1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2010 Broadcom Corporation
4  */
5 
6 /* Toplevel file. Relies on dhd_linux.c to send commands to the dongle. */
7 
8 #include <linux/kernel.h>
9 #include <linux/etherdevice.h>
10 #include <linux/module.h>
11 #include <linux/vmalloc.h>
12 #include <net/cfg80211.h>
13 #include <net/netlink.h>
14 #include <uapi/linux/if_arp.h>
15 
16 #include <brcmu_utils.h>
17 #include <defs.h>
18 #include <brcmu_wifi.h>
19 #include <brcm_hw_ids.h>
20 #include "core.h"
21 #include "debug.h"
22 #include "tracepoint.h"
23 #include "fwil_types.h"
24 #include "p2p.h"
25 #include "btcoex.h"
26 #include "pno.h"
27 #include "fwsignal.h"
28 #include "cfg80211.h"
29 #include "feature.h"
30 #include "fwil.h"
31 #include "proto.h"
32 #include "vendor.h"
33 #include "bus.h"
34 #include "common.h"
35 #include "fwvid.h"
36 
37 #define BRCMF_SCAN_IE_LEN_MAX		2048
38 
39 #define WPA_OUI				"\x00\x50\xF2"	/* WPA OUI */
40 #define WPA_OUI_TYPE			1
41 #define RSN_OUI				"\x00\x0F\xAC"	/* RSN OUI */
42 #define	WME_OUI_TYPE			2
43 #define WPS_OUI_TYPE			4
44 
45 #define VS_IE_FIXED_HDR_LEN		6
46 #define WPA_IE_VERSION_LEN		2
47 #define WPA_IE_MIN_OUI_LEN		4
48 #define WPA_IE_SUITE_COUNT_LEN		2
49 
50 #define WPA_CIPHER_NONE			0	/* None */
51 #define WPA_CIPHER_WEP_40		1	/* WEP (40-bit) */
52 #define WPA_CIPHER_TKIP			2	/* TKIP: default for WPA */
53 #define WPA_CIPHER_AES_CCM		4	/* AES (CCM) */
54 #define WPA_CIPHER_WEP_104		5	/* WEP (104-bit) */
55 
56 #define RSN_AKM_NONE			0	/* None (IBSS) */
57 #define RSN_AKM_UNSPECIFIED		1	/* Over 802.1x */
58 #define RSN_AKM_PSK			2	/* Pre-shared Key */
59 #define RSN_AKM_SHA256_1X		5	/* SHA256, 802.1X */
60 #define RSN_AKM_SHA256_PSK		6	/* SHA256, Pre-shared Key */
61 #define RSN_AKM_SAE			8	/* SAE */
62 #define RSN_CAP_LEN			2	/* Length of RSN capabilities */
63 #define RSN_CAP_PTK_REPLAY_CNTR_MASK	(BIT(2) | BIT(3))
64 #define RSN_CAP_MFPR_MASK		BIT(6)
65 #define RSN_CAP_MFPC_MASK		BIT(7)
66 #define RSN_PMKID_COUNT_LEN		2
67 
68 #define VNDR_IE_CMD_LEN			4	/* length of the set command
69 						 * string :"add", "del" (+ NUL)
70 						 */
71 #define VNDR_IE_COUNT_OFFSET		4
72 #define VNDR_IE_PKTFLAG_OFFSET		8
73 #define VNDR_IE_VSIE_OFFSET		12
74 #define VNDR_IE_HDR_SIZE		12
75 #define VNDR_IE_PARSE_LIMIT		5
76 
77 #define	DOT11_MGMT_HDR_LEN		24	/* d11 management header len */
78 #define	DOT11_BCN_PRB_FIXED_LEN		12	/* beacon/probe fixed length */
79 
80 #define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS	320
81 #define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS	400
82 #define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS	20
83 
84 #define BRCMF_SCAN_CHANNEL_TIME		40
85 #define BRCMF_SCAN_UNASSOC_TIME		40
86 #define BRCMF_SCAN_PASSIVE_TIME		120
87 
88 #define BRCMF_ND_INFO_TIMEOUT		msecs_to_jiffies(2000)
89 
90 #define BRCMF_PS_MAX_TIMEOUT_MS		2000
91 
92 /* Dump obss definitions */
93 #define ACS_MSRMNT_DELAY		80
94 #define CHAN_NOISE_DUMMY		(-80)
95 #define OBSS_TOKEN_IDX			15
96 #define IBSS_TOKEN_IDX			15
97 #define TX_TOKEN_IDX			14
98 #define CTG_TOKEN_IDX			13
99 #define PKT_TOKEN_IDX			15
100 #define IDLE_TOKEN_IDX			12
101 
102 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
103 	(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
104 
105 #define BRCMF_MAX_CHANSPEC_LIST \
106 	(BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
107 
108 struct brcmf_dump_survey {
109 	u32 obss;
110 	u32 ibss;
111 	u32 no_ctg;
112 	u32 no_pckt;
113 	u32 tx;
114 	u32 idle;
115 };
116 
117 struct cca_stats_n_flags {
118 	u32 msrmnt_time; /* Time for Measurement (msec) */
119 	u32 msrmnt_done; /* flag set when measurement complete */
120 	char buf[1];
121 };
122 
123 struct cca_msrmnt_query {
124 	u32 msrmnt_query;
125 	u32 time_req;
126 };
127 
128 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
129 {
130 	if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
131 		brcmf_dbg(INFO, "device is not ready : status (%lu)\n",
132 			  vif->sme_state);
133 		return false;
134 	}
135 	return true;
136 }
137 
138 #define RATE_TO_BASE100KBPS(rate)   (((rate) * 10) / 2)
139 #define RATETAB_ENT(_rateid, _flags) \
140 	{                                                               \
141 		.bitrate        = RATE_TO_BASE100KBPS(_rateid),     \
142 		.hw_value       = (_rateid),                            \
143 		.flags          = (_flags),                             \
144 	}
145 
146 static struct ieee80211_rate __wl_rates[] = {
147 	RATETAB_ENT(BRCM_RATE_1M, 0),
148 	RATETAB_ENT(BRCM_RATE_2M, IEEE80211_RATE_SHORT_PREAMBLE),
149 	RATETAB_ENT(BRCM_RATE_5M5, IEEE80211_RATE_SHORT_PREAMBLE),
150 	RATETAB_ENT(BRCM_RATE_11M, IEEE80211_RATE_SHORT_PREAMBLE),
151 	RATETAB_ENT(BRCM_RATE_6M, 0),
152 	RATETAB_ENT(BRCM_RATE_9M, 0),
153 	RATETAB_ENT(BRCM_RATE_12M, 0),
154 	RATETAB_ENT(BRCM_RATE_18M, 0),
155 	RATETAB_ENT(BRCM_RATE_24M, 0),
156 	RATETAB_ENT(BRCM_RATE_36M, 0),
157 	RATETAB_ENT(BRCM_RATE_48M, 0),
158 	RATETAB_ENT(BRCM_RATE_54M, 0),
159 };
160 
161 #define wl_g_rates		(__wl_rates + 0)
162 #define wl_g_rates_size		ARRAY_SIZE(__wl_rates)
163 #define wl_a_rates		(__wl_rates + 4)
164 #define wl_a_rates_size		(wl_g_rates_size - 4)
165 
166 #define CHAN2G(_channel, _freq) {				\
167 	.band			= NL80211_BAND_2GHZ,		\
168 	.center_freq		= (_freq),			\
169 	.hw_value		= (_channel),			\
170 	.max_antenna_gain	= 0,				\
171 	.max_power		= 30,				\
172 }
173 
174 #define CHAN5G(_channel) {					\
175 	.band			= NL80211_BAND_5GHZ,		\
176 	.center_freq		= 5000 + (5 * (_channel)),	\
177 	.hw_value		= (_channel),			\
178 	.max_antenna_gain	= 0,				\
179 	.max_power		= 30,				\
180 }
181 
182 static struct ieee80211_channel __wl_2ghz_channels[] = {
183 	CHAN2G(1, 2412), CHAN2G(2, 2417), CHAN2G(3, 2422), CHAN2G(4, 2427),
184 	CHAN2G(5, 2432), CHAN2G(6, 2437), CHAN2G(7, 2442), CHAN2G(8, 2447),
185 	CHAN2G(9, 2452), CHAN2G(10, 2457), CHAN2G(11, 2462), CHAN2G(12, 2467),
186 	CHAN2G(13, 2472), CHAN2G(14, 2484)
187 };
188 
189 static struct ieee80211_channel __wl_5ghz_channels[] = {
190 	CHAN5G(34), CHAN5G(36), CHAN5G(38), CHAN5G(40), CHAN5G(42),
191 	CHAN5G(44), CHAN5G(46), CHAN5G(48), CHAN5G(52), CHAN5G(56),
192 	CHAN5G(60), CHAN5G(64), CHAN5G(100), CHAN5G(104), CHAN5G(108),
193 	CHAN5G(112), CHAN5G(116), CHAN5G(120), CHAN5G(124), CHAN5G(128),
194 	CHAN5G(132), CHAN5G(136), CHAN5G(140), CHAN5G(144), CHAN5G(149),
195 	CHAN5G(153), CHAN5G(157), CHAN5G(161), CHAN5G(165)
196 };
197 
198 /* Band templates duplicated per wiphy. The channel info
199  * above is added to the band during setup.
200  */
201 static const struct ieee80211_supported_band __wl_band_2ghz = {
202 	.band = NL80211_BAND_2GHZ,
203 	.bitrates = wl_g_rates,
204 	.n_bitrates = wl_g_rates_size,
205 };
206 
207 static const struct ieee80211_supported_band __wl_band_5ghz = {
208 	.band = NL80211_BAND_5GHZ,
209 	.bitrates = wl_a_rates,
210 	.n_bitrates = wl_a_rates_size,
211 };
212 
213 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
214  * By default world regulatory domain defined in reg.c puts the flags
215  * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
216  * With respect to these flags, wpa_supplicant doesn't * start p2p
217  * operations on 5GHz channels. All the changes in world regulatory
218  * domain are to be done here.
219  */
220 static const struct ieee80211_regdomain brcmf_regdom = {
221 	.n_reg_rules = 4,
222 	.alpha2 =  "99",
223 	.reg_rules = {
224 		/* IEEE 802.11b/g, channels 1..11 */
225 		REG_RULE(2412-10, 2472+10, 40, 6, 20, 0),
226 		/* If any */
227 		/* IEEE 802.11 channel 14 - Only JP enables
228 		 * this and for 802.11b only
229 		 */
230 		REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
231 		/* IEEE 802.11a, channel 36..64 */
232 		REG_RULE(5150-10, 5350+10, 160, 6, 20, 0),
233 		/* IEEE 802.11a, channel 100..165 */
234 		REG_RULE(5470-10, 5850+10, 160, 6, 20, 0), }
235 };
236 
237 /* Note: brcmf_cipher_suites is an array of int defining which cipher suites
238  * are supported. A pointer to this array and the number of entries is passed
239  * on to upper layers. AES_CMAC defines whether or not the driver supports MFP.
240  * So the cipher suite AES_CMAC has to be the last one in the array, and when
241  * device does not support MFP then the number of suites will be decreased by 1
242  */
243 static const u32 brcmf_cipher_suites[] = {
244 	WLAN_CIPHER_SUITE_WEP40,
245 	WLAN_CIPHER_SUITE_WEP104,
246 	WLAN_CIPHER_SUITE_TKIP,
247 	WLAN_CIPHER_SUITE_CCMP,
248 	/* Keep as last entry: */
249 	WLAN_CIPHER_SUITE_AES_CMAC
250 };
251 
252 /* Vendor specific ie. id = 221, oui and type defines exact ie */
253 struct brcmf_vs_tlv {
254 	u8 id;
255 	u8 len;
256 	u8 oui[3];
257 	u8 oui_type;
258 };
259 
260 struct parsed_vndr_ie_info {
261 	u8 *ie_ptr;
262 	u32 ie_len;	/* total length including id & length field */
263 	struct brcmf_vs_tlv vndrie;
264 };
265 
266 struct parsed_vndr_ies {
267 	u32 count;
268 	struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
269 };
270 
271 #define WL_INTERFACE_CREATE_VER_1		1
272 #define WL_INTERFACE_CREATE_VER_2		2
273 #define WL_INTERFACE_CREATE_VER_3		3
274 #define WL_INTERFACE_CREATE_VER_MAX		WL_INTERFACE_CREATE_VER_3
275 
276 #define WL_INTERFACE_MAC_DONT_USE	0x0
277 #define WL_INTERFACE_MAC_USE		0x2
278 
279 #define WL_INTERFACE_CREATE_STA		0x0
280 #define WL_INTERFACE_CREATE_AP		0x1
281 
282 struct wl_interface_create_v1 {
283 	u16	ver;			/* structure version */
284 	u32	flags;			/* flags for operation */
285 	u8	mac_addr[ETH_ALEN];	/* MAC address */
286 	u32	wlc_index;		/* optional for wlc index */
287 };
288 
289 struct wl_interface_create_v2 {
290 	u16	ver;			/* structure version */
291 	u8	pad1[2];
292 	u32	flags;			/* flags for operation */
293 	u8	mac_addr[ETH_ALEN];	/* MAC address */
294 	u8	iftype;			/* type of interface created */
295 	u8	pad2;
296 	u32	wlc_index;		/* optional for wlc index */
297 };
298 
299 struct wl_interface_create_v3 {
300 	u16 ver;			/* structure version */
301 	u16 len;			/* length of structure + data */
302 	u16 fixed_len;			/* length of structure */
303 	u8 iftype;			/* type of interface created */
304 	u8 wlc_index;			/* optional for wlc index */
305 	u32 flags;			/* flags for operation */
306 	u8 mac_addr[ETH_ALEN];		/* MAC address */
307 	u8 bssid[ETH_ALEN];		/* optional for BSSID */
308 	u8 if_index;			/* interface index request */
309 	u8 pad[3];
310 	u8 data[];			/* Optional for specific data */
311 };
312 
313 static u8 nl80211_band_to_fwil(enum nl80211_band band)
314 {
315 	switch (band) {
316 	case NL80211_BAND_2GHZ:
317 		return WLC_BAND_2G;
318 	case NL80211_BAND_5GHZ:
319 		return WLC_BAND_5G;
320 	default:
321 		WARN_ON(1);
322 		break;
323 	}
324 	return 0;
325 }
326 
327 static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
328 			       struct cfg80211_chan_def *ch)
329 {
330 	struct brcmu_chan ch_inf;
331 	s32 primary_offset;
332 
333 	brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
334 		  ch->chan->center_freq, ch->center_freq1, ch->width);
335 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
336 	primary_offset = ch->chan->center_freq - ch->center_freq1;
337 	switch (ch->width) {
338 	case NL80211_CHAN_WIDTH_20:
339 	case NL80211_CHAN_WIDTH_20_NOHT:
340 		ch_inf.bw = BRCMU_CHAN_BW_20;
341 		WARN_ON(primary_offset != 0);
342 		break;
343 	case NL80211_CHAN_WIDTH_40:
344 		ch_inf.bw = BRCMU_CHAN_BW_40;
345 		if (primary_offset > 0)
346 			ch_inf.sb = BRCMU_CHAN_SB_U;
347 		else
348 			ch_inf.sb = BRCMU_CHAN_SB_L;
349 		break;
350 	case NL80211_CHAN_WIDTH_80:
351 		ch_inf.bw = BRCMU_CHAN_BW_80;
352 		if (primary_offset == -30)
353 			ch_inf.sb = BRCMU_CHAN_SB_LL;
354 		else if (primary_offset == -10)
355 			ch_inf.sb = BRCMU_CHAN_SB_LU;
356 		else if (primary_offset == 10)
357 			ch_inf.sb = BRCMU_CHAN_SB_UL;
358 		else
359 			ch_inf.sb = BRCMU_CHAN_SB_UU;
360 		break;
361 	case NL80211_CHAN_WIDTH_160:
362 		ch_inf.bw = BRCMU_CHAN_BW_160;
363 		if (primary_offset == -70)
364 			ch_inf.sb = BRCMU_CHAN_SB_LLL;
365 		else if (primary_offset == -50)
366 			ch_inf.sb = BRCMU_CHAN_SB_LLU;
367 		else if (primary_offset == -30)
368 			ch_inf.sb = BRCMU_CHAN_SB_LUL;
369 		else if (primary_offset == -10)
370 			ch_inf.sb = BRCMU_CHAN_SB_LUU;
371 		else if (primary_offset == 10)
372 			ch_inf.sb = BRCMU_CHAN_SB_ULL;
373 		else if (primary_offset == 30)
374 			ch_inf.sb = BRCMU_CHAN_SB_ULU;
375 		else if (primary_offset == 50)
376 			ch_inf.sb = BRCMU_CHAN_SB_UUL;
377 		else
378 			ch_inf.sb = BRCMU_CHAN_SB_UUU;
379 		break;
380 	case NL80211_CHAN_WIDTH_80P80:
381 	case NL80211_CHAN_WIDTH_5:
382 	case NL80211_CHAN_WIDTH_10:
383 	default:
384 		WARN_ON_ONCE(1);
385 	}
386 	switch (ch->chan->band) {
387 	case NL80211_BAND_2GHZ:
388 		ch_inf.band = BRCMU_CHAN_BAND_2G;
389 		break;
390 	case NL80211_BAND_5GHZ:
391 		ch_inf.band = BRCMU_CHAN_BAND_5G;
392 		break;
393 	case NL80211_BAND_60GHZ:
394 	default:
395 		WARN_ON_ONCE(1);
396 	}
397 	d11inf->encchspec(&ch_inf);
398 
399 	brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
400 	return ch_inf.chspec;
401 }
402 
403 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
404 			struct ieee80211_channel *ch)
405 {
406 	struct brcmu_chan ch_inf;
407 
408 	ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq);
409 	ch_inf.bw = BRCMU_CHAN_BW_20;
410 	d11inf->encchspec(&ch_inf);
411 
412 	return ch_inf.chspec;
413 }
414 
415 /* Traverse a string of 1-byte tag/1-byte length/variable-length value
416  * triples, returning a pointer to the substring whose first element
417  * matches tag
418  */
419 static const struct brcmf_tlv *
420 brcmf_parse_tlvs(const void *buf, int buflen, uint key)
421 {
422 	const struct brcmf_tlv *elt = buf;
423 	int totlen = buflen;
424 
425 	/* find tagged parameter */
426 	while (totlen >= TLV_HDR_LEN) {
427 		int len = elt->len;
428 
429 		/* validate remaining totlen */
430 		if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
431 			return elt;
432 
433 		elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
434 		totlen -= (len + TLV_HDR_LEN);
435 	}
436 
437 	return NULL;
438 }
439 
440 /* Is any of the tlvs the expected entry? If
441  * not update the tlvs buffer pointer/length.
442  */
443 static bool
444 brcmf_tlv_has_ie(const u8 *ie, const u8 **tlvs, u32 *tlvs_len,
445 		 const u8 *oui, u32 oui_len, u8 type)
446 {
447 	/* If the contents match the OUI and the type */
448 	if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
449 	    !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
450 	    type == ie[TLV_BODY_OFF + oui_len]) {
451 		return true;
452 	}
453 
454 	if (tlvs == NULL)
455 		return false;
456 	/* point to the next ie */
457 	ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
458 	/* calculate the length of the rest of the buffer */
459 	*tlvs_len -= (int)(ie - *tlvs);
460 	/* update the pointer to the start of the buffer */
461 	*tlvs = ie;
462 
463 	return false;
464 }
465 
466 static struct brcmf_vs_tlv *
467 brcmf_find_wpaie(const u8 *parse, u32 len)
468 {
469 	const struct brcmf_tlv *ie;
470 
471 	while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
472 		if (brcmf_tlv_has_ie((const u8 *)ie, &parse, &len,
473 				     WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
474 			return (struct brcmf_vs_tlv *)ie;
475 	}
476 	return NULL;
477 }
478 
479 static struct brcmf_vs_tlv *
480 brcmf_find_wpsie(const u8 *parse, u32 len)
481 {
482 	const struct brcmf_tlv *ie;
483 
484 	while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
485 		if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
486 				     WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
487 			return (struct brcmf_vs_tlv *)ie;
488 	}
489 	return NULL;
490 }
491 
492 static int brcmf_vif_change_validate(struct brcmf_cfg80211_info *cfg,
493 				     struct brcmf_cfg80211_vif *vif,
494 				     enum nl80211_iftype new_type)
495 {
496 	struct brcmf_cfg80211_vif *pos;
497 	bool check_combos = false;
498 	int ret = 0;
499 	struct iface_combination_params params = {
500 		.num_different_channels = 1,
501 	};
502 
503 	list_for_each_entry(pos, &cfg->vif_list, list)
504 		if (pos == vif) {
505 			params.iftype_num[new_type]++;
506 		} else {
507 			/* concurrent interfaces so need check combinations */
508 			check_combos = true;
509 			params.iftype_num[pos->wdev.iftype]++;
510 		}
511 
512 	if (check_combos)
513 		ret = cfg80211_check_combinations(cfg->wiphy, &params);
514 
515 	return ret;
516 }
517 
518 static int brcmf_vif_add_validate(struct brcmf_cfg80211_info *cfg,
519 				  enum nl80211_iftype new_type)
520 {
521 	struct brcmf_cfg80211_vif *pos;
522 	struct iface_combination_params params = {
523 		.num_different_channels = 1,
524 	};
525 
526 	list_for_each_entry(pos, &cfg->vif_list, list)
527 		params.iftype_num[pos->wdev.iftype]++;
528 
529 	params.iftype_num[new_type]++;
530 	return cfg80211_check_combinations(cfg->wiphy, &params);
531 }
532 
533 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
534 				 struct brcmf_wsec_key_le *key_le)
535 {
536 	key_le->index = cpu_to_le32(key->index);
537 	key_le->len = cpu_to_le32(key->len);
538 	key_le->algo = cpu_to_le32(key->algo);
539 	key_le->flags = cpu_to_le32(key->flags);
540 	key_le->rxiv.hi = cpu_to_le32(key->rxiv.hi);
541 	key_le->rxiv.lo = cpu_to_le16(key->rxiv.lo);
542 	key_le->iv_initialized = cpu_to_le32(key->iv_initialized);
543 	memcpy(key_le->data, key->data, sizeof(key->data));
544 	memcpy(key_le->ea, key->ea, sizeof(key->ea));
545 }
546 
547 static int
548 send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
549 {
550 	struct brcmf_pub *drvr = ifp->drvr;
551 	int err;
552 	struct brcmf_wsec_key_le key_le;
553 
554 	convert_key_from_CPU(key, &key_le);
555 
556 	brcmf_netdev_wait_pend8021x(ifp);
557 
558 	err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
559 					sizeof(key_le));
560 
561 	if (err)
562 		bphy_err(drvr, "wsec_key error (%d)\n", err);
563 	return err;
564 }
565 
566 static void
567 brcmf_cfg80211_update_proto_addr_mode(struct wireless_dev *wdev)
568 {
569 	struct brcmf_cfg80211_vif *vif;
570 	struct brcmf_if *ifp;
571 
572 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
573 	ifp = vif->ifp;
574 
575 	if ((wdev->iftype == NL80211_IFTYPE_ADHOC) ||
576 	    (wdev->iftype == NL80211_IFTYPE_AP) ||
577 	    (wdev->iftype == NL80211_IFTYPE_P2P_GO))
578 		brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
579 						ADDR_DIRECT);
580 	else
581 		brcmf_proto_configure_addr_mode(ifp->drvr, ifp->ifidx,
582 						ADDR_INDIRECT);
583 }
584 
585 static int brcmf_get_first_free_bsscfgidx(struct brcmf_pub *drvr)
586 {
587 	int bsscfgidx;
588 
589 	for (bsscfgidx = 0; bsscfgidx < BRCMF_MAX_IFS; bsscfgidx++) {
590 		/* bsscfgidx 1 is reserved for legacy P2P */
591 		if (bsscfgidx == 1)
592 			continue;
593 		if (!drvr->iflist[bsscfgidx])
594 			return bsscfgidx;
595 	}
596 
597 	return -ENOMEM;
598 }
599 
600 static void brcmf_set_vif_sta_macaddr(struct brcmf_if *ifp, u8 *mac_addr)
601 {
602 	u8 mac_idx = ifp->drvr->sta_mac_idx;
603 
604 	/* set difference MAC address with locally administered bit */
605 	memcpy(mac_addr, ifp->mac_addr, ETH_ALEN);
606 	mac_addr[0] |= 0x02;
607 	mac_addr[3] ^= mac_idx ? 0xC0 : 0xA0;
608 	mac_idx++;
609 	mac_idx = mac_idx % 2;
610 	ifp->drvr->sta_mac_idx = mac_idx;
611 }
612 
613 static int brcmf_cfg80211_request_sta_if(struct brcmf_if *ifp, u8 *macaddr)
614 {
615 	struct wl_interface_create_v1 iface_v1;
616 	struct wl_interface_create_v2 iface_v2;
617 	struct wl_interface_create_v3 iface_v3;
618 	u32 iface_create_ver;
619 	int err;
620 
621 	/* interface_create version 1 */
622 	memset(&iface_v1, 0, sizeof(iface_v1));
623 	iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
624 	iface_v1.flags = WL_INTERFACE_CREATE_STA |
625 			 WL_INTERFACE_MAC_USE;
626 	if (!is_zero_ether_addr(macaddr))
627 		memcpy(iface_v1.mac_addr, macaddr, ETH_ALEN);
628 	else
629 		brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
630 
631 	err = brcmf_fil_iovar_data_get(ifp, "interface_create",
632 				       &iface_v1,
633 				       sizeof(iface_v1));
634 	if (err) {
635 		brcmf_info("failed to create interface(v1), err=%d\n",
636 			   err);
637 	} else {
638 		brcmf_dbg(INFO, "interface created(v1)\n");
639 		return 0;
640 	}
641 
642 	/* interface_create version 2 */
643 	memset(&iface_v2, 0, sizeof(iface_v2));
644 	iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
645 	iface_v2.flags = WL_INTERFACE_MAC_USE;
646 	iface_v2.iftype = WL_INTERFACE_CREATE_STA;
647 	if (!is_zero_ether_addr(macaddr))
648 		memcpy(iface_v2.mac_addr, macaddr, ETH_ALEN);
649 	else
650 		brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
651 
652 	err = brcmf_fil_iovar_data_get(ifp, "interface_create",
653 				       &iface_v2,
654 				       sizeof(iface_v2));
655 	if (err) {
656 		brcmf_info("failed to create interface(v2), err=%d\n",
657 			   err);
658 	} else {
659 		brcmf_dbg(INFO, "interface created(v2)\n");
660 		return 0;
661 	}
662 
663 	/* interface_create version 3+ */
664 	/* get supported version from firmware side */
665 	iface_create_ver = 0;
666 	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
667 				       &iface_create_ver);
668 	if (err) {
669 		brcmf_err("fail to get supported version, err=%d\n", err);
670 		return -EOPNOTSUPP;
671 	}
672 
673 	switch (iface_create_ver) {
674 	case WL_INTERFACE_CREATE_VER_3:
675 		memset(&iface_v3, 0, sizeof(iface_v3));
676 		iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
677 		iface_v3.flags = WL_INTERFACE_MAC_USE;
678 		iface_v3.iftype = WL_INTERFACE_CREATE_STA;
679 		if (!is_zero_ether_addr(macaddr))
680 			memcpy(iface_v3.mac_addr, macaddr, ETH_ALEN);
681 		else
682 			brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
683 
684 		err = brcmf_fil_iovar_data_get(ifp, "interface_create",
685 					       &iface_v3,
686 					       sizeof(iface_v3));
687 
688 		if (!err)
689 			brcmf_dbg(INFO, "interface created(v3)\n");
690 		break;
691 	default:
692 		brcmf_err("not support interface create(v%d)\n",
693 			  iface_create_ver);
694 		err = -EOPNOTSUPP;
695 		break;
696 	}
697 
698 	if (err) {
699 		brcmf_info("station interface creation failed (%d)\n",
700 			   err);
701 		return -EIO;
702 	}
703 
704 	return 0;
705 }
706 
707 static int brcmf_cfg80211_request_ap_if(struct brcmf_if *ifp)
708 {
709 	struct wl_interface_create_v1 iface_v1;
710 	struct wl_interface_create_v2 iface_v2;
711 	struct wl_interface_create_v3 iface_v3;
712 	u32 iface_create_ver;
713 	struct brcmf_pub *drvr = ifp->drvr;
714 	struct brcmf_mbss_ssid_le mbss_ssid_le;
715 	int bsscfgidx;
716 	int err;
717 
718 	/* interface_create version 1 */
719 	memset(&iface_v1, 0, sizeof(iface_v1));
720 	iface_v1.ver = WL_INTERFACE_CREATE_VER_1;
721 	iface_v1.flags = WL_INTERFACE_CREATE_AP |
722 			 WL_INTERFACE_MAC_USE;
723 
724 	brcmf_set_vif_sta_macaddr(ifp, iface_v1.mac_addr);
725 
726 	err = brcmf_fil_iovar_data_get(ifp, "interface_create",
727 				       &iface_v1,
728 				       sizeof(iface_v1));
729 	if (err) {
730 		brcmf_info("failed to create interface(v1), err=%d\n",
731 			   err);
732 	} else {
733 		brcmf_dbg(INFO, "interface created(v1)\n");
734 		return 0;
735 	}
736 
737 	/* interface_create version 2 */
738 	memset(&iface_v2, 0, sizeof(iface_v2));
739 	iface_v2.ver = WL_INTERFACE_CREATE_VER_2;
740 	iface_v2.flags = WL_INTERFACE_MAC_USE;
741 	iface_v2.iftype = WL_INTERFACE_CREATE_AP;
742 
743 	brcmf_set_vif_sta_macaddr(ifp, iface_v2.mac_addr);
744 
745 	err = brcmf_fil_iovar_data_get(ifp, "interface_create",
746 				       &iface_v2,
747 				       sizeof(iface_v2));
748 	if (err) {
749 		brcmf_info("failed to create interface(v2), err=%d\n",
750 			   err);
751 	} else {
752 		brcmf_dbg(INFO, "interface created(v2)\n");
753 		return 0;
754 	}
755 
756 	/* interface_create version 3+ */
757 	/* get supported version from firmware side */
758 	iface_create_ver = 0;
759 	err = brcmf_fil_bsscfg_int_get(ifp, "interface_create",
760 				       &iface_create_ver);
761 	if (err) {
762 		brcmf_err("fail to get supported version, err=%d\n", err);
763 		return -EOPNOTSUPP;
764 	}
765 
766 	switch (iface_create_ver) {
767 	case WL_INTERFACE_CREATE_VER_3:
768 		memset(&iface_v3, 0, sizeof(iface_v3));
769 		iface_v3.ver = WL_INTERFACE_CREATE_VER_3;
770 		iface_v3.flags = WL_INTERFACE_MAC_USE;
771 		iface_v3.iftype = WL_INTERFACE_CREATE_AP;
772 		brcmf_set_vif_sta_macaddr(ifp, iface_v3.mac_addr);
773 
774 		err = brcmf_fil_iovar_data_get(ifp, "interface_create",
775 					       &iface_v3,
776 					       sizeof(iface_v3));
777 
778 		if (!err)
779 			brcmf_dbg(INFO, "interface created(v3)\n");
780 		break;
781 	default:
782 		brcmf_err("not support interface create(v%d)\n",
783 			  iface_create_ver);
784 		err = -EOPNOTSUPP;
785 		break;
786 	}
787 
788 	if (err) {
789 		brcmf_info("Does not support interface_create (%d)\n",
790 			   err);
791 		memset(&mbss_ssid_le, 0, sizeof(mbss_ssid_le));
792 		bsscfgidx = brcmf_get_first_free_bsscfgidx(ifp->drvr);
793 		if (bsscfgidx < 0)
794 			return bsscfgidx;
795 
796 		mbss_ssid_le.bsscfgidx = cpu_to_le32(bsscfgidx);
797 		mbss_ssid_le.SSID_len = cpu_to_le32(5);
798 		sprintf(mbss_ssid_le.SSID, "ssid%d", bsscfgidx);
799 
800 		err = brcmf_fil_bsscfg_data_set(ifp, "bsscfg:ssid", &mbss_ssid_le,
801 						sizeof(mbss_ssid_le));
802 
803 		if (err < 0)
804 			bphy_err(drvr, "setting ssid failed %d\n", err);
805 	}
806 
807 	return err;
808 }
809 
810 /**
811  * brcmf_apsta_add_vif() - create a new AP or STA virtual interface
812  *
813  * @wiphy: wiphy device of new interface.
814  * @name: name of the new interface.
815  * @params: contains mac address for AP or STA device.
816  * @type: interface type.
817  */
818 static
819 struct wireless_dev *brcmf_apsta_add_vif(struct wiphy *wiphy, const char *name,
820 					 struct vif_params *params,
821 					 enum nl80211_iftype type)
822 {
823 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
824 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
825 	struct brcmf_pub *drvr = cfg->pub;
826 	struct brcmf_cfg80211_vif *vif;
827 	int err;
828 
829 	if (type != NL80211_IFTYPE_STATION && type != NL80211_IFTYPE_AP)
830 		return ERR_PTR(-EINVAL);
831 
832 	if (brcmf_cfg80211_vif_event_armed(cfg))
833 		return ERR_PTR(-EBUSY);
834 
835 	brcmf_dbg(INFO, "Adding vif \"%s\"\n", name);
836 
837 	vif = brcmf_alloc_vif(cfg, type);
838 	if (IS_ERR(vif))
839 		return (struct wireless_dev *)vif;
840 
841 	brcmf_cfg80211_arm_vif_event(cfg, vif);
842 
843 	if (type == NL80211_IFTYPE_STATION)
844 		err = brcmf_cfg80211_request_sta_if(ifp, params->macaddr);
845 	else
846 		err = brcmf_cfg80211_request_ap_if(ifp);
847 	if (err) {
848 		brcmf_cfg80211_arm_vif_event(cfg, NULL);
849 		goto fail;
850 	}
851 
852 	/* wait for firmware event */
853 	err = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_ADD,
854 					    BRCMF_VIF_EVENT_TIMEOUT);
855 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
856 	if (!err) {
857 		bphy_err(drvr, "timeout occurred\n");
858 		err = -EIO;
859 		goto fail;
860 	}
861 
862 	/* interface created in firmware */
863 	ifp = vif->ifp;
864 	if (!ifp) {
865 		bphy_err(drvr, "no if pointer provided\n");
866 		err = -ENOENT;
867 		goto fail;
868 	}
869 
870 	strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
871 	err = brcmf_net_attach(ifp, true);
872 	if (err) {
873 		bphy_err(drvr, "Registering netdevice failed\n");
874 		free_netdev(ifp->ndev);
875 		goto fail;
876 	}
877 
878 	return &ifp->vif->wdev;
879 
880 fail:
881 	brcmf_free_vif(vif);
882 	return ERR_PTR(err);
883 }
884 
885 static bool brcmf_is_apmode(struct brcmf_cfg80211_vif *vif)
886 {
887 	enum nl80211_iftype iftype;
888 
889 	iftype = vif->wdev.iftype;
890 	return iftype == NL80211_IFTYPE_AP || iftype == NL80211_IFTYPE_P2P_GO;
891 }
892 
893 static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
894 {
895 	return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
896 }
897 
898 /**
899  * brcmf_mon_add_vif() - create monitor mode virtual interface
900  *
901  * @wiphy: wiphy device of new interface.
902  * @name: name of the new interface.
