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
2288 				  request->ssids[i].ssid,
2289 				  request->ssids[i].ssid_len, true);
2290 	}
2291 	wil_dbg_misc(wil, "channels:");
2292 	for (i = 0; i < request->n_channels; i++)
2293 		wil_dbg_misc(wil, " %d%s", request->channels[i]->hw_value,
2294 			     i == request->n_channels - 1 ? "\n" : "");
2295 	wil_dbg_misc(wil, "n_match_sets %d, min_rssi_thold %d, delay %d\n",
2296 		     request->n_match_sets, request->min_rssi_thold,
2297 		     request->delay);
2298 	for (i = 0; i < request->n_match_sets; i++) {
2299 		struct cfg80211_match_set *ms = &request->match_sets[i];
2300 
2301 		wil_dbg_misc(wil, "MATCHSET[%d]: rssi_thold %d\n",
2302 			     i, ms->rssi_thold);
2303 		wil_hex_dump_misc("SSID ", DUMP_PREFIX_OFFSET, 16, 1,
2304 				  ms->ssid.ssid,
2305 				  ms->ssid.ssid_len, true);
2306 	}
2307 	wil_dbg_misc(wil, "n_scan_plans %d\n", request->n_scan_plans);
2308 	for (i = 0; i < request->n_scan_plans; i++) {
2309 		struct cfg80211_sched_scan_plan *sp = &request->scan_plans[i];
2310 
2311 		wil_dbg_misc(wil, "SCAN PLAN[%d]: interval %d iterations %d\n",
2312 			     i, sp->interval, sp->iterations);
2313 	}
2314 
2315 	rc = wmi_set_ie(vif, WMI_FRAME_PROBE_REQ,
2316 			request->ie_len, request->ie);
2317 	if (rc)
2318 		return rc;
2319 	return wmi_start_sched_scan(wil, request);
2320 }
2321 
2322 static int
2323 wil_cfg80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev,
2324 			     u64 reqid)
2325 {
2326 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2327 	struct wil6210_vif *vif = ndev_to_vif(dev);
2328 	int rc;
2329 
2330 	if (vif->mid != 0)
2331 		return -EOPNOTSUPP;
2332 
2333 	rc = wmi_stop_sched_scan(wil);
2334 	/* device would return error if it thinks PNO is already stopped.
2335 	 * ignore the return code so user space and driver gets back in-sync
2336 	 */
2337 	wil_dbg_misc(wil, "sched scan stopped (%d)\n", rc);
2338 
2339 	return 0;
2340 }
2341 
2342 static int
2343 wil_cfg80211_update_ft_ies(struct wiphy *wiphy, struct net_device *dev,
2344 			   struct cfg80211_update_ft_ies_params *ftie)
2345 {
2346 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
2347 	struct wil6210_vif *vif = ndev_to_vif(dev);
2348 	struct cfg80211_bss *bss;
2349 	struct wmi_ft_reassoc_cmd reassoc;
2350 	int rc = 0;
2351 
2352 	wil_dbg_misc(wil, "update ft ies, mid=%d\n", vif->mid);
2353 	wil_hex_dump_misc("FT IE ", DUMP_PREFIX_OFFSET, 16, 1,
2354 			  ftie->ie, ftie->ie_len, true);
2355 
2356 	if (!test_bit(WMI_FW_CAPABILITY_FT_ROAMING, wil->fw_capabilities)) {
2357 		wil_err(wil, "FW does not support FT roaming\n");
2358 		return -EOPNOTSUPP;
2359 	}
2360 
2361 	rc = wmi_update_ft_ies(vif, ftie->ie_len, ftie->ie);
2362 	if (rc)
2363 		return rc;
2364 
2365 	if (!test_bit(wil_vif_ft_roam, vif->status))
2366 		/* vif is not roaming */
2367 		return 0;
2368 
2369 	/* wil_vif_ft_roam is set. wil_cfg80211_update_ft_ies is used as
2370 	 * a trigger for reassoc
2371 	 */
2372 
2373 	bss = vif->bss;
2374 	if (!bss) {
2375 		wil_err(wil, "FT: bss is NULL\n");
2376 		return -EINVAL;
2377 	}
2378 
2379 	memset(&reassoc, 0, sizeof(reassoc));
2380 	ether_addr_copy(reassoc.bssid, bss->bssid);
2381 
2382 	rc = wmi_send(wil, WMI_FT_REASSOC_CMDID, vif->mid,
2383 		      &reassoc, sizeof(reassoc));
2384 	if (rc)
