1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2010 Broadcom Corporation
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/etherdevice.h>
8 #include <linux/module.h>
9 #include <linux/inetdevice.h>
10 #include <linux/property.h>
11 #include <net/cfg80211.h>
12 #include <net/rtnetlink.h>
13 #include <net/addrconf.h>
14 #include <net/ieee80211_radiotap.h>
15 #include <net/ipv6.h>
16 #include <brcmu_utils.h>
17 #include <brcmu_wifi.h>
18 
19 #include "core.h"
20 #include "bus.h"
21 #include "debug.h"
22 #include "fwil_types.h"
23 #include "p2p.h"
24 #include "pno.h"
25 #include "cfg80211.h"
26 #include "fwil.h"
27 #include "feature.h"
28 #include "proto.h"
29 #include "pcie.h"
30 #include "common.h"
31 
32 #define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(950)
33 
34 #define BRCMF_BSSIDX_INVALID			-1
35 
36 #define	RXS_PBPRES				BIT(2)
37 
38 #define	D11_PHY_HDR_LEN				6
39 
40 struct d11rxhdr_le {
41 	__le16 RxFrameSize;
42 	u16 PAD;
43 	__le16 PhyRxStatus_0;
44 	__le16 PhyRxStatus_1;
45 	__le16 PhyRxStatus_2;
46 	__le16 PhyRxStatus_3;
47 	__le16 PhyRxStatus_4;
48 	__le16 PhyRxStatus_5;
49 	__le16 RxStatus1;
50 	__le16 RxStatus2;
51 	__le16 RxTSFTime;
52 	__le16 RxChan;
53 	u8 unknown[12];
54 } __packed;
55 
56 struct wlc_d11rxhdr {
57 	struct d11rxhdr_le rxhdr;
58 	__le32 tsf_l;
59 	s8 rssi;
60 	s8 rxpwr0;
61 	s8 rxpwr1;
62 	s8 do_rssi_ma;
63 	s8 rxpwr[4];
64 } __packed;
65 
66 char *brcmf_ifname(struct brcmf_if *ifp)
67 {
68 	if (!ifp)
69 		return "<if_null>";
70 
71 	if (ifp->ndev)
72 		return ifp->ndev->name;
73 
74 	return "<if_none>";
75 }
76 
77 struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
78 {
79 	struct brcmf_if *ifp;
80 	s32 bsscfgidx;
81 
82 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
83 		bphy_err(drvr, "ifidx %d out of range\n", ifidx);
84 		return NULL;
85 	}
86 
87 	ifp = NULL;
88 	bsscfgidx = drvr->if2bss[ifidx];
89 	if (bsscfgidx >= 0)
90 		ifp = drvr->iflist[bsscfgidx];
91 
92 	return ifp;
93 }
94 
95 void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
96 {
97 	s32 err;
98 	u32 mode;
99 
100 	if (enable)
101 		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
102 	else
103 		mode = 0;
104 
105 	/* Try to set and enable ARP offload feature, this may fail, then it  */
106 	/* is simply not supported and err 0 will be returned                 */
107 	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
108 	if (err) {
109 		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
110 			  mode, err);
111 	} else {
112 		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
113 		if (err) {
114 			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
115 				  enable, err);
116 		} else {
117 			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
118 				  enable, mode);
119 		}
120 	}
121 
122 	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
123 	if (err) {
124 		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
125 			  enable, err);
126 	} else {
127 		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
128 			  enable, mode);
129 	}
130 }
131 
132 static void _brcmf_set_multicast_list(struct work_struct *work)
133 {
134 	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
135 					    multicast_work);
136 	struct brcmf_pub *drvr = ifp->drvr;
137 	struct net_device *ndev;
138 	struct netdev_hw_addr *ha;
139 	u32 cmd_value, cnt;
140 	__le32 cnt_le;
141 	char *buf, *bufp;
142 	u32 buflen;
143 	s32 err;
144 
145 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
146 
147 	ndev = ifp->ndev;
148 
149 	/* Determine initial value of allmulti flag */
150 	cmd_value = (ndev->flags & IFF_ALLMULTI) ? true : false;
151 
152 	/* Send down the multicast list first. */
153 	cnt = netdev_mc_count(ndev);
154 	buflen = sizeof(cnt) + (cnt * ETH_ALEN);
155 	buf = kmalloc(buflen, GFP_KERNEL);
156 	if (!buf)
157 		return;
158 	bufp = buf;
159 