903  */
904 static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
905 					      const char *name)
906 {
907 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
908 	struct brcmf_cfg80211_vif *vif;
909 	struct net_device *ndev;
910 	struct brcmf_if *ifp;
911 	int err;
912 
913 	if (cfg->pub->mon_if) {
914 		err = -EEXIST;
915 		goto err_out;
916 	}
917 
918 	vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
919 	if (IS_ERR(vif)) {
920 		err = PTR_ERR(vif);
921 		goto err_out;
922 	}
923 
924 	ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
925 	if (!ndev) {
926 		err = -ENOMEM;
927 		goto err_free_vif;
928 	}
929 	ndev->type = ARPHRD_IEEE80211_RADIOTAP;
930 	ndev->ieee80211_ptr = &vif->wdev;
931 	ndev->needs_free_netdev = true;
932 	ndev->priv_destructor = brcmf_cfg80211_free_netdev;
933 	SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
934 
935 	ifp = netdev_priv(ndev);
936 	ifp->vif = vif;
937 	ifp->ndev = ndev;
938 	ifp->drvr = cfg->pub;
939 
940 	vif->ifp = ifp;
941 	vif->wdev.netdev = ndev;
942 
943 	err = brcmf_net_mon_attach(ifp);
944 	if (err) {
945 		brcmf_err("Failed to attach %s device\n", ndev->name);
946 		free_netdev(ndev);
947 		goto err_free_vif;
948 	}
949 
950 	cfg->pub->mon_if = ifp;
951 
952 	return &vif->wdev;
953 
954 err_free_vif:
955 	brcmf_free_vif(vif);
956 err_out:
957 	return ERR_PTR(err);
958 }
959 
960 static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
961 {
962 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
963 	struct net_device *ndev = wdev->netdev;
964 
965 	ndev->netdev_ops->ndo_stop(ndev);
966 
967 	brcmf_net_detach(ndev, true);
968 
969 	cfg->pub->mon_if = NULL;
970 
971 	return 0;
972 }
973 
974 static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
975 						     const char *name,
976 						     unsigned char name_assign_type,
977 						     enum nl80211_iftype type,
978 						     struct vif_params *params)
979 {
980 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
981 	struct brcmf_pub *drvr = cfg->pub;
982 	struct wireless_dev *wdev;
983 	int err;
984 
985 	brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
986 	err = brcmf_vif_add_validate(wiphy_to_cfg(wiphy), type);
987 	if (err) {
988 		bphy_err(drvr, "iface validation failed: err=%d\n", err);
989 		return ERR_PTR(err);
990 	}
991 	switch (type) {
992 	case NL80211_IFTYPE_ADHOC:
993 	case NL80211_IFTYPE_AP_VLAN:
994 	case NL80211_IFTYPE_WDS:
995 	case NL80211_IFTYPE_MESH_POINT:
996 		return ERR_PTR(-EOPNOTSUPP);
997 	case NL80211_IFTYPE_MONITOR:
998 		return brcmf_mon_add_vif(wiphy, name);
999 	case NL80211_IFTYPE_STATION:
1000 	case NL80211_IFTYPE_AP:
1001 		wdev = brcmf_apsta_add_vif(wiphy, name, params, type);
1002 		break;
1003 	case NL80211_IFTYPE_P2P_CLIENT:
1004 	case NL80211_IFTYPE_P2P_GO:
1005 	case NL80211_IFTYPE_P2P_DEVICE:
1006 		wdev = brcmf_p2p_add_vif(wiphy, name, name_assign_type, type, params);
1007 		break;
1008 	case NL80211_IFTYPE_UNSPECIFIED:
1009 	default:
1010 		return ERR_PTR(-EINVAL);
1011 	}
1012 
1013 	if (IS_ERR(wdev))
1014 		bphy_err(drvr, "add iface %s type %d failed: err=%d\n", name,
1015 			 type, (int)PTR_ERR(wdev));
1016 	else
1017 		brcmf_cfg80211_update_proto_addr_mode(wdev);
1018 
1019 	return wdev;
1020 }
1021 
1022 static void brcmf_scan_config_mpc(struct brcmf_if *ifp, int mpc)
1023 {
1024 	if (brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_NEED_MPC))
1025 		brcmf_set_mpc(ifp, mpc);
1026 }
1027 
1028 void brcmf_set_mpc(struct brcmf_if *ifp, int mpc)
1029 {
1030 	struct brcmf_pub *drvr = ifp->drvr;
1031 	s32 err = 0;
1032 
1033 	if (check_vif_up(ifp->vif)) {
1034 		err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
1035 		if (err) {
1036 			bphy_err(drvr, "fail to set mpc\n");
1037 			return;
1038 		}
1039 		brcmf_dbg(INFO, "MPC : %d\n", mpc);
1040 	}
1041 }
1042 
1043 static void brcmf_scan_params_v2_to_v1(struct brcmf_scan_params_v2_le *params_v2_le,
1044 				       struct brcmf_scan_params_le *params_le)
1045 {
1046 	size_t params_size;
1047 	u32 ch;
1048 	int n_channels, n_ssids;
1049 
1050 	memcpy(&params_le->ssid_le, &params_v2_le->ssid_le,
1051 	       sizeof(params_le->ssid_le));
1052 	memcpy(&params_le->bssid, &params_v2_le->bssid,
1053 	       sizeof(params_le->bssid));
1054 
1055 	params_le->bss_type = params_v2_le->bss_type;
1056 	params_le->scan_type = le32_to_cpu(params_v2_le->scan_type);
1057 	params_le->nprobes = params_v2_le->nprobes;
1058 	params_le->active_time = params_v2_le->active_time;
1059 	params_le->passive_time = params_v2_le->passive_time;
1060 	params_le->home_time = params_v2_le->home_time;
1061 	params_le->channel_num = params_v2_le->channel_num;
1062 
1063 	ch = le32_to_cpu(params_v2_le->channel_num);
1064 	n_channels = ch & BRCMF_SCAN_PARAMS_COUNT_MASK;
1065 	n_ssids = ch >> BRCMF_SCAN_PARAMS_NSSID_SHIFT;
1066 
1067 	params_size = sizeof(u16) * n_channels;
1068 	if (n_ssids > 0) {
1069 		params_size = roundup(params_size, sizeof(u32));
1070 		params_size += sizeof(struct brcmf_ssid_le) * n_ssids;
1071 	}
1072 
1073 	memcpy(&params_le->channel_list[0],
1074 	       &params_v2_le->channel_list[0], params_size);
1075 }
1076 
1077 static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
1078 			     struct brcmf_scan_params_v2_le *params_le,
1079 			     struct cfg80211_scan_request *request)
1080 {
1081 	u32 n_ssids;
1082 	u32 n_channels;
1083 	s32 i;
1084 	s32 offset;
1085 	u16 chanspec;
1086 	char *ptr;
1087 	int length;
1088 	struct brcmf_ssid_le ssid_le;
1089 
1090 	eth_broadcast_addr(params_le->bssid);
1091 
1092 	length = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1093 
1094 	params_le->version = cpu_to_le16(BRCMF_SCAN_PARAMS_VERSION_V2);
1095 	params_le->bss_type = DOT11_BSSTYPE_ANY;
1096 	params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_ACTIVE);
1097 	params_le->channel_num = 0;
1098 	params_le->nprobes = cpu_to_le32(-1);
1099 	params_le->active_time = cpu_to_le32(-1);
1100 	params_le->passive_time = cpu_to_le32(-1);
1101 	params_le->home_time = cpu_to_le32(-1);
1102 	memset(&params_le->ssid_le, 0, sizeof(params_le->ssid_le));
1103 
1104 	/* Scan abort */
1105 	if (!request) {
1106 		length += sizeof(u16);
1107 		params_le->channel_num = cpu_to_le32(1);
1108 		params_le->channel_list[0] = cpu_to_le16(-1);
1109 		params_le->length = cpu_to_le16(length);
1110 		return;
1111 	}
1112 
1113 	n_ssids = request->n_ssids;
1114 	n_channels = request->n_channels;
1115 
1116 	/* Copy channel array if applicable */
1117 	brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
1118 		  n_channels);
1119 	if (n_channels > 0) {
1120 		length += roundup(sizeof(u16) * n_channels, sizeof(u32));
1121 		for (i = 0; i < n_channels; i++) {
1122 			chanspec = channel_to_chanspec(&cfg->d11inf,
1123 						       request->channels[i]);
1124 			brcmf_dbg(SCAN, "Chan : %d, Channel spec: %x\n",
1125 				  request->channels[i]->hw_value, chanspec);
1126 			params_le->channel_list[i] = cpu_to_le16(chanspec);
1127 		}
1128 	} else {
1129 		brcmf_dbg(SCAN, "Scanning all channels\n");
1130 	}
1131 
1132 	/* Copy ssid array if applicable */
1133 	brcmf_dbg(SCAN, "### List of SSIDs to scan ### %d\n", n_ssids);
1134 	if (n_ssids > 0) {
1135 		offset = offsetof(struct brcmf_scan_params_v2_le, channel_list) +
1136 				n_channels * sizeof(u16);
1137 		offset = roundup(offset, sizeof(u32));
1138 		length += sizeof(ssid_le) * n_ssids,
1139 		ptr = (char *)params_le + offset;
1140 		for (i = 0; i < n_ssids; i++) {
1141 			memset(&ssid_le, 0, sizeof(ssid_le));
1142 			ssid_le.SSID_len =
1143 					cpu_to_le32(request->ssids[i].ssid_len);
1144 			memcpy(ssid_le.SSID, request->ssids[i].ssid,
1145 			       request->ssids[i].ssid_len);
1146 			if (!ssid_le.SSID_len)
1147 				brcmf_dbg(SCAN, "%d: Broadcast scan\n", i);
1148 			else
1149 				brcmf_dbg(SCAN, "%d: scan for  %.32s size=%d\n",
1150 					  i, ssid_le.SSID, ssid_le.SSID_len);
1151 			memcpy(ptr, &ssid_le, sizeof(ssid_le));
1152 			ptr += sizeof(ssid_le);
1153 		}
1154 	} else {
1155 		brcmf_dbg(SCAN, "Performing passive scan\n");
1156 		params_le->scan_type = cpu_to_le32(BRCMF_SCANTYPE_PASSIVE);
1157 	}
1158 	params_le->length = cpu_to_le16(length);
1159 	/* Adding mask to channel numbers */
1160 	params_le->channel_num =
1161 		cpu_to_le32((n_ssids << BRCMF_SCAN_PARAMS_NSSID_SHIFT) |
1162 			(n_channels & BRCMF_SCAN_PARAMS_COUNT_MASK));
1163 }
1164 
1165 s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
1166 				struct brcmf_if *ifp, bool aborted,
1167 				bool fw_abort)
1168 {
1169 	struct brcmf_pub *drvr = cfg->pub;
1170 	struct brcmf_scan_params_v2_le params_v2_le;
1171 	struct cfg80211_scan_request *scan_request;
1172 	u64 reqid;
1173 	u32 bucket;
1174 	s32 err = 0;
1175 
1176 	brcmf_dbg(SCAN, "Enter\n");
1177 
1178 	/* clear scan request, because the FW abort can cause a second call */
1179 	/* to this functon and might cause a double cfg80211_scan_done      */
1180 	scan_request = cfg->scan_request;
1181 	cfg->scan_request = NULL;
1182 
1183 	timer_delete_sync(&cfg->escan_timeout);
1184 
1185 	if (fw_abort) {
1186 		/* Do a scan abort to stop the driver's scan engine */
1187 		brcmf_dbg(SCAN, "ABORT scan in firmware\n");
1188 
1189 		brcmf_escan_prep(cfg, &params_v2_le, NULL);
1190 
1191 		/* E-Scan (or anyother type) can be aborted by SCAN */
1192 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1193 			err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1194 						     &params_v2_le,
1195 						     sizeof(params_v2_le));
1196 		} else {
1197 			struct brcmf_scan_params_le params_le;
1198 
1199 			brcmf_scan_params_v2_to_v1(&params_v2_le, &params_le);
1200 			err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCAN,
1201 						     &params_le,
1202 						     sizeof(params_le));
1203 		}
1204 
1205 		if (err)
1206 			bphy_err(drvr, "Scan abort failed\n");
1207 	}
1208 
1209 	brcmf_scan_config_mpc(ifp, 1);
1210 
1211 	/*
1212 	 * e-scan can be initiated internally
1213 	 * which takes precedence.
1214 	 */
1215 	if (cfg->int_escan_map) {
1216 		brcmf_dbg(SCAN, "scheduled scan completed (%x)\n",
1217 			  cfg->int_escan_map);
1218 		while (cfg->int_escan_map) {
1219 			bucket = __ffs(cfg->int_escan_map);
1220 			cfg->int_escan_map &= ~BIT(bucket);
1221 			reqid = brcmf_pno_find_reqid_by_bucket(cfg->pno,
1222 							       bucket);
1223 			if (!aborted) {
1224 				brcmf_dbg(SCAN, "report results: reqid=%llu\n",
1225 					  reqid);
1226 				cfg80211_sched_scan_results(cfg_to_wiphy(cfg),
1227 							    reqid);
1228 			}
1229 		}
1230 	} else if (scan_request) {
1231 		struct cfg80211_scan_info info = {
1232 			.aborted = aborted,
1233 		};
1234 
1235 		brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
1236 			  aborted ? "Aborted" : "Done");
1237 		cfg80211_scan_done(scan_request, &info);
1238 	}
1239 	if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
1240 		brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
1241 
1242 	return err;
1243 }
1244 
1245 static int brcmf_cfg80211_del_apsta_iface(struct wiphy *wiphy,
1246 					  struct wireless_dev *wdev)
1247 {
1248 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1249 	struct net_device *ndev = wdev->netdev;
1250 	struct brcmf_if *ifp = netdev_priv(ndev);
1251 	struct brcmf_pub *drvr = cfg->pub;
1252 	int ret;
1253 	int err;
1254 
1255 	brcmf_cfg80211_arm_vif_event(cfg, ifp->vif);
1256 
1257 	err = brcmf_fil_bsscfg_data_set(ifp, "interface_remove", NULL, 0);
1258 	if (err) {
1259 		bphy_err(drvr, "interface_remove failed %d\n", err);
1260 		goto err_unarm;
1261 	}
1262 
1263 	/* wait for firmware event */
1264 	ret = brcmf_cfg80211_wait_vif_event(cfg, BRCMF_E_IF_DEL,
1265 					    BRCMF_VIF_EVENT_TIMEOUT);
1266 	if (!ret) {
1267 		bphy_err(drvr, "timeout occurred\n");
1268 		err = -EIO;
1269 		goto err_unarm;
1270 	}
1271 
1272 	brcmf_remove_interface(ifp, true);
1273 
1274 err_unarm:
1275 	brcmf_cfg80211_arm_vif_event(cfg, NULL);
1276 	return err;
1277 }
1278 
1279 static
1280 int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
1281 {
1282 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1283 	struct net_device *ndev = wdev->netdev;
1284 
1285 	if (ndev && ndev == cfg_to_ndev(cfg))
1286 		return -ENOTSUPP;
1287 
1288 	/* vif event pending in firmware */
1289 	if (brcmf_cfg80211_vif_event_armed(cfg))
1290 		return -EBUSY;
1291 
1292 	if (ndev) {
1293 		if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
1294 		    cfg->escan_info.ifp == netdev_priv(ndev))
1295 			brcmf_notify_escan_complete(cfg, netdev_priv(ndev),
1296 						    true, true);
1297 
1298 		brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
1299 	}
1300 
1301 	switch (wdev->iftype) {
1302 	case NL80211_IFTYPE_ADHOC:
1303 	case NL80211_IFTYPE_AP_VLAN:
1304 	case NL80211_IFTYPE_WDS:
1305 	case NL80211_IFTYPE_MESH_POINT:
1306 		return -EOPNOTSUPP;
1307 	case NL80211_IFTYPE_MONITOR:
1308 		return brcmf_mon_del_vif(wiphy, wdev);
1309 	case NL80211_IFTYPE_STATION:
1310 	case NL80211_IFTYPE_AP:
1311 		return brcmf_cfg80211_del_apsta_iface(wiphy, wdev);
1312 	case NL80211_IFTYPE_P2P_CLIENT:
1313 	case NL80211_IFTYPE_P2P_GO:
1314 	case NL80211_IFTYPE_P2P_DEVICE:
1315 		return brcmf_p2p_del_vif(wiphy, wdev);
1316 	case NL80211_IFTYPE_UNSPECIFIED:
1317 	default:
1318 		return -EINVAL;
1319 	}
1320 	return -EOPNOTSUPP;
1321 }
1322 
1323 static s32
1324 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
1325 			 enum nl80211_iftype type,
1326 			 struct vif_params *params)
1327 {
1328 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1329 	struct brcmf_if *ifp = netdev_priv(ndev);
1330 	struct brcmf_cfg80211_vif *vif = ifp->vif;
1331 	struct brcmf_pub *drvr = cfg->pub;
1332 	s32 infra = 0;
1333 	s32 ap = 0;
1334 	s32 err = 0;
1335 
1336 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, type=%d\n", ifp->bsscfgidx,
1337 		  type);
1338 
1339 	/* WAR: There are a number of p2p interface related problems which
1340 	 * need to be handled initially (before doing the validate).
1341 	 * wpa_supplicant tends to do iface changes on p2p device/client/go
1342 	 * which are not always possible/allowed. However we need to return
1343 	 * OK otherwise the wpa_supplicant wont start. The situation differs
1344 	 * on configuration and setup (p2pon=1 module param). The first check
1345 	 * is to see if the request is a change to station for p2p iface.
1346 	 */
1347 	if ((type == NL80211_IFTYPE_STATION) &&
1348 	    ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
1349 	     (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO) ||
1350 	     (vif->wdev.iftype == NL80211_IFTYPE_P2P_DEVICE))) {
1351 		brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
1352 		/* Now depending on whether module param p2pon=1 was used the
1353 		 * response needs to be either 0 or EOPNOTSUPP. The reason is
1354 		 * that if p2pon=1 is used, but a newer supplicant is used then
1355 		 * we should return an error, as this combination wont work.
1356 		 * In other situations 0 is returned and supplicant will start
1357 		 * normally. It will give a trace in cfg80211, but it is the
1358 		 * only way to get it working. Unfortunately this will result
1359 		 * in situation where we wont support new supplicant in
1360 		 * combination with module param p2pon=1, but that is the way
1361 		 * it is. If the user tries this then unloading of driver might
1362 		 * fail/lock.
1363 		 */
1364 		if (cfg->p2p.p2pdev_dynamically)
1365 			return -EOPNOTSUPP;
1366 		else
1367 			return 0;
1368 	}
1369 	err = brcmf_vif_change_validate(wiphy_to_cfg(wiphy), vif, type);
1370 	if (err) {
1371 		bphy_err(drvr, "iface validation failed: err=%d\n", err);
1372 		return err;
1373 	}
1374 	switch (type) {
1375 	case NL80211_IFTYPE_MONITOR:
1376 	case NL80211_IFTYPE_WDS:
1377 		bphy_err(drvr, "type (%d) : currently we do not support this type\n",
1378 			 type);
1379 		return -EOPNOTSUPP;
1380 	case NL80211_IFTYPE_ADHOC:
1381 		infra = 0;
1382 		break;
1383 	case NL80211_IFTYPE_STATION:
1384 		infra = 1;
1385 		break;
1386 	case NL80211_IFTYPE_AP:
1387 	case NL80211_IFTYPE_P2P_GO:
1388 		ap = 1;
1389 		break;
1390 	default:
1391 		err = -EINVAL;
1392 		goto done;
1393 	}
1394 
1395 	if (ap) {
1396 		if (type == NL80211_IFTYPE_P2P_GO) {
1397 			brcmf_dbg(INFO, "IF Type = P2P GO\n");
1398 			err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
1399 		}
1400 		if (!err) {
1401 			brcmf_dbg(INFO, "IF Type = AP\n");
1402 		}
1403 	} else {
1404 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
1405 		if (err) {
1406 			bphy_err(drvr, "WLC_SET_INFRA error (%d)\n", err);
1407 			err = -EAGAIN;
1408 			goto done;
1409 		}
1410 		brcmf_dbg(INFO, "IF Type = %s\n", brcmf_is_ibssmode(vif) ?
1411 			  "Adhoc" : "Infra");
1412 	}
1413 	ndev->ieee80211_ptr->iftype = type;
1414 
1415 	brcmf_cfg80211_update_proto_addr_mode(&vif->wdev);
1416 
1417 done:
1418 	brcmf_dbg(TRACE, "Exit\n");
1419 
1420 	return err;
1421 }
1422 
1423 static s32
1424 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp,
1425 		struct cfg80211_scan_request *request)
1426 {
1427 	struct brcmf_pub *drvr = cfg->pub;
1428 	s32 params_size = BRCMF_SCAN_PARAMS_V2_FIXED_SIZE +
1429 			  offsetof(struct brcmf_escan_params_le, params_v2_le);
1430 	struct brcmf_escan_params_le *params;
1431 	s32 err = 0;
1432 
1433 	brcmf_dbg(SCAN, "E-SCAN START\n");
1434 
1435 	if (request != NULL) {
1436 		/* Allocate space for populating ssids in struct */
1437 		params_size += sizeof(u32) * ((request->n_channels + 1) / 2);
1438 
1439 		/* Allocate space for populating ssids in struct */
1440 		params_size += sizeof(struct brcmf_ssid_le) * request->n_ssids;
1441 	}
1442 
1443 	params = kzalloc(params_size, GFP_KERNEL);
1444 	if (!params) {
1445 		err = -ENOMEM;
1446 		goto exit;
1447 	}
1448 	BUG_ON(params_size + sizeof("escan") >= BRCMF_DCMD_MEDLEN);
1449 	brcmf_escan_prep(cfg, &params->params_v2_le, request);
1450 
1451 	params->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION_V2);
1452 
1453 	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_V2)) {
1454 		struct brcmf_escan_params_le *params_v1;
1455 
1456 		params_size -= BRCMF_SCAN_PARAMS_V2_FIXED_SIZE;
1457 		params_size += BRCMF_SCAN_PARAMS_FIXED_SIZE;
1458 		params_v1 = kzalloc(params_size, GFP_KERNEL);
1459 		if (!params_v1) {
1460 			err = -ENOMEM;
1461 			goto exit_params;
1462 		}
1463 		params_v1->version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
1464 		brcmf_scan_params_v2_to_v1(&params->params_v2_le, &params_v1->params_le);
1465 		kfree(params);
1466 		params = params_v1;
1467 	}
1468 
1469 	params->action = cpu_to_le16(WL_ESCAN_ACTION_START);
1470 	params->sync_id = cpu_to_le16(0x1234);
1471 
1472 	err = brcmf_fil_iovar_data_set(ifp, "escan", params, params_size);
1473 	if (err) {
1474 		if (err == -EBUSY)
1475 			brcmf_dbg(INFO, "system busy : escan canceled\n");
1476 		else
1477 			bphy_err(drvr, "error (%d)\n", err);
1478 	}
1479 
1480 exit_params:
1481 	kfree(params);
1482 exit:
1483 	return err;
1484 }
1485 
1486 static s32
1487 brcmf_do_escan(struct brcmf_if *ifp, struct cfg80211_scan_request *request)
1488 {
1489 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
1490 	s32 err;
1491 	struct brcmf_scan_results *results;
1492 	struct escan_info *escan = &cfg->escan_info;
1493 
1494 	brcmf_dbg(SCAN, "Enter\n");
1495 	escan->ifp = ifp;
1496 	escan->wiphy = cfg->wiphy;
1497 	escan->escan_state = WL_ESCAN_STATE_SCANNING;
1498 
1499 	brcmf_scan_config_mpc(ifp, 0);
1500 	results = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
1501 	results->version = 0;
1502 	results->count = 0;
1503 	results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
1504 
1505 	err = escan->run(cfg, ifp, request);
1506 	if (err)
1507 		brcmf_scan_config_mpc(ifp, 1);
1508 	return err;
1509 }
1510 
1511 static s32
1512 brcmf_cfg80211_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
1513 {
1514 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1515 	struct brcmf_pub *drvr = cfg->pub;
1516 	struct brcmf_cfg80211_vif *vif;
1517 	s32 err = 0;
1518 
1519 	brcmf_dbg(TRACE, "Enter\n");
1520 	vif = container_of(request->wdev, struct brcmf_cfg80211_vif, wdev);
1521 	if (!check_vif_up(vif))
1522 		return -EIO;
1523 
1524 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
1525 		bphy_err(drvr, "Scanning already: status (%lu)\n",
1526 			 cfg->scan_status);
1527 		return -EAGAIN;
1528 	}
1529 	if (test_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status)) {
1530 		bphy_err(drvr, "Scanning being aborted: status (%lu)\n",
1531 			 cfg->scan_status);
1532 		return -EAGAIN;
1533 	}
1534 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
1535 		bphy_err(drvr, "Scanning suppressed: status (%lu)\n",
1536 			 cfg->scan_status);
1537 		return -EAGAIN;
1538 	}
1539 	if (test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
1540 		bphy_err(drvr, "Connecting: status (%lu)\n", vif->sme_state);
1541 		return -EAGAIN;
1542 	}
1543 
1544 	/* If scan req comes for p2p0, send it over primary I/F */
1545 	if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
1546 		vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
1547 
1548 	brcmf_dbg(SCAN, "START ESCAN\n");
1549 
1550 	cfg->scan_request = request;
1551 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1552 
1553 	cfg->escan_info.run = brcmf_run_escan;
1554 	err = brcmf_p2p_scan_prep(wiphy, request, vif);
1555 	if (err)
1556 		goto scan_out;
1557 
1558 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
1559 				    request->ie, request->ie_len);
1560 	if (err)
1561 		goto scan_out;
1562 
1563 	err = brcmf_do_escan(vif->ifp, request);
1564 	if (err)
1565 		goto scan_out;
1566 
1567 	/* Arm scan timeout timer */
1568 	mod_timer(&cfg->escan_timeout,
1569 		  jiffies + msecs_to_jiffies(BRCMF_ESCAN_TIMER_INTERVAL_MS));
1570 
1571 	return 0;
1572 
1573 scan_out:
1574 	bphy_err(drvr, "scan error (%d)\n", err);
1575 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
1576 	cfg->scan_request = NULL;
1577 	return err;
1578 }
1579 
1580 static s32 brcmf_set_rts(struct net_device *ndev, u32 rts_threshold)
1581 {
1582 	struct brcmf_if *ifp = netdev_priv(ndev);
1583 	struct brcmf_pub *drvr = ifp->drvr;
1584 	s32 err = 0;
1585 
1586 	err = brcmf_fil_iovar_int_set(ifp, "rtsthresh", rts_threshold);
1587 	if (err)
1588 		bphy_err(drvr, "Error (%d)\n", err);
1589 
1590 	return err;
1591 }
1592 
1593 static s32 brcmf_set_frag(struct net_device *ndev, u32 frag_threshold)
1594 {
1595 	struct brcmf_if *ifp = netdev_priv(ndev);
1596 	struct brcmf_pub *drvr = ifp->drvr;
1597 	s32 err = 0;
1598 
1599 	err = brcmf_fil_iovar_int_set(ifp, "fragthresh",
1600 				      frag_threshold);
1601 	if (err)
1602 		bphy_err(drvr, "Error (%d)\n", err);
1603 
1604 	return err;
1605 }
1606 
1607 static s32 brcmf_set_retry(struct net_device *ndev, u32 retry, bool l)
1608 {
1609 	struct brcmf_if *ifp = netdev_priv(ndev);
1610 	struct brcmf_pub *drvr = ifp->drvr;
1611 	s32 err = 0;
1612 	u32 cmd = (l ? BRCMF_C_SET_LRL : BRCMF_C_SET_SRL);
1613 
1614 	err = brcmf_fil_cmd_int_set(ifp, cmd, retry);
1615 	if (err) {
1616 		bphy_err(drvr, "cmd (%d) , error (%d)\n", cmd, err);
1617 		return err;
1618 	}
1619 	return err;
1620 }
1621 
1622 static s32 brcmf_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1623 {
1624 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1625 	struct net_device *ndev = cfg_to_ndev(cfg);
1626 	struct brcmf_if *ifp = netdev_priv(ndev);
1627 	s32 err = 0;
1628 
1629 	brcmf_dbg(TRACE, "Enter\n");
1630 	if (!check_vif_up(ifp->vif))
1631 		return -EIO;
1632 
1633 	if (changed & WIPHY_PARAM_RTS_THRESHOLD &&
1634 	    (cfg->conf->rts_threshold != wiphy->rts_threshold)) {
1635 		cfg->conf->rts_threshold = wiphy->rts_threshold;
1636 		err = brcmf_set_rts(ndev, cfg->conf->rts_threshold);
1637 		if (!err)
1638 			goto done;
1639 	}
1640 	if (changed & WIPHY_PARAM_FRAG_THRESHOLD &&
1641 	    (cfg->conf->frag_threshold != wiphy->frag_threshold)) {
1642 		cfg->conf->frag_threshold = wiphy->frag_threshold;
1643 		err = brcmf_set_frag(ndev, cfg->conf->frag_threshold);
1644 		if (!err)
1645 			goto done;
1646 	}
1647 	if (changed & WIPHY_PARAM_RETRY_LONG
1648 	    && (cfg->conf->retry_long != wiphy->retry_long)) {
1649 		cfg->conf->retry_long = wiphy->retry_long;
1650 		err = brcmf_set_retry(ndev, cfg->conf->retry_long, true);
1651 		if (!err)
1652 			goto done;
1653 	}
1654 	if (changed & WIPHY_PARAM_RETRY_SHORT
1655 	    && (cfg->conf->retry_short != wiphy->retry_short)) {
1656 		cfg->conf->retry_short = wiphy->retry_short;
1657 		err = brcmf_set_retry(ndev, cfg->conf->retry_short, false);
1658 		if (!err)
1659 			goto done;
1660 	}
1661 
1662 done:
1663 	brcmf_dbg(TRACE, "Exit\n");
1664 	return err;
1665 }
1666 
1667 static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
1668 {
1669 	memset(prof, 0, sizeof(*prof));
1670 }
1671 
1672 static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
1673 {
1674 	u16 reason;
1675 
1676 	switch (e->event_code) {
1677 	case BRCMF_E_DEAUTH:
1678 	case BRCMF_E_DEAUTH_IND:
1679 	case BRCMF_E_DISASSOC_IND:
1680 		reason = e->reason;
1681 		break;
1682 	case BRCMF_E_LINK:
1683 	default:
1684 		reason = 0;
1685 		break;
1686 	}
1687 	return reason;
1688 }
1689 
1690 int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags)
1691 {
1692 	struct brcmf_pub *drvr = ifp->drvr;
1693 	struct brcmf_wsec_pmk_le pmk;
1694 	int err;
1695 
1696 	if (key_len > sizeof(pmk.key)) {
1697 		bphy_err(drvr, "key must be less than %zu bytes\n",
1698 			 sizeof(pmk.key));
1699 		return -EINVAL;
1700 	}
1701 
1702 	memset(&pmk, 0, sizeof(pmk));
1703 
1704 	/* pass key material directly */
1705 	pmk.key_len = cpu_to_le16(key_len);
1706 	pmk.flags = cpu_to_le16(flags);
1707 	memcpy(pmk.key, key, key_len);
1708 
1709 	/* store key material in firmware */
1710 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
1711 				     &pmk, sizeof(pmk));
1712 	if (err < 0)
1713 		bphy_err(drvr, "failed to change PSK in firmware (len=%u)\n",
1714 			 key_len);
1715 
1716 	return err;
1717 }
1718 BRCMF_EXPORT_SYMBOL_GPL(brcmf_set_wsec);
1719 
1720 static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len)
1721 {
1722 	return brcmf_set_wsec(ifp, pmk_data, pmk_len, 0);
1723 }
1724 
1725 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason,
1726 			    bool locally_generated)
1727 {
1728 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
1729 	struct brcmf_pub *drvr = cfg->pub;
1730 	bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
1731 	s32 err = 0;
1732 
1733 	brcmf_dbg(TRACE, "Enter\n");
1734 
1735 	if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
1736 		if (bus_up) {
1737 			brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
1738 			err = brcmf_fil_cmd_data_set(vif->ifp,
1739 						     BRCMF_C_DISASSOC, NULL, 0);
1740 			if (err)
1741 				bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
1742 					 err);
1743 		}
1744 
1745 		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
1746 		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
1747 			cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
1748 					      locally_generated, GFP_KERNEL);
1749 	}
1750 	clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
1751 	clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
1752 	clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
1753 	clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
1754 	brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
1755 	if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
1756 		if (bus_up)
1757 			brcmf_set_pmk(vif->ifp, NULL, 0);
1758 		vif->profile.use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
1759 	}
1760 	brcmf_dbg(TRACE, "Exit\n");
1761 }
1762 
1763 static s32
1764 brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
1765 		      struct cfg80211_ibss_params *params)
1766 {
1767 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
1768 	struct brcmf_if *ifp = netdev_priv(ndev);
1769 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
1770 	struct brcmf_pub *drvr = cfg->pub;
1771 	struct brcmf_join_params join_params;
1772 	size_t join_params_size = 0;
1773 	s32 err = 0;
1774 	s32 wsec = 0;
1775 	s32 bcnprd;
1776 	u16 chanspec;
1777 	u32 ssid_len;
1778 
1779 	brcmf_dbg(TRACE, "Enter\n");
1780 	if (!check_vif_up(ifp->vif))
1781 		return -EIO;
1782 
1783 	if (params->ssid)
1784 		brcmf_dbg(CONN, "SSID: %s\n", params->ssid);
1785 	else {
1786 		brcmf_dbg(CONN, "SSID: NULL, Not supported\n");
1787 		return -EOPNOTSUPP;
1788 	}
1789 
1790 	set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1791 
1792 	if (params->bssid)
1793 		brcmf_dbg(CONN, "BSSID: %pM\n", params->bssid);
1794 	else
1795 		brcmf_dbg(CONN, "No BSSID specified\n");
1796 
1797 	if (params->chandef.chan)
1798 		brcmf_dbg(CONN, "channel: %d\n",
1799 			  params->chandef.chan->center_freq);
1800 	else
1801 		brcmf_dbg(CONN, "no channel specified\n");
1802 
1803 	if (params->channel_fixed)
1804 		brcmf_dbg(CONN, "fixed channel required\n");
1805 	else
1806 		brcmf_dbg(CONN, "no fixed channel required\n");
1807 
1808 	if (params->ie && params->ie_len)
1809 		brcmf_dbg(CONN, "ie len: %d\n", params->ie_len);
1810 	else
1811 		brcmf_dbg(CONN, "no ie specified\n");
1812 
1813 	if (params->beacon_interval)
1814 		brcmf_dbg(CONN, "beacon interval: %d\n",
1815 			  params->beacon_interval);
1816 	else
1817 		brcmf_dbg(CONN, "no beacon interval specified\n");
1818 
1819 	if (params->basic_rates)
1820 		brcmf_dbg(CONN, "basic rates: %08X\n", params->basic_rates);
1821 	else
1822 		brcmf_dbg(CONN, "no basic rates specified\n");
1823 
1824 	if (params->privacy)
1825 		brcmf_dbg(CONN, "privacy required\n");
1826 	else
1827 		brcmf_dbg(CONN, "no privacy required\n");
1828 
1829 	/* Configure Privacy for starter */
1830 	if (params->privacy)
1831 		wsec |= WEP_ENABLED;
1832 
1833 	err = brcmf_fil_iovar_int_set(ifp, "wsec", wsec);
1834 	if (err) {
1835 		bphy_err(drvr, "wsec failed (%d)\n", err);
1836 		goto done;
1837 	}
1838 
1839 	/* Configure Beacon Interval for starter */
1840 	if (params->beacon_interval)
1841 		bcnprd = params->beacon_interval;
1842 	else
1843 		bcnprd = 100;
1844 
1845 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD, bcnprd);
1846 	if (err) {
1847 		bphy_err(drvr, "WLC_SET_BCNPRD failed (%d)\n", err);
1848 		goto done;
1849 	}
1850 
1851 	/* Configure required join parameter */
1852 	memset(&join_params, 0, sizeof(struct brcmf_join_params));
1853 
1854 	/* SSID */
1855 	ssid_len = min_t(u32, params->ssid_len, IEEE80211_MAX_SSID_LEN);
1856 	memcpy(join_params.ssid_le.SSID, params->ssid, ssid_len);
1857 	join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
1858 	join_params_size = sizeof(join_params.ssid_le);
1859 
1860 	/* BSSID */
1861 	if (params->bssid) {
1862 		memcpy(join_params.params_le.bssid, params->bssid, ETH_ALEN);
1863 		join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE;
1864 		memcpy(profile->bssid, params->bssid, ETH_ALEN);
1865 	} else {
1866 		eth_broadcast_addr(join_params.params_le.bssid);
1867 		eth_zero_addr(profile->bssid);
1868 	}
1869 
1870 	/* Channel */
1871 	if (params->chandef.chan) {
1872 		u32 target_channel;
1873 
1874 		cfg->channel =
1875 			ieee80211_frequency_to_channel(
1876 				params->chandef.chan->center_freq);
1877 		if (params->channel_fixed) {
1878 			/* adding chanspec */
1879 			chanspec = chandef_to_chanspec(&cfg->d11inf,
1880 						       &params->chandef);
1881 			join_params.params_le.chanspec_list[0] =
1882 				cpu_to_le16(chanspec);
1883 			join_params.params_le.chanspec_num = cpu_to_le32(1);
1884 			join_params_size += sizeof(join_params.params_le);
1885 		}
1886 
1887 		/* set channel for starter */
1888 		target_channel = cfg->channel;
1889 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_CHANNEL,
1890 					    target_channel);
1891 		if (err) {
1892 			bphy_err(drvr, "WLC_SET_CHANNEL failed (%d)\n", err);
1893 			goto done;
1894 		}
1895 	} else
1896 		cfg->channel = 0;
1897 
1898 	cfg->ibss_starter = false;
1899 
1900 
1901 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
1902 				     &join_params, join_params_size);
1903 	if (err) {
1904 		bphy_err(drvr, "WLC_SET_SSID failed (%d)\n", err);
1905 		goto done;
1906 	}
1907 
1908 done:
1909 	if (err)
1910 		clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
1911 	brcmf_dbg(TRACE, "Exit\n");
1912 	return err;
1913 }
1914 
1915 static s32
1916 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
1917 {
1918 	struct brcmf_if *ifp = netdev_priv(ndev);
1919 
1920 	brcmf_dbg(TRACE, "Enter\n");
1921 	if (!check_vif_up(ifp->vif)) {
1922 		/* When driver is being unloaded, it can end up here. If an
1923 		 * error is returned then later on a debug trace in the wireless
1924 		 * core module will be printed. To avoid this 0 is returned.