2385 		wil_err(wil, "FT: reassoc failed (%d)\n", rc);
2386 
2387 	return rc;
2388 }
2389 
2390 static const struct cfg80211_ops wil_cfg80211_ops = {
2391 	.add_virtual_intf = wil_cfg80211_add_iface,
2392 	.del_virtual_intf = wil_cfg80211_del_iface,
2393 	.scan = wil_cfg80211_scan,
2394 	.abort_scan = wil_cfg80211_abort_scan,
2395 	.connect = wil_cfg80211_connect,
2396 	.disconnect = wil_cfg80211_disconnect,
2397 	.set_wiphy_params = wil_cfg80211_set_wiphy_params,
2398 	.change_virtual_intf = wil_cfg80211_change_iface,
2399 	.get_station = wil_cfg80211_get_station,
2400 	.dump_station = wil_cfg80211_dump_station,
2401 	.remain_on_channel = wil_remain_on_channel,
2402 	.cancel_remain_on_channel = wil_cancel_remain_on_channel,
2403 	.mgmt_tx = wil_cfg80211_mgmt_tx,
2404 	.set_monitor_channel = wil_cfg80211_set_channel,
2405 	.add_key = wil_cfg80211_add_key,
2406 	.del_key = wil_cfg80211_del_key,
2407 	.set_default_key = wil_cfg80211_set_default_key,
2408 	/* AP mode */
2409 	.change_beacon = wil_cfg80211_change_beacon,
2410 	.start_ap = wil_cfg80211_start_ap,
2411 	.stop_ap = wil_cfg80211_stop_ap,
2412 	.add_station = wil_cfg80211_add_station,
2413 	.del_station = wil_cfg80211_del_station,
2414 	.change_station = wil_cfg80211_change_station,
2415 	.probe_client = wil_cfg80211_probe_client,
2416 	.change_bss = wil_cfg80211_change_bss,
2417 	/* P2P device */
2418 	.start_p2p_device = wil_cfg80211_start_p2p_device,
2419 	.stop_p2p_device = wil_cfg80211_stop_p2p_device,
2420 	.set_power_mgmt = wil_cfg80211_set_power_mgmt,
2421 	.suspend = wil_cfg80211_suspend,
2422 	.resume = wil_cfg80211_resume,
2423 	.sched_scan_start = wil_cfg80211_sched_scan_start,
2424 	.sched_scan_stop = wil_cfg80211_sched_scan_stop,
2425 	.update_ft_ies = wil_cfg80211_update_ft_ies,
2426 };
2427 
2428 static void wil_wiphy_init(struct wiphy *wiphy)
2429 {
2430 	wiphy->max_scan_ssids = 1;
2431 	wiphy->max_scan_ie_len = WMI_MAX_IE_LEN;
2432 	wiphy->max_remain_on_channel_duration = WIL_MAX_ROC_DURATION_MS;
2433 	wiphy->max_num_pmkids = 0 /* TODO: */;
2434 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
2435 				 BIT(NL80211_IFTYPE_AP) |
2436 				 BIT(NL80211_IFTYPE_P2P_CLIENT) |
2437 				 BIT(NL80211_IFTYPE_P2P_GO) |
2438 				 BIT(NL80211_IFTYPE_P2P_DEVICE) |
2439 				 BIT(NL80211_IFTYPE_MONITOR);
2440 	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
2441 			WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
2442 			WIPHY_FLAG_PS_ON_BY_DEFAULT;
2443 	if (!disable_ap_sme)
2444 		wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME;
2445 	dev_dbg(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
2446 		__func__, wiphy->flags);
2447 	wiphy->probe_resp_offload =
2448 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
2449 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
2450 		NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
2451 
2452 	wiphy->bands[NL80211_BAND_60GHZ] = &wil_band_60ghz;
2453 
2454 	/* may change after reading FW capabilities */
2455 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
2456 
2457 	wiphy->cipher_suites = wil_cipher_suites;
2458 	wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
2459 	wiphy->mgmt_stypes = wil_mgmt_stypes;
2460 	wiphy->features |= NL80211_FEATURE_SK_TX_STATUS;
2461 
2462 	wiphy->n_vendor_commands = ARRAY_SIZE(wil_nl80211_vendor_commands);