160 	cnt_le = cpu_to_le32(cnt);
161 	memcpy(bufp, &cnt_le, sizeof(cnt_le));
162 	bufp += sizeof(cnt_le);
163 
164 	netdev_for_each_mc_addr(ha, ndev) {
165 		if (!cnt)
166 			break;
167 		memcpy(bufp, ha->addr, ETH_ALEN);
168 		bufp += ETH_ALEN;
169 		cnt--;
170 	}
171 
172 	err = brcmf_fil_iovar_data_set(ifp, "mcast_list", buf, buflen);
173 	if (err < 0) {
174 		bphy_err(drvr, "Setting mcast_list failed, %d\n", err);
175 		cmd_value = cnt ? true : cmd_value;
176 	}
177 
178 	kfree(buf);
179 
180 	/*
181 	 * Now send the allmulti setting.  This is based on the setting in the
182 	 * net_device flags, but might be modified above to be turned on if we
183 	 * were trying to set some addresses and dongle rejected it...
184 	 */
185 	err = brcmf_fil_iovar_int_set(ifp, "allmulti", cmd_value);
186 	if (err < 0)
187 		bphy_err(drvr, "Setting allmulti failed, %d\n", err);
188 
189 	/*Finally, pick up the PROMISC flag */
190 	cmd_value = (ndev->flags & IFF_PROMISC) ? true : false;
191 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PROMISC, cmd_value);
192 	if (err < 0) {
193 		/* PROMISC unsupported by firmware of older chips */
194 		if (err == -EBADE)
195 			bphy_info_once(drvr, "BRCMF_C_SET_PROMISC unsupported\n");
196 		else
197 			bphy_err(drvr, "Setting BRCMF_C_SET_PROMISC failed, err=%d\n",
198 				 err);
199 	}
200 	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
201 }
202 
203 #if IS_ENABLED(CONFIG_IPV6)
204 static void _brcmf_update_ndtable(struct work_struct *work)
205 {
206 	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
207 					    ndoffload_work);
208 	struct brcmf_pub *drvr = ifp->drvr;
209 	int i, ret;
210 
211 	/* clear the table in firmware */
212 	ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip_clear", NULL, 0);
213 	if (ret) {
214 		brcmf_dbg(TRACE, "fail to clear nd ip table err:%d\n", ret);
215 		return;
216 	}
217 
218 	for (i = 0; i < ifp->ipv6addr_idx; i++) {
219 		ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip",
220 					       &ifp->ipv6_addr_tbl[i],
221 					       sizeof(struct in6_addr));
222 		if (ret)
223 			bphy_err(drvr, "add nd ip err %d\n", ret);
224 	}
225 }
226 #else
227 static void _brcmf_update_ndtable(struct work_struct *work)
228 {
229 }
230 #endif
231 
232 static int brcmf_netdev_set_mac_address(struct net_device *ndev, void *addr)
233 {
234 	struct brcmf_if *ifp = netdev_priv(ndev);
235 	struct sockaddr *sa = (struct sockaddr *)addr;
236 	int err;
237 
238 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
239 
240 	err = brcmf_c_set_cur_etheraddr(ifp, sa->sa_data);
241 	if (err >= 0) {
242 		brcmf_dbg(TRACE, "updated to %pM\n", sa->sa_data);
243 		memcpy(ifp->mac_addr, sa->sa_data, ETH_ALEN);
244 		eth_hw_addr_set(ifp->ndev, ifp->mac_addr);
245 	}
246 	return err;
247 }
248 
249 static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
250 {
251 	struct brcmf_if *ifp = netdev_priv(ndev);
252 
253 	schedule_work(&ifp->multicast_work);
254 }
255 
256 /**
257  * brcmf_skb_is_iapp - checks if skb is an IAPP packet
258  *
259  * @skb: skb to check
260  */
261 static bool brcmf_skb_is_iapp(struct sk_buff *skb)
262 {
263 	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
264 		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
265 	};
266 	unsigned char *eth_data;
267 #if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
268 	const u16 *a, *b;
269 #endif
270 
271 	if (skb->len - skb->mac_len != 6 ||
272 	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
273 		return false;
274 
275 	eth_data = skb_mac_header(skb) + ETH_HLEN;
276 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
277 	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
278 		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
279 #else
280 	a = (const u16 *)eth_data;
281 	b = (const u16 *)iapp_l2_update_packet;
282 
283 	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