1925 		 */
1926 		return 0;
1927 	}
1928 
1929 	brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING, true);
1930 	brcmf_net_setcarrier(ifp, false);
1931 
1932 	brcmf_dbg(TRACE, "Exit\n");
1933 
1934 	return 0;
1935 }
1936 
1937 static s32 brcmf_set_wpa_version(struct net_device *ndev,
1938 				 struct cfg80211_connect_params *sme)
1939 {
1940 	struct brcmf_if *ifp = netdev_priv(ndev);
1941 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1942 	struct brcmf_pub *drvr = ifp->drvr;
1943 	struct brcmf_cfg80211_security *sec;
1944 	s32 val = 0;
1945 	s32 err = 0;
1946 
1947 	if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_1)
1948 		val = WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED;
1949 	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_2)
1950 		val = WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED;
1951 	else if (sme->crypto.wpa_versions & NL80211_WPA_VERSION_3)
1952 		val = WPA3_AUTH_SAE_PSK;
1953 	else
1954 		val = WPA_AUTH_DISABLED;
1955 	brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
1956 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", val);
1957 	if (err) {
1958 		bphy_err(drvr, "set wpa_auth failed (%d)\n", err);
1959 		return err;
1960 	}
1961 	sec = &profile->sec;
1962 	sec->wpa_versions = sme->crypto.wpa_versions;
1963 	return err;
1964 }
1965 
1966 static s32 brcmf_set_auth_type(struct net_device *ndev,
1967 			       struct cfg80211_connect_params *sme)
1968 {
1969 	struct brcmf_if *ifp = netdev_priv(ndev);
1970 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
1971 	struct brcmf_pub *drvr = ifp->drvr;
1972 	struct brcmf_cfg80211_security *sec;
1973 	s32 val = 0;
1974 	s32 err = 0;
1975 
1976 	switch (sme->auth_type) {
1977 	case NL80211_AUTHTYPE_OPEN_SYSTEM:
1978 		val = 0;
1979 		brcmf_dbg(CONN, "open system\n");
1980 		break;
1981 	case NL80211_AUTHTYPE_SHARED_KEY:
1982 		val = 1;
1983 		brcmf_dbg(CONN, "shared key\n");
1984 		break;
1985 	case NL80211_AUTHTYPE_SAE:
1986 		val = 3;
1987 		brcmf_dbg(CONN, "SAE authentication\n");
1988 		break;
1989 	default:
1990 		val = 2;
1991 		brcmf_dbg(CONN, "automatic, auth type (%d)\n", sme->auth_type);
1992 		break;
1993 	}
1994 
1995 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
1996 	if (err) {
1997 		bphy_err(drvr, "set auth failed (%d)\n", err);
1998 		return err;
1999 	}
2000 	sec = &profile->sec;
2001 	sec->auth_type = sme->auth_type;
2002 	return err;
2003 }
2004 
2005 static s32
2006 brcmf_set_wsec_mode(struct net_device *ndev,
2007 		    struct cfg80211_connect_params *sme)
2008 {
2009 	struct brcmf_if *ifp = netdev_priv(ndev);
2010 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2011 	struct brcmf_pub *drvr = ifp->drvr;
2012 	struct brcmf_cfg80211_security *sec;
2013 	s32 pval = 0;
2014 	s32 gval = 0;
2015 	s32 wsec;
2016 	s32 err = 0;
2017 
2018 	if (sme->crypto.n_ciphers_pairwise) {
2019 		switch (sme->crypto.ciphers_pairwise[0]) {
2020 		case WLAN_CIPHER_SUITE_WEP40:
2021 		case WLAN_CIPHER_SUITE_WEP104:
2022 			pval = WEP_ENABLED;
2023 			break;
2024 		case WLAN_CIPHER_SUITE_TKIP:
2025 			pval = TKIP_ENABLED;
2026 			break;
2027 		case WLAN_CIPHER_SUITE_CCMP:
2028 			pval = AES_ENABLED;
2029 			break;
2030 		case WLAN_CIPHER_SUITE_AES_CMAC:
2031 			pval = AES_ENABLED;
2032 			break;
2033 		default:
2034 			bphy_err(drvr, "invalid cipher pairwise (%d)\n",
2035 				 sme->crypto.ciphers_pairwise[0]);
2036 			return -EINVAL;
2037 		}
2038 	}
2039 	if (sme->crypto.cipher_group) {
2040 		switch (sme->crypto.cipher_group) {
2041 		case WLAN_CIPHER_SUITE_WEP40:
2042 		case WLAN_CIPHER_SUITE_WEP104:
2043 			gval = WEP_ENABLED;
2044 			break;
2045 		case WLAN_CIPHER_SUITE_TKIP:
2046 			gval = TKIP_ENABLED;
2047 			break;
2048 		case WLAN_CIPHER_SUITE_CCMP:
2049 			gval = AES_ENABLED;
2050 			break;
2051 		case WLAN_CIPHER_SUITE_AES_CMAC:
2052 			gval = AES_ENABLED;
2053 			break;
2054 		default:
2055 			bphy_err(drvr, "invalid cipher group (%d)\n",
2056 				 sme->crypto.cipher_group);
2057 			return -EINVAL;
2058 		}
2059 	}
2060 
2061 	brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
2062 	/* In case of privacy, but no security and WPS then simulate */
2063 	/* setting AES. WPS-2.0 allows no security                   */
2064 	if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
2065 	    sme->privacy)
2066 		pval = AES_ENABLED;
2067 
2068 	wsec = pval | gval;
2069 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2070 	if (err) {
2071 		bphy_err(drvr, "error (%d)\n", err);
2072 		return err;
2073 	}
2074 
2075 	sec = &profile->sec;
2076 	sec->cipher_pairwise = sme->crypto.ciphers_pairwise[0];
2077 	sec->cipher_group = sme->crypto.cipher_group;
2078 
2079 	return err;
2080 }
2081 
2082 static s32
2083 brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
2084 {
2085 	struct brcmf_if *ifp = netdev_priv(ndev);
2086 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2087 	struct brcmf_pub *drvr = ifp->drvr;
2088 	s32 val;
2089 	s32 err;
2090 	const struct brcmf_tlv *rsn_ie;
2091 	const u8 *ie;
2092 	u32 ie_len;
2093 	u32 offset;
2094 	u16 rsn_cap;
2095 	u32 mfp;
2096 	u16 count;
2097 
2098 	profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
2099 	profile->is_ft = false;
2100 
2101 	if (!sme->crypto.n_akm_suites)
2102 		return 0;
2103 
2104 	err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev), "wpa_auth", &val);
2105 	if (err) {
2106 		bphy_err(drvr, "could not get wpa_auth (%d)\n", err);
2107 		return err;
2108 	}
2109 	if (val & (WPA_AUTH_PSK | WPA_AUTH_UNSPECIFIED)) {
2110 		switch (sme->crypto.akm_suites[0]) {
2111 		case WLAN_AKM_SUITE_8021X:
2112 			val = WPA_AUTH_UNSPECIFIED;
2113 			if (sme->want_1x)
2114 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2115 			break;
2116 		case WLAN_AKM_SUITE_PSK:
2117 			val = WPA_AUTH_PSK;
2118 			break;
2119 		default:
2120 			bphy_err(drvr, "invalid akm suite (%d)\n",
2121 				 sme->crypto.akm_suites[0]);
2122 			return -EINVAL;
2123 		}
2124 	} else if (val & (WPA2_AUTH_PSK | WPA2_AUTH_UNSPECIFIED)) {
2125 		switch (sme->crypto.akm_suites[0]) {
2126 		case WLAN_AKM_SUITE_8021X:
2127 			val = WPA2_AUTH_UNSPECIFIED;
2128 			if (sme->want_1x)
2129 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2130 			break;
2131 		case WLAN_AKM_SUITE_8021X_SHA256:
2132 			val = WPA2_AUTH_1X_SHA256;
2133 			if (sme->want_1x)
2134 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2135 			break;
2136 		case WLAN_AKM_SUITE_PSK_SHA256:
2137 			val = WPA2_AUTH_PSK_SHA256;
2138 			break;
2139 		case WLAN_AKM_SUITE_PSK:
2140 			val = WPA2_AUTH_PSK;
2141 			break;
2142 		case WLAN_AKM_SUITE_FT_8021X:
2143 			val = WPA2_AUTH_UNSPECIFIED | WPA2_AUTH_FT;
2144 			profile->is_ft = true;
2145 			if (sme->want_1x)
2146 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_1X;
2147 			break;
2148 		case WLAN_AKM_SUITE_FT_PSK:
2149 			val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
2150 			profile->is_ft = true;
2151 			break;
2152 		default:
2153 			bphy_err(drvr, "invalid akm suite (%d)\n",
2154 				 sme->crypto.akm_suites[0]);
2155 			return -EINVAL;
2156 		}
2157 	} else if (val & WPA3_AUTH_SAE_PSK) {
2158 		switch (sme->crypto.akm_suites[0]) {
2159 		case WLAN_AKM_SUITE_SAE:
2160 			val = WPA3_AUTH_SAE_PSK;
2161 			if (sme->crypto.sae_pwd) {
2162 				brcmf_dbg(INFO, "using SAE offload\n");
2163 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2164 			}
2165 			break;
2166 		case WLAN_AKM_SUITE_FT_OVER_SAE:
2167 			val = WPA3_AUTH_SAE_PSK | WPA2_AUTH_FT;
2168 			profile->is_ft = true;
2169 			if (sme->crypto.sae_pwd) {
2170 				brcmf_dbg(INFO, "using SAE offload\n");
2171 				profile->use_fwsup = BRCMF_PROFILE_FWSUP_SAE;
2172 			}
2173 			break;
2174 		default:
2175 			bphy_err(drvr, "invalid akm suite (%d)\n",
2176 				 sme->crypto.akm_suites[0]);
2177 			return -EINVAL;
2178 		}
2179 	}
2180 
2181 	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X)
2182 		brcmf_dbg(INFO, "using 1X offload\n");
2183 
2184 	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2185 		goto skip_mfp_config;
2186 	/* The MFP mode (1 or 2) needs to be determined, parse IEs. The
2187 	 * IE will not be verified, just a quick search for MFP config
2188 	 */
2189 	rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie, sme->ie_len,
2190 				  WLAN_EID_RSN);
2191 	if (!rsn_ie)
2192 		goto skip_mfp_config;
2193 	ie = (const u8 *)rsn_ie;
2194 	ie_len = rsn_ie->len + TLV_HDR_LEN;
2195 	/* Skip unicast suite */
2196 	offset = TLV_HDR_LEN + WPA_IE_VERSION_LEN + WPA_IE_MIN_OUI_LEN;
2197 	if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2198 		goto skip_mfp_config;
2199 	/* Skip multicast suite */
2200 	count = ie[offset] + (ie[offset + 1] << 8);
2201 	offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2202 	if (offset + WPA_IE_SUITE_COUNT_LEN >= ie_len)
2203 		goto skip_mfp_config;
2204 	/* Skip auth key management suite(s) */
2205 	count = ie[offset] + (ie[offset + 1] << 8);
2206 	offset += WPA_IE_SUITE_COUNT_LEN + (count * WPA_IE_MIN_OUI_LEN);
2207 	if (offset + WPA_IE_SUITE_COUNT_LEN > ie_len)
2208 		goto skip_mfp_config;
2209 	/* Ready to read capabilities */
2210 	mfp = BRCMF_MFP_NONE;
2211 	rsn_cap = ie[offset] + (ie[offset + 1] << 8);
2212 	if (rsn_cap & RSN_CAP_MFPR_MASK)
2213 		mfp = BRCMF_MFP_REQUIRED;
2214 	else if (rsn_cap & RSN_CAP_MFPC_MASK)
2215 		mfp = BRCMF_MFP_CAPABLE;
2216 	brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "mfp", mfp);
2217 
2218 skip_mfp_config:
2219 	brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
2220 	err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
2221 	if (err) {
2222 		bphy_err(drvr, "could not set wpa_auth (%d)\n", err);
2223 		return err;
2224 	}
2225 
2226 	return err;
2227 }
2228 
2229 static s32
2230 brcmf_set_sharedkey(struct net_device *ndev,
2231 		    struct cfg80211_connect_params *sme)
2232 {
2233 	struct brcmf_if *ifp = netdev_priv(ndev);
2234 	struct brcmf_pub *drvr = ifp->drvr;
2235 	struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
2236 	struct brcmf_cfg80211_security *sec;
2237 	struct brcmf_wsec_key key;
2238 	s32 val;
2239 	s32 err = 0;
2240 
2241 	brcmf_dbg(CONN, "key len (%d)\n", sme->key_len);
2242 
2243 	if (sme->key_len == 0)
2244 		return 0;
2245 
2246 	sec = &profile->sec;
2247 	brcmf_dbg(CONN, "wpa_versions 0x%x cipher_pairwise 0x%x\n",
2248 		  sec->wpa_versions, sec->cipher_pairwise);
2249 
2250 	if (sec->wpa_versions & (NL80211_WPA_VERSION_1 | NL80211_WPA_VERSION_2 |
2251 				 NL80211_WPA_VERSION_3))
2252 		return 0;
2253 
2254 	if (!(sec->cipher_pairwise &
2255 	    (WLAN_CIPHER_SUITE_WEP40 | WLAN_CIPHER_SUITE_WEP104)))
2256 		return 0;
2257 
2258 	memset(&key, 0, sizeof(key));
2259 	key.len = (u32) sme->key_len;
2260 	key.index = (u32) sme->key_idx;
2261 	if (key.len > sizeof(key.data)) {
2262 		bphy_err(drvr, "Too long key length (%u)\n", key.len);
2263 		return -EINVAL;
2264 	}
2265 	memcpy(key.data, sme->key, key.len);
2266 	key.flags = BRCMF_PRIMARY_KEY;
2267 	switch (sec->cipher_pairwise) {
2268 	case WLAN_CIPHER_SUITE_WEP40:
2269 		key.algo = CRYPTO_ALGO_WEP1;
2270 		break;
2271 	case WLAN_CIPHER_SUITE_WEP104:
2272 		key.algo = CRYPTO_ALGO_WEP128;
2273 		break;
2274 	default:
2275 		bphy_err(drvr, "Invalid algorithm (%d)\n",
2276 			 sme->crypto.ciphers_pairwise[0]);
2277 		return -EINVAL;
2278 	}
2279 	/* Set the new key/index */
2280 	brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
2281 		  key.len, key.index, key.algo);
2282 	brcmf_dbg(CONN, "key \"%s\"\n", key.data);
2283 	err = send_key_to_dongle(ifp, &key);
2284 	if (err)
2285 		return err;
2286 
2287 	if (sec->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {
2288 		brcmf_dbg(CONN, "set auth_type to shared key\n");
2289 		val = WL_AUTH_SHARED_KEY;	/* shared key */
2290 		err = brcmf_fil_bsscfg_int_set(ifp, "auth", val);
2291 		if (err)
2292 			bphy_err(drvr, "set auth failed (%d)\n", err);
2293 	}
2294 	return err;
2295 }
2296 
2297 static
2298 enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
2299 					   enum nl80211_auth_type type)
2300 {
2301 	if (type == NL80211_AUTHTYPE_AUTOMATIC &&
2302 	    brcmf_feat_is_quirk_enabled(ifp, BRCMF_FEAT_QUIRK_AUTO_AUTH)) {
2303 		brcmf_dbg(CONN, "WAR: use OPEN instead of AUTO\n");
2304 		type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2305 	}
2306 	return type;
2307 }
2308 
2309 static void brcmf_set_join_pref(struct brcmf_if *ifp,
2310 				struct cfg80211_bss_selection *bss_select)
2311 {
2312 	struct brcmf_pub *drvr = ifp->drvr;
2313 	struct brcmf_join_pref_params join_pref_params[2];
2314 	enum nl80211_band band;
2315 	int err, i = 0;
2316 
2317 	join_pref_params[i].len = 2;
2318 	join_pref_params[i].rssi_gain = 0;
2319 
2320 	if (bss_select->behaviour != NL80211_BSS_SELECT_ATTR_BAND_PREF)
2321 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_ASSOC_PREFER, WLC_BAND_AUTO);
2322 
2323 	switch (bss_select->behaviour) {
2324 	case __NL80211_BSS_SELECT_ATTR_INVALID:
2325 		brcmf_c_set_joinpref_default(ifp);
2326 		return;
2327 	case NL80211_BSS_SELECT_ATTR_BAND_PREF:
2328 		join_pref_params[i].type = BRCMF_JOIN_PREF_BAND;
2329 		band = bss_select->param.band_pref;
2330 		join_pref_params[i].band = nl80211_band_to_fwil(band);
2331 		i++;
2332 		break;
2333 	case NL80211_BSS_SELECT_ATTR_RSSI_ADJUST:
2334 		join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI_DELTA;
2335 		band = bss_select->param.adjust.band;
2336 		join_pref_params[i].band = nl80211_band_to_fwil(band);
2337 		join_pref_params[i].rssi_gain = bss_select->param.adjust.delta;
2338 		i++;
2339 		break;
2340 	case NL80211_BSS_SELECT_ATTR_RSSI:
2341 	default:
2342 		break;
2343 	}
2344 	join_pref_params[i].type = BRCMF_JOIN_PREF_RSSI;
2345 	join_pref_params[i].len = 2;
2346 	join_pref_params[i].rssi_gain = 0;
2347 	join_pref_params[i].band = 0;
2348 	err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
2349 				       sizeof(join_pref_params));
2350 	if (err)
2351 		bphy_err(drvr, "Set join_pref error (%d)\n", err);
2352 }
2353 
2354 static s32
2355 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
2356 		       struct cfg80211_connect_params *sme)
2357 {
2358 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2359 	struct brcmf_if *ifp = netdev_priv(ndev);
2360 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2361 	struct ieee80211_channel *chan = sme->channel;
2362 	struct brcmf_pub *drvr = ifp->drvr;
2363 	struct brcmf_join_params join_params;
2364 	size_t join_params_size;
2365 	const struct brcmf_tlv *rsn_ie;
2366 	const struct brcmf_vs_tlv *wpa_ie;
2367 	const void *ie;
2368 	u32 ie_len;
2369 	struct brcmf_ext_join_params_le *ext_join_params;
2370 	u16 chanspec;
2371 	s32 err = 0;
2372 	u32 ssid_len;
2373 
2374 	brcmf_dbg(TRACE, "Enter\n");
2375 	if (!check_vif_up(ifp->vif))
2376 		return -EIO;
2377 
2378 	if (!sme->ssid) {
2379 		bphy_err(drvr, "Invalid ssid\n");
2380 		return -EOPNOTSUPP;
2381 	}
2382 
2383 	if (sme->channel_hint)
2384 		chan = sme->channel_hint;
2385 
2386 	if (sme->bssid_hint)
2387 		sme->bssid = sme->bssid_hint;
2388 
2389 	if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
2390 		/* A normal (non P2P) connection request setup. */
2391 		ie = NULL;
2392 		ie_len = 0;
2393 		/* find the WPA_IE */
2394 		wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
2395 		if (wpa_ie) {
2396 			ie = wpa_ie;
2397 			ie_len = wpa_ie->len + TLV_HDR_LEN;
2398 		} else {
2399 			/* find the RSN_IE */
2400 			rsn_ie = brcmf_parse_tlvs((const u8 *)sme->ie,
2401 						  sme->ie_len,
2402 						  WLAN_EID_RSN);
2403 			if (rsn_ie) {
2404 				ie = rsn_ie;
2405 				ie_len = rsn_ie->len + TLV_HDR_LEN;
2406 			}
2407 		}
2408 		brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
2409 	}
2410 
2411 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
2412 				    sme->ie, sme->ie_len);
2413 	if (err)
2414 		bphy_err(drvr, "Set Assoc REQ IE Failed\n");
2415 	else
2416 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
2417 
2418 	set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2419 
2420 	if (chan) {
2421 		cfg->channel =
2422 			ieee80211_frequency_to_channel(chan->center_freq);
2423 		chanspec = channel_to_chanspec(&cfg->d11inf, chan);
2424 		brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
2425 			  cfg->channel, chan->center_freq, chanspec);
2426 	} else {
2427 		cfg->channel = 0;
2428 		chanspec = 0;
2429 	}
2430 
2431 	brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
2432 
2433 	err = brcmf_set_wpa_version(ndev, sme);
2434 	if (err) {
2435 		bphy_err(drvr, "wl_set_wpa_version failed (%d)\n", err);
2436 		goto done;
2437 	}
2438 
2439 	sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
2440 	err = brcmf_set_auth_type(ndev, sme);
2441 	if (err) {
2442 		bphy_err(drvr, "wl_set_auth_type failed (%d)\n", err);
2443 		goto done;
2444 	}
2445 
2446 	err = brcmf_set_wsec_mode(ndev, sme);
2447 	if (err) {
2448 		bphy_err(drvr, "wl_set_set_cipher failed (%d)\n", err);
2449 		goto done;
2450 	}
2451 
2452 	err = brcmf_set_key_mgmt(ndev, sme);
2453 	if (err) {
2454 		bphy_err(drvr, "wl_set_key_mgmt failed (%d)\n", err);
2455 		goto done;
2456 	}
2457 
2458 	err = brcmf_set_sharedkey(ndev, sme);
2459 	if (err) {
2460 		bphy_err(drvr, "brcmf_set_sharedkey failed (%d)\n", err);
2461 		goto done;
2462 	}
2463 
2464 	if (sme->crypto.psk &&
2465 	    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
2466 		if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
2467 			err = -EINVAL;
2468 			goto done;
2469 		}
2470 		brcmf_dbg(INFO, "using PSK offload\n");
2471 		profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
2472 	}
2473 
2474 	if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
2475 		/* enable firmware supplicant for this interface */
2476 		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
2477 		if (err < 0) {
2478 			bphy_err(drvr, "failed to enable fw supplicant\n");
2479 			goto done;
2480 		}
2481 	}
2482 
2483 	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
2484 		err = brcmf_set_pmk(ifp, sme->crypto.psk,
2485 				    BRCMF_WSEC_MAX_PSK_LEN);
2486 	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
2487 		/* clean up user-space RSNE */
2488 		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
2489 		if (err) {
2490 			bphy_err(drvr, "failed to clean up user-space RSNE\n");
2491 			goto done;
2492 		}
2493 		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
2494 		if (!err && sme->crypto.psk)
2495 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
2496 					    BRCMF_WSEC_MAX_PSK_LEN);
2497 	}
2498 	if (err)
2499 		goto done;
2500 
2501 	/* Join with specific BSSID and cached SSID
2502 	 * If SSID is zero join based on BSSID only
2503 	 */
2504 	join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
2505 		offsetof(struct brcmf_assoc_params_le, chanspec_list);
2506 	if (cfg->channel)
2507 		join_params_size += sizeof(u16);
2508 	ext_join_params = kzalloc(sizeof(*ext_join_params), GFP_KERNEL);
2509 	if (ext_join_params == NULL) {
2510 		err = -ENOMEM;
2511 		goto done;
2512 	}
2513 	ssid_len = min_t(u32, sme->ssid_len, IEEE80211_MAX_SSID_LEN);
2514 	ext_join_params->ssid_le.SSID_len = cpu_to_le32(ssid_len);
2515 	memcpy(&ext_join_params->ssid_le.SSID, sme->ssid, ssid_len);
2516 	if (ssid_len < IEEE80211_MAX_SSID_LEN)
2517 		brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n",
2518 			  ext_join_params->ssid_le.SSID, ssid_len);
2519 
2520 	/* Set up join scan parameters */
2521 	ext_join_params->scan_le.scan_type = -1;
2522 	ext_join_params->scan_le.home_time = cpu_to_le32(-1);
2523 
2524 	if (sme->bssid)
2525 		memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
2526 	else
2527 		eth_broadcast_addr(ext_join_params->assoc_le.bssid);
2528 
2529 	if (cfg->channel) {
2530 		ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
2531 
2532 		ext_join_params->assoc_le.chanspec_list[0] =
2533 			cpu_to_le16(chanspec);
2534 		/* Increase dwell time to receive probe response or detect
2535 		 * beacon from target AP at a noisy air only during connect
2536 		 * command.
2537 		 */
2538 		ext_join_params->scan_le.active_time =
2539 			cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
2540 		ext_join_params->scan_le.passive_time =
2541 			cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
2542 		/* To sync with presence period of VSDB GO send probe request
2543 		 * more frequently. Probe request will be stopped when it gets
2544 		 * probe response from target AP/GO.
2545 		 */
2546 		ext_join_params->scan_le.nprobes =
2547 			cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
2548 				    BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
2549 	} else {
2550 		ext_join_params->scan_le.active_time = cpu_to_le32(-1);
2551 		ext_join_params->scan_le.passive_time = cpu_to_le32(-1);
2552 		ext_join_params->scan_le.nprobes = cpu_to_le32(-1);
2553 	}
2554 
2555 	brcmf_set_join_pref(ifp, &sme->bss_select);
2556 
2557 	err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
2558 					 join_params_size);
2559 	kfree(ext_join_params);
2560 	if (!err)
2561 		/* This is it. join command worked, we are done */
2562 		goto done;
2563 
2564 	/* join command failed, fallback to set ssid */
2565 	memset(&join_params, 0, sizeof(join_params));
2566 	join_params_size = sizeof(join_params.ssid_le);
2567 
2568 	memcpy(&join_params.ssid_le.SSID, sme->ssid, ssid_len);
2569 	join_params.ssid_le.SSID_len = cpu_to_le32(ssid_len);
2570 
2571 	if (sme->bssid)
2572 		memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
2573 	else
2574 		eth_broadcast_addr(join_params.params_le.bssid);
2575 
2576 	if (cfg->channel) {
2577 		join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
2578 		join_params.params_le.chanspec_num = cpu_to_le32(1);
2579 		join_params_size += sizeof(join_params.params_le);
2580 	}
2581 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
2582 				     &join_params, join_params_size);
2583 	if (err)
2584 		bphy_err(drvr, "BRCMF_C_SET_SSID failed (%d)\n", err);
2585 
2586 done:
2587 	if (err)
2588 		clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2589 	brcmf_dbg(TRACE, "Exit\n");
2590 	return err;
2591 }
2592 
2593 static s32
2594 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
2595 		       u16 reason_code)
2596 {
2597 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2598 	struct brcmf_if *ifp = netdev_priv(ndev);
2599 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2600 	struct brcmf_pub *drvr = cfg->pub;
2601 	struct brcmf_scb_val_le scbval;
2602 	s32 err = 0;
2603 
2604 	brcmf_dbg(TRACE, "Enter. Reason code = %d\n", reason_code);
2605 	if (!check_vif_up(ifp->vif))
2606 		return -EIO;
2607 
2608 	clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
2609 	clear_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
2610 	clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &ifp->vif->sme_state);
2611 	clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &ifp->vif->sme_state);
2612 	cfg80211_disconnected(ndev, reason_code, NULL, 0, true, GFP_KERNEL);
2613 
2614 	memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
2615 	scbval.val = cpu_to_le32(reason_code);
2616 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_DISASSOC,
2617 				     &scbval, sizeof(scbval));
2618 	if (err)
2619 		bphy_err(drvr, "error (%d)\n", err);
2620 
2621 	brcmf_dbg(TRACE, "Exit\n");
2622 	return err;
2623 }
2624 
2625 static s32
2626 brcmf_cfg80211_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2627 			    enum nl80211_tx_power_setting type, s32 mbm)
2628 {
2629 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2630 	struct net_device *ndev = cfg_to_ndev(cfg);
2631 	struct brcmf_if *ifp = netdev_priv(ndev);
2632 	struct brcmf_pub *drvr = cfg->pub;
2633 	s32 err;
2634 	s32 disable;
2635 	u32 qdbm = 127;
2636 
2637 	brcmf_dbg(TRACE, "Enter %d %d\n", type, mbm);
2638 	if (!check_vif_up(ifp->vif))
2639 		return -EIO;
2640 
2641 	switch (type) {
2642 	case NL80211_TX_POWER_AUTOMATIC:
2643 		break;
2644 	case NL80211_TX_POWER_LIMITED:
2645 	case NL80211_TX_POWER_FIXED:
2646 		if (mbm < 0) {
2647 			bphy_err(drvr, "TX_POWER_FIXED - dbm is negative\n");
2648 			err = -EINVAL;
2649 			goto done;
2650 		}
2651 		qdbm =  MBM_TO_DBM(4 * mbm);
2652 		if (qdbm > 127)
2653 			qdbm = 127;
2654 		qdbm |= WL_TXPWR_OVERRIDE;
2655 		break;
2656 	default:
2657 		bphy_err(drvr, "Unsupported type %d\n", type);
2658 		err = -EINVAL;
2659 		goto done;
2660 	}
2661 	/* Make sure radio is off or on as far as software is concerned */
2662 	disable = WL_RADIO_SW_DISABLE << 16;
2663 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_RADIO, disable);
2664 	if (err)
2665 		bphy_err(drvr, "WLC_SET_RADIO error (%d)\n", err);
2666 
2667 	err = brcmf_fil_iovar_int_set(ifp, "qtxpower", qdbm);
2668 	if (err)
2669 		bphy_err(drvr, "qtxpower error (%d)\n", err);
2670 
2671 done:
2672 	brcmf_dbg(TRACE, "Exit %d (qdbm)\n", qdbm & ~WL_TXPWR_OVERRIDE);
2673 	return err;
2674 }
2675 
2676 static s32
2677 brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
2678 			    s32 *dbm)
2679 {
2680 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2681 	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
2682 	struct brcmf_pub *drvr = cfg->pub;
2683 	s32 qdbm = 0;
2684 	s32 err;
2685 
2686 	brcmf_dbg(TRACE, "Enter\n");
2687 	if (!check_vif_up(vif))
2688 		return -EIO;
2689 
2690 	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
2691 	if (err) {
2692 		bphy_err(drvr, "error (%d)\n", err);
2693 		goto done;
2694 	}
2695 	*dbm = (qdbm & ~WL_TXPWR_OVERRIDE) / 4;
2696 
2697 done:
2698 	brcmf_dbg(TRACE, "Exit (0x%x %d)\n", qdbm, *dbm);
2699 	return err;
2700 }
2701 
2702 static s32
2703 brcmf_cfg80211_config_default_key(struct wiphy *wiphy, struct net_device *ndev,
2704 				  int link_id, u8 key_idx, bool unicast,
2705 				  bool multicast)
2706 {
2707 	struct brcmf_if *ifp = netdev_priv(ndev);
2708 	struct brcmf_pub *drvr = ifp->drvr;
2709 	u32 index;
2710 	u32 wsec;
2711 	s32 err = 0;
2712 
2713 	brcmf_dbg(TRACE, "Enter\n");
2714 	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2715 	if (!check_vif_up(ifp->vif))
2716 		return -EIO;
2717 
2718 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2719 	if (err) {
2720 		bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2721 		goto done;
2722 	}
2723 
2724 	if (wsec & WEP_ENABLED) {
2725 		/* Just select a new current key */
2726 		index = key_idx;
2727 		err = brcmf_fil_cmd_int_set(ifp,
2728 					    BRCMF_C_SET_KEY_PRIMARY, index);
2729 		if (err)
2730 			bphy_err(drvr, "error (%d)\n", err);
2731 	}
2732 done:
2733 	brcmf_dbg(TRACE, "Exit\n");
2734 	return err;
2735 }
2736 
2737 static s32
2738 brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
2739 		       int link_id, u8 key_idx, bool pairwise,
2740 		       const u8 *mac_addr)
2741 {
2742 	struct brcmf_if *ifp = netdev_priv(ndev);
2743 	struct brcmf_wsec_key *key;
2744 	s32 err;
2745 
2746 	brcmf_dbg(TRACE, "Enter\n");
2747 	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2748 
2749 	if (!check_vif_up(ifp->vif))
2750 		return -EIO;
2751 
2752 	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2753 		/* we ignore this key index in this case */
2754 		return -EINVAL;
2755 	}
2756 
2757 	key = &ifp->vif->profile.key[key_idx];
2758 
2759 	if (key->algo == CRYPTO_ALGO_OFF) {
2760 		brcmf_dbg(CONN, "Ignore clearing of (never configured) key\n");
2761 		return -EINVAL;
2762 	}
2763 
2764 	memset(key, 0, sizeof(*key));
2765 	key->index = (u32)key_idx;
2766 	key->flags = BRCMF_PRIMARY_KEY;
2767 
2768 	/* Clear the key/index */
2769 	err = send_key_to_dongle(ifp, key);
2770 
2771 	brcmf_dbg(TRACE, "Exit\n");
2772 	return err;
2773 }
2774 
2775 static s32
2776 brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
2777 		       int link_id, u8 key_idx, bool pairwise,
2778 		       const u8 *mac_addr, struct key_params *params)
2779 {
2780 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2781 	struct brcmf_if *ifp = netdev_priv(ndev);
2782 	struct brcmf_pub *drvr = cfg->pub;
2783 	struct brcmf_wsec_key *key;
2784 	s32 val;
2785 	s32 wsec;
2786 	s32 err;
2787 	u8 keybuf[8];
2788 	bool ext_key;
2789 
2790 	brcmf_dbg(TRACE, "Enter\n");
2791 	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2792 	if (!check_vif_up(ifp->vif))
2793 		return -EIO;
2794 
2795 	if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
2796 		/* we ignore this key index in this case */
2797 		bphy_err(drvr, "invalid key index (%d)\n", key_idx);
2798 		return -EINVAL;
2799 	}
2800 
2801 	if (params->key_len == 0)
2802 		return brcmf_cfg80211_del_key(wiphy, ndev, -1, key_idx,
2803 					      pairwise, mac_addr);
2804 
2805 	if (params->key_len > sizeof(key->data)) {
2806 		bphy_err(drvr, "Too long key length (%u)\n", params->key_len);
2807 		return -EINVAL;
2808 	}
2809 
2810 	ext_key = false;
2811 	if (mac_addr && (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
2812 	    (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
2813 		brcmf_dbg(TRACE, "Ext key, mac %pM", mac_addr);
2814 		ext_key = true;
2815 	}
2816 
2817 	key = &ifp->vif->profile.key[key_idx];
2818 	memset(key, 0, sizeof(*key));
2819 	if ((ext_key) && (!is_multicast_ether_addr(mac_addr)))
2820 		memcpy((char *)&key->ea, (void *)mac_addr, ETH_ALEN);
2821 	key->len = params->key_len;
2822 	key->index = key_idx;
2823 	memcpy(key->data, params->key, key->len);
2824 	if (!ext_key)
2825 		key->flags = BRCMF_PRIMARY_KEY;
2826 
2827 	if (params->seq && params->seq_len == 6) {
2828 		/* rx iv */
2829 		u8 *ivptr;
2830 
2831 		ivptr = (u8 *)params->seq;
2832 		key->rxiv.hi = (ivptr[5] << 24) | (ivptr[4] << 16) |
2833 			(ivptr[3] << 8) | ivptr[2];
2834 		key->rxiv.lo = (ivptr[1] << 8) | ivptr[0];
2835 		key->iv_initialized = true;
2836 	}
2837 
2838 	switch (params->cipher) {
2839 	case WLAN_CIPHER_SUITE_WEP40:
2840 		key->algo = CRYPTO_ALGO_WEP1;
2841 		val = WEP_ENABLED;
2842 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2843 		break;
2844 	case WLAN_CIPHER_SUITE_WEP104:
2845 		key->algo = CRYPTO_ALGO_WEP128;
2846 		val = WEP_ENABLED;
2847 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2848 		break;
2849 	case WLAN_CIPHER_SUITE_TKIP:
2850 		if (!brcmf_is_apmode(ifp->vif)) {
2851 			brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
2852 			memcpy(keybuf, &key->data[24], sizeof(keybuf));
2853 			memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
2854 			memcpy(&key->data[16], keybuf, sizeof(keybuf));
2855 		}
2856 		key->algo = CRYPTO_ALGO_TKIP;
2857 		val = TKIP_ENABLED;
2858 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2859 		break;
2860 	case WLAN_CIPHER_SUITE_AES_CMAC:
2861 		key->algo = CRYPTO_ALGO_AES_CCM;
2862 		val = AES_ENABLED;
2863 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2864 		break;
2865 	case WLAN_CIPHER_SUITE_CCMP:
2866 		key->algo = CRYPTO_ALGO_AES_CCM;
2867 		val = AES_ENABLED;
2868 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
2869 		break;
2870 	default:
2871 		bphy_err(drvr, "Invalid cipher (0x%x)\n", params->cipher);
2872 		err = -EINVAL;
2873 		goto done;
2874 	}
2875 
2876 	err = send_key_to_dongle(ifp, key);
2877 	if (ext_key || err)
2878 		goto done;
2879 
2880 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2881 	if (err) {
2882 		bphy_err(drvr, "get wsec error (%d)\n", err);
2883 		goto done;
2884 	}
2885 	wsec |= val;
2886 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
2887 	if (err) {
2888 		bphy_err(drvr, "set wsec error (%d)\n", err);
2889 		goto done;
2890 	}
2891 
2892 done:
2893 	brcmf_dbg(TRACE, "Exit\n");
2894 	return err;
2895 }
2896 
2897 static s32
2898 brcmf_cfg80211_get_key(struct wiphy *wiphy, struct net_device *ndev,
2899 		       int link_id, u8 key_idx, bool pairwise,
2900 		       const u8 *mac_addr, void *cookie,
2901 		       void (*callback)(void *cookie,
2902 					struct key_params *params))
2903 {
2904 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
2905 	struct key_params params;
2906 	struct brcmf_if *ifp = netdev_priv(ndev);
2907 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
2908 	struct brcmf_pub *drvr = cfg->pub;
2909 	struct brcmf_cfg80211_security *sec;
2910 	s32 wsec;
2911 	s32 err = 0;
2912 
2913 	brcmf_dbg(TRACE, "Enter\n");
2914 	brcmf_dbg(CONN, "key index (%d)\n", key_idx);
2915 	if (!check_vif_up(ifp->vif))
2916 		return -EIO;
2917 
2918 	memset(&params, 0, sizeof(params));
2919 
2920 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2921 	if (err) {
2922 		bphy_err(drvr, "WLC_GET_WSEC error (%d)\n", err);
2923 		/* Ignore this error, may happen during DISASSOC */
2924 		err = -EAGAIN;
2925 		goto done;
2926 	}
2927 	if (wsec & WEP_ENABLED) {
2928 		sec = &profile->sec;
2929 		if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP40) {
2930 			params.cipher = WLAN_CIPHER_SUITE_WEP40;
2931 			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
2932 		} else if (sec->cipher_pairwise & WLAN_CIPHER_SUITE_WEP104) {
2933 			params.cipher = WLAN_CIPHER_SUITE_WEP104;
2934 			brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
2935 		}
2936 	} else if (wsec & TKIP_ENABLED) {
2937 		params.cipher = WLAN_CIPHER_SUITE_TKIP;
2938 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
2939 	} else if (wsec & AES_ENABLED) {
2940 		params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
2941 		brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
2942 	} else  {
2943 		bphy_err(drvr, "Invalid algo (0x%x)\n", wsec);
2944 		err = -EINVAL;
2945 		goto done;
2946 	}
2947 	callback(cookie, &params);
2948 
2949 done:
2950 	brcmf_dbg(TRACE, "Exit\n");
2951 	return err;
2952 }
2953 
2954 static s32
2955 brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
2956 				       struct net_device *ndev, int link_id,
2957 				       u8 key_idx)
2958 {
2959 	struct brcmf_if *ifp = netdev_priv(ndev);
2960 
2961 	brcmf_dbg(TRACE, "Enter key_idx %d\n", key_idx);
2962 
2963 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
2964 		return 0;
2965 
2966 	brcmf_dbg(INFO, "Not supported\n");
2967 
2968 	return -EOPNOTSUPP;
2969 }
2970 
2971 static void
2972 brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
2973 {
2974 	struct brcmf_pub *drvr = ifp->drvr;
2975 	s32 err;
2976 	u8 key_idx;
2977 	struct brcmf_wsec_key *key;
2978 	s32 wsec;
2979 
2980 	for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
2981 		key = &ifp->vif->profile.key[key_idx];
2982 		if ((key->algo == CRYPTO_ALGO_WEP1) ||
2983 		    (key->algo == CRYPTO_ALGO_WEP128))
2984 			break;
2985 	}
2986 	if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
2987 		return;
2988 
2989 	err = send_key_to_dongle(ifp, key);
2990 	if (err) {
2991 		bphy_err(drvr, "Setting WEP key failed (%d)\n", err);
2992 		return;
2993 	}
2994 	err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
2995 	if (err) {
2996 		bphy_err(drvr, "get wsec error (%d)\n", err);
2997 		return;
2998 	}
2999 	wsec |= WEP_ENABLED;
3000 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
3001 	if (err)
3002 		bphy_err(drvr, "set wsec error (%d)\n", err);
3003 }
3004 
3005 static void brcmf_convert_sta_flags(u32 fw_sta_flags, struct station_info *si)
3006 {
3007 	struct nl80211_sta_flag_update *sfu;
3008 
3009 	brcmf_dbg(TRACE, "flags %08x\n", fw_sta_flags);
3010 	si->filled |= BIT_ULL(NL80211_STA_INFO_STA_FLAGS);
3011 	sfu = &si->sta_flags;
3012 	sfu->mask = BIT(NL80211_STA_FLAG_WME) |
3013 		    BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3014 		    BIT(NL80211_STA_FLAG_ASSOCIATED) |
3015 		    BIT(NL80211_STA_FLAG_AUTHORIZED);
3016 	if (fw_sta_flags & BRCMF_STA_WME)
3017 		sfu->set |= BIT(NL80211_STA_FLAG_WME);
3018 	if (fw_sta_flags & BRCMF_STA_AUTHE)
3019 		sfu->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3020 	if (fw_sta_flags & BRCMF_STA_ASSOC)
3021 		sfu->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3022 	if (fw_sta_flags & BRCMF_STA_AUTHO)
3023 		sfu->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3024 }
3025 
3026 static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
3027 {
3028 	struct brcmf_pub *drvr = ifp->drvr;
3029 	struct {
3030 		__le32 len;
3031 		struct brcmf_bss_info_le bss_le;
3032 	} *buf;
3033 	u16 capability;
3034 	int err;
3035 
3036 	buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3037 	if (!buf)
3038 		return;
3039 
3040 	buf->len = cpu_to_le32(WL_BSS_INFO_MAX);
3041 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO, buf,
3042 				     WL_BSS_INFO_MAX);
3043 	if (err) {
3044 		bphy_err(drvr, "Failed to get bss info (%d)\n", err);
3045 		goto out_kfree;
3046 	}
3047 	si->filled |= BIT_ULL(NL80211_STA_INFO_BSS_PARAM);
3048 	si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
3049 	si->bss_param.dtim_period = buf->bss_le.dtim_period;
3050 	capability = le16_to_cpu(buf->bss_le.capability);
3051 	if (capability & IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT)
3052 		si->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
3053 	if (capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3054 		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
3055 	if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
3056 		si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
3057 
3058 out_kfree:
3059 	kfree(buf);
3060 }
3061 
3062 static s32
3063 brcmf_cfg80211_get_station_ibss(struct brcmf_if *ifp,
3064 				struct station_info *sinfo)
3065 {
3066 	struct brcmf_pub *drvr = ifp->drvr;
3067 	struct brcmf_scb_val_le scbval;
3068 	struct brcmf_pktcnt_le pktcnt;
3069 	s32 err;
3070 	u32 rate;
3071 	u32 rssi;
3072 
3073 	/* Get the current tx rate */
3074 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
3075 	if (err < 0) {
3076 		bphy_err(drvr, "BRCMF_C_GET_RATE error (%d)\n", err);
3077 		return err;
3078 	}
3079 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3080 	sinfo->txrate.legacy = rate * 5;
3081 
3082 	memset(&scbval, 0, sizeof(scbval));
3083 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI, &scbval,
3084 				     sizeof(scbval));
3085 	if (err) {
3086 		bphy_err(drvr, "BRCMF_C_GET_RSSI error (%d)\n", err);
3087 		return err;
3088 	}
3089 	rssi = le32_to_cpu(scbval.val);
3090 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3091 	sinfo->signal = rssi;
3092 
3093 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_GET_PKTCNTS, &pktcnt,
3094 				     sizeof(pktcnt));
3095 	if (err) {
3096 		bphy_err(drvr, "BRCMF_C_GET_GET_PKTCNTS error (%d)\n", err);
3097 		return err;
3098 	}
3099 	sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS) |
3100 			 BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC) |
3101 			 BIT_ULL(NL80211_STA_INFO_TX_PACKETS) |
3102 			 BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3103 	sinfo->rx_packets = le32_to_cpu(pktcnt.rx_good_pkt);
3104 	sinfo->rx_dropped_misc = le32_to_cpu(pktcnt.rx_bad_pkt);
3105 	sinfo->tx_packets = le32_to_cpu(pktcnt.tx_good_pkt);
3106 	sinfo->tx_failed  = le32_to_cpu(pktcnt.tx_bad_pkt);
3107 
3108 	return 0;
3109 }
3110 
3111 static s32
3112 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
3113 			   const u8 *mac, struct station_info *sinfo)
3114 {