2463 	wiphy->vendor_commands = wil_nl80211_vendor_commands;
2464 
2465 #ifdef CONFIG_PM
2466 	wiphy->wowlan = &wil_wowlan_support;
2467 #endif
2468 }
2469 
2470 int wil_cfg80211_iface_combinations_from_fw(
2471 	struct wil6210_priv *wil, const struct wil_fw_record_concurrency *conc)
2472 {
2473 	struct wiphy *wiphy = wil_to_wiphy(wil);
2474 	u32 total_limits = 0;
2475 	u16 n_combos;
2476 	const struct wil_fw_concurrency_combo *combo;
2477 	const struct wil_fw_concurrency_limit *limit;
2478 	struct ieee80211_iface_combination *iface_combinations;
2479 	struct ieee80211_iface_limit *iface_limit;
2480 	int i, j;
2481 
2482 	if (wiphy->iface_combinations) {
2483 		wil_dbg_misc(wil, "iface_combinations already set, skipping\n");
2484 		return 0;
2485 	}
2486 
2487 	combo = conc->combos;
2488 	n_combos = le16_to_cpu(conc->n_combos);
2489 	for (i = 0; i < n_combos; i++) {
2490 		total_limits += combo->n_limits;
2491 		limit = combo->limits + combo->n_limits;
2492 		combo = (struct wil_fw_concurrency_combo *)limit;
2493 	}
2494 
2495 	iface_combinations =
2496 		kzalloc(n_combos * sizeof(struct ieee80211_iface_combination) +
2497 			total_limits * sizeof(struct ieee80211_iface_limit),
2498 			GFP_KERNEL);
2499 	if (!iface_combinations)
2500 		return -ENOMEM;
2501 	iface_limit = (struct ieee80211_iface_limit *)(iface_combinations +
2502 						       n_combos);
2503 	combo = conc->combos;
2504 	for (i = 0; i < n_combos; i++) {
2505 		iface_combinations[i].max_interfaces = combo->max_interfaces;
2506 		iface_combinations[i].num_different_channels =
2507 			combo->n_diff_channels;
2508 		iface_combinations[i].beacon_int_infra_match =
2509 			combo->same_bi;
2510 		iface_combinations[i].n_limits = combo->n_limits;
2511 		wil_dbg_misc(wil,
2512 			     "iface_combination %d: max_if %d, num_ch %d, bi_match %d\n",
2513 			     i, iface_combinations[i].max_interfaces,
2514 			     iface_combinations[i].num_different_channels,
2515 			     iface_combinations[i].beacon_int_infra_match);
2516 		limit = combo->limits;
2517 		for (j = 0; j < combo->n_limits; j++) {
2518 			iface_limit[j].max = le16_to_cpu(limit[j].max);
2519 			iface_limit[j].types = le16_to_cpu(limit[j].types);
2520 			wil_dbg_misc(wil,
2521 				     "limit %d: max %d types 0x%x\n", j,
2522 				     iface_limit[j].max, iface_limit[j].types);
2523 		}
2524 		iface_combinations[i].limits = iface_limit;
2525 		iface_limit += combo->n_limits;
2526 		limit += combo->n_limits;
2527 		combo = (struct wil_fw_concurrency_combo *)limit;
2528 	}
2529 
2530 	wil_dbg_misc(wil, "multiple VIFs supported, n_mids %d\n", conc->n_mids);
2531 	wil->max_vifs = conc->n_mids + 1; /* including main interface */
2532 	if (wil->max_vifs > WIL_MAX_VIFS) {
2533 		wil_info(wil, "limited number of VIFs supported(%d, FW %d)\n",
2534 			 WIL_MAX_VIFS, wil->max_vifs);
2535 		wil->max_vifs = WIL_MAX_VIFS;
2536 	}
2537 	wiphy->n_iface_combinations = n_combos;
2538 	wiphy->iface_combinations = iface_combinations;
2539 	return 0;
2540 }
2541 
2542 struct wil6210_priv *wil_cfg80211_init(struct device *dev)
2543 {
2544 	struct wiphy *wiphy;
2545 	struct wil6210_priv *wil;
2546 	struct ieee80211_channel *ch;
2547 
2548 	dev_dbg(dev, "%s()\n", __func__);
2549 
2550 	/* Note: the wireless_dev structure is no longer allocated here.