284 #endif
285 }
286 
287 static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
288 					   struct net_device *ndev)
289 {
290 	int ret;
291 	struct brcmf_if *ifp = netdev_priv(ndev);
292 	struct brcmf_pub *drvr = ifp->drvr;
293 	struct ethhdr *eh;
294 	int head_delta;
295 	unsigned int tx_bytes = skb->len;
296 
297 	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
298 
299 	/* Can the device send data? */
300 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
301 		bphy_err(drvr, "xmit rejected state=%d\n", drvr->bus_if->state);
302 		netif_stop_queue(ndev);
303 		dev_kfree_skb(skb);
304 		ret = -ENODEV;
305 		goto done;
306 	}
307 
308 	/* Some recent Broadcom's firmwares disassociate STA when they receive
309 	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
310 	 * issue. Attacker may trigger disassociation of any STA by sending a
311 	 * proper Ethernet frame to the wireless interface.
312 	 *
313 	 * Moreover this feature may break AP interfaces in some specific
314 	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
315 	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
316 	 * will get passed back to the wireless interface and cause immediate
317 	 * disassociation of a just-connected STA.
318 	 */
319 	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
320 		dev_kfree_skb(skb);
321 		ret = -EINVAL;
322 		goto done;
323 	}
324 
325 	/* Make sure there's enough writeable headroom */
326 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
327 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
328 
329 		brcmf_dbg(INFO, "%s: insufficient headroom (%d)\n",
330 			  brcmf_ifname(ifp), head_delta);
331 		atomic_inc(&drvr->bus_if->stats.pktcowed);
332 		ret = pskb_expand_head(skb, ALIGN(head_delta, NET_SKB_PAD), 0,
333 				       GFP_ATOMIC);
334 		if (ret < 0) {
335 			bphy_err(drvr, "%s: failed to expand headroom\n",
336 				 brcmf_ifname(ifp));
337 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
338 			goto done;
339 		}
340 	}
341 
342 	/* validate length for ether packet */
343 	if (skb->len < sizeof(*eh)) {
344 		ret = -EINVAL;
345 		dev_kfree_skb(skb);
346 		goto done;
347 	}
348 
349 	eh = (struct ethhdr *)(skb->data);
350 
351 	if (eh->h_proto == htons(ETH_P_PAE))
352 		atomic_inc(&ifp->pend_8021x_cnt);
353 
354 	/* determine the priority */
355 	if ((skb->priority == 0) || (skb->priority > 7))
356 		skb->priority = cfg80211_classify8021d(skb, NULL);
357 
358 	/* set pacing shift for packet aggregation */
359 	sk_pacing_shift_update(skb->sk, 8);
360 
361 	ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb);
362 	if (ret < 0)
363 		brcmf_txfinalize(ifp, skb, false);
364 
365 done:
366 	if (ret) {
367 		ndev->stats.tx_dropped++;
368 	} else {
369 		ndev->stats.tx_packets++;
370 		ndev->stats.tx_bytes += tx_bytes;
371 	}
372 
373 	/* Return ok: we always eat the packet */
374 	return NETDEV_TX_OK;
375 }
376 
377 void brcmf_txflowblock_if(struct brcmf_if *ifp,
378 			  enum brcmf_netif_stop_reason reason, bool state)
379 {
380 	unsigned long flags;
381 
382 	if (!ifp || !ifp->ndev)
383 		return;
384 
385 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d stop=0x%X reason=%d state=%d\n",
386 		  ifp->bsscfgidx, ifp->netif_stop, reason, state);
387 
388 	spin_lock_irqsave(&ifp->netif_stop_lock, flags);
389 	if (state) {
390 		if (!ifp->netif_stop)
391 			netif_stop_queue(ifp->ndev);
392 		ifp->netif_stop |= reason;
393 	} else {
394 		ifp->netif_stop &= ~reason;
395 		if (!ifp->netif_stop)
396 			netif_wake_queue(ifp->ndev);
397 	}
398 	spin_unlock_irqrestore(&ifp->netif_stop_lock, flags);
399 }
400 
401 void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
402 {
403 	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
404 	 * STA connects to the AP interface. This is an obsoleted standard most
405 	 * users don't use, so don't pass these frames up unless requested.