3115 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3116 	struct brcmf_if *ifp = netdev_priv(ndev);
3117 	struct brcmf_pub *drvr = cfg->pub;
3118 	struct brcmf_scb_val_le scb_val;
3119 	s32 err = 0;
3120 	struct brcmf_sta_info_le sta_info_le;
3121 	u32 sta_flags;
3122 	u32 is_tdls_peer;
3123 	s32 total_rssi_avg = 0;
3124 	s32 total_rssi = 0;
3125 	s32 count_rssi = 0;
3126 	int rssi;
3127 	u32 i;
3128 
3129 	brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
3130 	if (!check_vif_up(ifp->vif))
3131 		return -EIO;
3132 
3133 	if (brcmf_is_ibssmode(ifp->vif))
3134 		return brcmf_cfg80211_get_station_ibss(ifp, sinfo);
3135 
3136 	memset(&sta_info_le, 0, sizeof(sta_info_le));
3137 	memcpy(&sta_info_le, mac, ETH_ALEN);
3138 	err = brcmf_fil_iovar_data_get(ifp, "tdls_sta_info",
3139 				       &sta_info_le,
3140 				       sizeof(sta_info_le));
3141 	is_tdls_peer = !err;
3142 	if (err) {
3143 		err = brcmf_fil_iovar_data_get(ifp, "sta_info",
3144 					       &sta_info_le,
3145 					       sizeof(sta_info_le));
3146 		if (err < 0) {
3147 			bphy_err(drvr, "GET STA INFO failed, %d\n", err);
3148 			goto done;
3149 		}
3150 	}
3151 	brcmf_dbg(TRACE, "version %d\n", le16_to_cpu(sta_info_le.ver));
3152 	sinfo->filled = BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME);
3153 	sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
3154 	sta_flags = le32_to_cpu(sta_info_le.flags);
3155 	brcmf_convert_sta_flags(sta_flags, sinfo);
3156 	sinfo->sta_flags.mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3157 	if (is_tdls_peer)
3158 		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3159 	else
3160 		sinfo->sta_flags.set &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3161 	if (sta_flags & BRCMF_STA_ASSOC) {
3162 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CONNECTED_TIME);
3163 		sinfo->connected_time = le32_to_cpu(sta_info_le.in);
3164 		brcmf_fill_bss_param(ifp, sinfo);
3165 	}
3166 	if (sta_flags & BRCMF_STA_SCBSTATS) {
3167 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
3168 		sinfo->tx_failed = le32_to_cpu(sta_info_le.tx_failures);
3169 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
3170 		sinfo->tx_packets = le32_to_cpu(sta_info_le.tx_pkts);
3171 		sinfo->tx_packets += le32_to_cpu(sta_info_le.tx_mcast_pkts);
3172 		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
3173 		sinfo->rx_packets = le32_to_cpu(sta_info_le.rx_ucast_pkts);
3174 		sinfo->rx_packets += le32_to_cpu(sta_info_le.rx_mcast_pkts);
3175 		if (sinfo->tx_packets) {
3176 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
3177 			sinfo->txrate.legacy =
3178 				le32_to_cpu(sta_info_le.tx_rate) / 100;
3179 		}
3180 		if (sinfo->rx_packets) {
3181 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
3182 			sinfo->rxrate.legacy =
3183 				le32_to_cpu(sta_info_le.rx_rate) / 100;
3184 		}
3185 		if (le16_to_cpu(sta_info_le.ver) >= 4) {
3186 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
3187 			sinfo->tx_bytes = le64_to_cpu(sta_info_le.tx_tot_bytes);
3188 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
3189 			sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes);
3190 		}
3191 		for (i = 0; i < BRCMF_ANT_MAX; i++) {
3192 			if (sta_info_le.rssi[i] == 0 ||
3193 			    sta_info_le.rx_lastpkt_rssi[i] == 0)
3194 				continue;
3195 			sinfo->chains |= BIT(count_rssi);
3196 			sinfo->chain_signal[count_rssi] =
3197 				sta_info_le.rx_lastpkt_rssi[i];
3198 			sinfo->chain_signal_avg[count_rssi] =
3199 				sta_info_le.rssi[i];
3200 			total_rssi += sta_info_le.rx_lastpkt_rssi[i];
3201 			total_rssi_avg += sta_info_le.rssi[i];
3202 			count_rssi++;
3203 		}
3204 		if (count_rssi) {
3205 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3206 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
3207 			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
3208 			sinfo->filled |=
3209 				BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
3210 			sinfo->signal = total_rssi / count_rssi;
3211 			sinfo->signal_avg = total_rssi_avg / count_rssi;
3212 		} else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
3213 			&ifp->vif->sme_state)) {
3214 			memset(&scb_val, 0, sizeof(scb_val));
3215 			err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
3216 						     &scb_val, sizeof(scb_val));
3217 			if (err) {
3218 				bphy_err(drvr, "Could not get rssi (%d)\n",
3219 					 err);
3220 				goto done;
3221 			} else {
3222 				rssi = le32_to_cpu(scb_val.val);
3223 				sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
3224 				sinfo->signal = rssi;
3225 				brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
3226 			}
3227 		}
3228 	}
3229 done:
3230 	brcmf_dbg(TRACE, "Exit\n");
3231 	return err;
3232 }
3233 
3234 static int
3235 brcmf_cfg80211_dump_station(struct wiphy *wiphy, struct net_device *ndev,
3236 			    int idx, u8 *mac, struct station_info *sinfo)
3237 {
3238 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3239 	struct brcmf_if *ifp = netdev_priv(ndev);
3240 	struct brcmf_pub *drvr = cfg->pub;
3241 	s32 err;
3242 
3243 	brcmf_dbg(TRACE, "Enter, idx %d\n", idx);
3244 
3245 	if (idx == 0) {
3246 		cfg->assoclist.count = cpu_to_le32(BRCMF_MAX_ASSOCLIST);
3247 		err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_ASSOCLIST,
3248 					     &cfg->assoclist,
3249 					     sizeof(cfg->assoclist));
3250 		if (err) {
3251 			/* GET_ASSOCLIST unsupported by firmware of older chips */
3252 			if (err == -EBADE)
3253 				bphy_info_once(drvr, "BRCMF_C_GET_ASSOCLIST unsupported\n");
3254 			else
3255 				bphy_err(drvr, "BRCMF_C_GET_ASSOCLIST failed, err=%d\n",
3256 					 err);
3257 
3258 			cfg->assoclist.count = 0;
3259 			return -EOPNOTSUPP;
3260 		}
3261 	}
3262 	if (idx < le32_to_cpu(cfg->assoclist.count)) {
3263 		memcpy(mac, cfg->assoclist.mac[idx], ETH_ALEN);
3264 		return brcmf_cfg80211_get_station(wiphy, ndev, mac, sinfo);
3265 	}
3266 	return -ENOENT;
3267 }
3268 
3269 static s32
3270 brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev,
3271 			   bool enabled, s32 timeout)
3272 {
3273 	s32 pm;
3274 	s32 err = 0;
3275 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3276 	struct brcmf_if *ifp = netdev_priv(ndev);
3277 	struct brcmf_pub *drvr = cfg->pub;
3278 
3279 	brcmf_dbg(TRACE, "Enter\n");
3280 
3281 	/*
3282 	 * Powersave enable/disable request is coming from the
3283 	 * cfg80211 even before the interface is up. In that
3284 	 * scenario, driver will be storing the power save
3285 	 * preference in cfg struct to apply this to
3286 	 * FW later while initializing the dongle
3287 	 */
3288 	cfg->pwr_save = enabled;
3289 	if (!check_vif_up(ifp->vif)) {
3290 
3291 		brcmf_dbg(INFO, "Device is not ready, storing the value in cfg_info struct\n");
3292 		goto done;
3293 	}
3294 
3295 	pm = enabled ? PM_FAST : PM_OFF;
3296 	/* Do not enable the power save after assoc if it is a p2p interface */
3297 	if (ifp->vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) {
3298 		brcmf_dbg(INFO, "Do not enable power save for P2P clients\n");
3299 		pm = PM_OFF;
3300 	}
3301 	brcmf_dbg(INFO, "power save %s\n", (pm ? "enabled" : "disabled"));
3302 
3303 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, pm);
3304 	if (err) {
3305 		if (err == -ENODEV)
3306 			bphy_err(drvr, "net_device is not ready yet\n");
3307 		else
3308 			bphy_err(drvr, "error (%d)\n", err);
3309 	}
3310 
3311 	err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
3312 				min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
3313 	if (err)
3314 		bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err);
3315 
3316 done:
3317 	brcmf_dbg(TRACE, "Exit\n");
3318 	return err;
3319 }
3320 
3321 static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
3322 				   struct brcmf_bss_info_le *bi)
3323 {
3324 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
3325 	struct brcmf_pub *drvr = cfg->pub;
3326 	struct cfg80211_bss *bss;
3327 	enum nl80211_band band;
3328 	struct brcmu_chan ch;
3329 	u16 channel;
3330 	u32 freq;
3331 	u16 notify_capability;
3332 	u16 notify_interval;
3333 	u8 *notify_ie;
3334 	size_t notify_ielen;
3335 	struct cfg80211_inform_bss bss_data = {};
3336 
3337 	if (le32_to_cpu(bi->length) > WL_BSS_INFO_MAX) {
3338 		bphy_err(drvr, "Bss info is larger than buffer. Discarding\n");
3339 		return -EINVAL;
3340 	}
3341 
3342 	if (!bi->ctl_ch) {
3343 		ch.chspec = le16_to_cpu(bi->chanspec);
3344 		cfg->d11inf.decchspec(&ch);
3345 		bi->ctl_ch = ch.control_ch_num;
3346 	}
3347 	channel = bi->ctl_ch;
3348 
3349 	if (channel <= CH_MAX_2G_CHANNEL)
3350 		band = NL80211_BAND_2GHZ;
3351 	else
3352 		band = NL80211_BAND_5GHZ;
3353 
3354 	freq = ieee80211_channel_to_frequency(channel, band);
3355 	bss_data.chan = ieee80211_get_channel(wiphy, freq);
3356 	bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20;
3357 	bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime());
3358 
3359 	notify_capability = le16_to_cpu(bi->capability);
3360 	notify_interval = le16_to_cpu(bi->beacon_period);
3361 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3362 	notify_ielen = le32_to_cpu(bi->ie_length);
3363 	bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3364 
3365 	brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID);
3366 	brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq);
3367 	brcmf_dbg(CONN, "Capability: %X\n", notify_capability);
3368 	brcmf_dbg(CONN, "Beacon interval: %d\n", notify_interval);
3369 	brcmf_dbg(CONN, "Signal: %d\n", bss_data.signal);
3370 
3371 	bss = cfg80211_inform_bss_data(wiphy, &bss_data,
3372 				       CFG80211_BSS_FTYPE_UNKNOWN,
3373 				       (const u8 *)bi->BSSID,
3374 				       0, notify_capability,
3375 				       notify_interval, notify_ie,
3376 				       notify_ielen, GFP_KERNEL);
3377 
3378 	if (!bss)
3379 		return -ENOMEM;
3380 
3381 	cfg80211_put_bss(wiphy, bss);
3382 
3383 	return 0;
3384 }
3385 
3386 static struct brcmf_bss_info_le *
3387 next_bss_le(struct brcmf_scan_results *list, struct brcmf_bss_info_le *bss)
3388 {
3389 	if (bss == NULL)
3390 		return list->bss_info_le;
3391 	return (struct brcmf_bss_info_le *)((unsigned long)bss +
3392 					    le32_to_cpu(bss->length));
3393 }
3394 
3395 static s32 brcmf_inform_bss(struct brcmf_cfg80211_info *cfg)
3396 {
3397 	struct brcmf_pub *drvr = cfg->pub;
3398 	struct brcmf_scan_results *bss_list;
3399 	struct brcmf_bss_info_le *bi = NULL;	/* must be initialized */
3400 	s32 err = 0;
3401 	int i;
3402 
3403 	bss_list = (struct brcmf_scan_results *)cfg->escan_info.escan_buf;
3404 	if (bss_list->count != 0 &&
3405 	    bss_list->version != BRCMF_BSS_INFO_VERSION) {
3406 		bphy_err(drvr, "Version %d != WL_BSS_INFO_VERSION\n",
3407 			 bss_list->version);
3408 		return -EOPNOTSUPP;
3409 	}
3410 	brcmf_dbg(SCAN, "scanned AP count (%d)\n", bss_list->count);
3411 	for (i = 0; i < bss_list->count; i++) {
3412 		bi = next_bss_le(bss_list, bi);
3413 		err = brcmf_inform_single_bss(cfg, bi);
3414 		if (err)
3415 			break;
3416 	}
3417 	return err;
3418 }
3419 
3420 static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg,
3421 			     struct net_device *ndev, const u8 *bssid)
3422 {
3423 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
3424 	struct brcmf_pub *drvr = cfg->pub;
3425 	struct ieee80211_channel *notify_channel;
3426 	struct brcmf_bss_info_le *bi = NULL;
3427 	struct ieee80211_supported_band *band;
3428 	struct cfg80211_bss *bss;
3429 	struct brcmu_chan ch;
3430 	u8 *buf = NULL;
3431 	s32 err = 0;
3432 	u32 freq;
3433 	u16 notify_capability;
3434 	u16 notify_interval;
3435 	u8 *notify_ie;
3436 	size_t notify_ielen;
3437 	s32 notify_signal;
3438 
3439 	brcmf_dbg(TRACE, "Enter\n");
3440 
3441 	buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
3442 	if (buf == NULL) {
3443 		err = -ENOMEM;
3444 		goto CleanUp;
3445 	}
3446 
3447 	*(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
3448 
3449 	err = brcmf_fil_cmd_data_get(netdev_priv(ndev), BRCMF_C_GET_BSS_INFO,
3450 				     buf, WL_BSS_INFO_MAX);
3451 	if (err) {
3452 		bphy_err(drvr, "WLC_GET_BSS_INFO failed: %d\n", err);
3453 		goto CleanUp;
3454 	}
3455 
3456 	bi = (struct brcmf_bss_info_le *)(buf + 4);
3457 
3458 	ch.chspec = le16_to_cpu(bi->chanspec);
3459 	cfg->d11inf.decchspec(&ch);
3460 
3461 	if (ch.band == BRCMU_CHAN_BAND_2G)
3462 		band = wiphy->bands[NL80211_BAND_2GHZ];
3463 	else
3464 		band = wiphy->bands[NL80211_BAND_5GHZ];
3465 
3466 	freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
3467 	cfg->channel = freq;
3468 	notify_channel = ieee80211_get_channel(wiphy, freq);
3469 
3470 	notify_capability = le16_to_cpu(bi->capability);
3471 	notify_interval = le16_to_cpu(bi->beacon_period);
3472 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
3473 	notify_ielen = le32_to_cpu(bi->ie_length);
3474 	notify_signal = (s16)le16_to_cpu(bi->RSSI) * 100;
3475 
3476 	brcmf_dbg(CONN, "channel: %d(%d)\n", ch.control_ch_num, freq);
3477 	brcmf_dbg(CONN, "capability: %X\n", notify_capability);
3478 	brcmf_dbg(CONN, "beacon interval: %d\n", notify_interval);
3479 	brcmf_dbg(CONN, "signal: %d\n", notify_signal);
3480 
3481 	bss = cfg80211_inform_bss(wiphy, notify_channel,
3482 				  CFG80211_BSS_FTYPE_UNKNOWN, bssid, 0,
3483 				  notify_capability, notify_interval,
3484 				  notify_ie, notify_ielen, notify_signal,
3485 				  GFP_KERNEL);
3486 
3487 	if (!bss) {
3488 		err = -ENOMEM;
3489 		goto CleanUp;
3490 	}
3491 
3492 	cfg80211_put_bss(wiphy, bss);
3493 
3494 CleanUp:
3495 
3496 	kfree(buf);
3497 
3498 	brcmf_dbg(TRACE, "Exit\n");
3499 
3500 	return err;
3501 }
3502 
3503 static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
3504 				 struct brcmf_if *ifp)
3505 {
3506 	struct brcmf_pub *drvr = cfg->pub;
3507 	struct brcmf_bss_info_le *bi = NULL;
3508 	s32 err = 0;
3509 
3510 	brcmf_dbg(TRACE, "Enter\n");
3511 	if (brcmf_is_ibssmode(ifp->vif))
3512 		return err;
3513 
3514 	*(__le32 *)cfg->extra_buf = cpu_to_le32(WL_EXTRA_BUF_MAX);
3515 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
3516 				     cfg->extra_buf, WL_EXTRA_BUF_MAX);
3517 	if (err) {
3518 		bphy_err(drvr, "Could not get bss info %d\n", err);
3519 		goto update_bss_info_out;
3520 	}
3521 	bi = (struct brcmf_bss_info_le *)(cfg->extra_buf + 4);
3522 	err = brcmf_inform_single_bss(cfg, bi);
3523 
3524 update_bss_info_out:
3525 	brcmf_dbg(TRACE, "Exit");
3526 	return err;
3527 }
3528 
3529 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
3530 {
3531 	struct escan_info *escan = &cfg->escan_info;
3532 
3533 	set_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3534 	if (cfg->int_escan_map || cfg->scan_request) {
3535 		escan->escan_state = WL_ESCAN_STATE_IDLE;
3536 		brcmf_notify_escan_complete(cfg, escan->ifp, true, true);
3537 	}
3538 	clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3539 	clear_bit(BRCMF_SCAN_STATUS_ABORT, &cfg->scan_status);
3540 }
3541 
3542 static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
3543 {
3544 	struct brcmf_cfg80211_info *cfg =
3545 			container_of(work, struct brcmf_cfg80211_info,
3546 				     escan_timeout_work);
3547 
3548 	brcmf_inform_bss(cfg);
3549 	brcmf_notify_escan_complete(cfg, cfg->escan_info.ifp, true, true);
3550 }
3551 
3552 static void brcmf_escan_timeout(struct timer_list *t)
3553 {
3554 	struct brcmf_cfg80211_info *cfg =
3555 			from_timer(cfg, t, escan_timeout);
3556 	struct brcmf_pub *drvr = cfg->pub;
3557 
3558 	if (cfg->int_escan_map || cfg->scan_request) {
3559 		bphy_err(drvr, "timer expired\n");
3560 		schedule_work(&cfg->escan_timeout_work);
3561 	}
3562 }
3563 
3564 static s32
3565 brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
3566 			      struct brcmf_bss_info_le *bss,
3567 			      struct brcmf_bss_info_le *bss_info_le)
3568 {
3569 	struct brcmu_chan ch_bss, ch_bss_info_le;
3570 
3571 	ch_bss.chspec = le16_to_cpu(bss->chanspec);
3572 	cfg->d11inf.decchspec(&ch_bss);
3573 	ch_bss_info_le.chspec = le16_to_cpu(bss_info_le->chanspec);
3574 	cfg->d11inf.decchspec(&ch_bss_info_le);
3575 
3576 	if (!memcmp(&bss_info_le->BSSID, &bss->BSSID, ETH_ALEN) &&
3577 		ch_bss.band == ch_bss_info_le.band &&
3578 		bss_info_le->SSID_len == bss->SSID_len &&
3579 		!memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
3580 		if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
3581 			(bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
3582 			s16 bss_rssi = le16_to_cpu(bss->RSSI);
3583 			s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
3584 
3585 			/* preserve max RSSI if the measurements are
3586 			* both on-channel or both off-channel
3587 			*/
3588 			if (bss_info_rssi > bss_rssi)
3589 				bss->RSSI = bss_info_le->RSSI;
3590 		} else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
3591 			(bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
3592 			/* preserve the on-channel rssi measurement
3593 			* if the new measurement is off channel
3594 			*/
3595 			bss->RSSI = bss_info_le->RSSI;
3596 			bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
3597 		}
3598 		return 1;
3599 	}
3600 	return 0;
3601 }
3602 
3603 static s32
3604 brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
3605 			     const struct brcmf_event_msg *e, void *data)
3606 {
3607 	struct brcmf_pub *drvr = ifp->drvr;
3608 	struct brcmf_cfg80211_info *cfg = drvr->config;
3609 	s32 status;
3610 	struct brcmf_escan_result_le *escan_result_le;
3611 	u32 escan_buflen;
3612 	struct brcmf_bss_info_le *bss_info_le;
3613 	struct brcmf_bss_info_le *bss = NULL;
3614 	u32 bi_length;
3615 	struct brcmf_scan_results *list;
3616 	u32 i;
3617 	bool aborted;
3618 
3619 	status = e->status;
3620 
3621 	if (status == BRCMF_E_STATUS_ABORT)
3622 		goto exit;
3623 
3624 	if (!test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3625 		bphy_err(drvr, "scan not ready, bsscfgidx=%d\n",
3626 			 ifp->bsscfgidx);
3627 		return -EPERM;
3628 	}
3629 
3630 	if (status == BRCMF_E_STATUS_PARTIAL) {
3631 		brcmf_dbg(SCAN, "ESCAN Partial result\n");
3632 		if (e->datalen < sizeof(*escan_result_le)) {
3633 			bphy_err(drvr, "invalid event data length\n");
3634 			goto exit;
3635 		}
3636 		escan_result_le = (struct brcmf_escan_result_le *) data;
3637 		if (!escan_result_le) {
3638 			bphy_err(drvr, "Invalid escan result (NULL pointer)\n");
3639 			goto exit;
3640 		}
3641 		escan_buflen = le32_to_cpu(escan_result_le->buflen);
3642 		if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
3643 		    escan_buflen > e->datalen ||
3644 		    escan_buflen < sizeof(*escan_result_le)) {
3645 			bphy_err(drvr, "Invalid escan buffer length: %d\n",
3646 				 escan_buflen);
3647 			goto exit;
3648 		}
3649 		if (le16_to_cpu(escan_result_le->bss_count) != 1) {
3650 			bphy_err(drvr, "Invalid bss_count %d: ignoring\n",
3651 				 escan_result_le->bss_count);
3652 			goto exit;
3653 		}
3654 		bss_info_le = &escan_result_le->bss_info_le;
3655 
3656 		if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
3657 			goto exit;
3658 
3659 		if (!cfg->int_escan_map && !cfg->scan_request) {
3660 			brcmf_dbg(SCAN, "result without cfg80211 request\n");
3661 			goto exit;
3662 		}
3663 
3664 		bi_length = le32_to_cpu(bss_info_le->length);
3665 		if (bi_length != escan_buflen -	WL_ESCAN_RESULTS_FIXED_SIZE) {
3666 			bphy_err(drvr, "Ignoring invalid bss_info length: %d\n",
3667 				 bi_length);
3668 			goto exit;
3669 		}
3670 
3671 		if (!(cfg_to_wiphy(cfg)->interface_modes &
3672 					BIT(NL80211_IFTYPE_ADHOC))) {
3673 			if (le16_to_cpu(bss_info_le->capability) &
3674 						WLAN_CAPABILITY_IBSS) {
3675 				bphy_err(drvr, "Ignoring IBSS result\n");
3676 				goto exit;
3677 			}
3678 		}
3679 
3680 		list = (struct brcmf_scan_results *)
3681 				cfg->escan_info.escan_buf;
3682 		if (bi_length > BRCMF_ESCAN_BUF_SIZE - list->buflen) {
3683 			bphy_err(drvr, "Buffer is too small: ignoring\n");
3684 			goto exit;
3685 		}
3686 
3687 		for (i = 0; i < list->count; i++) {
3688 			bss = bss ? (struct brcmf_bss_info_le *)
3689 				((unsigned char *)bss +
3690 				le32_to_cpu(bss->length)) : list->bss_info_le;
3691 			if (brcmf_compare_update_same_bss(cfg, bss,
3692 							  bss_info_le))
3693 				goto exit;
3694 		}
3695 		memcpy(&cfg->escan_info.escan_buf[list->buflen], bss_info_le,
3696 		       bi_length);
3697 		list->version = le32_to_cpu(bss_info_le->version);
3698 		list->buflen += bi_length;
3699 		list->count++;
3700 	} else {
3701 		cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3702 		if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
3703 			goto exit;
3704 		if (cfg->int_escan_map || cfg->scan_request) {
3705 			brcmf_inform_bss(cfg);
3706 			aborted = status != BRCMF_E_STATUS_SUCCESS;
3707 			brcmf_notify_escan_complete(cfg, ifp, aborted, false);
3708 		} else
3709 			brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
3710 				  status);
3711 	}
3712 exit:
3713 	return 0;
3714 }
3715 
3716 static void brcmf_init_escan(struct brcmf_cfg80211_info *cfg)
3717 {
3718 	brcmf_fweh_register(cfg->pub, BRCMF_E_ESCAN_RESULT,
3719 			    brcmf_cfg80211_escan_handler);
3720 	cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
3721 	/* Init scan_timeout timer */
3722 	timer_setup(&cfg->escan_timeout, brcmf_escan_timeout, 0);
3723 	INIT_WORK(&cfg->escan_timeout_work,
3724 		  brcmf_cfg80211_escan_timeout_worker);
3725 }
3726 
3727 static struct cfg80211_scan_request *
3728 brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) {
3729 	struct cfg80211_scan_request *req;
3730 	size_t req_size;
3731 
3732 	req_size = sizeof(*req) +
3733 		   n_netinfo * sizeof(req->channels[0]) +
3734 		   n_netinfo * sizeof(*req->ssids);
3735 
3736 	req = kzalloc(req_size, GFP_KERNEL);
3737 	if (req) {
3738 		req->wiphy = wiphy;
3739 		req->ssids = (void *)(&req->channels[0]) +
3740 			     n_netinfo * sizeof(req->channels[0]);
3741 	}
3742 	return req;
3743 }
3744 
3745 static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
3746 					 u8 *ssid, u8 ssid_len, u8 channel)
3747 {
3748 	struct ieee80211_channel *chan;
3749 	enum nl80211_band band;
3750 	int freq, i;
3751 
3752 	if (channel <= CH_MAX_2G_CHANNEL)
3753 		band = NL80211_BAND_2GHZ;
3754 	else
3755 		band = NL80211_BAND_5GHZ;
3756 
3757 	freq = ieee80211_channel_to_frequency(channel, band);
3758 	if (!freq)
3759 		return -EINVAL;
3760 
3761 	chan = ieee80211_get_channel(req->wiphy, freq);
3762 	if (!chan)
3763 		return -EINVAL;
3764 
3765 	for (i = 0; i < req->n_channels; i++) {
3766 		if (req->channels[i] == chan)
3767 			break;
3768 	}
3769 	if (i == req->n_channels) {
3770 		req->n_channels++;
3771 		req->channels[i] = chan;
3772 	}
3773 
3774 	for (i = 0; i < req->n_ssids; i++) {
3775 		if (req->ssids[i].ssid_len == ssid_len &&
3776 		    !memcmp(req->ssids[i].ssid, ssid, ssid_len))
3777 			break;
3778 	}
3779 	if (i == req->n_ssids) {
3780 		memcpy(req->ssids[req->n_ssids].ssid, ssid, ssid_len);
3781 		req->ssids[req->n_ssids++].ssid_len = ssid_len;
3782 	}
3783 	return 0;
3784 }
3785 
3786 static int brcmf_start_internal_escan(struct brcmf_if *ifp, u32 fwmap,
3787 				      struct cfg80211_scan_request *request)
3788 {
3789 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
3790 	int err;
3791 
3792 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
3793 		if (cfg->int_escan_map)
3794 			brcmf_dbg(SCAN, "aborting internal scan: map=%u\n",
3795 				  cfg->int_escan_map);
3796 		/* Abort any on-going scan */
3797 		brcmf_abort_scanning(cfg);
3798 	}
3799 
3800 	brcmf_dbg(SCAN, "start internal scan: map=%u\n", fwmap);
3801 	set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3802 	cfg->escan_info.run = brcmf_run_escan;
3803 	err = brcmf_do_escan(ifp, request);
3804 	if (err) {
3805 		clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
3806 		return err;
3807 	}
3808 	cfg->int_escan_map = fwmap;
3809 	return 0;
3810 }
3811 
3812 static struct brcmf_pno_net_info_le *
3813 brcmf_get_netinfo_array(struct brcmf_pno_scanresults_le *pfn_v1)
3814 {
3815 	struct brcmf_pno_scanresults_v2_le *pfn_v2;
3816 	struct brcmf_pno_net_info_le *netinfo;
3817 
3818 	switch (pfn_v1->version) {
3819 	default:
3820 		WARN_ON(1);
3821 		fallthrough;
3822 	case cpu_to_le32(1):
3823 		netinfo = (struct brcmf_pno_net_info_le *)(pfn_v1 + 1);
3824 		break;
3825 	case cpu_to_le32(2):
3826 		pfn_v2 = (struct brcmf_pno_scanresults_v2_le *)pfn_v1;
3827 		netinfo = (struct brcmf_pno_net_info_le *)(pfn_v2 + 1);
3828 		break;
3829 	}
3830 
3831 	return netinfo;
3832 }
3833 
3834 /* PFN result doesn't have all the info which are required by the supplicant
3835  * (For e.g IEs) Do a target Escan so that sched scan results are reported
3836  * via wl_inform_single_bss in the required format. Escan does require the
3837  * scan request in the form of cfg80211_scan_request. For timebeing, create
3838  * cfg80211_scan_request one out of the received PNO event.
3839  */
3840 static s32
3841 brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
3842 				const struct brcmf_event_msg *e, void *data)
3843 {
3844 	struct brcmf_pub *drvr = ifp->drvr;
3845 	struct brcmf_cfg80211_info *cfg = drvr->config;
3846 	struct brcmf_pno_net_info_le *netinfo, *netinfo_start;
3847 	struct cfg80211_scan_request *request = NULL;
3848 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
3849 	int i, err = 0;
3850 	struct brcmf_pno_scanresults_le *pfn_result;
3851 	u32 bucket_map;
3852 	u32 result_count;
3853 	u32 status;
3854 	u32 datalen;
3855 
3856 	brcmf_dbg(SCAN, "Enter\n");
3857 
3858 	if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
3859 		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
3860 		return 0;
3861 	}
3862 
3863 	if (e->event_code == BRCMF_E_PFN_NET_LOST) {
3864 		brcmf_dbg(SCAN, "PFN NET LOST event. Do Nothing\n");
3865 		return 0;
3866 	}
3867 
3868 	pfn_result = (struct brcmf_pno_scanresults_le *)data;
3869 	result_count = le32_to_cpu(pfn_result->count);
3870 	status = le32_to_cpu(pfn_result->status);
3871 
3872 	/* PFN event is limited to fit 512 bytes so we may get
3873 	 * multiple NET_FOUND events. For now place a warning here.
3874 	 */
3875 	WARN_ON(status != BRCMF_PNO_SCAN_COMPLETE);
3876 	brcmf_dbg(SCAN, "PFN NET FOUND event. count: %d\n", result_count);
3877 	if (!result_count) {
3878 		bphy_err(drvr, "FALSE PNO Event. (pfn_count == 0)\n");
3879 		goto out_err;
3880 	}
3881 
3882 	netinfo_start = brcmf_get_netinfo_array(pfn_result);
3883 	datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result);
3884 	if (datalen < result_count * sizeof(*netinfo)) {
3885 		bphy_err(drvr, "insufficient event data\n");
3886 		goto out_err;
3887 	}
3888 
3889 	request = brcmf_alloc_internal_escan_request(wiphy,
3890 						     result_count);
3891 	if (!request) {
3892 		err = -ENOMEM;
3893 		goto out_err;
3894 	}
3895 
3896 	bucket_map = 0;
3897 	for (i = 0; i < result_count; i++) {
3898 		netinfo = &netinfo_start[i];
3899 
3900 		if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
3901 			netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
3902 		brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n",
3903 			  netinfo->SSID, netinfo->channel);
3904 		bucket_map |= brcmf_pno_get_bucket_map(cfg->pno, netinfo);
3905 		err = brcmf_internal_escan_add_info(request,
3906 						    netinfo->SSID,
3907 						    netinfo->SSID_len,
3908 						    netinfo->channel);
3909 		if (err)
3910 			goto out_err;
3911 	}
3912 
3913 	if (!bucket_map)
3914 		goto free_req;
3915 
3916 	err = brcmf_start_internal_escan(ifp, bucket_map, request);
3917 	if (!err)
3918 		goto free_req;
3919 
3920 out_err:
3921 	cfg80211_sched_scan_stopped(wiphy, 0);
3922 free_req:
3923 	kfree(request);
3924 	return err;
3925 }
3926 
3927 static int
3928 brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
3929 				struct net_device *ndev,
3930 				struct cfg80211_sched_scan_request *req)
3931 {
3932 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3933 	struct brcmf_if *ifp = netdev_priv(ndev);
3934 	struct brcmf_pub *drvr = cfg->pub;
3935 
3936 	brcmf_dbg(SCAN, "Enter: n_match_sets=%d n_ssids=%d\n",
3937 		  req->n_match_sets, req->n_ssids);
3938 
3939 	if (test_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status)) {
3940 		bphy_err(drvr, "Scanning suppressed: status=%lu\n",
3941 			 cfg->scan_status);
3942 		return -EAGAIN;
3943 	}
3944 
3945 	if (req->n_match_sets <= 0) {
3946 		brcmf_dbg(SCAN, "invalid number of matchsets specified: %d\n",
3947 			  req->n_match_sets);
3948 		return -EINVAL;
3949 	}
3950 
3951 	return brcmf_pno_start_sched_scan(ifp, req);
3952 }
3953 
3954 static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
3955 					  struct net_device *ndev, u64 reqid)
3956 {
3957 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
3958 	struct brcmf_if *ifp = netdev_priv(ndev);
3959 
3960 	brcmf_dbg(SCAN, "enter\n");
3961 	brcmf_pno_stop_sched_scan(ifp, reqid);
3962 	if (cfg->int_escan_map)
3963 		brcmf_notify_escan_complete(cfg, ifp, true, true);
3964 	return 0;
3965 }
3966 
3967 static __always_inline void brcmf_delay(u32 ms)
3968 {
3969 	if (ms < 1000 / HZ) {
3970 		cond_resched();
3971 		mdelay(ms);
3972 	} else {
3973 		msleep(ms);
3974 	}
3975 }
3976 
3977 static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
3978 				     u8 *pattern, u32 patternsize, u8 *mask,
3979 				     u32 packet_offset)
3980 {
3981 	struct brcmf_fil_wowl_pattern_le *filter;
3982 	u32 masksize;
3983 	u32 patternoffset;
3984 	u8 *buf;
3985 	u32 bufsize;
3986 	s32 ret;
3987 
3988 	masksize = (patternsize + 7) / 8;
3989 	patternoffset = sizeof(*filter) - sizeof(filter->cmd) + masksize;
3990 
3991 	bufsize = sizeof(*filter) + patternsize + masksize;
3992 	buf = kzalloc(bufsize, GFP_KERNEL);
3993 	if (!buf)
3994 		return -ENOMEM;
3995 	filter = (struct brcmf_fil_wowl_pattern_le *)buf;
3996 
3997 	memcpy(filter->cmd, cmd, 4);
3998 	filter->masksize = cpu_to_le32(masksize);
3999 	filter->offset = cpu_to_le32(packet_offset);
4000 	filter->patternoffset = cpu_to_le32(patternoffset);
4001 	filter->patternsize = cpu_to_le32(patternsize);
4002 	filter->type = cpu_to_le32(BRCMF_WOWL_PATTERN_TYPE_BITMAP);
4003 
4004 	if ((mask) && (masksize))
4005 		memcpy(buf + sizeof(*filter), mask, masksize);
4006 	if ((pattern) && (patternsize))
4007 		memcpy(buf + sizeof(*filter) + masksize, pattern, patternsize);
4008 
4009 	ret = brcmf_fil_iovar_data_set(ifp, "wowl_pattern", buf, bufsize);
4010 
4011 	kfree(buf);
4012 	return ret;
4013 }
4014 
4015 static s32
4016 brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
4017 		      void *data)
4018 {
4019 	struct brcmf_pub *drvr = ifp->drvr;
4020 	struct brcmf_cfg80211_info *cfg = drvr->config;
4021 	struct brcmf_pno_scanresults_le *pfn_result;
4022 	struct brcmf_pno_net_info_le *netinfo;
4023 
4024 	brcmf_dbg(SCAN, "Enter\n");
4025 
4026 	if (e->datalen < (sizeof(*pfn_result) + sizeof(*netinfo))) {
4027 		brcmf_dbg(SCAN, "Event data to small. Ignore\n");
4028 		return 0;
4029 	}
4030 
4031 	pfn_result = (struct brcmf_pno_scanresults_le *)data;
4032 
4033 	if (e->event_code == BRCMF_E_PFN_NET_LOST) {
4034 		brcmf_dbg(SCAN, "PFN NET LOST event. Ignore\n");
4035 		return 0;
4036 	}
4037 
4038 	if (le32_to_cpu(pfn_result->count) < 1) {
4039 		bphy_err(drvr, "Invalid result count, expected 1 (%d)\n",
4040 			 le32_to_cpu(pfn_result->count));
4041 		return -EINVAL;
4042 	}
4043 
4044 	netinfo = brcmf_get_netinfo_array(pfn_result);
4045 	if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
4046 		netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
4047 	memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
4048 	cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
4049 	cfg->wowl.nd->n_channels = 1;
4050 	cfg->wowl.nd->channels[0] =
4051 		ieee80211_channel_to_frequency(netinfo->channel,
4052 			netinfo->channel <= CH_MAX_2G_CHANNEL ?
4053 					NL80211_BAND_2GHZ : NL80211_BAND_5GHZ);
4054 	cfg->wowl.nd_info->n_matches = 1;
4055 	cfg->wowl.nd_info->matches[0] = cfg->wowl.nd;
4056 
4057 	/* Inform (the resume task) that the net detect information was recvd */
4058 	cfg->wowl.nd_data_completed = true;
4059 	wake_up(&cfg->wowl.nd_data_wait);
4060 
4061 	return 0;
4062 }
4063 
4064 #ifdef CONFIG_PM
4065 
4066 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4067 {
4068 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4069 	struct brcmf_pub *drvr = cfg->pub;
4070 	struct brcmf_wowl_wakeind_le wake_ind_le;
4071 	struct cfg80211_wowlan_wakeup wakeup_data;
4072 	struct cfg80211_wowlan_wakeup *wakeup;
4073 	u32 wakeind;
4074 	s32 err;
4075 	int timeout;
4076 
4077 	err = brcmf_fil_iovar_data_get(ifp, "wowl_wakeind", &wake_ind_le,
4078 				       sizeof(wake_ind_le));
4079 	if (err) {
4080 		bphy_err(drvr, "Get wowl_wakeind failed, err = %d\n", err);
4081 		return;
4082 	}
4083 
4084 	wakeind = le32_to_cpu(wake_ind_le.ucode_wakeind);
4085 	if (wakeind & (BRCMF_WOWL_MAGIC | BRCMF_WOWL_DIS | BRCMF_WOWL_BCN |
4086 		       BRCMF_WOWL_RETR | BRCMF_WOWL_NET |
4087 		       BRCMF_WOWL_PFN_FOUND)) {
4088 		wakeup = &wakeup_data;
4089 		memset(&wakeup_data, 0, sizeof(wakeup_data));
4090 		wakeup_data.pattern_idx = -1;
4091 
4092 		if (wakeind & BRCMF_WOWL_MAGIC) {
4093 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_MAGIC\n");
4094 			wakeup_data.magic_pkt = true;
4095 		}
4096 		if (wakeind & BRCMF_WOWL_DIS) {
4097 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_DIS\n");
4098 			wakeup_data.disconnect = true;
4099 		}
4100 		if (wakeind & BRCMF_WOWL_BCN) {
4101 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_BCN\n");
4102 			wakeup_data.disconnect = true;
4103 		}
4104 		if (wakeind & BRCMF_WOWL_RETR) {
4105 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_RETR\n");
4106 			wakeup_data.disconnect = true;
4107 		}
4108 		if (wakeind & BRCMF_WOWL_NET) {
4109 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_NET\n");
4110 			/* For now always map to pattern 0, no API to get
4111 			 * correct information available at the moment.
4112 			 */
4113 			wakeup_data.pattern_idx = 0;
4114 		}
4115 		if (wakeind & BRCMF_WOWL_PFN_FOUND) {
4116 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_PFN_FOUND\n");
4117 			timeout = wait_event_timeout(cfg->wowl.nd_data_wait,
4118 				cfg->wowl.nd_data_completed,
4119 				BRCMF_ND_INFO_TIMEOUT);
4120 			if (!timeout)
4121 				bphy_err(drvr, "No result for wowl net detect\n");
4122 			else
4123 				wakeup_data.net_detect = cfg->wowl.nd_info;
4124 		}
4125 		if (wakeind & BRCMF_WOWL_GTK_FAILURE) {
4126 			brcmf_dbg(INFO, "WOWL Wake indicator: BRCMF_WOWL_GTK_FAILURE\n");
4127 			wakeup_data.gtk_rekey_failure = true;
4128 		}
4129 	} else {
4130 		wakeup = NULL;
4131 	}
4132 	cfg80211_report_wowlan_wakeup(&ifp->vif->wdev, wakeup, GFP_KERNEL);
4133 }
4134 
4135 #else
4136 
4137 static void brcmf_report_wowl_wakeind(struct wiphy *wiphy, struct brcmf_if *ifp)
4138 {
4139 }
4140 
4141 #endif /* CONFIG_PM */
4142 
4143 static s32 brcmf_cfg80211_resume(struct wiphy *wiphy)
4144 {
4145 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4146 	struct net_device *ndev = cfg_to_ndev(cfg);
4147 	struct brcmf_if *ifp = netdev_priv(ndev);
4148 
4149 	brcmf_dbg(TRACE, "Enter\n");
4150 
4151 	if (cfg->wowl.active) {
4152 		brcmf_report_wowl_wakeind(wiphy, ifp);
4153 		brcmf_fil_iovar_int_set(ifp, "wowl_clear", 0);
4154 		brcmf_config_wowl_pattern(ifp, "clr", NULL, 0, NULL, 0);
4155 		if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4156 			brcmf_configure_arp_nd_offload(ifp, true);
4157 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM,
4158 				      cfg->wowl.pre_pmmode);
4159 		cfg->wowl.active = false;
4160 		if (cfg->wowl.nd_enabled) {
4161 			brcmf_cfg80211_sched_scan_stop(cfg->wiphy, ifp->ndev, 0);
4162 			brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4163 			brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4164 					    brcmf_notify_sched_scan_results);
4165 			cfg->wowl.nd_enabled = false;
4166 		}
4167 	}
4168 	return 0;
4169 }
4170 
4171 static void brcmf_configure_wowl(struct brcmf_cfg80211_info *cfg,
4172 				 struct brcmf_if *ifp,
4173 				 struct cfg80211_wowlan *wowl)
4174 {
4175 	u32 wowl_config;
4176 	struct brcmf_wowl_wakeind_le wowl_wakeind;
4177 	u32 i;
4178 
4179 	brcmf_dbg(TRACE, "Suspend, wowl config.\n");
4180 
4181 	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ARP_ND))
4182 		brcmf_configure_arp_nd_offload(ifp, false);
4183 	brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PM, &cfg->wowl.pre_pmmode);
4184 	brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, PM_MAX);
4185 
4186 	wowl_config = 0;
4187 	if (wowl->disconnect)
4188 		wowl_config = BRCMF_WOWL_DIS | BRCMF_WOWL_BCN | BRCMF_WOWL_RETR;
4189 	if (wowl->magic_pkt)
4190 		wowl_config |= BRCMF_WOWL_MAGIC;
4191 	if ((wowl->patterns) && (wowl->n_patterns)) {
4192 		wowl_config |= BRCMF_WOWL_NET;
4193 		for (i = 0; i < wowl->n_patterns; i++) {
4194 			brcmf_config_wowl_pattern(ifp, "add",
4195 				(u8 *)wowl->patterns[i].pattern,
4196 				wowl->patterns[i].pattern_len,
4197 				(u8 *)wowl->patterns[i].mask,
4198 				wowl->patterns[i].pkt_offset);
4199 		}
4200 	}
4201 	if (wowl->nd_config) {
4202 		brcmf_cfg80211_sched_scan_start(cfg->wiphy, ifp->ndev,
4203 						wowl->nd_config);
4204 		wowl_config |= BRCMF_WOWL_PFN_FOUND;
4205 
4206 		cfg->wowl.nd_data_completed = false;
4207 		cfg->wowl.nd_enabled = true;
4208 		/* Now reroute the event for PFN to the wowl function. */
4209 		brcmf_fweh_unregister(cfg->pub, BRCMF_E_PFN_NET_FOUND);
4210 		brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
4211 				    brcmf_wowl_nd_results);
4212 	}
4213 	if (wowl->gtk_rekey_failure)
4214 		wowl_config |= BRCMF_WOWL_GTK_FAILURE;
4215 	if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))
4216 		wowl_config |= BRCMF_WOWL_UNASSOC;
4217 
4218 	memcpy(&wowl_wakeind, "clear", 6);
4219 	brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind,
4220 				 sizeof(wowl_wakeind));
4221 	brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config);
4222 	brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1);
4223 	brcmf_bus_wowl_config(cfg->pub->bus_if, true);
4224 	cfg->wowl.active = true;
4225 }
4226 
4227 static int brcmf_keepalive_start(struct brcmf_if *ifp, unsigned int interval)
4228 {
4229 	struct brcmf_mkeep_alive_pkt_le kalive = {0};
4230 	int ret = 0;
4231 
4232 	/* Configure Null function/data keepalive */
4233 	kalive.version = cpu_to_le16(1);
4234 	kalive.period_msec = cpu_to_le32(interval * MSEC_PER_SEC);
4235 	kalive.len_bytes = cpu_to_le16(0);
4236 	kalive.keep_alive_id = 0;
4237 
4238 	ret = brcmf_fil_iovar_data_set(ifp, "mkeep_alive", &kalive, sizeof(kalive));
4239 	if (ret)
4240 		brcmf_err("keep-alive packet config failed, ret=%d\n", ret);
4241 
4242 	return ret;
4243 }
4244 
4245 static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
4246 				  struct cfg80211_wowlan *wowl)
4247 {
4248 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4249 	struct net_device *ndev = cfg_to_ndev(cfg);
4250 	struct brcmf_if *ifp = netdev_priv(ndev);
4251 	struct brcmf_cfg80211_vif *vif;
4252 
4253 	brcmf_dbg(TRACE, "Enter\n");
4254 
4255 	/* if the primary net_device is not READY there is nothing
4256 	 * we can do but pray resume goes smoothly.