2551 	 * Instead, it is allocated as part of the net_device structure
2552 	 * for main interface and each VIF.
2553 	 */
2554 	wiphy = wiphy_new(&wil_cfg80211_ops, sizeof(struct wil6210_priv));
2555 	if (!wiphy)
2556 		return ERR_PTR(-ENOMEM);
2557 
2558 	set_wiphy_dev(wiphy, dev);
2559 	wil_wiphy_init(wiphy);
2560 
2561 	wil = wiphy_to_wil(wiphy);
2562 	wil->wiphy = wiphy;
2563 
2564 	/* default monitor channel */
2565 	ch = wiphy->bands[NL80211_BAND_60GHZ]->channels;
2566 	cfg80211_chandef_create(&wil->monitor_chandef, ch, NL80211_CHAN_NO_HT);
2567 
2568 	return wil;
2569 }
2570 
2571 void wil_cfg80211_deinit(struct wil6210_priv *wil)
2572 {
2573 	struct wiphy *wiphy = wil_to_wiphy(wil);
2574 
2575 	dev_dbg(wil_to_dev(wil), "%s()\n", __func__);
2576 
2577 	if (!wiphy)
2578 		return;
2579 
2580 	kfree(wiphy->iface_combinations);
2581 	wiphy->iface_combinations = NULL;
2582 
2583 	wiphy_free(wiphy);
2584 	/* do not access wil6210_priv after returning from here */
2585 }
2586 
2587 void wil_p2p_wdev_free(struct wil6210_priv *wil)
2588 {
2589 	struct wireless_dev *p2p_wdev;
2590 
2591 	mutex_lock(&wil->vif_mutex);
2592 	p2p_wdev = wil->p2p_wdev;
2593 	wil->p2p_wdev = NULL;
2594 	wil->radio_wdev = wil->main_ndev->ieee80211_ptr;
2595 	mutex_unlock(&wil->vif_mutex);
2596 	if (p2p_wdev) {
2597 		cfg80211_unregister_wdev(p2p_wdev);
2598 		kfree(p2p_wdev);
2599 	}
2600 }
2601 
2602 static int wil_rf_sector_status_to_rc(u8 status)
2603 {
2604 	switch (status) {
2605 	case WMI_RF_SECTOR_STATUS_SUCCESS:
2606 		return 0;
2607 	case WMI_RF_SECTOR_STATUS_BAD_PARAMETERS_ERROR:
2608 		return -EINVAL;
2609 	case WMI_RF_SECTOR_STATUS_BUSY_ERROR:
2610 		return -EAGAIN;
2611 	case WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR:
2612 		return -EOPNOTSUPP;
2613 	default:
2614 		return -EINVAL;
2615 	}
2616 }
2617 
2618 static int wil_rf_sector_get_cfg(struct wiphy *wiphy,
2619 				 struct wireless_dev *wdev,
2620 				 const void *data, int data_len)
2621 {
2622 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2623 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2624 	int rc;
2625 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2626 	u16 sector_index;
2627 	u8 sector_type;
2628 	u32 rf_modules_vec;
2629 	struct wmi_get_rf_sector_params_cmd cmd;
2630 	struct {
2631 		struct wmi_cmd_hdr wmi;
2632 		struct wmi_get_rf_sector_params_done_event evt;
2633 	} __packed reply = {
2634 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2635 	};
2636 	struct sk_buff *msg;
2637 	struct nlattr *nl_cfgs, *nl_cfg;
2638 	u32 i;
2639 	struct wmi_rf_sector_info *si;
2640 
2641 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2642 		return -EOPNOTSUPP;
2643 
2644 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2645 				  data_len, wil_rf_sector_policy, NULL);
2646 	if (rc) {
2647 		wil_err(wil, "Invalid rf sector ATTR\n");
2648 		return rc;
2649 	}
2650 
2651 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2652 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2653 	    !tb[QCA_ATTR_DMG_RF_MODULE_MASK]) {
2654 		wil_err(wil, "Invalid rf sector spec\n");
2655 		return -EINVAL;
2656 	}
2657 
2658 	sector_index = nla_get_u16(
2659 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2660 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2661 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2662 		return -EINVAL;
2663 	}
2664 