406 	 */
407 	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
408 		brcmu_pkt_buf_free_skb(skb);
409 		return;
410 	}
411 
412 	if (skb->pkt_type == PACKET_MULTICAST)
413 		ifp->ndev->stats.multicast++;
414 
415 	if (!(ifp->ndev->flags & IFF_UP)) {
416 		brcmu_pkt_buf_free_skb(skb);
417 		return;
418 	}
419 
420 	ifp->ndev->stats.rx_bytes += skb->len;
421 	ifp->ndev->stats.rx_packets++;
422 
423 	brcmf_dbg(DATA, "rx proto=0x%X\n", ntohs(skb->protocol));
424 	netif_rx(skb);
425 }
426 
427 void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb)
428 {
429 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
430 		/* Do nothing */
431 	} else if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR)) {
432 		struct wlc_d11rxhdr *wlc_rxhdr = (struct wlc_d11rxhdr *)skb->data;
433 		struct ieee80211_radiotap_header *radiotap;
434 		unsigned int offset;
435 		u16 RxStatus1;
436 
437 		RxStatus1 = le16_to_cpu(wlc_rxhdr->rxhdr.RxStatus1);
438 
439 		offset = sizeof(struct wlc_d11rxhdr);
440 		/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU
441 		 * subframes
442 		 */
443 		if (RxStatus1 & RXS_PBPRES)
444 			offset += 2;
445 		offset += D11_PHY_HDR_LEN;
446 
447 		skb_pull(skb, offset);
448 
449 		/* TODO: use RX header to fill some radiotap data */
450 		radiotap = skb_push(skb, sizeof(*radiotap));
451 		memset(radiotap, 0, sizeof(*radiotap));
452 		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
453 
454 		/* TODO: 4 bytes with receive status? */
455 		skb->len -= 4;
456 	} else {
457 		struct ieee80211_radiotap_header *radiotap;
458 
459 		/* TODO: use RX status to fill some radiotap data */
460 		radiotap = skb_push(skb, sizeof(*radiotap));
461 		memset(radiotap, 0, sizeof(*radiotap));
462 		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
463 
464 		/* TODO: 4 bytes with receive status? */
465 		skb->len -= 4;
466 	}
467 
468 	skb->dev = ifp->ndev;
469 	skb_reset_mac_header(skb);
470 	skb->pkt_type = PACKET_OTHERHOST;
471 	skb->protocol = htons(ETH_P_802_2);
472 
473 	brcmf_netif_rx(ifp, skb);
474 }
475 
476 static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
477 			    struct brcmf_if **ifp)
478 {
479 	int ret;
480 
481 	/* process and remove protocol-specific header */
482 	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
483 
484 	if (ret || !(*ifp) || !(*ifp)->ndev) {
485 		if (ret != -ENODATA && *ifp && (*ifp)->ndev)
486 			(*ifp)->ndev->stats.rx_errors++;
487 		brcmu_pkt_buf_free_skb(skb);
488 		return -ENODATA;
489 	}
490 
491 	skb->protocol = eth_type_trans(skb, (*ifp)->ndev);
492 	return 0;
493 }
494 
495 void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event,
496 		    bool inirq)
497 {
498 	struct brcmf_if *ifp;
499 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
500 	struct brcmf_pub *drvr = bus_if->drvr;
501 
502 	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
503 
504 	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
505 		return;
506 
507 	if (brcmf_proto_is_reorder_skb(skb)) {
508 		brcmf_proto_rxreorder(ifp, skb);
509 	} else {
510 		/* Process special event packets */
511 		if (handle_event) {
512 			gfp_t gfp = inirq ? GFP_ATOMIC : GFP_KERNEL;