4257 	 */
4258 	if (!check_vif_up(ifp->vif))
4259 		goto exit;
4260 
4261 	/* Stop scheduled scan */
4262 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO))
4263 		brcmf_cfg80211_sched_scan_stop(wiphy, ndev, 0);
4264 
4265 	/* end any scanning */
4266 	if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
4267 		brcmf_abort_scanning(cfg);
4268 
4269 	if (wowl == NULL) {
4270 		brcmf_bus_wowl_config(cfg->pub->bus_if, false);
4271 		list_for_each_entry(vif, &cfg->vif_list, list) {
4272 			if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state))
4273 				continue;
4274 			/* While going to suspend if associated with AP
4275 			 * disassociate from AP to save power while system is
4276 			 * in suspended state
4277 			 */
4278 			brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED, true);
4279 			/* Make sure WPA_Supplicant receives all the event
4280 			 * generated due to DISASSOC call to the fw to keep
4281 			 * the state fw and WPA_Supplicant state consistent
4282 			 */
4283 			brcmf_delay(500);
4284 		}
4285 		/* Configure MPC */
4286 		brcmf_set_mpc(ifp, 1);
4287 
4288 	} else {
4289 		/* Configure WOWL paramaters */
4290 		brcmf_configure_wowl(cfg, ifp, wowl);
4291 
4292 		/* Prevent disassociation due to inactivity with keep-alive */
4293 		brcmf_keepalive_start(ifp, 30);
4294 	}
4295 
4296 exit:
4297 	brcmf_dbg(TRACE, "Exit\n");
4298 	/* clear any scanning activity */
4299 	cfg->scan_status = 0;
4300 	return 0;
4301 }
4302 
4303 static s32
4304 brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
4305 		  bool alive)
4306 {
4307 	struct brcmf_pmk_op_v3_le *pmk_op;
4308 	int length = offsetof(struct brcmf_pmk_op_v3_le, pmk);
4309 	int ret;
4310 
4311 	pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
4312 	if (!pmk_op)
4313 		return -ENOMEM;
4314 
4315 	pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
4316 
4317 	if (!pmksa) {
4318 		/* Flush operation, operate on entire list */
4319 		pmk_op->count = cpu_to_le16(0);
4320 	} else {
4321 		/* Single PMK operation */
4322 		pmk_op->count = cpu_to_le16(1);
4323 		length += sizeof(struct brcmf_pmksa_v3);
4324 		memcpy(pmk_op->pmk[0].bssid, pmksa->bssid, ETH_ALEN);
4325 		memcpy(pmk_op->pmk[0].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4326 		pmk_op->pmk[0].pmkid_len = WLAN_PMKID_LEN;
4327 		pmk_op->pmk[0].time_left = cpu_to_le32(alive ? BRCMF_PMKSA_NO_EXPIRY : 0);
4328 	}
4329 
4330 	pmk_op->length = cpu_to_le16(length);
4331 
4332 	ret = brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_op, sizeof(*pmk_op));
4333 	kfree(pmk_op);
4334 	return ret;
4335 }
4336 
4337 static __used s32
4338 brcmf_update_pmklist(struct brcmf_cfg80211_info *cfg, struct brcmf_if *ifp)
4339 {
4340 	struct brcmf_pmk_list_le *pmk_list;
4341 	int i;
4342 	u32 npmk;
4343 
4344 	pmk_list = &cfg->pmk_list;
4345 	npmk = le32_to_cpu(pmk_list->npmk);
4346 
4347 	brcmf_dbg(CONN, "No of elements %d\n", npmk);
4348 	for (i = 0; i < npmk; i++)
4349 		brcmf_dbg(CONN, "PMK[%d]: %pM\n", i, &pmk_list->pmk[i].bssid);
4350 
4351 	return brcmf_fil_iovar_data_set(ifp, "pmkid_info", pmk_list,
4352 			sizeof(*pmk_list));
4353 }
4354 
4355 static s32
4356 brcmf_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4357 			 struct cfg80211_pmksa *pmksa)
4358 {
4359 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4360 	struct brcmf_if *ifp = netdev_priv(ndev);
4361 	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4362 	struct brcmf_pub *drvr = cfg->pub;
4363 	s32 err;
4364 	u32 npmk, i;
4365 
4366 	brcmf_dbg(TRACE, "Enter\n");
4367 	if (!check_vif_up(ifp->vif))
4368 		return -EIO;
4369 
4370 	brcmf_dbg(CONN, "set_pmksa - PMK bssid: %pM =\n", pmksa->bssid);
4371 	brcmf_dbg(CONN, "%*ph\n", WLAN_PMKID_LEN, pmksa->pmkid);
4372 
4373 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4374 		return brcmf_pmksa_v3_op(ifp, pmksa, true);
4375 
4376 	/* TODO: implement PMKID_V2 */
4377 
4378 	npmk = le32_to_cpu(cfg->pmk_list.npmk);
4379 	for (i = 0; i < npmk; i++)
4380 		if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4381 			break;
4382 	if (i < BRCMF_MAXPMKID) {
4383 		memcpy(pmk[i].bssid, pmksa->bssid, ETH_ALEN);
4384 		memcpy(pmk[i].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
4385 		if (i == npmk) {
4386 			npmk++;
4387 			cfg->pmk_list.npmk = cpu_to_le32(npmk);
4388 		}
4389 	} else {
4390 		bphy_err(drvr, "Too many PMKSA entries cached %d\n", npmk);
4391 		return -EINVAL;
4392 	}
4393 
4394 	err = brcmf_update_pmklist(cfg, ifp);
4395 
4396 	brcmf_dbg(TRACE, "Exit\n");
4397 	return err;
4398 }
4399 
4400 static s32
4401 brcmf_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *ndev,
4402 			 struct cfg80211_pmksa *pmksa)
4403 {
4404 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4405 	struct brcmf_if *ifp = netdev_priv(ndev);
4406 	struct brcmf_pmksa *pmk = &cfg->pmk_list.pmk[0];
4407 	struct brcmf_pub *drvr = cfg->pub;
4408 	s32 err;
4409 	u32 npmk, i;
4410 
4411 	brcmf_dbg(TRACE, "Enter\n");
4412 	if (!check_vif_up(ifp->vif))
4413 		return -EIO;
4414 
4415 	brcmf_dbg(CONN, "del_pmksa - PMK bssid = %pM\n", pmksa->bssid);
4416 
4417 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4418 		return brcmf_pmksa_v3_op(ifp, pmksa, false);
4419 
4420 	/* TODO: implement PMKID_V2 */
4421 
4422 	npmk = le32_to_cpu(cfg->pmk_list.npmk);
4423 	for (i = 0; i < npmk; i++)
4424 		if (!memcmp(pmksa->bssid, pmk[i].bssid, ETH_ALEN))
4425 			break;
4426 
4427 	if ((npmk > 0) && (i < npmk)) {
4428 		for (; i < (npmk - 1); i++) {
4429 			memcpy(&pmk[i].bssid, &pmk[i + 1].bssid, ETH_ALEN);
4430 			memcpy(&pmk[i].pmkid, &pmk[i + 1].pmkid,
4431 			       WLAN_PMKID_LEN);
4432 		}
4433 		memset(&pmk[i], 0, sizeof(*pmk));
4434 		cfg->pmk_list.npmk = cpu_to_le32(npmk - 1);
4435 	} else {
4436 		bphy_err(drvr, "Cache entry not found\n");
4437 		return -EINVAL;
4438 	}
4439 
4440 	err = brcmf_update_pmklist(cfg, ifp);
4441 
4442 	brcmf_dbg(TRACE, "Exit\n");
4443 	return err;
4444 
4445 }
4446 
4447 static s32
4448 brcmf_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *ndev)
4449 {
4450 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
4451 	struct brcmf_if *ifp = netdev_priv(ndev);
4452 	s32 err;
4453 
4454 	brcmf_dbg(TRACE, "Enter\n");
4455 	if (!check_vif_up(ifp->vif))
4456 		return -EIO;
4457 
4458 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PMKID_V3))
4459 		return brcmf_pmksa_v3_op(ifp, NULL, false);
4460 
4461 	/* TODO: implement PMKID_V2 */
4462 
4463 	memset(&cfg->pmk_list, 0, sizeof(cfg->pmk_list));
4464 	err = brcmf_update_pmklist(cfg, ifp);
4465 
4466 	brcmf_dbg(TRACE, "Exit\n");
4467 	return err;
4468 
4469 }
4470 
4471 static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
4472 {
4473 	struct brcmf_pub *drvr = ifp->drvr;
4474 	s32 err;
4475 	s32 wpa_val;
4476 
4477 	/* set auth */
4478 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", 0);
4479 	if (err < 0) {
4480 		bphy_err(drvr, "auth error %d\n", err);
4481 		return err;
4482 	}
4483 	/* set wsec */
4484 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", 0);
4485 	if (err < 0) {
4486 		bphy_err(drvr, "wsec error %d\n", err);
4487 		return err;
4488 	}
4489 	/* set upper-layer auth */
4490 	if (brcmf_is_ibssmode(ifp->vif))
4491 		wpa_val = WPA_AUTH_NONE;
4492 	else
4493 		wpa_val = WPA_AUTH_DISABLED;
4494 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_val);
4495 	if (err < 0) {
4496 		bphy_err(drvr, "wpa_auth error %d\n", err);
4497 		return err;
4498 	}
4499 
4500 	return 0;
4501 }
4502 
4503 static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
4504 {
4505 	if (is_rsn_ie)
4506 		return (memcmp(oui, RSN_OUI, TLV_OUI_LEN) == 0);
4507 
4508 	return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
4509 }
4510 
4511 static s32
4512 brcmf_configure_wpaie(struct brcmf_if *ifp,
4513 		      const struct brcmf_vs_tlv *wpa_ie,
4514 		      bool is_rsn_ie)
4515 {
4516 	struct brcmf_pub *drvr = ifp->drvr;
4517 	u32 auth = 0; /* d11 open authentication */
4518 	u16 count;
4519 	s32 err = 0;
4520 	s32 len;
4521 	u32 i;
4522 	u32 wsec;
4523 	u32 pval = 0;
4524 	u32 gval = 0;
4525 	u32 wpa_auth = 0;
4526 	u32 offset;
4527 	u8 *data;
4528 	u16 rsn_cap;
4529 	u32 wme_bss_disable;
4530 	u32 mfp;
4531 
4532 	brcmf_dbg(TRACE, "Enter\n");
4533 	if (wpa_ie == NULL)
4534 		goto exit;
4535 
4536 	len = wpa_ie->len + TLV_HDR_LEN;
4537 	data = (u8 *)wpa_ie;
4538 	offset = TLV_HDR_LEN;
4539 	if (!is_rsn_ie)
4540 		offset += VS_IE_FIXED_HDR_LEN;
4541 	else
4542 		offset += WPA_IE_VERSION_LEN;
4543 
4544 	/* check for multicast cipher suite */
4545 	if (offset + WPA_IE_MIN_OUI_LEN > len) {
4546 		err = -EINVAL;
4547 		bphy_err(drvr, "no multicast cipher suite\n");
4548 		goto exit;
4549 	}
4550 
4551 	if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4552 		err = -EINVAL;
4553 		bphy_err(drvr, "ivalid OUI\n");
4554 		goto exit;
4555 	}
4556 	offset += TLV_OUI_LEN;
4557 
4558 	/* pick up multicast cipher */
4559 	switch (data[offset]) {
4560 	case WPA_CIPHER_NONE:
4561 		gval = 0;
4562 		break;
4563 	case WPA_CIPHER_WEP_40:
4564 	case WPA_CIPHER_WEP_104:
4565 		gval = WEP_ENABLED;
4566 		break;
4567 	case WPA_CIPHER_TKIP:
4568 		gval = TKIP_ENABLED;
4569 		break;
4570 	case WPA_CIPHER_AES_CCM:
4571 		gval = AES_ENABLED;
4572 		break;
4573 	default:
4574 		err = -EINVAL;
4575 		bphy_err(drvr, "Invalid multi cast cipher info\n");
4576 		goto exit;
4577 	}
4578 
4579 	offset++;
4580 	/* walk thru unicast cipher list and pick up what we recognize */
4581 	count = data[offset] + (data[offset + 1] << 8);
4582 	offset += WPA_IE_SUITE_COUNT_LEN;
4583 	/* Check for unicast suite(s) */
4584 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4585 		err = -EINVAL;
4586 		bphy_err(drvr, "no unicast cipher suite\n");
4587 		goto exit;
4588 	}
4589 	for (i = 0; i < count; i++) {
4590 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4591 			err = -EINVAL;
4592 			bphy_err(drvr, "ivalid OUI\n");
4593 			goto exit;
4594 		}
4595 		offset += TLV_OUI_LEN;
4596 		switch (data[offset]) {
4597 		case WPA_CIPHER_NONE:
4598 			break;
4599 		case WPA_CIPHER_WEP_40:
4600 		case WPA_CIPHER_WEP_104:
4601 			pval |= WEP_ENABLED;
4602 			break;
4603 		case WPA_CIPHER_TKIP:
4604 			pval |= TKIP_ENABLED;
4605 			break;
4606 		case WPA_CIPHER_AES_CCM:
4607 			pval |= AES_ENABLED;
4608 			break;
4609 		default:
4610 			bphy_err(drvr, "Invalid unicast security info\n");
4611 		}
4612 		offset++;
4613 	}
4614 	/* walk thru auth management suite list and pick up what we recognize */
4615 	count = data[offset] + (data[offset + 1] << 8);
4616 	offset += WPA_IE_SUITE_COUNT_LEN;
4617 	/* Check for auth key management suite(s) */
4618 	if (offset + (WPA_IE_MIN_OUI_LEN * count) > len) {
4619 		err = -EINVAL;
4620 		bphy_err(drvr, "no auth key mgmt suite\n");
4621 		goto exit;
4622 	}
4623 	for (i = 0; i < count; i++) {
4624 		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
4625 			err = -EINVAL;
4626 			bphy_err(drvr, "ivalid OUI\n");
4627 			goto exit;
4628 		}
4629 		offset += TLV_OUI_LEN;
4630 		switch (data[offset]) {
4631 		case RSN_AKM_NONE:
4632 			brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
4633 			wpa_auth |= WPA_AUTH_NONE;
4634 			break;
4635 		case RSN_AKM_UNSPECIFIED:
4636 			brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
4637 			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
4638 				    (wpa_auth |= WPA_AUTH_UNSPECIFIED);
4639 			break;
4640 		case RSN_AKM_PSK:
4641 			brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
4642 			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
4643 				    (wpa_auth |= WPA_AUTH_PSK);
4644 			break;
4645 		case RSN_AKM_SHA256_PSK:
4646 			brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
4647 			wpa_auth |= WPA2_AUTH_PSK_SHA256;
4648 			break;
4649 		case RSN_AKM_SHA256_1X:
4650 			brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
4651 			wpa_auth |= WPA2_AUTH_1X_SHA256;
4652 			break;
4653 		case RSN_AKM_SAE:
4654 			brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
4655 			wpa_auth |= WPA3_AUTH_SAE_PSK;
4656 			break;
4657 		default:
4658 			bphy_err(drvr, "Invalid key mgmt info\n");
4659 		}
4660 		offset++;
4661 	}
4662 
4663 	mfp = BRCMF_MFP_NONE;
4664 	if (is_rsn_ie) {
4665 		wme_bss_disable = 1;
4666 		if ((offset + RSN_CAP_LEN) <= len) {
4667 			rsn_cap = data[offset] + (data[offset + 1] << 8);
4668 			if (rsn_cap & RSN_CAP_PTK_REPLAY_CNTR_MASK)
4669 				wme_bss_disable = 0;
4670 			if (rsn_cap & RSN_CAP_MFPR_MASK) {
4671 				brcmf_dbg(TRACE, "MFP Required\n");
4672 				mfp = BRCMF_MFP_REQUIRED;
4673 				/* Firmware only supports mfp required in
4674 				 * combination with WPA2_AUTH_PSK_SHA256,
4675 				 * WPA2_AUTH_1X_SHA256, or WPA3_AUTH_SAE_PSK.
4676 				 */
4677 				if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
4678 						  WPA2_AUTH_1X_SHA256 |
4679 						  WPA3_AUTH_SAE_PSK))) {
4680 					err = -EINVAL;
4681 					goto exit;
4682 				}
4683 				/* Firmware has requirement that WPA2_AUTH_PSK/
4684 				 * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
4685 				 * is to be included in the rsn ie.
4686 				 */
4687 				if (wpa_auth & WPA2_AUTH_PSK_SHA256)
4688 					wpa_auth |= WPA2_AUTH_PSK;
4689 				else if (wpa_auth & WPA2_AUTH_1X_SHA256)
4690 					wpa_auth |= WPA2_AUTH_UNSPECIFIED;
4691 			} else if (rsn_cap & RSN_CAP_MFPC_MASK) {
4692 				brcmf_dbg(TRACE, "MFP Capable\n");
4693 				mfp = BRCMF_MFP_CAPABLE;
4694 			}
4695 		}
4696 		offset += RSN_CAP_LEN;
4697 		/* set wme_bss_disable to sync RSN Capabilities */
4698 		err = brcmf_fil_bsscfg_int_set(ifp, "wme_bss_disable",
4699 					       wme_bss_disable);
4700 		if (err < 0) {
4701 			bphy_err(drvr, "wme_bss_disable error %d\n", err);
4702 			goto exit;
4703 		}
4704 
4705 		/* Skip PMKID cnt as it is know to be 0 for AP. */
4706 		offset += RSN_PMKID_COUNT_LEN;
4707 
4708 		/* See if there is BIP wpa suite left for MFP */
4709 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP) &&
4710 		    ((offset + WPA_IE_MIN_OUI_LEN) <= len)) {
4711 			err = brcmf_fil_bsscfg_data_set(ifp, "bip",
4712 							&data[offset],
4713 							WPA_IE_MIN_OUI_LEN);
4714 			if (err < 0) {
4715 				bphy_err(drvr, "bip error %d\n", err);
4716 				goto exit;
4717 			}
4718 		}
4719 	}
4720 	/* FOR WPS , set SES_OW_ENABLED */
4721 	wsec = (pval | gval | SES_OW_ENABLED);
4722 
4723 	/* set auth */
4724 	err = brcmf_fil_bsscfg_int_set(ifp, "auth", auth);
4725 	if (err < 0) {
4726 		bphy_err(drvr, "auth error %d\n", err);
4727 		goto exit;
4728 	}
4729 	/* set wsec */
4730 	err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
4731 	if (err < 0) {
4732 		bphy_err(drvr, "wsec error %d\n", err);
4733 		goto exit;
4734 	}
4735 	/* Configure MFP, this needs to go after wsec otherwise the wsec command
4736 	 * will overwrite the values set by MFP
4737 	 */
4738 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP)) {
4739 		err = brcmf_fil_bsscfg_int_set(ifp, "mfp", mfp);
4740 		if (err < 0) {
4741 			bphy_err(drvr, "mfp error %d\n", err);
4742 			goto exit;
4743 		}
4744 	}
4745 	/* set upper-layer auth */
4746 	err = brcmf_fil_bsscfg_int_set(ifp, "wpa_auth", wpa_auth);
4747 	if (err < 0) {
4748 		bphy_err(drvr, "wpa_auth error %d\n", err);
4749 		goto exit;
4750 	}
4751 
4752 exit:
4753 	return err;
4754 }
4755 
4756 static s32
4757 brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
4758 		     struct parsed_vndr_ies *vndr_ies)
4759 {
4760 	struct brcmf_vs_tlv *vndrie;
4761 	struct brcmf_tlv *ie;
4762 	struct parsed_vndr_ie_info *parsed_info;
4763 	s32 remaining_len;
4764 
4765 	remaining_len = (s32)vndr_ie_len;
4766 	memset(vndr_ies, 0, sizeof(*vndr_ies));
4767 
4768 	ie = (struct brcmf_tlv *)vndr_ie_buf;
4769 	while (ie) {
4770 		if (ie->id != WLAN_EID_VENDOR_SPECIFIC)
4771 			goto next;
4772 		vndrie = (struct brcmf_vs_tlv *)ie;
4773 		/* len should be bigger than OUI length + one */
4774 		if (vndrie->len < (VS_IE_FIXED_HDR_LEN - TLV_HDR_LEN + 1)) {
4775 			brcmf_err("invalid vndr ie. length is too small %d\n",
4776 				  vndrie->len);
4777 			goto next;
4778 		}
4779 		/* if wpa or wme ie, do not add ie */
4780 		if (!memcmp(vndrie->oui, (u8 *)WPA_OUI, TLV_OUI_LEN) &&
4781 		    ((vndrie->oui_type == WPA_OUI_TYPE) ||
4782 		    (vndrie->oui_type == WME_OUI_TYPE))) {
4783 			brcmf_dbg(TRACE, "Found WPA/WME oui. Do not add it\n");
4784 			goto next;
4785 		}
4786 
4787 		parsed_info = &vndr_ies->ie_info[vndr_ies->count];
4788 
4789 		/* save vndr ie information */
4790 		parsed_info->ie_ptr = (char *)vndrie;
4791 		parsed_info->ie_len = vndrie->len + TLV_HDR_LEN;
4792 		memcpy(&parsed_info->vndrie, vndrie, sizeof(*vndrie));
4793 
4794 		vndr_ies->count++;
4795 
4796 		brcmf_dbg(TRACE, "** OUI %3ph, type 0x%02x\n",
4797 			  parsed_info->vndrie.oui,
4798 			  parsed_info->vndrie.oui_type);
4799 
4800 		if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
4801 			break;
4802 next:
4803 		remaining_len -= (ie->len + TLV_HDR_LEN);
4804 		if (remaining_len <= TLV_HDR_LEN)
4805 			ie = NULL;
4806 		else
4807 			ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
4808 				TLV_HDR_LEN);
4809 	}
4810 	return 0;
4811 }
4812 
4813 static u32
4814 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
4815 {
4816 	strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
4817 
4818 	put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
4819 
4820 	put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
4821 
4822 	memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
4823 
4824 	return ie_len + VNDR_IE_HDR_SIZE;
4825 }
4826 
4827 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
4828 			  const u8 *vndr_ie_buf, u32 vndr_ie_len)
4829 {
4830 	struct brcmf_pub *drvr;
4831 	struct brcmf_if *ifp;
4832 	struct vif_saved_ie *saved_ie;
4833 	s32 err = 0;
4834 	u8  *iovar_ie_buf;
4835 	u8  *curr_ie_buf;
4836 	u8  *mgmt_ie_buf = NULL;
4837 	int mgmt_ie_buf_len;
4838 	u32 *mgmt_ie_len;
4839 	u32 del_add_ie_buf_len = 0;
4840 	u32 total_ie_buf_len = 0;
4841 	u32 parsed_ie_buf_len = 0;
4842 	struct parsed_vndr_ies old_vndr_ies;
4843 	struct parsed_vndr_ies new_vndr_ies;
4844 	struct parsed_vndr_ie_info *vndrie_info;
4845 	s32 i;
4846 	u8 *ptr;
4847 	int remained_buf_len;
4848 
4849 	if (!vif)
4850 		return -ENODEV;
4851 	ifp = vif->ifp;
4852 	drvr = ifp->drvr;
4853 	saved_ie = &vif->saved_ie;
4854 
4855 	brcmf_dbg(TRACE, "bsscfgidx %d, pktflag : 0x%02X\n", ifp->bsscfgidx,
4856 		  pktflag);
4857 	iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
4858 	if (!iovar_ie_buf)
4859 		return -ENOMEM;
4860 	curr_ie_buf = iovar_ie_buf;
4861 	switch (pktflag) {
4862 	case BRCMF_VNDR_IE_PRBREQ_FLAG:
4863 		mgmt_ie_buf = saved_ie->probe_req_ie;
4864 		mgmt_ie_len = &saved_ie->probe_req_ie_len;
4865 		mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
4866 		break;
4867 	case BRCMF_VNDR_IE_PRBRSP_FLAG:
4868 		mgmt_ie_buf = saved_ie->probe_res_ie;
4869 		mgmt_ie_len = &saved_ie->probe_res_ie_len;
4870 		mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
4871 		break;
4872 	case BRCMF_VNDR_IE_BEACON_FLAG:
4873 		mgmt_ie_buf = saved_ie->beacon_ie;
4874 		mgmt_ie_len = &saved_ie->beacon_ie_len;
4875 		mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
4876 		break;
4877 	case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
4878 		mgmt_ie_buf = saved_ie->assoc_req_ie;
4879 		mgmt_ie_len = &saved_ie->assoc_req_ie_len;
4880 		mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
4881 		break;
4882 	case BRCMF_VNDR_IE_ASSOCRSP_FLAG:
4883 		mgmt_ie_buf = saved_ie->assoc_res_ie;
4884 		mgmt_ie_len = &saved_ie->assoc_res_ie_len;
4885 		mgmt_ie_buf_len = sizeof(saved_ie->assoc_res_ie);
4886 		break;
4887 	default:
4888 		err = -EPERM;
4889 		bphy_err(drvr, "not suitable type\n");
4890 		goto exit;
4891 	}
4892 
4893 	if (vndr_ie_len > mgmt_ie_buf_len) {
4894 		err = -ENOMEM;
4895 		bphy_err(drvr, "extra IE size too big\n");
4896 		goto exit;
4897 	}
4898 
4899 	/* parse and save new vndr_ie in curr_ie_buff before comparing it */
4900 	if (vndr_ie_buf && vndr_ie_len && curr_ie_buf) {
4901 		ptr = curr_ie_buf;
4902 		brcmf_parse_vndr_ies(vndr_ie_buf, vndr_ie_len, &new_vndr_ies);
4903 		for (i = 0; i < new_vndr_ies.count; i++) {
4904 			vndrie_info = &new_vndr_ies.ie_info[i];
4905 			memcpy(ptr + parsed_ie_buf_len, vndrie_info->ie_ptr,
4906 			       vndrie_info->ie_len);
4907 			parsed_ie_buf_len += vndrie_info->ie_len;
4908 		}
4909 	}
4910 
4911 	if (mgmt_ie_buf && *mgmt_ie_len) {
4912 		if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
4913 		    (memcmp(mgmt_ie_buf, curr_ie_buf,
4914 			    parsed_ie_buf_len) == 0)) {
4915 			brcmf_dbg(TRACE, "Previous mgmt IE equals to current IE\n");
4916 			goto exit;
4917 		}
4918 
4919 		/* parse old vndr_ie */
4920 		brcmf_parse_vndr_ies(mgmt_ie_buf, *mgmt_ie_len, &old_vndr_ies);
4921 
4922 		/* make a command to delete old ie */
4923 		for (i = 0; i < old_vndr_ies.count; i++) {
4924 			vndrie_info = &old_vndr_ies.ie_info[i];
4925 
4926 			brcmf_dbg(TRACE, "DEL ID : %d, Len: %d , OUI:%3ph\n",
4927 				  vndrie_info->vndrie.id,
4928 				  vndrie_info->vndrie.len,
4929 				  vndrie_info->vndrie.oui);
4930 
4931 			del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4932 							   vndrie_info->ie_ptr,
4933 							   vndrie_info->ie_len,
4934 							   "del");
4935 			curr_ie_buf += del_add_ie_buf_len;
4936 			total_ie_buf_len += del_add_ie_buf_len;
4937 		}
4938 	}
4939 
4940 	*mgmt_ie_len = 0;
4941 	/* Add if there is any extra IE */
4942 	if (mgmt_ie_buf && parsed_ie_buf_len) {
4943 		ptr = mgmt_ie_buf;
4944 
4945 		remained_buf_len = mgmt_ie_buf_len;
4946 
4947 		/* make a command to add new ie */
4948 		for (i = 0; i < new_vndr_ies.count; i++) {
4949 			vndrie_info = &new_vndr_ies.ie_info[i];
4950 
4951 			/* verify remained buf size before copy data */
4952 			if (remained_buf_len < (vndrie_info->vndrie.len +
4953 							VNDR_IE_VSIE_OFFSET)) {
4954 				bphy_err(drvr, "no space in mgmt_ie_buf: len left %d",
4955 					 remained_buf_len);
4956 				break;
4957 			}
4958 			remained_buf_len -= (vndrie_info->ie_len +
4959 					     VNDR_IE_VSIE_OFFSET);
4960 
4961 			brcmf_dbg(TRACE, "ADDED ID : %d, Len: %d, OUI:%3ph\n",
4962 				  vndrie_info->vndrie.id,
4963 				  vndrie_info->vndrie.len,
4964 				  vndrie_info->vndrie.oui);
4965 
4966 			del_add_ie_buf_len = brcmf_vndr_ie(curr_ie_buf, pktflag,
4967 							   vndrie_info->ie_ptr,
4968 							   vndrie_info->ie_len,
4969 							   "add");
4970 
4971 			/* save the parsed IE in wl struct */
4972 			memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
4973 			       vndrie_info->ie_len);
4974 			*mgmt_ie_len += vndrie_info->ie_len;
4975 
4976 			curr_ie_buf += del_add_ie_buf_len;
4977 			total_ie_buf_len += del_add_ie_buf_len;
4978 		}
4979 	}
4980 	if (total_ie_buf_len) {
4981 		err  = brcmf_fil_bsscfg_data_set(ifp, "vndr_ie", iovar_ie_buf,
4982 						 total_ie_buf_len);
4983 		if (err)
4984 			bphy_err(drvr, "vndr ie set error : %d\n", err);
4985 	}
4986 
4987 exit:
4988 	kfree(iovar_ie_buf);
4989 	return err;
4990 }
4991 
4992 s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
4993 {
4994 	static const s32 pktflags[] = {
4995 		BRCMF_VNDR_IE_PRBREQ_FLAG,
4996 		BRCMF_VNDR_IE_PRBRSP_FLAG,
4997 		BRCMF_VNDR_IE_BEACON_FLAG
4998 	};
4999 	int i;
5000 
5001 	for (i = 0; i < ARRAY_SIZE(pktflags); i++)
5002 		brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
5003 
5004 	memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
5005 	return 0;
5006 }
5007 
5008 static s32
5009 brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
5010 			struct cfg80211_beacon_data *beacon)
5011 {
5012 	struct brcmf_pub *drvr = vif->ifp->drvr;
5013 	s32 err;
5014 
5015 	/* Set Beacon IEs to FW */
5016 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
5017 				    beacon->tail, beacon->tail_len);
5018 	if (err) {
5019 		bphy_err(drvr, "Set Beacon IE Failed\n");
5020 		return err;
5021 	}
5022 	brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
5023 
5024 	/* Set Probe Response IEs to FW */
5025 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
5026 				    beacon->proberesp_ies,
5027 				    beacon->proberesp_ies_len);
5028 	if (err)
5029 		bphy_err(drvr, "Set Probe Resp IE Failed\n");
5030 	else
5031 		brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
5032 
5033 	/* Set Assoc Response IEs to FW */
5034 	err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_ASSOCRSP_FLAG,
5035 				    beacon->assocresp_ies,
5036 				    beacon->assocresp_ies_len);
5037 	if (err)
5038 		brcmf_err("Set Assoc Resp IE Failed\n");
5039 	else
5040 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc Resp\n");
5041 
5042 	return err;
5043 }
5044 
5045 static s32
5046 brcmf_parse_configure_security(struct brcmf_if *ifp,
5047 			       struct cfg80211_ap_settings *settings,
5048 			       enum nl80211_iftype dev_role)
5049 {
5050 	const struct brcmf_tlv *rsn_ie;
5051 	const struct brcmf_vs_tlv *wpa_ie;
5052 	s32 err = 0;
5053 
5054 	/* find the RSN_IE */
5055 	rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5056 				  settings->beacon.tail_len, WLAN_EID_RSN);
5057 
5058 	/* find the WPA_IE */
5059 	wpa_ie = brcmf_find_wpaie((u8 *)settings->beacon.tail,
5060 				  settings->beacon.tail_len);
5061 
5062 	if (wpa_ie || rsn_ie) {
5063 		brcmf_dbg(TRACE, "WPA(2) IE is found\n");
5064 		if (wpa_ie) {
5065 			/* WPA IE */
5066 			err = brcmf_configure_wpaie(ifp, wpa_ie, false);
5067 			if (err < 0)
5068 				return err;
5069 		} else {
5070 			struct brcmf_vs_tlv *tmp_ie;
5071 
5072 			tmp_ie = (struct brcmf_vs_tlv *)rsn_ie;
5073 
5074 			/* RSN IE */
5075 			err = brcmf_configure_wpaie(ifp, tmp_ie, true);
5076 			if (err < 0)
5077 				return err;
5078 		}
5079 	} else {
5080 		brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
5081 		brcmf_configure_opensecurity(ifp);
5082 	}
5083 
5084 	return err;
5085 }
5086 
5087 static s32
5088 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
5089 			struct cfg80211_ap_settings *settings)
5090 {
5091 	s32 ie_offset;
5092 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5093 	struct brcmf_if *ifp = netdev_priv(ndev);
5094 	struct brcmf_pub *drvr = cfg->pub;
5095 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5096 	struct cfg80211_crypto_settings *crypto = &settings->crypto;
5097 	const struct brcmf_tlv *ssid_ie;
5098 	const struct brcmf_tlv *country_ie;
5099 	struct brcmf_ssid_le ssid_le;
5100 	s32 err = -EPERM;
5101 	struct brcmf_join_params join_params;
5102 	enum nl80211_iftype dev_role;
5103 	struct brcmf_fil_bss_enable_le bss_enable;
5104 	u16 chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
5105 	bool mbss;
5106 	int is_11d;
5107 	bool supports_11d;
5108 
5109 	brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
5110 		  settings->chandef.chan->hw_value,
5111 		  settings->chandef.center_freq1, settings->chandef.width,
5112 		  settings->beacon_interval, settings->dtim_period);
5113 	brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
5114 		  settings->ssid, settings->ssid_len, settings->auth_type,
5115 		  settings->inactivity_timeout);
5116 	dev_role = ifp->vif->wdev.iftype;
5117 	mbss = ifp->vif->mbss;
5118 
5119 	/* store current 11d setting */
5120 	if (brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY,
5121 				  &ifp->vif->is_11d)) {
5122 		is_11d = supports_11d = false;
5123 	} else {
5124 		country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
5125 					      settings->beacon.tail_len,
5126 					      WLAN_EID_COUNTRY);
5127 		is_11d = country_ie ? 1 : 0;
5128 		supports_11d = true;
5129 	}
5130 
5131 	memset(&ssid_le, 0, sizeof(ssid_le));
5132 	if (settings->ssid == NULL || settings->ssid_len == 0) {
5133 		ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
5134 		ssid_ie = brcmf_parse_tlvs(
5135 				(u8 *)&settings->beacon.head[ie_offset],
5136 				settings->beacon.head_len - ie_offset,
5137 				WLAN_EID_SSID);
5138 		if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
5139 			return -EINVAL;
5140 
5141 		memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
5142 		ssid_le.SSID_len = cpu_to_le32(ssid_ie->len);
5143 		brcmf_dbg(TRACE, "SSID is (%s) in Head\n", ssid_le.SSID);
5144 	} else {
5145 		memcpy(ssid_le.SSID, settings->ssid, settings->ssid_len);
5146 		ssid_le.SSID_len = cpu_to_le32((u32)settings->ssid_len);
5147 	}
5148 
5149 	if (!mbss) {
5150 		brcmf_set_mpc(ifp, 0);
5151 		brcmf_configure_arp_nd_offload(ifp, false);
5152 	}
5153 
5154 	/* Parameters shared by all radio interfaces */
5155 	if (!mbss) {
5156 		if ((supports_11d) && (is_11d != ifp->vif->is_11d)) {
5157 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5158 						    is_11d);
5159 			if (err < 0) {
5160 				bphy_err(drvr, "Regulatory Set Error, %d\n",
5161 					 err);
5162 				goto exit;
5163 			}
5164 		}
5165 		if (settings->beacon_interval) {
5166 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
5167 						    settings->beacon_interval);
5168 			if (err < 0) {
5169 				bphy_err(drvr, "Beacon Interval Set Error, %d\n",
5170 					 err);
5171 				goto exit;
5172 			}
5173 		}
5174 		if (settings->dtim_period) {
5175 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_DTIMPRD,
5176 						    settings->dtim_period);
5177 			if (err < 0) {
5178 				bphy_err(drvr, "DTIM Interval Set Error, %d\n",
5179 					 err);
5180 				goto exit;
5181 			}
5182 		}
5183 
5184 		if ((dev_role == NL80211_IFTYPE_AP) &&
5185 		    ((ifp->ifidx == 0) ||
5186 		     (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB) &&
5187 		      !brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN)))) {
5188 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5189 			if (err < 0) {
5190 				bphy_err(drvr, "BRCMF_C_DOWN error %d\n",
5191 					 err);
5192 				goto exit;
5193 			}
5194 			brcmf_fil_iovar_int_set(ifp, "apsta", 0);
5195 		}
5196 
5197 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
5198 		if (err < 0) {
5199 			bphy_err(drvr, "SET INFRA error %d\n", err);
5200 			goto exit;
5201 		}
5202 	} else if (WARN_ON(supports_11d && (is_11d != ifp->vif->is_11d))) {
5203 		/* Multiple-BSS should use same 11d configuration */
5204 		err = -EINVAL;
5205 		goto exit;
5206 	}
5207 
5208 	/* Interface specific setup */
5209 	if (dev_role == NL80211_IFTYPE_AP) {
5210 		if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
5211 			brcmf_fil_iovar_int_set(ifp, "mbss", 1);
5212 
5213 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
5214 		if (err < 0) {
5215 			bphy_err(drvr, "setting AP mode failed %d\n",
5216 				 err);
5217 			goto exit;
5218 		}
5219 		if (!mbss) {
5220 			/* Firmware 10.x requires setting channel after enabling
5221 			 * AP and before bringing interface up.