2665 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2666 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2667 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2668 		return -EINVAL;
2669 	}
2670 
2671 	rf_modules_vec = nla_get_u32(
2672 		tb[QCA_ATTR_DMG_RF_MODULE_MASK]);
2673 	if (rf_modules_vec >= BIT(WMI_MAX_RF_MODULES_NUM)) {
2674 		wil_err(wil, "Invalid rf module mask 0x%x\n", rf_modules_vec);
2675 		return -EINVAL;
2676 	}
2677 
2678 	cmd.sector_idx = cpu_to_le16(sector_index);
2679 	cmd.sector_type = sector_type;
2680 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2681 	rc = wmi_call(wil, WMI_GET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2682 		      &cmd, sizeof(cmd), WMI_GET_RF_SECTOR_PARAMS_DONE_EVENTID,
2683 		      &reply, sizeof(reply),
2684 		      500);
2685 	if (rc)
2686 		return rc;
2687 	if (reply.evt.status) {
2688 		wil_err(wil, "get rf sector cfg failed with status %d\n",
2689 			reply.evt.status);
2690 		return wil_rf_sector_status_to_rc(reply.evt.status);
2691 	}
2692 
2693 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2694 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2695 	if (!msg)
2696 		return -ENOMEM;
2697 
2698 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2699 			      le64_to_cpu(reply.evt.tsf),
2700 			      QCA_ATTR_PAD))
2701 		goto nla_put_failure;
2702 
2703 	nl_cfgs = nla_nest_start_noflag(msg, QCA_ATTR_DMG_RF_SECTOR_CFG);
2704 	if (!nl_cfgs)
2705 		goto nla_put_failure;
2706 	for (i = 0; i < WMI_MAX_RF_MODULES_NUM; i++) {
2707 		if (!(rf_modules_vec & BIT(i)))
2708 			continue;
2709 		nl_cfg = nla_nest_start_noflag(msg, i);
2710 		if (!nl_cfg)
2711 			goto nla_put_failure;
2712 		si = &reply.evt.sectors_info[i];
2713 		if (nla_put_u8(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX,
2714 			       i) ||
2715 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0,
2716 				le32_to_cpu(si->etype0)) ||
2717 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1,
2718 				le32_to_cpu(si->etype1)) ||
2719 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2,
2720 				le32_to_cpu(si->etype2)) ||
2721 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI,
2722 				le32_to_cpu(si->psh_hi)) ||
2723 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO,
2724 				le32_to_cpu(si->psh_lo)) ||
2725 		    nla_put_u32(msg, QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16,
2726 				le32_to_cpu(si->dtype_swch_off)))
2727 			goto nla_put_failure;
2728 		nla_nest_end(msg, nl_cfg);
2729 	}
2730 
2731 	nla_nest_end(msg, nl_cfgs);
2732 	rc = cfg80211_vendor_cmd_reply(msg);
2733 	return rc;
2734 nla_put_failure:
2735 	kfree_skb(msg);
2736 	return -ENOBUFS;
2737 }
2738 
2739 static int wil_rf_sector_set_cfg(struct wiphy *wiphy,
2740 				 struct wireless_dev *wdev,
2741 				 const void *data, int data_len)
2742 {
2743 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2744 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2745 	int rc, tmp;
2746 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2747 	struct nlattr *tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MAX + 1];
2748 	u16 sector_index, rf_module_index;
2749 	u8 sector_type;
2750 	u32 rf_modules_vec = 0;
2751 	struct wmi_set_rf_sector_params_cmd cmd;
2752 	struct {
2753 		struct wmi_cmd_hdr wmi;
2754 		struct wmi_set_rf_sector_params_done_event evt;
2755 	} __packed reply = {
2756 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2757 	};
2758 	struct nlattr *nl_cfg;
2759 	struct wmi_rf_sector_info *si;
2760 