513 
514 			brcmf_fweh_process_skb(ifp->drvr, skb,
515 					       BCMILCP_SUBTYPE_VENDOR_LONG, gfp);
516 		}
517 		brcmf_netif_rx(ifp, skb);
518 	}
519 }
520 
521 void brcmf_rx_event(struct device *dev, struct sk_buff *skb)
522 {
523 	struct brcmf_if *ifp;
524 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
525 	struct brcmf_pub *drvr = bus_if->drvr;
526 
527 	brcmf_dbg(EVENT, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
528 
529 	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
530 		return;
531 
532 	brcmf_fweh_process_skb(ifp->drvr, skb, 0, GFP_KERNEL);
533 	brcmu_pkt_buf_free_skb(skb);
534 }
535 
536 void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
537 {
538 	struct ethhdr *eh;
539 	u16 type;
540 
541 	eh = (struct ethhdr *)(txp->data);
542 	type = ntohs(eh->h_proto);
543 
544 	if (type == ETH_P_PAE) {
545 		atomic_dec(&ifp->pend_8021x_cnt);
546 		if (waitqueue_active(&ifp->pend_8021x_wait))
547 			wake_up(&ifp->pend_8021x_wait);
548 	}
549 
550 	if (!success)
551 		ifp->ndev->stats.tx_errors++;
552 
553 	brcmu_pkt_buf_free_skb(txp);
554 }
555 
556 static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
557 				    struct ethtool_drvinfo *info)
558 {
559 	struct brcmf_if *ifp = netdev_priv(ndev);
560 	struct brcmf_pub *drvr = ifp->drvr;
561 	char drev[BRCMU_DOTREV_LEN] = "n/a";
562 
563 	if (drvr->revinfo.result == 0)
564 		brcmu_dotrev_str(drvr->revinfo.driverrev, drev);
565 	strscpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
566 	strscpy(info->version, drev, sizeof(info->version));
567 	strscpy(info->fw_version, drvr->fwver, sizeof(info->fw_version));
568 	strscpy(info->bus_info, dev_name(drvr->bus_if->dev),
569 		sizeof(info->bus_info));
570 }
571 
572 static const struct ethtool_ops brcmf_ethtool_ops = {
573 	.get_drvinfo = brcmf_ethtool_get_drvinfo,
574 };
575 
576 static int brcmf_netdev_stop(struct net_device *ndev)
577 {
578 	struct brcmf_if *ifp = netdev_priv(ndev);
579 
580 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
581 
582 	brcmf_cfg80211_down(ndev);
583 
584 	brcmf_net_setcarrier(ifp, false);
585 
586 	return 0;
587 }
588 
589 static int brcmf_netdev_open(struct net_device *ndev)
590 {
591 	struct brcmf_if *ifp = netdev_priv(ndev);
592 	struct brcmf_pub *drvr = ifp->drvr;
593 	struct brcmf_bus *bus_if = drvr->bus_if;
594 	u32 toe_ol;
595 
596 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
597 
598 	/* If bus is not ready, can't continue */
599 	if (bus_if->state != BRCMF_BUS_UP) {
600 		bphy_err(drvr, "failed bus is not ready\n");
601 		return -EAGAIN;
602 	}
603 
604 	atomic_set(&ifp->pend_8021x_cnt, 0);
605 
606 	/* Get current TOE mode from dongle */
607 	if (brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_ol) >= 0
608 	    && (toe_ol & TOE_TX_CSUM_OL) != 0)
609 		ndev->features |= NETIF_F_IP_CSUM;
610 	else
611 		ndev->features &= ~NETIF_F_IP_CSUM;
612 
613 	if (brcmf_cfg80211_up(ndev)) {
614 		bphy_err(drvr, "failed to bring up cfg80211\n");
615 		return -EIO;
616 	}
617 
618 	/* Clear, carrier, set when connected or AP mode. */
619 	netif_carrier_off(ndev);
620 	return 0;
621 }
622 
623 static const struct net_device_ops brcmf_netdev_ops_pri = {