5222 			 */
5223 			err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5224 			if (err < 0) {
5225 				bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5226 					 chanspec, err);
5227 				goto exit;
5228 			}
5229 		}
5230 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5231 		if (err < 0) {
5232 			bphy_err(drvr, "BRCMF_C_UP error (%d)\n", err);
5233 			goto exit;
5234 		}
5235 
5236 		if (crypto->psk) {
5237 			brcmf_dbg(INFO, "using PSK offload\n");
5238 			profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_PSK);
5239 			err = brcmf_set_pmk(ifp, crypto->psk,
5240 					    BRCMF_WSEC_MAX_PSK_LEN);
5241 			if (err < 0)
5242 				goto exit;
5243 		}
5244 		if (crypto->sae_pwd) {
5245 			brcmf_dbg(INFO, "using SAE offload\n");
5246 			profile->use_fwauth |= BIT(BRCMF_PROFILE_FWAUTH_SAE);
5247 			err = brcmf_fwvid_set_sae_password(ifp, crypto);
5248 			if (err < 0)
5249 				goto exit;
5250 		}
5251 		if (profile->use_fwauth == 0)
5252 			profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5253 
5254 		err = brcmf_parse_configure_security(ifp, settings,
5255 						     NL80211_IFTYPE_AP);
5256 		if (err < 0) {
5257 			bphy_err(drvr, "brcmf_parse_configure_security error\n");
5258 			goto exit;
5259 		}
5260 
5261 		/* On DOWN the firmware removes the WEP keys, reconfigure
5262 		 * them if they were set.
5263 		 */
5264 		brcmf_cfg80211_reconfigure_wep(ifp);
5265 
5266 		memset(&join_params, 0, sizeof(join_params));
5267 		/* join parameters starts with ssid */
5268 		memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
5269 		/* create softap */
5270 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5271 					     &join_params, sizeof(join_params));
5272 		if (err < 0) {
5273 			bphy_err(drvr, "SET SSID error (%d)\n", err);
5274 			goto exit;
5275 		}
5276 
5277 		err = brcmf_fil_iovar_int_set(ifp, "closednet",
5278 					      settings->hidden_ssid);
5279 		if (err) {
5280 			bphy_err(drvr, "%s closednet error (%d)\n",
5281 				 settings->hidden_ssid ?
5282 				 "enabled" : "disabled",
5283 				 err);
5284 			goto exit;
5285 		}
5286 
5287 		brcmf_dbg(TRACE, "AP mode configuration complete\n");
5288 	} else if (dev_role == NL80211_IFTYPE_P2P_GO) {
5289 		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
5290 		if (err < 0) {
5291 			bphy_err(drvr, "Set Channel failed: chspec=%d, %d\n",
5292 				 chanspec, err);
5293 			goto exit;
5294 		}
5295 
5296 		err = brcmf_parse_configure_security(ifp, settings,
5297 						     NL80211_IFTYPE_P2P_GO);
5298 		if (err < 0) {
5299 			brcmf_err("brcmf_parse_configure_security error\n");
5300 			goto exit;
5301 		}
5302 
5303 		err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
5304 						sizeof(ssid_le));
5305 		if (err < 0) {
5306 			bphy_err(drvr, "setting ssid failed %d\n", err);
5307 			goto exit;
5308 		}
5309 		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5310 		bss_enable.enable = cpu_to_le32(1);
5311 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5312 					       sizeof(bss_enable));
5313 		if (err < 0) {
5314 			bphy_err(drvr, "bss_enable config failed %d\n", err);
5315 			goto exit;
5316 		}
5317 
5318 		brcmf_dbg(TRACE, "GO mode configuration complete\n");
5319 	} else {
5320 		WARN_ON(1);
5321 	}
5322 
5323 	brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
5324 	set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5325 	brcmf_net_setcarrier(ifp, true);
5326 
5327 exit:
5328 	if ((err) && (!mbss)) {
5329 		brcmf_set_mpc(ifp, 1);
5330 		brcmf_configure_arp_nd_offload(ifp, true);
5331 	}
5332 	return err;
5333 }
5334 
5335 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev,
5336 				  unsigned int link_id)
5337 {
5338 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5339 	struct brcmf_if *ifp = netdev_priv(ndev);
5340 	struct brcmf_pub *drvr = cfg->pub;
5341 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
5342 	s32 err;
5343 	struct brcmf_fil_bss_enable_le bss_enable;
5344 	struct brcmf_join_params join_params;
5345 
5346 	brcmf_dbg(TRACE, "Enter\n");
5347 
5348 	if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
5349 		/* Due to most likely deauths outstanding we sleep */
5350 		/* first to make sure they get processed by fw. */
5351 		msleep(400);
5352 
5353 		if (profile->use_fwauth != BIT(BRCMF_PROFILE_FWAUTH_NONE)) {
5354 			struct cfg80211_crypto_settings crypto = {};
5355 
5356 			if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_PSK))
5357 				brcmf_set_pmk(ifp, NULL, 0);
5358 			if (profile->use_fwauth & BIT(BRCMF_PROFILE_FWAUTH_SAE))
5359 				brcmf_fwvid_set_sae_password(ifp, &crypto);
5360 			profile->use_fwauth = BIT(BRCMF_PROFILE_FWAUTH_NONE);
5361 		}
5362 
5363 		if (ifp->vif->mbss) {
5364 			err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5365 			return err;
5366 		}
5367 
5368 		/* First BSS doesn't get a full reset */
5369 		if (ifp->bsscfgidx == 0)
5370 			brcmf_fil_iovar_int_set(ifp, "closednet", 0);
5371 
5372 		memset(&join_params, 0, sizeof(join_params));
5373 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
5374 					     &join_params, sizeof(join_params));
5375 		if (err < 0)
5376 			bphy_err(drvr, "SET SSID error (%d)\n", err);
5377 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
5378 		if (err < 0)
5379 			bphy_err(drvr, "BRCMF_C_DOWN error %d\n", err);
5380 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
5381 		if (err < 0)
5382 			bphy_err(drvr, "setting AP mode failed %d\n", err);
5383 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
5384 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
5385 		brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
5386 				      ifp->vif->is_11d);
5387 		/* Bring device back up so it can be used again */
5388 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
5389 		if (err < 0)
5390 			bphy_err(drvr, "BRCMF_C_UP error %d\n", err);
5391 
5392 		brcmf_vif_clear_mgmt_ies(ifp->vif);
5393 	} else {
5394 		bss_enable.bsscfgidx = cpu_to_le32(ifp->bsscfgidx);
5395 		bss_enable.enable = cpu_to_le32(0);
5396 		err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
5397 					       sizeof(bss_enable));
5398 		if (err < 0)
5399 			bphy_err(drvr, "bss_enable config failed %d\n", err);
5400 	}
5401 	brcmf_set_mpc(ifp, 1);
5402 	brcmf_configure_arp_nd_offload(ifp, true);
5403 	clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
5404 	brcmf_net_setcarrier(ifp, false);
5405 
5406 	return err;
5407 }
5408 
5409 static s32
5410 brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
5411 			     struct cfg80211_beacon_data *info)
5412 {
5413 	struct brcmf_if *ifp = netdev_priv(ndev);
5414 
5415 	brcmf_dbg(TRACE, "Enter\n");
5416 
5417 	return brcmf_config_ap_mgmt_ie(ifp->vif, info);
5418 }
5419 
5420 static int
5421 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
5422 			   struct station_del_parameters *params)
5423 {
5424 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5425 	struct brcmf_pub *drvr = cfg->pub;
5426 	struct brcmf_scb_val_le scbval;
5427 	struct brcmf_if *ifp = netdev_priv(ndev);
5428 	s32 err;
5429 
5430 	if (!params->mac)
5431 		return -EFAULT;
5432 
5433 	brcmf_dbg(TRACE, "Enter %pM\n", params->mac);
5434 
5435 	if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
5436 		ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
5437 	if (!check_vif_up(ifp->vif))
5438 		return -EIO;
5439 
5440 	memcpy(&scbval.ea, params->mac, ETH_ALEN);
5441 	scbval.val = cpu_to_le32(params->reason_code);
5442 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON,
5443 				     &scbval, sizeof(scbval));
5444 	if (err)
5445 		bphy_err(drvr, "SCB_DEAUTHENTICATE_FOR_REASON failed %d\n",
5446 			 err);
5447 
5448 	brcmf_dbg(TRACE, "Exit\n");
5449 	return err;
5450 }
5451 
5452 static int
5453 brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
5454 			      const u8 *mac, struct station_parameters *params)
5455 {
5456 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5457 	struct brcmf_pub *drvr = cfg->pub;
5458 	struct brcmf_if *ifp = netdev_priv(ndev);
5459 	s32 err;
5460 
5461 	brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
5462 		  params->sta_flags_mask, params->sta_flags_set);
5463 
5464 	/* Ignore all 00 MAC */
5465 	if (is_zero_ether_addr(mac))
5466 		return 0;
5467 
5468 	if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5469 		return 0;
5470 
5471 	if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
5472 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
5473 					     (void *)mac, ETH_ALEN);
5474 	else
5475 		err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
5476 					     (void *)mac, ETH_ALEN);
5477 	if (err < 0)
5478 		bphy_err(drvr, "Setting SCB (de-)authorize failed, %d\n", err);
5479 
5480 	return err;
5481 }
5482 
5483 static void
5484 brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
5485 					       struct wireless_dev *wdev,
5486 					       struct mgmt_frame_regs *upd)
5487 {
5488 	struct brcmf_cfg80211_vif *vif;
5489 
5490 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5491 
5492 	vif->mgmt_rx_reg = upd->interface_stypes;
5493 }
5494 
5495 
5496 static int
5497 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
5498 		       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
5499 {
5500 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5501 	struct ieee80211_channel *chan = params->chan;
5502 	struct brcmf_pub *drvr = cfg->pub;
5503 	const u8 *buf = params->buf;
5504 	size_t len = params->len;
5505 	const struct ieee80211_mgmt *mgmt;
5506 	struct brcmf_cfg80211_vif *vif;
5507 	s32 err = 0;
5508 	s32 ie_offset;
5509 	s32 ie_len;
5510 	struct brcmf_fil_action_frame_le *action_frame;
5511 	struct brcmf_fil_af_params_le *af_params;
5512 	bool ack;
5513 	s32 chan_nr;
5514 	u32 freq;
5515 
5516 	brcmf_dbg(TRACE, "Enter\n");
5517 
5518 	*cookie = 0;
5519 
5520 	mgmt = (const struct ieee80211_mgmt *)buf;
5521 
5522 	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
5523 		bphy_err(drvr, "Driver only allows MGMT packet type\n");
5524 		return -EPERM;
5525 	}
5526 
5527 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5528 
5529 	if (ieee80211_is_probe_resp(mgmt->frame_control)) {
5530 		/* Right now the only reason to get a probe response */
5531 		/* is for p2p listen response or for p2p GO from     */
5532 		/* wpa_supplicant. Unfortunately the probe is send   */
5533 		/* on primary ndev, while dongle wants it on the p2p */
5534 		/* vif. Since this is only reason for a probe        */
5535 		/* response to be sent, the vif is taken from cfg.   */
5536 		/* If ever desired to send proberesp for non p2p     */
5537 		/* response then data should be checked for          */
5538 		/* "DIRECT-". Note in future supplicant will take    */
5539 		/* dedicated p2p wdev to do this and then this 'hack'*/
5540 		/* is not needed anymore.                            */
5541 		ie_offset =  DOT11_MGMT_HDR_LEN +
5542 			     DOT11_BCN_PRB_FIXED_LEN;
5543 		ie_len = len - ie_offset;
5544 		if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
5545 			vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5546 		err = brcmf_vif_set_mgmt_ie(vif,
5547 					    BRCMF_VNDR_IE_PRBRSP_FLAG,
5548 					    &buf[ie_offset],
5549 					    ie_len);
5550 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
5551 					GFP_KERNEL);
5552 	} else if (ieee80211_is_action(mgmt->frame_control)) {
5553 		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
5554 			bphy_err(drvr, "invalid action frame length\n");
5555 			err = -EINVAL;
5556 			goto exit;
5557 		}
5558 		af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
5559 		if (af_params == NULL) {
5560 			bphy_err(drvr, "unable to allocate frame\n");
5561 			err = -ENOMEM;
5562 			goto exit;
5563 		}
5564 		action_frame = &af_params->action_frame;
5565 		/* Add the packet Id */
5566 		action_frame->packet_id = cpu_to_le32(*cookie);
5567 		/* Add BSSID */
5568 		memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
5569 		memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
5570 		/* Add the length exepted for 802.11 header  */
5571 		action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
5572 		/* Add the channel. Use the one specified as parameter if any or
5573 		 * the current one (got from the firmware) otherwise
5574 		 */
5575 		if (chan)
5576 			freq = chan->center_freq;
5577 		else
5578 			brcmf_fil_cmd_int_get(vif->ifp, BRCMF_C_GET_CHANNEL,
5579 					      &freq);
5580 		chan_nr = ieee80211_frequency_to_channel(freq);
5581 		af_params->channel = cpu_to_le32(chan_nr);
5582 		af_params->dwell_time = cpu_to_le32(params->wait);
5583 		memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
5584 		       le16_to_cpu(action_frame->len));
5585 
5586 		brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
5587 			  *cookie, le16_to_cpu(action_frame->len), freq);
5588 
5589 		ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5590 						  af_params);
5591 
5592 		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
5593 					GFP_KERNEL);
5594 		kfree(af_params);
5595 	} else {
5596 		brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
5597 		brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
5598 	}
5599 
5600 exit:
5601 	return err;
5602 }
5603 
5604 static int brcmf_cfg80211_set_cqm_rssi_range_config(struct wiphy *wiphy,
5605 						    struct net_device *ndev,
5606 						    s32 rssi_low, s32 rssi_high)
5607 {
5608 	struct brcmf_cfg80211_vif *vif;
5609 	struct brcmf_if *ifp;
5610 	int err = 0;
5611 
5612 	brcmf_dbg(TRACE, "low=%d high=%d", rssi_low, rssi_high);
5613 
5614 	ifp = netdev_priv(ndev);
5615 	vif = ifp->vif;
5616 
5617 	if (rssi_low != vif->cqm_rssi_low || rssi_high != vif->cqm_rssi_high) {
5618 		/* The firmware will send an event when the RSSI is less than or
5619 		 * equal to a configured level and the previous RSSI event was
5620 		 * less than or equal to a different level. Set a third level
5621 		 * so that we also detect the transition from rssi <= rssi_high
5622 		 * to rssi > rssi_high.
5623 		 */
5624 		struct brcmf_rssi_event_le config = {
5625 			.rate_limit_msec = cpu_to_le32(0),
5626 			.rssi_level_num = 3,
5627 			.rssi_levels = {
5628 				clamp_val(rssi_low, S8_MIN, S8_MAX - 2),
5629 				clamp_val(rssi_high, S8_MIN + 1, S8_MAX - 1),
5630 				S8_MAX,
5631 			},
5632 		};
5633 
5634 		err = brcmf_fil_iovar_data_set(ifp, "rssi_event", &config,
5635 					       sizeof(config));
5636 		if (err) {
5637 			err = -EINVAL;
5638 		} else {
5639 			vif->cqm_rssi_low = rssi_low;
5640 			vif->cqm_rssi_high = rssi_high;
5641 		}
5642 	}
5643 
5644 	return err;
5645 }
5646 
5647 static int
5648 brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
5649 					struct wireless_dev *wdev,
5650 					u64 cookie)
5651 {
5652 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5653 	struct brcmf_pub *drvr = cfg->pub;
5654 	struct brcmf_cfg80211_vif *vif;
5655 	int err = 0;
5656 
5657 	brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
5658 
5659 	vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
5660 	if (vif == NULL) {
5661 		bphy_err(drvr, "No p2p device available for probe response\n");
5662 		err = -ENODEV;
5663 		goto exit;
5664 	}
5665 	brcmf_p2p_cancel_remain_on_channel(vif->ifp);
5666 exit:
5667 	return err;
5668 }
5669 
5670 static int brcmf_cfg80211_get_channel(struct wiphy *wiphy,
5671 				      struct wireless_dev *wdev,
5672 				      unsigned int link_id,
5673 				      struct cfg80211_chan_def *chandef)
5674 {
5675 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5676 	struct net_device *ndev = wdev->netdev;
5677 	struct brcmf_pub *drvr = cfg->pub;
5678 	struct brcmu_chan ch;
5679 	enum nl80211_band band = 0;
5680 	enum nl80211_chan_width width = 0;
5681 	u32 chanspec;
5682 	int freq, err;
5683 
5684 	if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
5685 		return -ENODEV;
5686 
5687 	err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
5688 	if (err) {
5689 		bphy_err(drvr, "chanspec failed (%d)\n", err);
5690 		return err;
5691 	}
5692 
5693 	ch.chspec = chanspec;
5694 	cfg->d11inf.decchspec(&ch);
5695 
5696 	switch (ch.band) {
5697 	case BRCMU_CHAN_BAND_2G:
5698 		band = NL80211_BAND_2GHZ;
5699 		break;
5700 	case BRCMU_CHAN_BAND_5G:
5701 		band = NL80211_BAND_5GHZ;
5702 		break;
5703 	}
5704 
5705 	switch (ch.bw) {
5706 	case BRCMU_CHAN_BW_80:
5707 		width = NL80211_CHAN_WIDTH_80;
5708 		break;
5709 	case BRCMU_CHAN_BW_40:
5710 		width = NL80211_CHAN_WIDTH_40;
5711 		break;
5712 	case BRCMU_CHAN_BW_20:
5713 		width = NL80211_CHAN_WIDTH_20;
5714 		break;
5715 	case BRCMU_CHAN_BW_80P80:
5716 		width = NL80211_CHAN_WIDTH_80P80;
5717 		break;
5718 	case BRCMU_CHAN_BW_160:
5719 		width = NL80211_CHAN_WIDTH_160;
5720 		break;
5721 	}
5722 
5723 	freq = ieee80211_channel_to_frequency(ch.control_ch_num, band);
5724 	chandef->chan = ieee80211_get_channel(wiphy, freq);
5725 	chandef->width = width;
5726 	chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band);
5727 	chandef->center_freq2 = 0;
5728 
5729 	return 0;
5730 }
5731 
5732 static int brcmf_cfg80211_crit_proto_start(struct wiphy *wiphy,
5733 					   struct wireless_dev *wdev,
5734 					   enum nl80211_crit_proto_id proto,
5735 					   u16 duration)
5736 {
5737 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5738 	struct brcmf_cfg80211_vif *vif;
5739 
5740 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5741 
5742 	/* only DHCP support for now */
5743 	if (proto != NL80211_CRIT_PROTO_DHCP)
5744 		return -EINVAL;
5745 
5746 	/* suppress and abort scanning */
5747 	set_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5748 	brcmf_abort_scanning(cfg);
5749 
5750 	return brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_DISABLED, duration);
5751 }
5752 
5753 static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
5754 					   struct wireless_dev *wdev)
5755 {
5756 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5757 	struct brcmf_cfg80211_vif *vif;
5758 
5759 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
5760 
5761 	brcmf_btcoex_set_mode(vif, BRCMF_BTCOEX_ENABLED, 0);
5762 	clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
5763 }
5764 
5765 static s32
5766 brcmf_notify_tdls_peer_event(struct brcmf_if *ifp,
5767 			     const struct brcmf_event_msg *e, void *data)
5768 {
5769 	switch (e->reason) {
5770 	case BRCMF_E_REASON_TDLS_PEER_DISCOVERED:
5771 		brcmf_dbg(TRACE, "TDLS Peer Discovered\n");
5772 		break;
5773 	case BRCMF_E_REASON_TDLS_PEER_CONNECTED:
5774 		brcmf_dbg(TRACE, "TDLS Peer Connected\n");
5775 		brcmf_proto_add_tdls_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5776 		break;
5777 	case BRCMF_E_REASON_TDLS_PEER_DISCONNECTED:
5778 		brcmf_dbg(TRACE, "TDLS Peer Disconnected\n");
5779 		brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
5780 		break;
5781 	}
5782 
5783 	return 0;
5784 }
5785 
5786 static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
5787 {
5788 	int ret;
5789 
5790 	switch (oper) {
5791 	case NL80211_TDLS_DISCOVERY_REQ:
5792 		ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
5793 		break;
5794 	case NL80211_TDLS_SETUP:
5795 		ret = BRCMF_TDLS_MANUAL_EP_CREATE;
5796 		break;
5797 	case NL80211_TDLS_TEARDOWN:
5798 		ret = BRCMF_TDLS_MANUAL_EP_DELETE;
5799 		break;
5800 	default:
5801 		brcmf_err("unsupported operation: %d\n", oper);
5802 		ret = -EOPNOTSUPP;
5803 	}
5804 	return ret;
5805 }
5806 
5807 static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
5808 				    struct net_device *ndev, const u8 *peer,
5809 				    enum nl80211_tdls_operation oper)
5810 {
5811 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5812 	struct brcmf_pub *drvr = cfg->pub;
5813 	struct brcmf_if *ifp;
5814 	struct brcmf_tdls_iovar_le info;
5815 	int ret = 0;
5816 
5817 	ret = brcmf_convert_nl80211_tdls_oper(oper);
5818 	if (ret < 0)
5819 		return ret;
5820 
5821 	ifp = netdev_priv(ndev);
5822 	memset(&info, 0, sizeof(info));
5823 	info.mode = (u8)ret;
5824 	if (peer)
5825 		memcpy(info.ea, peer, ETH_ALEN);
5826 
5827 	ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
5828 				       &info, sizeof(info));
5829 	if (ret < 0)
5830 		bphy_err(drvr, "tdls_endpoint iovar failed: ret=%d\n", ret);
5831 
5832 	return ret;
5833 }
5834 
5835 static int
5836 brcmf_cfg80211_update_conn_params(struct wiphy *wiphy,
5837 				  struct net_device *ndev,
5838 				  struct cfg80211_connect_params *sme,
5839 				  u32 changed)
5840 {
5841 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5842 	struct brcmf_pub *drvr = cfg->pub;
5843 	struct brcmf_if *ifp;
5844 	int err;
5845 
5846 	if (!(changed & UPDATE_ASSOC_IES))
5847 		return 0;
5848 
5849 	ifp = netdev_priv(ndev);
5850 	err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
5851 				    sme->ie, sme->ie_len);
5852 	if (err)
5853 		bphy_err(drvr, "Set Assoc REQ IE Failed\n");
5854 	else
5855 		brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
5856 
5857 	return err;
5858 }
5859 
5860 #ifdef CONFIG_PM
5861 static int
5862 brcmf_cfg80211_set_rekey_data(struct wiphy *wiphy, struct net_device *ndev,
5863 			      struct cfg80211_gtk_rekey_data *gtk)
5864 {
5865 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
5866 	struct brcmf_pub *drvr = cfg->pub;
5867 	struct brcmf_if *ifp = netdev_priv(ndev);
5868 	struct brcmf_gtk_keyinfo_le gtk_le;
5869 	int ret;
5870 
5871 	brcmf_dbg(TRACE, "Enter, bssidx=%d\n", ifp->bsscfgidx);
5872 
5873 	memcpy(gtk_le.kck, gtk->kck, sizeof(gtk_le.kck));
5874 	memcpy(gtk_le.kek, gtk->kek, sizeof(gtk_le.kek));
5875 	memcpy(gtk_le.replay_counter, gtk->replay_ctr,
5876 	       sizeof(gtk_le.replay_counter));
5877 
5878 	ret = brcmf_fil_iovar_data_set(ifp, "gtk_key_info", &gtk_le,
5879 				       sizeof(gtk_le));
5880 	if (ret < 0)
5881 		bphy_err(drvr, "gtk_key_info iovar failed: ret=%d\n", ret);
5882 
5883 	return ret;
5884 }
5885 #endif
5886 
5887 static int brcmf_cfg80211_set_pmk(struct wiphy *wiphy, struct net_device *dev,
5888 				  const struct cfg80211_pmk_conf *conf)
5889 {
5890 	struct brcmf_if *ifp;
5891 
5892 	brcmf_dbg(TRACE, "enter\n");
5893 
5894 	/* expect using firmware supplicant for 1X */
5895 	ifp = netdev_priv(dev);
5896 	if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5897 		return -EINVAL;
5898 
5899 	if (conf->pmk_len > BRCMF_WSEC_MAX_PSK_LEN)
5900 		return -ERANGE;
5901 
5902 	return brcmf_set_pmk(ifp, conf->pmk, conf->pmk_len);
5903 }
5904 
5905 static int brcmf_cfg80211_del_pmk(struct wiphy *wiphy, struct net_device *dev,
5906 				  const u8 *aa)
5907 {
5908 	struct brcmf_if *ifp;
5909 
5910 	brcmf_dbg(TRACE, "enter\n");
5911 	ifp = netdev_priv(dev);
5912 	if (WARN_ON(ifp->vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_1X))
5913 		return -EINVAL;
5914 
5915 	return brcmf_set_pmk(ifp, NULL, 0);
5916 }
5917 
5918 static struct cfg80211_ops brcmf_cfg80211_ops = {
5919 	.add_virtual_intf = brcmf_cfg80211_add_iface,
5920 	.del_virtual_intf = brcmf_cfg80211_del_iface,
5921 	.change_virtual_intf = brcmf_cfg80211_change_iface,
5922 	.scan = brcmf_cfg80211_scan,
5923 	.set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
5924 	.join_ibss = brcmf_cfg80211_join_ibss,
5925 	.leave_ibss = brcmf_cfg80211_leave_ibss,
5926 	.get_station = brcmf_cfg80211_get_station,
5927 	.dump_station = brcmf_cfg80211_dump_station,
5928 	.set_tx_power = brcmf_cfg80211_set_tx_power,
5929 	.get_tx_power = brcmf_cfg80211_get_tx_power,
5930 	.add_key = brcmf_cfg80211_add_key,
5931 	.del_key = brcmf_cfg80211_del_key,
5932 	.get_key = brcmf_cfg80211_get_key,
5933 	.set_default_key = brcmf_cfg80211_config_default_key,
5934 	.set_default_mgmt_key = brcmf_cfg80211_config_default_mgmt_key,
5935 	.set_power_mgmt = brcmf_cfg80211_set_power_mgmt,
5936 	.connect = brcmf_cfg80211_connect,
5937 	.disconnect = brcmf_cfg80211_disconnect,
5938 	.suspend = brcmf_cfg80211_suspend,
5939 	.resume = brcmf_cfg80211_resume,
5940 	.set_pmksa = brcmf_cfg80211_set_pmksa,
5941 	.del_pmksa = brcmf_cfg80211_del_pmksa,
5942 	.flush_pmksa = brcmf_cfg80211_flush_pmksa,
5943 	.start_ap = brcmf_cfg80211_start_ap,
5944 	.stop_ap = brcmf_cfg80211_stop_ap,
5945 	.change_beacon = brcmf_cfg80211_change_beacon,
5946 	.del_station = brcmf_cfg80211_del_station,
5947 	.change_station = brcmf_cfg80211_change_station,
5948 	.sched_scan_start = brcmf_cfg80211_sched_scan_start,
5949 	.sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
5950 	.update_mgmt_frame_registrations =
5951 		brcmf_cfg80211_update_mgmt_frame_registrations,
5952 	.mgmt_tx = brcmf_cfg80211_mgmt_tx,
5953 	.set_cqm_rssi_range_config = brcmf_cfg80211_set_cqm_rssi_range_config,
5954 	.remain_on_channel = brcmf_p2p_remain_on_channel,
5955 	.cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
5956 	.get_channel = brcmf_cfg80211_get_channel,
5957 	.start_p2p_device = brcmf_p2p_start_device,
5958 	.stop_p2p_device = brcmf_p2p_stop_device,
5959 	.crit_proto_start = brcmf_cfg80211_crit_proto_start,
5960 	.crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
5961 	.tdls_oper = brcmf_cfg80211_tdls_oper,
5962 	.update_connect_params = brcmf_cfg80211_update_conn_params,
5963 	.set_pmk = brcmf_cfg80211_set_pmk,
5964 	.del_pmk = brcmf_cfg80211_del_pmk,
5965 };
5966 
5967 struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
5968 {
5969 	struct cfg80211_ops *ops;
5970 
5971 	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
5972 		       GFP_KERNEL);
5973 
5974 	if (ops && settings->roamoff)
5975 		ops->update_connect_params = NULL;
5976 
5977 	return ops;
5978 }
5979 
5980 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
5981 					   enum nl80211_iftype type)
5982 {
5983 	struct brcmf_cfg80211_vif *vif_walk;
5984 	struct brcmf_cfg80211_vif *vif;
5985 	bool mbss;
5986 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
5987 
5988 	brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
5989 		  sizeof(*vif));
5990 	vif = kzalloc(sizeof(*vif), GFP_KERNEL);
5991 	if (!vif)
5992 		return ERR_PTR(-ENOMEM);
5993 
5994 	vif->wdev.wiphy = cfg->wiphy;
5995 	vif->wdev.iftype = type;
5996 
5997 	brcmf_init_prof(&vif->profile);
5998 
5999 	if (type == NL80211_IFTYPE_AP &&
6000 	    brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) {
6001 		mbss = false;
6002 		list_for_each_entry(vif_walk, &cfg->vif_list, list) {
6003 			if (vif_walk->wdev.iftype == NL80211_IFTYPE_AP) {
6004 				mbss = true;
6005 				break;
6006 			}
6007 		}
6008 		vif->mbss = mbss;
6009 	}
6010 
6011 	list_add_tail(&vif->list, &cfg->vif_list);
6012 	return vif;
6013 }
6014 
6015 void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
6016 {
6017 	list_del(&vif->list);
6018 	kfree(vif);
6019 }
6020 
6021 void brcmf_cfg80211_free_netdev(struct net_device *ndev)
6022 {
6023 	struct brcmf_cfg80211_vif *vif;
6024 	struct brcmf_if *ifp;
6025 
6026 	ifp = netdev_priv(ndev);
6027 	vif = ifp->vif;
6028 
6029 	if (vif)
6030 		brcmf_free_vif(vif);
6031 }
6032 
6033 static bool brcmf_is_linkup(struct brcmf_cfg80211_vif *vif,
6034 			    const struct brcmf_event_msg *e)
6035 {
6036 	u32 event = e->event_code;
6037 	u32 status = e->status;
6038 
6039 	if ((vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_PSK ||
6040 	     vif->profile.use_fwsup == BRCMF_PROFILE_FWSUP_SAE) &&
6041 	    event == BRCMF_E_PSK_SUP &&
6042 	    status == BRCMF_E_STATUS_FWSUP_COMPLETED)
6043 		set_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6044 	if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
6045 		brcmf_dbg(CONN, "Processing set ssid\n");
6046 		memcpy(vif->profile.bssid, e->addr, ETH_ALEN);
6047 		if (vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_PSK &&
6048 		    vif->profile.use_fwsup != BRCMF_PROFILE_FWSUP_SAE)
6049 			return true;
6050 
6051 		set_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6052 	}
6053 
6054 	if (test_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state) &&
6055 	    test_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state)) {
6056 		clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6057 		clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6058 		return true;
6059 	}
6060 	return false;
6061 }
6062 
6063 static bool brcmf_is_linkdown(struct brcmf_cfg80211_vif *vif,
6064 			    const struct brcmf_event_msg *e)
6065 {
6066 	u32 event = e->event_code;
6067 	u16 flags = e->flags;
6068 
6069 	if ((event == BRCMF_E_DEAUTH) || (event == BRCMF_E_DEAUTH_IND) ||
6070 	    (event == BRCMF_E_DISASSOC_IND) ||
6071 	    ((event == BRCMF_E_LINK) && (!(flags & BRCMF_EVENT_MSG_LINK)))) {
6072 		brcmf_dbg(CONN, "Processing link down\n");
6073 		clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS, &vif->sme_state);
6074 		clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS, &vif->sme_state);
6075 		return true;
6076 	}
6077 	return false;
6078 }
6079 
6080 static bool brcmf_is_nonetwork(struct brcmf_cfg80211_info *cfg,
6081 			       const struct brcmf_event_msg *e)
6082 {
6083 	u32 event = e->event_code;
6084 	u32 status = e->status;
6085 
6086 	if (event == BRCMF_E_LINK && status == BRCMF_E_STATUS_NO_NETWORKS) {
6087 		brcmf_dbg(CONN, "Processing Link %s & no network found\n",
6088 			  e->flags & BRCMF_EVENT_MSG_LINK ? "up" : "down");
6089 		return true;
6090 	}
6091 
6092 	if (event == BRCMF_E_SET_SSID && status != BRCMF_E_STATUS_SUCCESS) {
6093 		brcmf_dbg(CONN, "Processing connecting & no network found\n");
6094 		return true;
6095 	}
6096 
6097 	if (event == BRCMF_E_PSK_SUP &&
6098 	    status != BRCMF_E_STATUS_FWSUP_COMPLETED) {
6099 		brcmf_dbg(CONN, "Processing failed supplicant state: %u\n",
6100 			  status);
6101 		return true;
6102 	}
6103 
6104 	return false;
6105 }
6106 
6107 static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
6108 {
6109 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6110 
6111 	kfree(conn_info->req_ie);
6112 	conn_info->req_ie = NULL;
6113 	conn_info->req_ie_len = 0;
6114 	kfree(conn_info->resp_ie);
6115 	conn_info->resp_ie = NULL;
6116 	conn_info->resp_ie_len = 0;
6117 }
6118 
6119 u8 brcmf_map_prio_to_prec(void *config, u8 prio)
6120 {
6121 	struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6122 
6123 	if (!cfg)
6124 		return (prio == PRIO_8021D_NONE || prio == PRIO_8021D_BE) ?
6125 		       (prio ^ 2) : prio;
6126 
6127 	/* For those AC(s) with ACM flag set to 1, convert its 4-level priority
6128 	 * to an 8-level precedence which is the same as BE's
6129 	 */
6130 	if (prio > PRIO_8021D_EE &&
6131 	    cfg->ac_priority[prio] == cfg->ac_priority[PRIO_8021D_BE])
6132 		return cfg->ac_priority[prio] * 2;
6133 
6134 	/* Conversion of 4-level priority to 8-level precedence */
6135 	if (prio == PRIO_8021D_BE || prio == PRIO_8021D_BK ||
6136 	    prio == PRIO_8021D_CL || prio == PRIO_8021D_VO)
6137 		return cfg->ac_priority[prio] * 2;
6138 	else
6139 		return cfg->ac_priority[prio] * 2 + 1;
6140 }
6141 
6142 u8 brcmf_map_prio_to_aci(void *config, u8 prio)
6143 {
6144 	/* Prio here refers to the 802.1d priority in range of 0 to 7.
6145 	 * ACI here refers to the WLAN AC Index in range of 0 to 3.
6146 	 * This function will return ACI corresponding to input prio.
6147 	 */
6148 	struct brcmf_cfg80211_info *cfg = (struct brcmf_cfg80211_info *)config;
6149 
6150 	if (cfg)
6151 		return cfg->ac_priority[prio];
6152 
6153 	return prio;
6154 }
6155 
6156 static void brcmf_init_wmm_prio(u8 *priority)
6157 {
6158 	/* Initialize AC priority array to default
6159 	 * 802.1d priority as per following table:
6160 	 * 802.1d prio 0,3 maps to BE
6161 	 * 802.1d prio 1,2 maps to BK
6162 	 * 802.1d prio 4,5 maps to VI
6163 	 * 802.1d prio 6,7 maps to VO
6164 	 */
6165 	priority[0] = BRCMF_FWS_FIFO_AC_BE;
6166 	priority[3] = BRCMF_FWS_FIFO_AC_BE;
6167 	priority[1] = BRCMF_FWS_FIFO_AC_BK;
6168 	priority[2] = BRCMF_FWS_FIFO_AC_BK;
6169 	priority[4] = BRCMF_FWS_FIFO_AC_VI;
6170 	priority[5] = BRCMF_FWS_FIFO_AC_VI;
6171 	priority[6] = BRCMF_FWS_FIFO_AC_VO;
6172 	priority[7] = BRCMF_FWS_FIFO_AC_VO;
6173 }
6174 
6175 static void brcmf_wifi_prioritize_acparams(const
6176 	struct brcmf_cfg80211_edcf_acparam *acp, u8 *priority)
6177 {
6178 	u8 aci;
6179 	u8 aifsn;
6180 	u8 ecwmin;
6181 	u8 ecwmax;
6182 	u8 acm;
6183 	u8 ranking_basis[EDCF_AC_COUNT];
6184 	u8 aci_prio[EDCF_AC_COUNT]; /* AC_BE, AC_BK, AC_VI, AC_VO */
6185 	u8 index;
6186 
6187 	for (aci = 0; aci < EDCF_AC_COUNT; aci++, acp++) {
6188 		aifsn  = acp->ACI & EDCF_AIFSN_MASK;
6189 		acm = (acp->ACI & EDCF_ACM_MASK) ? 1 : 0;
6190 		ecwmin = acp->ECW & EDCF_ECWMIN_MASK;
6191 		ecwmax = (acp->ECW & EDCF_ECWMAX_MASK) >> EDCF_ECWMAX_SHIFT;
6192 		brcmf_dbg(CONN, "ACI %d aifsn %d acm %d ecwmin %d ecwmax %d\n",
6193 			  aci, aifsn, acm, ecwmin, ecwmax);
6194 		/* Default AC_VO will be the lowest ranking value */
6195 		ranking_basis[aci] = aifsn + ecwmin + ecwmax;
6196 		/* Initialise priority starting at 0 (AC_BE) */
6197 		aci_prio[aci] = 0;
6198 
6199 		/* If ACM is set, STA can't use this AC as per 802.11.
6200 		 * Change the ranking to BE
6201 		 */
6202 		if (aci != AC_BE && aci != AC_BK && acm == 1)
6203 			ranking_basis[aci] = ranking_basis[AC_BE];
6204 	}
6205 
6206 	/* Ranking method which works for AC priority
6207 	 * swapping when values for cwmin, cwmax and aifsn are varied
6208 	 * Compare each aci_prio against each other aci_prio
6209 	 */
6210 	for (aci = 0; aci < EDCF_AC_COUNT; aci++) {
6211 		for (index = 0; index < EDCF_AC_COUNT; index++) {
6212 			if (index != aci) {
6213 				/* Smaller ranking value has higher priority,
6214 				 * so increment priority for each ACI which has
6215 				 * a higher ranking value
6216 				 */
6217 				if (ranking_basis[aci] < ranking_basis[index])
6218 					aci_prio[aci]++;
6219 			}
6220 		}
6221 	}
6222 
6223 	/* By now, aci_prio[] will be in range of 0 to 3.
6224 	 * Use ACI prio to get the new priority value for
6225 	 * each 802.1d traffic type, in this range.