2761 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2762 		return -EOPNOTSUPP;
2763 
2764 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2765 				  data_len, wil_rf_sector_policy, NULL);
2766 	if (rc) {
2767 		wil_err(wil, "Invalid rf sector ATTR\n");
2768 		return rc;
2769 	}
2770 
2771 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2772 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE] ||
2773 	    !tb[QCA_ATTR_DMG_RF_SECTOR_CFG]) {
2774 		wil_err(wil, "Invalid rf sector spec\n");
2775 		return -EINVAL;
2776 	}
2777 
2778 	sector_index = nla_get_u16(
2779 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2780 	if (sector_index >= WIL_MAX_RF_SECTORS) {
2781 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2782 		return -EINVAL;
2783 	}
2784 
2785 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2786 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2787 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2788 		return -EINVAL;
2789 	}
2790 
2791 	memset(&cmd, 0, sizeof(cmd));
2792 
2793 	cmd.sector_idx = cpu_to_le16(sector_index);
2794 	cmd.sector_type = sector_type;
2795 	nla_for_each_nested(nl_cfg, tb[QCA_ATTR_DMG_RF_SECTOR_CFG],
2796 			    tmp) {
2797 		rc = nla_parse_nested_deprecated(tb2,
2798 						 QCA_ATTR_DMG_RF_SECTOR_CFG_MAX,
2799 						 nl_cfg,
2800 						 wil_rf_sector_cfg_policy,
2801 						 NULL);
2802 		if (rc) {
2803 			wil_err(wil, "invalid sector cfg\n");
2804 			return -EINVAL;
2805 		}
2806 
2807 		if (!tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX] ||
2808 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0] ||
2809 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1] ||
2810 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2] ||
2811 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI] ||
2812 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO] ||
2813 		    !tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]) {
2814 			wil_err(wil, "missing cfg params\n");
2815 			return -EINVAL;
2816 		}
2817 
2818 		rf_module_index = nla_get_u8(
2819 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_MODULE_INDEX]);
2820 		if (rf_module_index >= WMI_MAX_RF_MODULES_NUM) {
2821 			wil_err(wil, "invalid RF module index %d\n",
2822 				rf_module_index);
2823 			return -EINVAL;
2824 		}
2825 		rf_modules_vec |= BIT(rf_module_index);
2826 		si = &cmd.sectors_info[rf_module_index];
2827 		si->etype0 = cpu_to_le32(nla_get_u32(
2828 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE0]));
2829 		si->etype1 = cpu_to_le32(nla_get_u32(
2830 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE1]));
2831 		si->etype2 = cpu_to_le32(nla_get_u32(
2832 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_ETYPE2]));
2833 		si->psh_hi = cpu_to_le32(nla_get_u32(
2834 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_HI]));
2835 		si->psh_lo = cpu_to_le32(nla_get_u32(
2836 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_PSH_LO]));
2837 		si->dtype_swch_off = cpu_to_le32(nla_get_u32(
2838 			tb2[QCA_ATTR_DMG_RF_SECTOR_CFG_DTYPE_X16]));
2839 	}
2840 
2841 	cmd.rf_modules_vec = rf_modules_vec & 0xFF;
2842 	rc = wmi_call(wil, WMI_SET_RF_SECTOR_PARAMS_CMDID, vif->mid,
2843 		      &cmd, sizeof(cmd), WMI_SET_RF_SECTOR_PARAMS_DONE_EVENTID,
2844 		      &reply, sizeof(reply),
2845 		      500);
2846 	if (rc)
2847 		return rc;
2848 	return wil_rf_sector_status_to_rc(reply.evt.status);
2849 }
2850 
2851 static int wil_rf_sector_get_selected(struct wiphy *wiphy,
2852 				      struct wireless_dev *wdev,
2853 				      const void *data, int data_len)
2854 {
2855 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2856 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2857 	int rc;
2858 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2859 	u8 sector_type, mac_addr[ETH_ALEN];
2860 	int cid = 0;
2861 	struct wmi_get_selected_rf_sector_index_cmd cmd;
2862 	struct {
2863 		struct wmi_cmd_hdr wmi;
2864 		struct wmi_get_selected_rf_sector_index_done_event evt;
2865 	} __packed reply = {
2866 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2867 	};
2868 	struct sk_buff *msg;
2869 
2870 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2871 		return -EOPNOTSUPP;
2872 
2873 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2874 				  data_len, wil_rf_sector_policy, NULL);
2875 	if (rc) {
2876 		wil_err(wil, "Invalid rf sector ATTR\n");
2877 		return rc;
2878 	}
2879 
2880 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2881 		wil_err(wil, "Invalid rf sector spec\n");
2882 		return -EINVAL;
2883 	}
2884 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
2885 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
2886 		wil_err(wil, "Invalid sector type %d\n", sector_type);
2887 		return -EINVAL;
2888 	}
2889 
2890 	if (tb[QCA_ATTR_MAC_ADDR]) {
2891 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
2892 		cid = wil_find_cid(wil, vif->mid, mac_addr);
2893 		if (cid < 0) {
2894 			wil_err(wil, "invalid MAC address %pM\n", mac_addr);
2895 			return -ENOENT;
2896 		}
2897 	} else {
2898 		if (test_bit(wil_vif_fwconnected, vif->status)) {
2899 			wil_err(wil, "must specify MAC address when connected\n");
2900 			return -EINVAL;
2901 		}
2902 	}
2903 
2904 	memset(&cmd, 0, sizeof(cmd));
2905 	cmd.cid = (u8)cid;
2906 	cmd.sector_type = sector_type;
2907 	rc = wmi_call(wil, WMI_GET_SELECTED_RF_SECTOR_INDEX_CMDID, vif->mid,
2908 		      &cmd, sizeof(cmd),
2909 		      WMI_GET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2910 		      &reply, sizeof(reply),
2911 		      500);
2912 	if (rc)
2913 		return rc;
2914 	if (reply.evt.status) {
2915 		wil_err(wil, "get rf selected sector cfg failed with status %d\n",
2916 			reply.evt.status);
2917 		return wil_rf_sector_status_to_rc(reply.evt.status);
2918 	}
2919 
2920 	msg = cfg80211_vendor_cmd_alloc_reply_skb(
2921 		wiphy, 64 * WMI_MAX_RF_MODULES_NUM);
2922 	if (!msg)
2923 		return -ENOMEM;
2924 
2925 	if (nla_put_u64_64bit(msg, QCA_ATTR_TSF,
2926 			      le64_to_cpu(reply.evt.tsf),
2927 			      QCA_ATTR_PAD) ||
2928 	    nla_put_u16(msg, QCA_ATTR_DMG_RF_SECTOR_INDEX,
2929 			le16_to_cpu(reply.evt.sector_idx)))
2930 		goto nla_put_failure;
2931 
2932 	rc = cfg80211_vendor_cmd_reply(msg);
2933 	return rc;
2934 nla_put_failure:
2935 	kfree_skb(msg);
2936 	return -ENOBUFS;
2937 }
2938 
2939 static int wil_rf_sector_wmi_set_selected(struct wil6210_priv *wil,
2940 					  u8 mid, u16 sector_index,
2941 					  u8 sector_type, u8 cid)
2942 {
2943 	struct wmi_set_selected_rf_sector_index_cmd cmd;
2944 	struct {
2945 		struct wmi_cmd_hdr wmi;
2946 		struct wmi_set_selected_rf_sector_index_done_event evt;
2947 	} __packed reply = {
2948 		.evt = {.status = WMI_RF_SECTOR_STATUS_NOT_SUPPORTED_ERROR},
2949 	};
2950 	int rc;
2951 
2952 	memset(&cmd, 0, sizeof(cmd));
2953 	cmd.sector_idx = cpu_to_le16(sector_index);
2954 	cmd.sector_type = sector_type;
2955 	cmd.cid = (u8)cid;