6226 	 */
6227 	if (!(aci_prio[AC_BE] == aci_prio[AC_BK] &&
6228 	      aci_prio[AC_BK] == aci_prio[AC_VI] &&
6229 	      aci_prio[AC_VI] == aci_prio[AC_VO])) {
6230 		/* 802.1d 0,3 maps to BE */
6231 		priority[0] = aci_prio[AC_BE];
6232 		priority[3] = aci_prio[AC_BE];
6233 
6234 		/* 802.1d 1,2 maps to BK */
6235 		priority[1] = aci_prio[AC_BK];
6236 		priority[2] = aci_prio[AC_BK];
6237 
6238 		/* 802.1d 4,5 maps to VO */
6239 		priority[4] = aci_prio[AC_VI];
6240 		priority[5] = aci_prio[AC_VI];
6241 
6242 		/* 802.1d 6,7 maps to VO */
6243 		priority[6] = aci_prio[AC_VO];
6244 		priority[7] = aci_prio[AC_VO];
6245 	} else {
6246 		/* Initialize to default priority */
6247 		brcmf_init_wmm_prio(priority);
6248 	}
6249 
6250 	brcmf_dbg(CONN, "Adj prio BE 0->%d, BK 1->%d, BK 2->%d, BE 3->%d\n",
6251 		  priority[0], priority[1], priority[2], priority[3]);
6252 
6253 	brcmf_dbg(CONN, "Adj prio VI 4->%d, VI 5->%d, VO 6->%d, VO 7->%d\n",
6254 		  priority[4], priority[5], priority[6], priority[7]);
6255 }
6256 
6257 static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
6258 			       struct brcmf_if *ifp)
6259 {
6260 	struct brcmf_pub *drvr = cfg->pub;
6261 	struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
6262 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6263 	struct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];
6264 	u32 req_len;
6265 	u32 resp_len;
6266 	s32 err = 0;
6267 
6268 	brcmf_clear_assoc_ies(cfg);
6269 
6270 	err = brcmf_fil_iovar_data_get(ifp, "assoc_info",
6271 				       cfg->extra_buf, WL_ASSOC_INFO_MAX);
6272 	if (err) {
6273 		bphy_err(drvr, "could not get assoc info (%d)\n", err);
6274 		return err;
6275 	}
6276 	assoc_info =
6277 		(struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
6278 	req_len = le32_to_cpu(assoc_info->req_len);
6279 	resp_len = le32_to_cpu(assoc_info->resp_len);
6280 	if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
6281 		bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
6282 			 req_len, resp_len);
6283 		return -EINVAL;
6284 	}
6285 	if (req_len) {
6286 		err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
6287 					       cfg->extra_buf,
6288 					       WL_ASSOC_INFO_MAX);
6289 		if (err) {
6290 			bphy_err(drvr, "could not get assoc req (%d)\n", err);
6291 			return err;
6292 		}
6293 		conn_info->req_ie_len = req_len;
6294 		conn_info->req_ie =
6295 		    kmemdup(cfg->extra_buf, conn_info->req_ie_len,
6296 			    GFP_KERNEL);
6297 		if (!conn_info->req_ie)
6298 			conn_info->req_ie_len = 0;
6299 	} else {
6300 		conn_info->req_ie_len = 0;
6301 		conn_info->req_ie = NULL;
6302 	}
6303 	if (resp_len) {
6304 		err = brcmf_fil_iovar_data_get(ifp, "assoc_resp_ies",
6305 					       cfg->extra_buf,
6306 					       WL_ASSOC_INFO_MAX);
6307 		if (err) {
6308 			bphy_err(drvr, "could not get assoc resp (%d)\n", err);
6309 			return err;
6310 		}
6311 		conn_info->resp_ie_len = resp_len;
6312 		conn_info->resp_ie =
6313 		    kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
6314 			    GFP_KERNEL);
6315 		if (!conn_info->resp_ie)
6316 			conn_info->resp_ie_len = 0;
6317 
6318 		err = brcmf_fil_iovar_data_get(ifp, "wme_ac_sta",
6319 					       edcf_acparam_info,
6320 					       sizeof(edcf_acparam_info));
6321 		if (err) {
6322 			brcmf_err("could not get wme_ac_sta (%d)\n", err);
6323 			return err;
6324 		}
6325 
6326 		brcmf_wifi_prioritize_acparams(edcf_acparam_info,
6327 					       cfg->ac_priority);
6328 	} else {
6329 		conn_info->resp_ie_len = 0;
6330 		conn_info->resp_ie = NULL;
6331 	}
6332 	brcmf_dbg(CONN, "req len (%d) resp len (%d)\n",
6333 		  conn_info->req_ie_len, conn_info->resp_ie_len);
6334 
6335 	return err;
6336 }
6337 
6338 static s32
6339 brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
6340 		       struct net_device *ndev,
6341 		       const struct brcmf_event_msg *e)
6342 {
6343 	struct brcmf_if *ifp = netdev_priv(ndev);
6344 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6345 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6346 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
6347 	struct ieee80211_channel *notify_channel = NULL;
6348 	struct ieee80211_supported_band *band;
6349 	struct brcmf_bss_info_le *bi;
6350 	struct brcmu_chan ch;
6351 	struct cfg80211_roam_info roam_info = {};
6352 	u32 freq;
6353 	s32 err = 0;
6354 	u8 *buf;
6355 
6356 	brcmf_dbg(TRACE, "Enter\n");
6357 
6358 	brcmf_get_assoc_ies(cfg, ifp);
6359 	memcpy(profile->bssid, e->addr, ETH_ALEN);
6360 	brcmf_update_bss_info(cfg, ifp);
6361 
6362 	buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
6363 	if (buf == NULL) {
6364 		err = -ENOMEM;
6365 		goto done;
6366 	}
6367 
6368 	/* data sent to dongle has to be little endian */
6369 	*(__le32 *)buf = cpu_to_le32(WL_BSS_INFO_MAX);
6370 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSS_INFO,
6371 				     buf, WL_BSS_INFO_MAX);
6372 
6373 	if (err)
6374 		goto done;
6375 
6376 	bi = (struct brcmf_bss_info_le *)(buf + 4);
6377 	ch.chspec = le16_to_cpu(bi->chanspec);
6378 	cfg->d11inf.decchspec(&ch);
6379 
6380 	if (ch.band == BRCMU_CHAN_BAND_2G)
6381 		band = wiphy->bands[NL80211_BAND_2GHZ];
6382 	else
6383 		band = wiphy->bands[NL80211_BAND_5GHZ];
6384 
6385 	freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band);
6386 	notify_channel = ieee80211_get_channel(wiphy, freq);
6387 
6388 done:
6389 	kfree(buf);
6390 
6391 	roam_info.links[0].channel = notify_channel;
6392 	roam_info.links[0].bssid = profile->bssid;
6393 	roam_info.req_ie = conn_info->req_ie;
6394 	roam_info.req_ie_len = conn_info->req_ie_len;
6395 	roam_info.resp_ie = conn_info->resp_ie;
6396 	roam_info.resp_ie_len = conn_info->resp_ie_len;
6397 
6398 	cfg80211_roamed(ndev, &roam_info, GFP_KERNEL);
6399 	brcmf_dbg(CONN, "Report roaming result\n");
6400 
6401 	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_1X && profile->is_ft) {
6402 		cfg80211_port_authorized(ndev, profile->bssid, NULL, 0, GFP_KERNEL);
6403 		brcmf_dbg(CONN, "Report port authorized\n");
6404 	}
6405 
6406 	set_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
6407 	brcmf_dbg(TRACE, "Exit\n");
6408 	return err;
6409 }
6410 
6411 static s32
6412 brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
6413 		       struct net_device *ndev, const struct brcmf_event_msg *e,
6414 		       bool completed)
6415 {
6416 	struct brcmf_if *ifp = netdev_priv(ndev);
6417 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6418 	struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
6419 	struct cfg80211_connect_resp_params conn_params;
6420 
6421 	brcmf_dbg(TRACE, "Enter\n");
6422 
6423 	if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6424 			       &ifp->vif->sme_state)) {
6425 		memset(&conn_params, 0, sizeof(conn_params));
6426 		if (completed) {
6427 			brcmf_get_assoc_ies(cfg, ifp);
6428 			brcmf_update_bss_info(cfg, ifp);
6429 			set_bit(BRCMF_VIF_STATUS_CONNECTED,
6430 				&ifp->vif->sme_state);
6431 			conn_params.status = WLAN_STATUS_SUCCESS;
6432 		} else {
6433 			clear_bit(BRCMF_VIF_STATUS_EAP_SUCCESS,
6434 				  &ifp->vif->sme_state);
6435 			clear_bit(BRCMF_VIF_STATUS_ASSOC_SUCCESS,
6436 				  &ifp->vif->sme_state);
6437 			conn_params.status = WLAN_STATUS_AUTH_TIMEOUT;
6438 		}
6439 		conn_params.links[0].bssid = profile->bssid;
6440 		conn_params.req_ie = conn_info->req_ie;
6441 		conn_params.req_ie_len = conn_info->req_ie_len;
6442 		conn_params.resp_ie = conn_info->resp_ie;
6443 		conn_params.resp_ie_len = conn_info->resp_ie_len;
6444 		cfg80211_connect_done(ndev, &conn_params, GFP_KERNEL);
6445 		brcmf_dbg(CONN, "Report connect result - connection %s\n",
6446 			  completed ? "succeeded" : "failed");
6447 	}
6448 	brcmf_dbg(TRACE, "Exit\n");
6449 	return 0;
6450 }
6451 
6452 static s32
6453 brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
6454 			       struct net_device *ndev,
6455 			       const struct brcmf_event_msg *e, void *data)
6456 {
6457 	struct brcmf_pub *drvr = cfg->pub;
6458 	static int generation;
6459 	u32 event = e->event_code;
6460 	u32 reason = e->reason;
6461 	struct station_info *sinfo;
6462 
6463 	brcmf_dbg(CONN, "event %s (%u), reason %d\n",
6464 		  brcmf_fweh_event_name(event), event, reason);
6465 	if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
6466 	    ndev != cfg_to_ndev(cfg)) {
6467 		brcmf_dbg(CONN, "AP mode link down\n");
6468 		complete(&cfg->vif_disabled);
6469 		return 0;
6470 	}
6471 
6472 	if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
6473 	    (reason == BRCMF_E_STATUS_SUCCESS)) {
6474 		if (!data) {
6475 			bphy_err(drvr, "No IEs present in ASSOC/REASSOC_IND\n");
6476 			return -EINVAL;
6477 		}
6478 
6479 		sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
6480 		if (!sinfo)
6481 			return -ENOMEM;
6482 
6483 		sinfo->assoc_req_ies = data;
6484 		sinfo->assoc_req_ies_len = e->datalen;
6485 		generation++;
6486 		sinfo->generation = generation;
6487 		cfg80211_new_sta(ndev, e->addr, sinfo, GFP_KERNEL);
6488 
6489 		kfree(sinfo);
6490 	} else if ((event == BRCMF_E_DISASSOC_IND) ||
6491 		   (event == BRCMF_E_DEAUTH_IND) ||
6492 		   (event == BRCMF_E_DEAUTH)) {
6493 		cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
6494 	}
6495 	return 0;
6496 }
6497 
6498 static s32
6499 brcmf_notify_connect_status(struct brcmf_if *ifp,
6500 			    const struct brcmf_event_msg *e, void *data)
6501 {
6502 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6503 	struct net_device *ndev = ifp->ndev;
6504 	struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
6505 	struct ieee80211_channel *chan;
6506 	s32 err = 0;
6507 
6508 	if ((e->event_code == BRCMF_E_DEAUTH) ||
6509 	    (e->event_code == BRCMF_E_DEAUTH_IND) ||
6510 	    (e->event_code == BRCMF_E_DISASSOC_IND) ||
6511 	    ((e->event_code == BRCMF_E_LINK) && (!e->flags))) {
6512 		brcmf_proto_delete_peer(ifp->drvr, ifp->ifidx, (u8 *)e->addr);
6513 	}
6514 
6515 	if (brcmf_is_apmode(ifp->vif)) {
6516 		err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
6517 	} else if (brcmf_is_linkup(ifp->vif, e)) {
6518 		brcmf_dbg(CONN, "Linkup\n");
6519 		if (brcmf_is_ibssmode(ifp->vif)) {
6520 			brcmf_inform_ibss(cfg, ndev, e->addr);
6521 			chan = ieee80211_get_channel(cfg->wiphy, cfg->channel);
6522 			memcpy(profile->bssid, e->addr, ETH_ALEN);
6523 			cfg80211_ibss_joined(ndev, e->addr, chan, GFP_KERNEL);
6524 			clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6525 				  &ifp->vif->sme_state);
6526 			set_bit(BRCMF_VIF_STATUS_CONNECTED,
6527 				&ifp->vif->sme_state);
6528 		} else
6529 			brcmf_bss_connect_done(cfg, ndev, e, true);
6530 		brcmf_net_setcarrier(ifp, true);
6531 	} else if (brcmf_is_linkdown(ifp->vif, e)) {
6532 		brcmf_dbg(CONN, "Linkdown\n");
6533 		if (!brcmf_is_ibssmode(ifp->vif) &&
6534 		    (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6535 			      &ifp->vif->sme_state) ||
6536 		     test_bit(BRCMF_VIF_STATUS_CONNECTING,
6537 			      &ifp->vif->sme_state))) {
6538 			if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6539 				     &ifp->vif->sme_state) &&
6540 			    memcmp(profile->bssid, e->addr, ETH_ALEN))
6541 				return err;
6542 
6543 			brcmf_bss_connect_done(cfg, ndev, e, false);
6544 			brcmf_link_down(ifp->vif,
6545 					brcmf_map_fw_linkdown_reason(e),
6546 					e->event_code &
6547 					(BRCMF_E_DEAUTH_IND |
6548 					BRCMF_E_DISASSOC_IND)
6549 					? false : true);
6550 			brcmf_init_prof(ndev_to_prof(ndev));
6551 			if (ndev != cfg_to_ndev(cfg))
6552 				complete(&cfg->vif_disabled);
6553 			brcmf_net_setcarrier(ifp, false);
6554 		}
6555 	} else if (brcmf_is_nonetwork(cfg, e)) {
6556 		if (brcmf_is_ibssmode(ifp->vif))
6557 			clear_bit(BRCMF_VIF_STATUS_CONNECTING,
6558 				  &ifp->vif->sme_state);
6559 		else
6560 			brcmf_bss_connect_done(cfg, ndev, e, false);
6561 	}
6562 
6563 	return err;
6564 }
6565 
6566 static s32
6567 brcmf_notify_roaming_status(struct brcmf_if *ifp,
6568 			    const struct brcmf_event_msg *e, void *data)
6569 {
6570 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6571 	u32 event = e->event_code;
6572 	u32 status = e->status;
6573 
6574 	if (event == BRCMF_E_ROAM && status == BRCMF_E_STATUS_SUCCESS) {
6575 		if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
6576 			     &ifp->vif->sme_state)) {
6577 			brcmf_bss_roaming_done(cfg, ifp->ndev, e);
6578 		} else {
6579 			brcmf_bss_connect_done(cfg, ifp->ndev, e, true);
6580 			brcmf_net_setcarrier(ifp, true);
6581 		}
6582 	}
6583 
6584 	return 0;
6585 }
6586 
6587 static s32
6588 brcmf_notify_mic_status(struct brcmf_if *ifp,
6589 			const struct brcmf_event_msg *e, void *data)
6590 {
6591 	u16 flags = e->flags;
6592 	enum nl80211_key_type key_type;
6593 
6594 	if (flags & BRCMF_EVENT_MSG_GROUP)
6595 		key_type = NL80211_KEYTYPE_GROUP;
6596 	else
6597 		key_type = NL80211_KEYTYPE_PAIRWISE;
6598 
6599 	cfg80211_michael_mic_failure(ifp->ndev, (u8 *)&e->addr, key_type, -1,
6600 				     NULL, GFP_KERNEL);
6601 
6602 	return 0;
6603 }
6604 
6605 static s32 brcmf_notify_rssi(struct brcmf_if *ifp,
6606 			     const struct brcmf_event_msg *e, void *data)
6607 {
6608 	struct brcmf_cfg80211_vif *vif = ifp->vif;
6609 	struct brcmf_rssi_be *info = data;
6610 	s32 rssi, snr = 0, noise = 0;
6611 	s32 low, high, last;
6612 
6613 	if (e->datalen >= sizeof(*info)) {
6614 		rssi = be32_to_cpu(info->rssi);
6615 		snr = be32_to_cpu(info->snr);
6616 		noise = be32_to_cpu(info->noise);
6617 	} else if (e->datalen >= sizeof(rssi)) {
6618 		rssi = be32_to_cpu(*(__be32 *)data);
6619 	} else {
6620 		brcmf_err("insufficient RSSI event data\n");
6621 		return 0;
6622 	}
6623 
6624 	low = vif->cqm_rssi_low;
6625 	high = vif->cqm_rssi_high;
6626 	last = vif->cqm_rssi_last;
6627 
6628 	brcmf_dbg(TRACE, "rssi=%d snr=%d noise=%d low=%d high=%d last=%d\n",
6629 		  rssi, snr, noise, low, high, last);
6630 
6631 	vif->cqm_rssi_last = rssi;
6632 
6633 	if (rssi <= low || rssi == 0) {
6634 		brcmf_dbg(INFO, "LOW rssi=%d\n", rssi);
6635 		cfg80211_cqm_rssi_notify(ifp->ndev,
6636 					 NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
6637 					 rssi, GFP_KERNEL);
6638 	} else if (rssi > high) {
6639 		brcmf_dbg(INFO, "HIGH rssi=%d\n", rssi);
6640 		cfg80211_cqm_rssi_notify(ifp->ndev,
6641 					 NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
6642 					 rssi, GFP_KERNEL);
6643 	}
6644 
6645 	return 0;
6646 }
6647 
6648 static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
6649 				  const struct brcmf_event_msg *e, void *data)
6650 {
6651 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
6652 	struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
6653 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
6654 	struct brcmf_cfg80211_vif *vif;
6655 
6656 	brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfgidx %u\n",
6657 		  ifevent->action, ifevent->flags, ifevent->ifidx,
6658 		  ifevent->bsscfgidx);
6659 
6660 	spin_lock(&event->vif_event_lock);
6661 	event->action = ifevent->action;
6662 	vif = event->vif;
6663 
6664 	switch (ifevent->action) {
6665 	case BRCMF_E_IF_ADD:
6666 		/* waiting process may have timed out */
6667 		if (!cfg->vif_event.vif) {
6668 			spin_unlock(&event->vif_event_lock);
6669 			return -EBADF;
6670 		}
6671 
6672 		ifp->vif = vif;
6673 		vif->ifp = ifp;
6674 		if (ifp->ndev) {
6675 			vif->wdev.netdev = ifp->ndev;
6676 			ifp->ndev->ieee80211_ptr = &vif->wdev;
6677 			SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
6678 		}
6679 		spin_unlock(&event->vif_event_lock);
6680 		wake_up(&event->vif_wq);
6681 		return 0;
6682 
6683 	case BRCMF_E_IF_DEL:
6684 		spin_unlock(&event->vif_event_lock);
6685 		/* event may not be upon user request */
6686 		if (brcmf_cfg80211_vif_event_armed(cfg))
6687 			wake_up(&event->vif_wq);
6688 		return 0;
6689 
6690 	case BRCMF_E_IF_CHANGE:
6691 		spin_unlock(&event->vif_event_lock);
6692 		wake_up(&event->vif_wq);
6693 		return 0;
6694 
6695 	default:
6696 		spin_unlock(&event->vif_event_lock);
6697 		break;
6698 	}
6699 	return -EINVAL;
6700 }
6701 
6702 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
6703 {
6704 	conf->frag_threshold = (u32)-1;
6705 	conf->rts_threshold = (u32)-1;
6706 	conf->retry_short = (u32)-1;
6707 	conf->retry_long = (u32)-1;
6708 }
6709 
6710 static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
6711 {
6712 	brcmf_fweh_register(cfg->pub, BRCMF_E_LINK,
6713 			    brcmf_notify_connect_status);
6714 	brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH_IND,
6715 			    brcmf_notify_connect_status);
6716 	brcmf_fweh_register(cfg->pub, BRCMF_E_DEAUTH,
6717 			    brcmf_notify_connect_status);
6718 	brcmf_fweh_register(cfg->pub, BRCMF_E_DISASSOC_IND,
6719 			    brcmf_notify_connect_status);
6720 	brcmf_fweh_register(cfg->pub, BRCMF_E_ASSOC_IND,
6721 			    brcmf_notify_connect_status);
6722 	brcmf_fweh_register(cfg->pub, BRCMF_E_REASSOC_IND,
6723 			    brcmf_notify_connect_status);
6724 	brcmf_fweh_register(cfg->pub, BRCMF_E_ROAM,
6725 			    brcmf_notify_roaming_status);
6726 	brcmf_fweh_register(cfg->pub, BRCMF_E_MIC_ERROR,
6727 			    brcmf_notify_mic_status);
6728 	brcmf_fweh_register(cfg->pub, BRCMF_E_SET_SSID,
6729 			    brcmf_notify_connect_status);
6730 	brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
6731 			    brcmf_notify_sched_scan_results);
6732 	brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
6733 			    brcmf_notify_vif_event);
6734 	brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
6735 			    brcmf_p2p_notify_rx_mgmt_p2p_probereq);
6736 	brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
6737 			    brcmf_p2p_notify_listen_complete);
6738 	brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
6739 			    brcmf_p2p_notify_action_frame_rx);
6740 	brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
6741 			    brcmf_p2p_notify_action_tx_complete);
6742 	brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
6743 			    brcmf_p2p_notify_action_tx_complete);
6744 	brcmf_fweh_register(cfg->pub, BRCMF_E_PSK_SUP,
6745 			    brcmf_notify_connect_status);
6746 	brcmf_fweh_register(cfg->pub, BRCMF_E_RSSI, brcmf_notify_rssi);
6747 }
6748 
6749 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
6750 {
6751 	kfree(cfg->conf);
6752 	cfg->conf = NULL;
6753 	kfree(cfg->extra_buf);
6754 	cfg->extra_buf = NULL;
6755 	kfree(cfg->wowl.nd);
6756 	cfg->wowl.nd = NULL;
6757 	kfree(cfg->wowl.nd_info);
6758 	cfg->wowl.nd_info = NULL;
6759 	kfree(cfg->escan_info.escan_buf);
6760 	cfg->escan_info.escan_buf = NULL;
6761 }
6762 
6763 static s32 brcmf_init_priv_mem(struct brcmf_cfg80211_info *cfg)
6764 {
6765 	cfg->conf = kzalloc(sizeof(*cfg->conf), GFP_KERNEL);
6766 	if (!cfg->conf)
6767 		goto init_priv_mem_out;
6768 	cfg->extra_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
6769 	if (!cfg->extra_buf)
6770 		goto init_priv_mem_out;
6771 	cfg->wowl.nd = kzalloc(sizeof(*cfg->wowl.nd) + sizeof(u32), GFP_KERNEL);
6772 	if (!cfg->wowl.nd)
6773 		goto init_priv_mem_out;
6774 	cfg->wowl.nd_info = kzalloc(sizeof(*cfg->wowl.nd_info) +
6775 				    sizeof(struct cfg80211_wowlan_nd_match *),
6776 				    GFP_KERNEL);
6777 	if (!cfg->wowl.nd_info)
6778 		goto init_priv_mem_out;
6779 	cfg->escan_info.escan_buf = kzalloc(BRCMF_ESCAN_BUF_SIZE, GFP_KERNEL);
6780 	if (!cfg->escan_info.escan_buf)
6781 		goto init_priv_mem_out;
6782 
6783 	return 0;
6784 
6785 init_priv_mem_out:
6786 	brcmf_deinit_priv_mem(cfg);
6787 
6788 	return -ENOMEM;
6789 }
6790 
6791 static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
6792 {
6793 	s32 err = 0;
6794 
6795 	cfg->scan_request = NULL;
6796 	cfg->pwr_save = true;
6797 	cfg->dongle_up = false;		/* dongle is not up yet */
6798 	err = brcmf_init_priv_mem(cfg);
6799 	if (err)
6800 		return err;
6801 	brcmf_register_event_handlers(cfg);
6802 	mutex_init(&cfg->usr_sync);
6803 	brcmf_init_escan(cfg);
6804 	brcmf_init_conf(cfg->conf);
6805 	brcmf_init_wmm_prio(cfg->ac_priority);
6806 	init_completion(&cfg->vif_disabled);
6807 	return err;
6808 }
6809 
6810 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
6811 {
6812 	cfg->dongle_up = false;	/* dongle down */
6813 	brcmf_abort_scanning(cfg);
6814 	brcmf_deinit_priv_mem(cfg);
6815 	brcmf_clear_assoc_ies(cfg);
6816 }
6817 
6818 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
6819 {
6820 	init_waitqueue_head(&event->vif_wq);
6821 	spin_lock_init(&event->vif_event_lock);
6822 }
6823 
6824 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
6825 {
6826 	struct brcmf_pub *drvr = ifp->drvr;
6827 	s32 err;
6828 	u32 bcn_timeout;
6829 	__le32 roamtrigger[2];
6830 	__le32 roam_delta[2];
6831 
6832 	/* Configure beacon timeout value based upon roaming setting */
6833 	if (ifp->drvr->settings->roamoff)
6834 		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_OFF;
6835 	else
6836 		bcn_timeout = BRCMF_DEFAULT_BCN_TIMEOUT_ROAM_ON;
6837 	err = brcmf_fil_iovar_int_set(ifp, "bcn_timeout", bcn_timeout);
6838 	if (err) {
6839 		bphy_err(drvr, "bcn_timeout error (%d)\n", err);
6840 		goto roam_setup_done;
6841 	}
6842 
6843 	/* Enable/Disable built-in roaming to allow supplicant to take care of
6844 	 * roaming.
6845 	 */
6846 	brcmf_dbg(INFO, "Internal Roaming = %s\n",
6847 		  ifp->drvr->settings->roamoff ? "Off" : "On");
6848 	err = brcmf_fil_iovar_int_set(ifp, "roam_off",
6849 				      ifp->drvr->settings->roamoff);
6850 	if (err) {
6851 		bphy_err(drvr, "roam_off error (%d)\n", err);
6852 		goto roam_setup_done;
6853 	}
6854 
6855 	roamtrigger[0] = cpu_to_le32(WL_ROAM_TRIGGER_LEVEL);
6856 	roamtrigger[1] = cpu_to_le32(BRCM_BAND_ALL);
6857 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_TRIGGER,
6858 				     (void *)roamtrigger, sizeof(roamtrigger));
6859 	if (err)
6860 		bphy_err(drvr, "WLC_SET_ROAM_TRIGGER error (%d)\n", err);
6861 
6862 	roam_delta[0] = cpu_to_le32(WL_ROAM_DELTA);
6863 	roam_delta[1] = cpu_to_le32(BRCM_BAND_ALL);
6864 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_ROAM_DELTA,
6865 				     (void *)roam_delta, sizeof(roam_delta));
6866 	if (err)
6867 		bphy_err(drvr, "WLC_SET_ROAM_DELTA error (%d)\n", err);
6868 
6869 	return 0;
6870 
6871 roam_setup_done:
6872 	return err;
6873 }
6874 
6875 static s32
6876 brcmf_dongle_scantime(struct brcmf_if *ifp)
6877 {
6878 	struct brcmf_pub *drvr = ifp->drvr;
6879 	s32 err = 0;
6880 
6881 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
6882 				    BRCMF_SCAN_CHANNEL_TIME);
6883 	if (err) {
6884 		bphy_err(drvr, "Scan assoc time error (%d)\n", err);
6885 		goto dongle_scantime_out;
6886 	}
6887 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_UNASSOC_TIME,
6888 				    BRCMF_SCAN_UNASSOC_TIME);
6889 	if (err) {
6890 		bphy_err(drvr, "Scan unassoc time error (%d)\n", err);
6891 		goto dongle_scantime_out;
6892 	}
6893 
6894 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_PASSIVE_TIME,
6895 				    BRCMF_SCAN_PASSIVE_TIME);
6896 	if (err) {
6897 		bphy_err(drvr, "Scan passive time error (%d)\n", err);
6898 		goto dongle_scantime_out;
6899 	}
6900 
6901 dongle_scantime_out:
6902 	return err;
6903 }
6904 
6905 static void brcmf_update_bw40_channel_flag(struct ieee80211_channel *channel,
6906 					   struct brcmu_chan *ch)
6907 {
6908 	u32 ht40_flag;
6909 
6910 	ht40_flag = channel->flags & IEEE80211_CHAN_NO_HT40;
6911 	if (ch->sb == BRCMU_CHAN_SB_U) {
6912 		if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6913 			channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6914 		channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
6915 	} else {
6916 		/* It should be one of
6917 		 * IEEE80211_CHAN_NO_HT40 or
6918 		 * IEEE80211_CHAN_NO_HT40PLUS
6919 		 */
6920 		channel->flags &= ~IEEE80211_CHAN_NO_HT40;
6921 		if (ht40_flag == IEEE80211_CHAN_NO_HT40)
6922 			channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
6923 	}
6924 }
6925 
6926 static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
6927 				    u32 bw_cap[])
6928 {
6929 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
6930 	struct brcmf_pub *drvr = cfg->pub;
6931 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
6932 	struct ieee80211_supported_band *band;
6933 	struct ieee80211_channel *channel;
6934 	struct brcmf_chanspec_list *list;
6935 	struct brcmu_chan ch;
6936 	int err;
6937 	u8 *pbuf;
6938 	u32 i, j;
6939 	u32 total;
6940 	u32 chaninfo;
6941 
6942 	pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
6943 
6944 	if (pbuf == NULL)
6945 		return -ENOMEM;
6946 
6947 	list = (struct brcmf_chanspec_list *)pbuf;
6948 
6949 	err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
6950 				       BRCMF_DCMD_MEDLEN);
6951 	if (err) {
6952 		bphy_err(drvr, "get chanspecs error (%d)\n", err);
6953 		goto fail_pbuf;
6954 	}
6955 
6956 	band = wiphy->bands[NL80211_BAND_2GHZ];
6957 	if (band)
6958 		for (i = 0; i < band->n_channels; i++)
6959 			band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6960 	band = wiphy->bands[NL80211_BAND_5GHZ];
6961 	if (band)
6962 		for (i = 0; i < band->n_channels; i++)
6963 			band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6964 
6965 	total = le32_to_cpu(list->count);
6966 	if (total > BRCMF_MAX_CHANSPEC_LIST) {
6967 		bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6968 			 total);
6969 		err = -EINVAL;
6970 		goto fail_pbuf;
6971 	}
6972 
6973 	for (i = 0; i < total; i++) {
6974 		ch.chspec = (u16)le32_to_cpu(list->element[i]);
6975 		cfg->d11inf.decchspec(&ch);
6976 
6977 		if (ch.band == BRCMU_CHAN_BAND_2G) {
6978 			band = wiphy->bands[NL80211_BAND_2GHZ];
6979 		} else if (ch.band == BRCMU_CHAN_BAND_5G) {
6980 			band = wiphy->bands[NL80211_BAND_5GHZ];
6981 		} else {
6982 			bphy_err(drvr, "Invalid channel Spec. 0x%x.\n",
6983 				 ch.chspec);
6984 			continue;
6985 		}
6986 		if (!band)
6987 			continue;
6988 		if (!(bw_cap[band->band] & WLC_BW_40MHZ_BIT) &&
6989 		    ch.bw == BRCMU_CHAN_BW_40)
6990 			continue;
6991 		if (!(bw_cap[band->band] & WLC_BW_80MHZ_BIT) &&
6992 		    ch.bw == BRCMU_CHAN_BW_80)
6993 			continue;
6994 
6995 		channel = NULL;
6996 		for (j = 0; j < band->n_channels; j++) {
6997 			if (band->channels[j].hw_value == ch.control_ch_num) {
6998 				channel = &band->channels[j];
6999 				break;
7000 			}
7001 		}
7002 		if (!channel) {
7003 			/* It seems firmware supports some channel we never
7004 			 * considered. Something new in IEEE standard?
7005 			 */
7006 			bphy_err(drvr, "Ignoring unexpected firmware channel %d\n",
7007 				 ch.control_ch_num);
7008 			continue;
7009 		}
7010 
7011 		if (channel->orig_flags & IEEE80211_CHAN_DISABLED)
7012 			continue;
7013 
7014 		/* assuming the chanspecs order is HT20,
7015 		 * HT40 upper, HT40 lower, and VHT80.
7016 		 */
7017 		switch (ch.bw) {
7018 		case BRCMU_CHAN_BW_160:
7019 			channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
7020 			break;
7021 		case BRCMU_CHAN_BW_80:
7022 			channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
7023 			break;
7024 		case BRCMU_CHAN_BW_40:
7025 			brcmf_update_bw40_channel_flag(channel, &ch);
7026 			break;
7027 		default:
7028 			wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
7029 				   ch.bw);
7030 			fallthrough;
7031 		case BRCMU_CHAN_BW_20:
7032 			/* enable the channel and disable other bandwidths
7033 			 * for now as mentioned order assure they are enabled
7034 			 * for subsequent chanspecs.
7035 			 */
7036 			channel->flags = IEEE80211_CHAN_NO_HT40 |
7037 					 IEEE80211_CHAN_NO_80MHZ |
7038 					 IEEE80211_CHAN_NO_160MHZ;
7039 			ch.bw = BRCMU_CHAN_BW_20;
7040 			cfg->d11inf.encchspec(&ch);
7041 			chaninfo = ch.chspec;
7042 			err = brcmf_fil_bsscfg_int_get(ifp, "per_chan_info",
7043 						       &chaninfo);
7044 			if (!err) {
7045 				if (chaninfo & WL_CHAN_RADAR)
7046 					channel->flags |=
7047 						(IEEE80211_CHAN_RADAR |
7048 						 IEEE80211_CHAN_NO_IR);
7049 				if (chaninfo & WL_CHAN_PASSIVE)
7050 					channel->flags |=
7051 						IEEE80211_CHAN_NO_IR;
7052 			}
7053 		}
7054 	}
7055 
7056 fail_pbuf:
7057 	kfree(pbuf);
7058 	return err;
7059 }
7060 
7061 static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
7062 {
7063 	struct brcmf_pub *drvr = cfg->pub;
7064 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7065 	struct ieee80211_supported_band *band;
7066 	struct brcmf_fil_bwcap_le band_bwcap;
7067 	struct brcmf_chanspec_list *list;
7068 	u8 *pbuf;
7069 	u32 val;
7070 	int err;
7071 	struct brcmu_chan ch;
7072 	u32 num_chan;
7073 	int i, j;
7074 
7075 	/* verify support for bw_cap command */
7076 	val = WLC_BAND_5G;
7077 	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &val);
7078 
7079 	if (!err) {
7080 		/* only set 2G bandwidth using bw_cap command */
7081 		band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
7082 		band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
7083 		err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
7084 					       sizeof(band_bwcap));
7085 	} else {
7086 		brcmf_dbg(INFO, "fallback to mimo_bw_cap\n");
7087 		val = WLC_N_BW_40ALL;
7088 		err = brcmf_fil_iovar_int_set(ifp, "mimo_bw_cap", val);
7089 	}
7090 
7091 	if (!err) {
7092 		/* update channel info in 2G band */
7093 		pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
7094 
7095 		if (pbuf == NULL)
7096 			return -ENOMEM;
7097 
7098 		ch.band = BRCMU_CHAN_BAND_2G;
7099 		ch.bw = BRCMU_CHAN_BW_40;
7100 		ch.sb = BRCMU_CHAN_SB_NONE;
7101 		ch.chnum = 0;
7102 		cfg->d11inf.encchspec(&ch);
7103 
7104 		/* pass encoded chanspec in query */
7105 		*(__le16 *)pbuf = cpu_to_le16(ch.chspec);
7106 
7107 		err = brcmf_fil_iovar_data_get(ifp, "chanspecs", pbuf,
7108 					       BRCMF_DCMD_MEDLEN);
7109 		if (err) {
7110 			bphy_err(drvr, "get chanspecs error (%d)\n", err);
7111 			kfree(pbuf);
7112 			return err;
7113 		}
7114 
7115 		band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
7116 		list = (struct brcmf_chanspec_list *)pbuf;
7117 		num_chan = le32_to_cpu(list->count);
7118 		if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
7119 			bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
7120 				 num_chan);
7121 			kfree(pbuf);
7122 			return -EINVAL;
7123 		}
7124 
7125 		for (i = 0; i < num_chan; i++) {
7126 			ch.chspec = (u16)le32_to_cpu(list->element[i]);
7127 			cfg->d11inf.decchspec(&ch);
7128 			if (WARN_ON(ch.band != BRCMU_CHAN_BAND_2G))
7129 				continue;
7130 			if (WARN_ON(ch.bw != BRCMU_CHAN_BW_40))
7131 				continue;
7132 			for (j = 0; j < band->n_channels; j++) {
7133 				if (band->channels[j].hw_value == ch.control_ch_num)
7134 					break;
7135 			}
7136 			if (WARN_ON(j == band->n_channels))
7137 				continue;
7138 
7139 			brcmf_update_bw40_channel_flag(&band->channels[j], &ch);
7140 		}
7141 		kfree(pbuf);
7142 	}
7143 	return err;
7144 }
7145 
7146 static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
7147 {
7148 	struct brcmf_pub *drvr = ifp->drvr;
7149 	u32 band, mimo_bwcap;
7150 	int err;
7151 
7152 	band = WLC_BAND_2G;
7153 	err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7154 	if (!err) {
7155 		bw_cap[NL80211_BAND_2GHZ] = band;
7156 		band = WLC_BAND_5G;
7157 		err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
7158 		if (!err) {
7159 			bw_cap[NL80211_BAND_5GHZ] = band;
7160 			return;
7161 		}
7162 		WARN_ON(1);
7163 		return;
7164 	}
7165 	brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
7166 	mimo_bwcap = 0;
7167 	err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
7168 	if (err)
7169 		/* assume 20MHz if firmware does not give a clue */
7170 		mimo_bwcap = WLC_N_BW_20ALL;
7171 
7172 	switch (mimo_bwcap) {
7173 	case WLC_N_BW_40ALL:
7174 		bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
7175 		fallthrough;
7176 	case WLC_N_BW_20IN2G_40IN5G:
7177 		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
7178 		fallthrough;
7179 	case WLC_N_BW_20ALL:
7180 		bw_cap[NL80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
7181 		bw_cap[NL80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
7182 		break;
7183 	default:
7184 		bphy_err(drvr, "invalid mimo_bw_cap value\n");
7185 	}
7186 }
7187 
7188 static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
7189 				u32 bw_cap[2], u32 nchain)
7190 {
7191 	band->ht_cap.ht_supported = true;
7192 	if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
7193 		band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
7194 		band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
7195 	}
7196 	band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
7197 	band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
7198 	band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
7199 	band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
7200 	memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
7201 	band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
7202 }
7203 
7204 static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
7205 {
7206 	u16 mcs_map;
7207 	int i;
7208 
7209 	for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
7210 		mcs_map = (mcs_map << 2) | supp;
7211 
7212 	return cpu_to_le16(mcs_map);
7213 }
7214 
7215 static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
7216 				 u32 bw_cap[2], u32 nchain, u32 txstreams,
7217 				 u32 txbf_bfe_cap, u32 txbf_bfr_cap)
7218 {
7219 	__le16 mcs_map;
7220 
7221 	/* not allowed in 2.4G band */
7222 	if (band->band == NL80211_BAND_2GHZ)
7223 		return;
7224 
7225 	band->vht_cap.vht_supported = true;
7226 	/* 80MHz is mandatory */
7227 	band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
7228 	if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
7229 		band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
7230 		band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
7231 	}
7232 	/* all support 256-QAM */
7233 	mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
7234 	band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
7235 	band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
7236 
7237 	/* Beamforming support information */
7238 	if (txbf_bfe_cap & BRCMF_TXBF_SU_BFE_CAP)
7239 		band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
7240 	if (txbf_bfe_cap & BRCMF_TXBF_MU_BFE_CAP)
7241 		band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
7242 	if (txbf_bfr_cap & BRCMF_TXBF_SU_BFR_CAP)
7243 		band->vht_cap.cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
7244 	if (txbf_bfr_cap & BRCMF_TXBF_MU_BFR_CAP)
7245 		band->vht_cap.cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
7246 
7247 	if ((txbf_bfe_cap || txbf_bfr_cap) && (txstreams > 1)) {
7248 		band->vht_cap.cap |=
7249 			(2 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT);
7250 		band->vht_cap.cap |= ((txstreams - 1) <<
7251 				IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT);
7252 		band->vht_cap.cap |=
7253 			IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB;
7254 	}
7255 }
7256 
7257 static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
7258 {
7259 	struct brcmf_pub *drvr = cfg->pub;
7260 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
7261 	struct wiphy *wiphy = cfg_to_wiphy(cfg);
7262 	u32 nmode = 0;
7263 	u32 vhtmode = 0;
7264 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
7265 	u32 rxchain;
7266 	u32 nchain;
7267 	int err;
7268 	s32 i;
7269 	struct ieee80211_supported_band *band;
7270 	u32 txstreams = 0;
7271 	u32 txbf_bfe_cap = 0;
7272 	u32 txbf_bfr_cap = 0;
7273 
7274 	(void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
7275 	err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
7276 	if (err) {
7277 		bphy_err(drvr, "nmode error (%d)\n", err);
7278 	} else {
7279 		brcmf_get_bwcap(ifp, bw_cap);
7280 	}
7281 	brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
7282 		  nmode, vhtmode, bw_cap[NL80211_BAND_2GHZ],
7283 		  bw_cap[NL80211_BAND_5GHZ]);
7284 
7285 	err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
7286 	if (err) {
7287 		/* rxchain unsupported by firmware of older chips */
7288 		if (err == -EBADE)
7289 			bphy_info_once(drvr, "rxchain unsupported\n");
7290 		else
7291 			bphy_err(drvr, "rxchain error (%d)\n", err);
7292 
7293 		nchain = 1;
7294 	} else {
7295 		for (nchain = 0; rxchain; nchain++)
7296 			rxchain = rxchain & (rxchain - 1);
7297 	}
7298 	brcmf_dbg(INFO, "nchain=%d\n", nchain);
7299 
7300 	err = brcmf_construct_chaninfo(cfg, bw_cap);
7301 	if (err) {
7302 		bphy_err(drvr, "brcmf_construct_chaninfo failed (%d)\n", err);
7303 		return err;
7304 	}
7305 
7306 	if (vhtmode) {
7307 		(void)brcmf_fil_iovar_int_get(ifp, "txstreams", &txstreams);
7308 		(void)brcmf_fil_iovar_int_get(ifp, "txbf_bfe_cap",
7309 					      &txbf_bfe_cap);
7310 		(void)brcmf_fil_iovar_int_get(ifp, "txbf_bfr_cap",
7311 					      &txbf_bfr_cap);
7312 	}
7313 
7314 	for (i = 0; i < ARRAY_SIZE(wiphy->bands); i++) {
7315 		band = wiphy->bands[i];
7316 		if (band == NULL)
7317 			continue;
7318 
7319 		if (nmode)
7320 			brcmf_update_ht_cap(band, bw_cap, nchain);
7321 		if (vhtmode)
7322 			brcmf_update_vht_cap(band, bw_cap, nchain, txstreams,
7323 					     txbf_bfe_cap, txbf_bfr_cap);
7324 	}
7325 
7326 	return 0;
7327 }
7328 
7329 static const struct ieee80211_txrx_stypes
7330 brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
7331 	[NL80211_IFTYPE_STATION] = {
7332 		.tx = 0xffff,
7333 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7334 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7335 	},
7336 	[NL80211_IFTYPE_P2P_CLIENT] = {
7337 		.tx = 0xffff,
7338 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7339 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7340 	},
7341 	[NL80211_IFTYPE_P2P_GO] = {
7342 		.tx = 0xffff,
7343 		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7344 		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7345 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7346 		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7347 		      BIT(IEEE80211_STYPE_AUTH >> 4) |
7348 		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7349 		      BIT(IEEE80211_STYPE_ACTION >> 4)
7350 	},
7351 	[NL80211_IFTYPE_P2P_DEVICE] = {
7352 		.tx = 0xffff,
7353 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
7354 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
7355 	},
7356 	[NL80211_IFTYPE_AP] = {
7357 		.tx = 0xffff,
7358 		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
7359 		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
7360 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
7361 		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
7362 		      BIT(IEEE80211_STYPE_AUTH >> 4) |
7363 		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
7364 		      BIT(IEEE80211_STYPE_ACTION >> 4)
7365 	}
7366 };
7367 
7368 /**
7369  * brcmf_setup_ifmodes() - determine interface modes and combinations.