2956 	rc = wmi_call(wil, WMI_SET_SELECTED_RF_SECTOR_INDEX_CMDID, mid,
2957 		      &cmd, sizeof(cmd),
2958 		      WMI_SET_SELECTED_RF_SECTOR_INDEX_DONE_EVENTID,
2959 		      &reply, sizeof(reply),
2960 		      500);
2961 	if (rc)
2962 		return rc;
2963 	return wil_rf_sector_status_to_rc(reply.evt.status);
2964 }
2965 
2966 static int wil_rf_sector_set_selected(struct wiphy *wiphy,
2967 				      struct wireless_dev *wdev,
2968 				      const void *data, int data_len)
2969 {
2970 	struct wil6210_priv *wil = wdev_to_wil(wdev);
2971 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
2972 	int rc;
2973 	struct nlattr *tb[QCA_ATTR_DMG_RF_SECTOR_MAX + 1];
2974 	u16 sector_index;
2975 	u8 sector_type, mac_addr[ETH_ALEN], i;
2976 	int cid = 0;
2977 
2978 	if (!test_bit(WMI_FW_CAPABILITY_RF_SECTORS, wil->fw_capabilities))
2979 		return -EOPNOTSUPP;
2980 
2981 	rc = nla_parse_deprecated(tb, QCA_ATTR_DMG_RF_SECTOR_MAX, data,
2982 				  data_len, wil_rf_sector_policy, NULL);
2983 	if (rc) {
2984 		wil_err(wil, "Invalid rf sector ATTR\n");
2985 		return rc;
2986 	}
2987 
2988 	if (!tb[QCA_ATTR_DMG_RF_SECTOR_INDEX] ||
2989 	    !tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]) {
2990 		wil_err(wil, "Invalid rf sector spec\n");
2991 		return -EINVAL;
2992 	}
2993 
2994 	sector_index = nla_get_u16(
2995 		tb[QCA_ATTR_DMG_RF_SECTOR_INDEX]);
2996 	if (sector_index >= WIL_MAX_RF_SECTORS &&
2997 	    sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
2998 		wil_err(wil, "Invalid sector index %d\n", sector_index);
2999 		return -EINVAL;
3000 	}
3001 
3002 	sector_type = nla_get_u8(tb[QCA_ATTR_DMG_RF_SECTOR_TYPE]);
3003 	if (sector_type >= QCA_ATTR_DMG_RF_SECTOR_TYPE_MAX) {
3004 		wil_err(wil, "Invalid sector type %d\n", sector_type);
3005 		return -EINVAL;
3006 	}
3007 
3008 	if (tb[QCA_ATTR_MAC_ADDR]) {
3009 		ether_addr_copy(mac_addr, nla_data(tb[QCA_ATTR_MAC_ADDR]));
3010 		if (!is_broadcast_ether_addr(mac_addr)) {
3011 			cid = wil_find_cid(wil, vif->mid, mac_addr);
3012 			if (cid < 0) {
3013 				wil_err(wil, "invalid MAC address %pM\n",
3014 					mac_addr);
3015 				return -ENOENT;
3016 			}
3017 		} else {
3018 			if (sector_index != WMI_INVALID_RF_SECTOR_INDEX) {
3019 				wil_err(wil, "broadcast MAC valid only with unlocking\n");
3020 				return -EINVAL;
3021 			}
3022 			cid = -1;
3023 		}
3024 	} else {
3025 		if (test_bit(wil_vif_fwconnected, vif->status)) {
3026 			wil_err(wil, "must specify MAC address when connected\n");
3027 			return -EINVAL;
3028 		}
3029 		/* otherwise, using cid=0 for unassociated station */
3030 	}
3031 
3032 	if (cid >= 0) {
3033 		rc = wil_rf_sector_wmi_set_selected(wil, vif->mid, sector_index,
3034 						    sector_type, cid);
3035 	} else {
3036 		/* unlock all cids */
3037 		rc = wil_rf_sector_wmi_set_selected(
3038 			wil, vif->mid, WMI_INVALID_RF_SECTOR_INDEX,
3039 			sector_type, WIL_CID_ALL);
3040 		if (rc == -EINVAL) {
3041 			for (i = 0; i < wil->max_assoc_sta; i++) {
3042 				if (wil->sta[i].mid != vif->mid)
3043 					continue;
3044 				rc = wil_rf_sector_wmi_set_selected(
3045 					wil, vif->mid,
3046 					WMI_INVALID_RF_SECTOR_INDEX,
3047 					sector_type, i);
3048 				/* the FW will silently ignore and return
3049 				 * success for unused cid, so abort the loop
3050 				 * on any other error
3051 				 */
3052 				if (rc) {
3053 					wil_err(wil, "unlock cid %d failed with status %d\n",
3054 						i, rc);
3055 					break;
3056 				}
3057 			}
3058 		}
3059 	}
3060 
3061 	return rc;
3062 }
3063