7370  *
7371  * @wiphy: wiphy object.
7372  * @ifp: interface object needed for feat module api.
7373  *
7374  * The interface modes and combinations are determined dynamically here
7375  * based on firmware functionality.
7376  *
7377  * no p2p and no mbss:
7378  *
7379  *	#STA <= 1, #AP <= 1, channels = 1, 2 total
7380  *
7381  * no p2p and mbss:
7382  *
7383  *	#STA <= 1, #AP <= 1, channels = 1, 2 total
7384  *	#AP <= 4, matching BI, channels = 1, 4 total
7385  *
7386  * no p2p and rsdb:
7387  *	#STA <= 1, #AP <= 2, channels = 2, 4 total
7388  *
7389  * p2p, no mchan, and mbss:
7390  *
7391  *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 1, 3 total
7392  *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7393  *	#AP <= 4, matching BI, channels = 1, 4 total
7394  *
7395  * p2p, mchan, and mbss:
7396  *
7397  *	#STA <= 2, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 1, channels = 2, 3 total
7398  *	#STA <= 1, #P2P-DEV <= 1, #AP <= 1, #P2P-CL <= 1, channels = 1, 4 total
7399  *	#AP <= 4, matching BI, channels = 1, 4 total
7400  *
7401  * p2p, rsdb, and no mbss:
7402  *	#STA <= 1, #P2P-DEV <= 1, #{P2P-CL, P2P-GO} <= 2, AP <= 2,
7403  *	 channels = 2, 4 total
7404  */
7405 static int brcmf_setup_ifmodes(struct wiphy *wiphy, struct brcmf_if *ifp)
7406 {
7407 	struct ieee80211_iface_combination *combo = NULL;
7408 	struct ieee80211_iface_limit *c0_limits = NULL;
7409 	struct ieee80211_iface_limit *p2p_limits = NULL;
7410 	struct ieee80211_iface_limit *mbss_limits = NULL;
7411 	bool mon_flag, mbss, p2p, rsdb, mchan;
7412 	int i, c, n_combos, n_limits;
7413 
7414 	mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
7415 	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
7416 	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
7417 	rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
7418 	mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
7419 
7420 	n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
7421 	combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
7422 	if (!combo)
7423 		goto err;
7424 
7425 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
7426 				 BIT(NL80211_IFTYPE_ADHOC) |
7427 				 BIT(NL80211_IFTYPE_AP);
7428 	if (mon_flag)
7429 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
7430 	if (p2p)
7431 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
7432 					  BIT(NL80211_IFTYPE_P2P_GO) |
7433 					  BIT(NL80211_IFTYPE_P2P_DEVICE);
7434 
7435 	c = 0;
7436 	i = 0;
7437 	n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
7438 	c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
7439 	if (!c0_limits)
7440 		goto err;
7441 
7442 	combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
7443 	c0_limits[i].max = 1 + (p2p && mchan);
7444 	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7445 	if (mon_flag) {
7446 		c0_limits[i].max = 1;
7447 		c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7448 	}
7449 	if (p2p) {
7450 		c0_limits[i].max = 1;
7451 		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7452 		c0_limits[i].max = 1 + rsdb;
7453 		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
7454 				       BIT(NL80211_IFTYPE_P2P_GO);
7455 	}
7456 	if (p2p && rsdb) {
7457 		c0_limits[i].max = 2;
7458 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7459 		combo[c].max_interfaces = 4;
7460 	} else if (p2p) {
7461 		combo[c].max_interfaces = i;
7462 	} else if (rsdb) {
7463 		c0_limits[i].max = 2;
7464 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7465 		combo[c].max_interfaces = 3;
7466 	} else {
7467 		c0_limits[i].max = 1;
7468 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7469 		combo[c].max_interfaces = i;
7470 	}
7471 	combo[c].n_limits = i;
7472 	combo[c].limits = c0_limits;
7473 
7474 	if (p2p && !rsdb) {
7475 		c++;
7476 		i = 0;
7477 		p2p_limits = kcalloc(4, sizeof(*p2p_limits), GFP_KERNEL);
7478 		if (!p2p_limits)
7479 			goto err;
7480 		p2p_limits[i].max = 1;
7481 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
7482 		p2p_limits[i].max = 1;
7483 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7484 		p2p_limits[i].max = 1;
7485 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT);
7486 		p2p_limits[i].max = 1;
7487 		p2p_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
7488 		combo[c].num_different_channels = 1;
7489 		combo[c].max_interfaces = i;
7490 		combo[c].n_limits = i;
7491 		combo[c].limits = p2p_limits;
7492 	}
7493 
7494 	if (mbss) {
7495 		c++;
7496 		i = 0;
7497 		n_limits = 1 + mon_flag;
7498 		mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
7499 				      GFP_KERNEL);
7500 		if (!mbss_limits)
7501 			goto err;
7502 		mbss_limits[i].max = 4;
7503 		mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
7504 		if (mon_flag) {
7505 			mbss_limits[i].max = 1;
7506 			mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
7507 		}
7508 		combo[c].beacon_int_infra_match = true;
7509 		combo[c].num_different_channels = 1;
7510 		combo[c].max_interfaces = 4 + mon_flag;
7511 		combo[c].n_limits = i;
7512 		combo[c].limits = mbss_limits;
7513 	}
7514 
7515 	wiphy->n_iface_combinations = n_combos;
7516 	wiphy->iface_combinations = combo;
7517 	return 0;
7518 
7519 err:
7520 	kfree(c0_limits);
7521 	kfree(p2p_limits);
7522 	kfree(mbss_limits);
7523 	kfree(combo);
7524 	return -ENOMEM;
7525 }
7526 
7527 #ifdef CONFIG_PM
7528 static const struct wiphy_wowlan_support brcmf_wowlan_support = {
7529 	.flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
7530 	.n_patterns = BRCMF_WOWL_MAXPATTERNS,
7531 	.pattern_max_len = BRCMF_WOWL_MAXPATTERNSIZE,
7532 	.pattern_min_len = 1,
7533 	.max_pkt_offset = 1500,
7534 };
7535 #endif
7536 
7537 static void brcmf_wiphy_wowl_params(struct wiphy *wiphy, struct brcmf_if *ifp)
7538 {
7539 #ifdef CONFIG_PM
7540 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
7541 	struct brcmf_pub *drvr = cfg->pub;
7542 	struct wiphy_wowlan_support *wowl;
7543 
7544 	wowl = kmemdup(&brcmf_wowlan_support, sizeof(brcmf_wowlan_support),
7545 		       GFP_KERNEL);
7546 	if (!wowl) {
7547 		bphy_err(drvr, "only support basic wowlan features\n");
7548 		wiphy->wowlan = &brcmf_wowlan_support;
7549 		return;
7550 	}
7551 
7552 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7553 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_ND)) {
7554 			wowl->flags |= WIPHY_WOWLAN_NET_DETECT;
7555 			wowl->max_nd_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
7556 			init_waitqueue_head(&cfg->wowl.nd_data_wait);
7557 		}
7558 	}
7559 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK)) {
7560 		wowl->flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY;
7561 		wowl->flags |= WIPHY_WOWLAN_GTK_REKEY_FAILURE;
7562 	}
7563 
7564 	wiphy->wowlan = wowl;
7565 #endif
7566 }
7567 
7568 static int brcmf_setup_wiphy(struct wiphy *wiphy, struct brcmf_if *ifp)
7569 {
7570 	struct brcmf_pub *drvr = ifp->drvr;
7571 	const struct ieee80211_iface_combination *combo;
7572 	struct ieee80211_supported_band *band;
7573 	u16 max_interfaces = 0;
7574 	bool gscan;
7575 	__le32 bandlist[3];
7576 	u32 n_bands;
7577 	int err, i;
7578 
7579 	wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
7580 	wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
7581 	wiphy->max_num_pmkids = BRCMF_MAXPMKID;
7582 
7583 	err = brcmf_setup_ifmodes(wiphy, ifp);
7584 	if (err)
7585 		return err;
7586 
7587 	for (i = 0, combo = wiphy->iface_combinations;
7588 	     i < wiphy->n_iface_combinations; i++, combo++) {
7589 		max_interfaces = max(max_interfaces, combo->max_interfaces);
7590 	}
7591 
7592 	for (i = 0; i < max_interfaces && i < ARRAY_SIZE(drvr->addresses);
7593 	     i++) {
7594 		u8 *addr = drvr->addresses[i].addr;
7595 
7596 		memcpy(addr, drvr->mac, ETH_ALEN);
7597 		if (i) {
7598 			addr[0] |= BIT(1);
7599 			addr[ETH_ALEN - 1] ^= i;
7600 		}
7601 	}
7602 	wiphy->addresses = drvr->addresses;
7603 	wiphy->n_addresses = i;
7604 
7605 	wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
7606 	wiphy->cipher_suites = brcmf_cipher_suites;
7607 	wiphy->n_cipher_suites = ARRAY_SIZE(brcmf_cipher_suites);
7608 	if (!brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MFP))
7609 		wiphy->n_cipher_suites--;
7610 	wiphy->bss_select_support = BIT(NL80211_BSS_SELECT_ATTR_RSSI) |
7611 				    BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
7612 				    BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
7613 
7614 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
7615 			WIPHY_FLAG_PS_ON_BY_DEFAULT |
7616 			WIPHY_FLAG_HAVE_AP_SME |
7617 			WIPHY_FLAG_OFFCHAN_TX |
7618 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
7619 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
7620 		wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
7621 	if (!ifp->drvr->settings->roamoff)
7622 		wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
7623 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
7624 		wiphy_ext_feature_set(wiphy,
7625 				      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK);
7626 		wiphy_ext_feature_set(wiphy,
7627 				      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X);
7628 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7629 			wiphy_ext_feature_set(wiphy,
7630 					      NL80211_EXT_FEATURE_SAE_OFFLOAD);
7631 	}
7632 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWAUTH)) {
7633 		wiphy_ext_feature_set(wiphy,
7634 				      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK);
7635 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE))
7636 			wiphy_ext_feature_set(wiphy,
7637 					      NL80211_EXT_FEATURE_SAE_OFFLOAD_AP);
7638 	}
7639 	wiphy->mgmt_stypes = brcmf_txrx_stypes;
7640 	wiphy->max_remain_on_channel_duration = 5000;
7641 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_PNO)) {
7642 		gscan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GSCAN);
7643 		brcmf_pno_wiphy_params(wiphy, gscan);
7644 	}
7645 	/* vendor commands/events support */
7646 	wiphy->vendor_commands = brcmf_vendor_cmds;
7647 	wiphy->n_vendor_commands = BRCMF_VNDR_CMDS_LAST - 1;
7648 
7649 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL))
7650 		brcmf_wiphy_wowl_params(wiphy, ifp);
7651 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BANDLIST, &bandlist,
7652 				     sizeof(bandlist));
7653 	if (err) {
7654 		bphy_err(drvr, "could not obtain band info: err=%d\n", err);
7655 		return err;
7656 	}
7657 	/* first entry in bandlist is number of bands */
7658 	n_bands = le32_to_cpu(bandlist[0]);
7659 	for (i = 1; i <= n_bands && i < ARRAY_SIZE(bandlist); i++) {
7660 		if (bandlist[i] == cpu_to_le32(WLC_BAND_2G)) {
7661 			band = kmemdup(&__wl_band_2ghz, sizeof(__wl_band_2ghz),
7662 				       GFP_KERNEL);
7663 			if (!band)
7664 				return -ENOMEM;
7665 
7666 			band->channels = kmemdup(&__wl_2ghz_channels,
7667 						 sizeof(__wl_2ghz_channels),
7668 						 GFP_KERNEL);
7669 			if (!band->channels) {
7670 				kfree(band);
7671 				return -ENOMEM;
7672 			}
7673 
7674 			band->n_channels = ARRAY_SIZE(__wl_2ghz_channels);
7675 			wiphy->bands[NL80211_BAND_2GHZ] = band;
7676 		}
7677 		if (bandlist[i] == cpu_to_le32(WLC_BAND_5G)) {
7678 			band = kmemdup(&__wl_band_5ghz, sizeof(__wl_band_5ghz),
7679 				       GFP_KERNEL);
7680 			if (!band)
7681 				return -ENOMEM;
7682 
7683 			band->channels = kmemdup(&__wl_5ghz_channels,
7684 						 sizeof(__wl_5ghz_channels),
7685 						 GFP_KERNEL);
7686 			if (!band->channels) {
7687 				kfree(band);
7688 				return -ENOMEM;
7689 			}
7690 
7691 			band->n_channels = ARRAY_SIZE(__wl_5ghz_channels);
7692 			wiphy->bands[NL80211_BAND_5GHZ] = band;
7693 		}
7694 	}
7695 
7696 	if (wiphy->bands[NL80211_BAND_5GHZ] &&
7697 	    brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DOT11H))
7698 		wiphy_ext_feature_set(wiphy,
7699 				      NL80211_EXT_FEATURE_DFS_OFFLOAD);
7700 
7701 	wiphy_ext_feature_set(wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
7702 
7703 	wiphy_read_of_freq_limits(wiphy);
7704 
7705 	return 0;
7706 }
7707 
7708 static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg)
7709 {
7710 	struct brcmf_pub *drvr = cfg->pub;
7711 	struct net_device *ndev;
7712 	struct wireless_dev *wdev;
7713 	struct brcmf_if *ifp;
7714 	s32 power_mode;
7715 	s32 err = 0;
7716 
7717 	if (cfg->dongle_up)
7718 		return err;
7719 
7720 	ndev = cfg_to_ndev(cfg);
7721 	wdev = ndev->ieee80211_ptr;
7722 	ifp = netdev_priv(ndev);
7723 
7724 	/* make sure RF is ready for work */
7725 	brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
7726 
7727 	brcmf_dongle_scantime(ifp);
7728 
7729 	power_mode = cfg->pwr_save ? PM_FAST : PM_OFF;
7730 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PM, power_mode);
7731 	if (err)
7732 		goto default_conf_out;
7733 	brcmf_dbg(INFO, "power save set to %s\n",
7734 		  (power_mode ? "enabled" : "disabled"));
7735 
7736 	err = brcmf_dongle_roam(ifp);
7737 	if (err)
7738 		goto default_conf_out;
7739 	err = brcmf_cfg80211_change_iface(wdev->wiphy, ndev, wdev->iftype,
7740 					  NULL);
7741 	if (err)
7742 		goto default_conf_out;
7743 
7744 	brcmf_configure_arp_nd_offload(ifp, true);
7745 
7746 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
7747 	if (err) {
7748 		bphy_err(drvr, "failed to set frameburst mode\n");
7749 		goto default_conf_out;
7750 	}
7751 
7752 	cfg->dongle_up = true;
7753 default_conf_out:
7754 
7755 	return err;
7756 
7757 }
7758 
7759 static s32 __brcmf_cfg80211_up(struct brcmf_if *ifp)
7760 {
7761 	set_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7762 
7763 	return brcmf_config_dongle(ifp->drvr->config);
7764 }
7765 
7766 static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
7767 {
7768 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7769 
7770 	/*
7771 	 * While going down, if associated with AP disassociate
7772 	 * from AP to save power
7773 	 */
7774 	if (check_vif_up(ifp->vif)) {
7775 		brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED, true);
7776 
7777 		/* Make sure WPA_Supplicant receives all the event
7778 		   generated due to DISASSOC call to the fw to keep
7779 		   the state fw and WPA_Supplicant state consistent
7780 		 */
7781 		brcmf_delay(500);
7782 	}
7783 
7784 	brcmf_abort_scanning(cfg);
7785 	clear_bit(BRCMF_VIF_STATUS_READY, &ifp->vif->sme_state);
7786 
7787 	return 0;
7788 }
7789 
7790 s32 brcmf_cfg80211_up(struct net_device *ndev)
7791 {
7792 	struct brcmf_if *ifp = netdev_priv(ndev);
7793 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7794 	s32 err = 0;
7795 
7796 	mutex_lock(&cfg->usr_sync);
7797 	err = __brcmf_cfg80211_up(ifp);
7798 	mutex_unlock(&cfg->usr_sync);
7799 
7800 	return err;
7801 }
7802 
7803 s32 brcmf_cfg80211_down(struct net_device *ndev)
7804 {
7805 	struct brcmf_if *ifp = netdev_priv(ndev);
7806 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
7807 	s32 err = 0;
7808 
7809 	mutex_lock(&cfg->usr_sync);
7810 	err = __brcmf_cfg80211_down(ifp);
7811 	mutex_unlock(&cfg->usr_sync);
7812 
7813 	return err;
7814 }
7815 
7816 enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp)
7817 {
7818 	struct wireless_dev *wdev = &ifp->vif->wdev;
7819 
7820 	return wdev->iftype;
7821 }
7822 
7823 bool brcmf_get_vif_state_any(struct brcmf_cfg80211_info *cfg,
7824 			     unsigned long state)
7825 {
7826 	struct brcmf_cfg80211_vif *vif;
7827 
7828 	list_for_each_entry(vif, &cfg->vif_list, list) {
7829 		if (test_bit(state, &vif->sme_state))
7830 			return true;
7831 	}
7832 	return false;
7833 }
7834 
7835 static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
7836 				    u8 action)
7837 {
7838 	u8 evt_action;
7839 
7840 	spin_lock(&event->vif_event_lock);
7841 	evt_action = event->action;
7842 	spin_unlock(&event->vif_event_lock);
7843 	return evt_action == action;
7844 }
7845 
7846 void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
7847 				  struct brcmf_cfg80211_vif *vif)
7848 {
7849 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7850 
7851 	spin_lock(&event->vif_event_lock);
7852 	event->vif = vif;
7853 	event->action = 0;
7854 	spin_unlock(&event->vif_event_lock);
7855 }
7856 
7857 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
7858 {
7859 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7860 	bool armed;
7861 
7862 	spin_lock(&event->vif_event_lock);
7863 	armed = event->vif != NULL;
7864 	spin_unlock(&event->vif_event_lock);
7865 
7866 	return armed;
7867 }
7868 
7869 int brcmf_cfg80211_wait_vif_event(struct brcmf_cfg80211_info *cfg,
7870 				  u8 action, ulong timeout)
7871 {
7872 	struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
7873 
7874 	return wait_event_timeout(event->vif_wq,
7875 				  vif_event_equals(event, action), timeout);
7876 }
7877 
7878 static bool brmcf_use_iso3166_ccode_fallback(struct brcmf_pub *drvr)
7879 {
7880 	if (drvr->settings->trivial_ccode_map)
7881 		return true;
7882 
7883 	switch (drvr->bus_if->chip) {
7884 	case BRCM_CC_43430_CHIP_ID:
7885 	case BRCM_CC_4345_CHIP_ID:
7886 	case BRCM_CC_4356_CHIP_ID:
7887 	case BRCM_CC_43602_CHIP_ID:
7888 		return true;
7889 	default:
7890 		return false;
7891 	}
7892 }
7893 
7894 static s32 brcmf_translate_country_code(struct brcmf_pub *drvr, char alpha2[2],
7895 					struct brcmf_fil_country_le *ccreq)
7896 {
7897 	struct brcmfmac_pd_cc *country_codes;
7898 	struct brcmfmac_pd_cc_entry *cc;
7899 	s32 found_index;
7900 	int i;
7901 
7902 	if ((alpha2[0] == ccreq->country_abbrev[0]) &&
7903 	    (alpha2[1] == ccreq->country_abbrev[1])) {
7904 		brcmf_dbg(TRACE, "Country code already set\n");
7905 		return -EAGAIN;
7906 	}
7907 
7908 	country_codes = drvr->settings->country_codes;
7909 	if (!country_codes) {
7910 		if (brmcf_use_iso3166_ccode_fallback(drvr)) {
7911 			brcmf_dbg(TRACE, "No country codes configured for device, using ISO3166 code and 0 rev\n");
7912 			memset(ccreq, 0, sizeof(*ccreq));
7913 			ccreq->country_abbrev[0] = alpha2[0];
7914 			ccreq->country_abbrev[1] = alpha2[1];
7915 			ccreq->ccode[0] = alpha2[0];
7916 			ccreq->ccode[1] = alpha2[1];
7917 			return 0;
7918 		}
7919 
7920 		brcmf_dbg(TRACE, "No country codes configured for device\n");
7921 		return -EINVAL;
7922 	}
7923 
7924 	found_index = -1;
7925 	for (i = 0; i < country_codes->table_size; i++) {
7926 		cc = &country_codes->table[i];
7927 		if ((cc->iso3166[0] == '\0') && (found_index == -1))
7928 			found_index = i;
7929 		if ((cc->iso3166[0] == alpha2[0]) &&
7930 		    (cc->iso3166[1] == alpha2[1])) {
7931 			found_index = i;
7932 			break;
7933 		}
7934 	}
7935 	if (found_index == -1) {
7936 		brcmf_dbg(TRACE, "No country code match found\n");
7937 		return -EINVAL;
7938 	}
7939 	memset(ccreq, 0, sizeof(*ccreq));
7940 	ccreq->rev = cpu_to_le32(country_codes->table[found_index].rev);
7941 	memcpy(ccreq->ccode, country_codes->table[found_index].cc,
7942 	       BRCMF_COUNTRY_BUF_SZ);
7943 	ccreq->country_abbrev[0] = alpha2[0];
7944 	ccreq->country_abbrev[1] = alpha2[1];
7945 	ccreq->country_abbrev[2] = 0;
7946 
7947 	return 0;
7948 }
7949 
7950 static int
7951 brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
7952 {
7953 	int i;
7954 	char *token;
7955 	char delim[] = "\n ";
7956 	unsigned long val;
7957 	int err = 0;
7958 
7959 	token = strsep(&buf, delim);
7960 	while (token) {
7961 		if (!strcmp(token, "OBSS")) {
7962 			for (i = 0; i < OBSS_TOKEN_IDX; i++)
7963 				token = strsep(&buf, delim);
7964 			err = kstrtoul(token, 10, &val);
7965 			if (err)
7966 				break;
7967 			survey->obss = val;
7968 		}
7969 
7970 		if (!strcmp(token, "IBSS")) {
7971 			for (i = 0; i < IBSS_TOKEN_IDX; i++)
7972 				token = strsep(&buf, delim);
7973 			err = kstrtoul(token, 10, &val);
7974 			if (err)
7975 				break;
7976 			survey->ibss = val;
7977 		}
7978 
7979 		if (!strcmp(token, "TXDur")) {
7980 			for (i = 0; i < TX_TOKEN_IDX; i++)
7981 				token = strsep(&buf, delim);
7982 			err = kstrtoul(token, 10, &val);
7983 			if (err)
7984 				break;
7985 			survey->tx = val;
7986 		}
7987 
7988 		if (!strcmp(token, "Category")) {
7989 			for (i = 0; i < CTG_TOKEN_IDX; i++)
7990 				token = strsep(&buf, delim);
7991 			err = kstrtoul(token, 10, &val);
7992 			if (err)
7993 				break;
7994 			survey->no_ctg = val;
7995 		}
7996 
7997 		if (!strcmp(token, "Packet")) {
7998 			for (i = 0; i < PKT_TOKEN_IDX; i++)
7999 				token = strsep(&buf, delim);
8000 			err = kstrtoul(token, 10, &val);
8001 			if (err)
8002 				break;
8003 			survey->no_pckt = val;
8004 		}
8005 
8006 		if (!strcmp(token, "Opp(time):")) {
8007 			for (i = 0; i < IDLE_TOKEN_IDX; i++)
8008 				token = strsep(&buf, delim);
8009 			err = kstrtoul(token, 10, &val);
8010 			if (err)
8011 				break;
8012 			survey->idle = val;
8013 		}
8014 
8015 		token = strsep(&buf, delim);
8016 	}
8017 
8018 	return err;
8019 }
8020 
8021 static int
8022 brcmf_dump_obss(struct brcmf_if *ifp, struct cca_msrmnt_query req,
8023 		struct brcmf_dump_survey *survey)
8024 {
8025 	struct cca_stats_n_flags *results;
8026 	char *buf;
8027 	int err;
8028 
8029 	buf = kzalloc(sizeof(char) * BRCMF_DCMD_MEDLEN, GFP_KERNEL);
8030 	if (!buf)
8031 		return -ENOMEM;
8032 
8033 	memcpy(buf, &req, sizeof(struct cca_msrmnt_query));
8034 	err = brcmf_fil_iovar_data_get(ifp, "dump_obss",
8035 				       buf, BRCMF_DCMD_MEDLEN);
8036 	if (err) {
8037 		brcmf_err("dump_obss error (%d)\n", err);
8038 		err = -EINVAL;
8039 		goto exit;
8040 	}
8041 	results = (struct cca_stats_n_flags *)(buf);
8042 
8043 	if (req.msrmnt_query)
8044 		brcmf_parse_dump_obss(results->buf, survey);
8045 
8046 exit:
8047 	kfree(buf);
8048 	return err;
8049 }
8050 
8051 static s32
8052 brcmf_set_channel(struct brcmf_cfg80211_info *cfg, struct ieee80211_channel *chan)
8053 {
8054 	u16 chspec = 0;
8055 	int err = 0;
8056 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8057 
8058 	if (chan->flags & IEEE80211_CHAN_DISABLED)
8059 		return -EINVAL;
8060 
8061 	/* set_channel */
8062 	chspec = channel_to_chanspec(&cfg->d11inf, chan);
8063 	if (chspec != INVCHANSPEC) {
8064 		err = brcmf_fil_iovar_int_set(ifp, "chanspec", chspec);
8065 		if (err) {
8066 			brcmf_err("set chanspec 0x%04x fail, reason %d\n", chspec, err);
8067 			err = -EINVAL;
8068 		}
8069 	} else {
8070 		brcmf_err("failed to convert host chanspec to fw chanspec\n");
8071 		err = -EINVAL;
8072 	}
8073 
8074 	return err;
8075 }
8076 
8077 static int
8078 brcmf_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *ndev,
8079 			   int idx, struct survey_info *info)
8080 {
8081 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8082 	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
8083 	struct brcmf_dump_survey survey = {};
8084 	struct ieee80211_supported_band *band;
8085 	enum nl80211_band band_id;
8086 	struct cca_msrmnt_query req;
8087 	u32 noise;
8088 	int err;
8089 
8090 	brcmf_dbg(TRACE, "Enter: channel idx=%d\n", idx);
8091 
8092 	/* Do not run survey when VIF in CONNECTING / CONNECTED states */
8093 	if ((test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) ||
8094 	    (test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state))) {
8095 		return -EBUSY;
8096 	}
8097 
8098 	for (band_id = 0; band_id < NUM_NL80211_BANDS; band_id++) {
8099 		band = wiphy->bands[band_id];
8100 		if (!band)
8101 			continue;
8102 		if (idx >= band->n_channels) {
8103 			idx -= band->n_channels;
8104 			continue;
8105 		}
8106 
8107 		info->channel = &band->channels[idx];
8108 		break;
8109 	}
8110 	if (band_id == NUM_NL80211_BANDS)
8111 		return -ENOENT;
8112 
8113 	/* Setting current channel to the requested channel */
8114 	info->filled = 0;
8115 	if (brcmf_set_channel(cfg, info->channel))
8116 		return 0;
8117 
8118 	/* Disable mpc */
8119 	brcmf_set_mpc(ifp, 0);
8120 
8121 	/* Set interface up, explicitly. */
8122 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
8123 	if (err) {
8124 		brcmf_err("set interface up failed, err = %d\n", err);
8125 		goto exit;
8126 	}
8127 
8128 	/* Get noise value */
8129 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_PHY_NOISE, &noise);
8130 	if (err) {
8131 		brcmf_err("Get Phy Noise failed, use dummy value\n");
8132 		noise = CHAN_NOISE_DUMMY;
8133 	}
8134 
8135 	/* Start Measurement for obss stats on current channel */
8136 	req.msrmnt_query = 0;
8137 	req.time_req = ACS_MSRMNT_DELAY;
8138 	err = brcmf_dump_obss(ifp, req, &survey);
8139 	if (err)
8140 		goto exit;
8141 
8142 	/* Add 10 ms for IOVAR completion */
8143 	msleep(ACS_MSRMNT_DELAY + 10);
8144 
8145 	/* Issue IOVAR to collect measurement results */
8146 	req.msrmnt_query = 1;
8147 	err = brcmf_dump_obss(ifp, req, &survey);
8148 	if (err)
8149 		goto exit;
8150 
8151 	info->noise = noise;
8152 	info->time = ACS_MSRMNT_DELAY;
8153 	info->time_busy = ACS_MSRMNT_DELAY - survey.idle;
8154 	info->time_rx = survey.obss + survey.ibss + survey.no_ctg +
8155 		survey.no_pckt;
8156 	info->time_tx = survey.tx;
8157 	info->filled = SURVEY_INFO_NOISE_DBM | SURVEY_INFO_TIME |
8158 		SURVEY_INFO_TIME_BUSY | SURVEY_INFO_TIME_RX |
8159 		SURVEY_INFO_TIME_TX;
8160 
8161 	brcmf_dbg(INFO, "OBSS dump: channel %d: survey duration %d\n",
8162 		  ieee80211_frequency_to_channel(info->channel->center_freq),
8163 		  ACS_MSRMNT_DELAY);
8164 	brcmf_dbg(INFO, "noise(%d) busy(%llu) rx(%llu) tx(%llu)\n",
8165 		  info->noise, info->time_busy, info->time_rx, info->time_tx);
8166 
8167 exit:
8168 	if (!brcmf_is_apmode(ifp->vif))
8169 		brcmf_set_mpc(ifp, 1);
8170 	return err;
8171 }
8172 
8173 static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
8174 					struct regulatory_request *req)
8175 {
8176 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
8177 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
8178 	struct brcmf_pub *drvr = cfg->pub;
8179 	struct brcmf_fil_country_le ccreq;
8180 	s32 err;
8181 	int i;
8182 
8183 	/* The country code gets set to "00" by default at boot, ignore */
8184 	if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
8185 		return;
8186 
8187 	/* ignore non-ISO3166 country codes */
8188 	for (i = 0; i < 2; i++)
8189 		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
8190 			bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
8191 				 req->alpha2[0], req->alpha2[1]);
8192 			return;
8193 		}
8194 
8195 	brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
8196 		  req->alpha2[0], req->alpha2[1]);
8197 
8198 	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
8199 	if (err) {
8200 		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
8201 		return;
8202 	}
8203 
8204 	err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
8205 	if (err)
8206 		return;
8207 
8208 	err = brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
8209 	if (err) {
8210 		bphy_err(drvr, "Firmware rejected country setting\n");
8211 		return;
8212 	}
8213 	brcmf_setup_wiphybands(cfg);
8214 }
8215 
8216 static void brcmf_free_wiphy(struct wiphy *wiphy)
8217 {
8218 	int i;
8219 
8220 	if (!wiphy)
8221 		return;
8222 
8223 	if (wiphy->iface_combinations) {
8224 		for (i = 0; i < wiphy->n_iface_combinations; i++)
8225 			kfree(wiphy->iface_combinations[i].limits);
8226 	}
8227 	kfree(wiphy->iface_combinations);
8228 	if (wiphy->bands[NL80211_BAND_2GHZ]) {
8229 		kfree(wiphy->bands[NL80211_BAND_2GHZ]->channels);
8230 		kfree(wiphy->bands[NL80211_BAND_2GHZ]);
8231 	}
8232 	if (wiphy->bands[NL80211_BAND_5GHZ]) {
8233 		kfree(wiphy->bands[NL80211_BAND_5GHZ]->channels);
8234 		kfree(wiphy->bands[NL80211_BAND_5GHZ]);
8235 	}
8236 #if IS_ENABLED(CONFIG_PM)
8237 	if (wiphy->wowlan != &brcmf_wowlan_support)
8238 		kfree(wiphy->wowlan);
8239 #endif
8240 }
8241 
8242 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
8243 						  struct cfg80211_ops *ops,
8244 						  bool p2pdev_forced)
8245 {
8246 	struct wiphy *wiphy = drvr->wiphy;
8247 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
8248 	struct brcmf_cfg80211_info *cfg;
8249 	struct brcmf_cfg80211_vif *vif;
8250 	struct brcmf_if *ifp;
8251 	s32 err = 0;
8252 	s32 io_type;
8253 	u16 *cap = NULL;
8254 
8255 	if (!ndev) {
8256 		bphy_err(drvr, "ndev is invalid\n");
8257 		return NULL;
8258 	}
8259 
8260 	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
8261 	if (!cfg) {
8262 		bphy_err(drvr, "Could not allocate wiphy device\n");
8263 		return NULL;
8264 	}
8265 
8266 	cfg->wiphy = wiphy;
8267 	cfg->pub = drvr;
8268 	init_vif_event(&cfg->vif_event);
8269 	INIT_LIST_HEAD(&cfg->vif_list);
8270 
8271 	vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION);
8272 	if (IS_ERR(vif))
8273 		goto wiphy_out;
8274 
8275 	ifp = netdev_priv(ndev);
8276 	vif->ifp = ifp;
8277 	vif->wdev.netdev = ndev;
8278 	ndev->ieee80211_ptr = &vif->wdev;
8279 	SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
8280 
8281 	err = wl_init_priv(cfg);
8282 	if (err) {
8283 		bphy_err(drvr, "Failed to init iwm_priv (%d)\n", err);
8284 		brcmf_free_vif(vif);
8285 		goto wiphy_out;
8286 	}
8287 	ifp->vif = vif;
8288 
8289 	/* determine d11 io type before wiphy setup */
8290 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION, &io_type);
8291 	if (err) {
8292 		bphy_err(drvr, "Failed to get D11 version (%d)\n", err);
8293 		goto priv_out;
8294 	}
8295 	cfg->d11inf.io_type = (u8)io_type;
8296 	brcmu_d11_attach(&cfg->d11inf);
8297 
8298 	/* regulatory notifer below needs access to cfg so
8299 	 * assign it now.
8300 	 */
8301 	drvr->config = cfg;
8302 
8303 	err = brcmf_setup_wiphy(wiphy, ifp);
8304 	if (err < 0)
8305 		goto priv_out;
8306 
8307 	brcmf_dbg(INFO, "Registering custom regulatory\n");
8308 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
8309 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
8310 	wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
8311 
8312 	/* firmware defaults to 40MHz disabled in 2G band. We signal
8313 	 * cfg80211 here that we do and have it decide we can enable
8314 	 * it. But first check if device does support 2G operation.
8315 	 */
8316 	if (wiphy->bands[NL80211_BAND_2GHZ]) {
8317 		cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
8318 		*cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8319 	}
8320 #ifdef CONFIG_PM
8321 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
8322 		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
8323 #endif
8324 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_DUMP_OBSS))
8325 		ops->dump_survey = brcmf_cfg80211_dump_survey;
8326 
8327 	err = wiphy_register(wiphy);
8328 	if (err < 0) {
8329 		bphy_err(drvr, "Could not register wiphy device (%d)\n", err);
8330 		goto priv_out;
8331 	}
8332 
8333 	err = brcmf_setup_wiphybands(cfg);
8334 	if (err) {
8335 		bphy_err(drvr, "Setting wiphy bands failed (%d)\n", err);
8336 		goto wiphy_unreg_out;
8337 	}
8338 
8339 	/* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(),
8340 	 * setup 40MHz in 2GHz band and enable OBSS scanning.
8341 	 */
8342 	if (cap && (*cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)) {
8343 		err = brcmf_enable_bw40_2g(cfg);
8344 		if (!err)
8345 			err = brcmf_fil_iovar_int_set(ifp, "obss_coex",
8346 						      BRCMF_OBSS_COEX_AUTO);
8347 		else
8348 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
8349 	}
8350 
8351 	err = brcmf_fweh_activate_events(ifp);
8352 	if (err) {
8353 		bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8354 		goto wiphy_unreg_out;
8355 	}
8356 
8357 	err = brcmf_p2p_attach(cfg, p2pdev_forced);
8358 	if (err) {
8359 		bphy_err(drvr, "P2P initialisation failed (%d)\n", err);
8360 		goto wiphy_unreg_out;
8361 	}
8362 	err = brcmf_btcoex_attach(cfg);
8363 	if (err) {
8364 		bphy_err(drvr, "BT-coex initialisation failed (%d)\n", err);
8365 		brcmf_p2p_detach(&cfg->p2p);
8366 		goto wiphy_unreg_out;
8367 	}
8368 	err = brcmf_pno_attach(cfg);
8369 	if (err) {
8370 		bphy_err(drvr, "PNO initialisation failed (%d)\n", err);
8371 		brcmf_btcoex_detach(cfg);
8372 		brcmf_p2p_detach(&cfg->p2p);
8373 		goto wiphy_unreg_out;
8374 	}
8375 
8376 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS)) {
8377 		err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
8378 		if (err) {
8379 			brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
8380 			wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
8381 		} else {
8382 			brcmf_fweh_register(cfg->pub, BRCMF_E_TDLS_PEER_EVENT,
8383 					    brcmf_notify_tdls_peer_event);
8384 		}
8385 	}
8386 
8387 	/* (re-) activate FWEH event handling */
8388 	err = brcmf_fweh_activate_events(ifp);
8389 	if (err) {
8390 		bphy_err(drvr, "FWEH activation failed (%d)\n", err);
8391 		goto detach;
8392 	}
8393 
8394 	/* Fill in some of the advertised nl80211 supported features */
8395 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SCAN_RANDOM_MAC)) {
8396 		wiphy->features |= NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
8397 #ifdef CONFIG_PM
8398 		if (wiphy->wowlan &&
8399 		    wiphy->wowlan->flags & WIPHY_WOWLAN_NET_DETECT)
8400 			wiphy->features |= NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8401 #endif
8402 	}
8403 
8404 	return cfg;
8405 
8406 detach:
8407 	brcmf_pno_detach(cfg);
8408 	brcmf_btcoex_detach(cfg);
8409 	brcmf_p2p_detach(&cfg->p2p);
8410 wiphy_unreg_out:
8411 	wiphy_unregister(cfg->wiphy);
8412 priv_out:
8413 	wl_deinit_priv(cfg);
8414 	brcmf_free_vif(vif);
8415 	ifp->vif = NULL;
8416 wiphy_out:
8417 	brcmf_free_wiphy(wiphy);
8418 	kfree(cfg);
8419 	return NULL;
8420 }
8421 
8422 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
8423 {
8424 	if (!cfg)
8425 		return;
8426 
8427 	brcmf_pno_detach(cfg);
8428 	brcmf_btcoex_detach(cfg);
8429 	wiphy_unregister(cfg->wiphy);
8430 	wl_deinit_priv(cfg);
8431 	cancel_work_sync(&cfg->escan_timeout_work);
8432 	brcmf_free_wiphy(cfg->wiphy);
8433 	kfree(cfg);
8434 }
8435