624 	.ndo_open = brcmf_netdev_open,
625 	.ndo_stop = brcmf_netdev_stop,
626 	.ndo_start_xmit = brcmf_netdev_start_xmit,
627 	.ndo_set_mac_address = brcmf_netdev_set_mac_address,
628 	.ndo_set_rx_mode = brcmf_netdev_set_multicast_list
629 };
630 
631 int brcmf_net_attach(struct brcmf_if *ifp, bool locked)
632 {
633 	struct brcmf_pub *drvr = ifp->drvr;
634 	struct net_device *ndev;
635 	s32 err;
636 
637 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
638 		  ifp->mac_addr);
639 	ndev = ifp->ndev;
640 
641 	/* set appropriate operations */
642 	ndev->netdev_ops = &brcmf_netdev_ops_pri;
643 
644 	ndev->needed_headroom += drvr->hdrlen;
645 	ndev->ethtool_ops = &brcmf_ethtool_ops;
646 
647 	/* set the mac address & netns */
648 	eth_hw_addr_set(ndev, ifp->mac_addr);
649 	dev_net_set(ndev, wiphy_net(cfg_to_wiphy(drvr->config)));
650 
651 	INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
652 	INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);
653 
654 	if (locked)
655 		err = cfg80211_register_netdevice(ndev);
656 	else
657 		err = register_netdev(ndev);
658 	if (err != 0) {
659 		bphy_err(drvr, "couldn't register the net device\n");
660 		goto fail;
661 	}
662 
663 	netif_carrier_off(ndev);
664 
665 	ndev->priv_destructor = brcmf_cfg80211_free_netdev;
666 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
667 	return 0;
668 
669 fail:
670 	drvr->iflist[ifp->bsscfgidx] = NULL;
671 	ndev->netdev_ops = NULL;
672 	return -EBADE;
673 }
674 
675 void brcmf_net_detach(struct net_device *ndev, bool locked)
676 {
677 	if (ndev->reg_state == NETREG_REGISTERED) {
678 		if (locked)
679 			cfg80211_unregister_netdevice(ndev);
680 		else
681 			unregister_netdev(ndev);
682 	} else {
683 		brcmf_cfg80211_free_netdev(ndev);
684 		free_netdev(ndev);
685 	}
686 }
687 
688 static int brcmf_net_mon_open(struct net_device *ndev)
689 {
690 	struct brcmf_if *ifp = netdev_priv(ndev);
691 	struct brcmf_pub *drvr = ifp->drvr;
692 	u32 monitor;
693 	int err;
694 
695 	brcmf_dbg(TRACE, "Enter\n");
696 
697 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_MONITOR, &monitor);
698 	if (err) {
699 		bphy_err(drvr, "BRCMF_C_GET_MONITOR error (%d)\n", err);
700 		return err;
701 	} else if (monitor) {
702 		bphy_err(drvr, "Monitor mode is already enabled\n");
703 		return -EEXIST;
704 	}
705 
706 	monitor = 3;
707 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
708 	if (err)
709 		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
710 
711 	return err;
712 }
713 
714 static int brcmf_net_mon_stop(struct net_device *ndev)
715 {
716 	struct brcmf_if *ifp = netdev_priv(ndev);
717 	struct brcmf_pub *drvr = ifp->drvr;
718 	u32 monitor;
719 	int err;
720 
721 	brcmf_dbg(TRACE, "Enter\n");
722 
723 	monitor = 0;
724 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
725 	if (err)
726 		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
727 
728 	return err;
729 }
730 
731 static netdev_tx_t brcmf_net_mon_start_xmit(struct sk_buff *skb,
732 					    struct net_device *ndev)
733 {
734 	dev_kfree_skb_any(skb);
735 
736 	return NETDEV_TX_OK;
737 }
738 
739 static const struct net_device_ops brcmf_netdev_ops_mon = {
740 	.ndo_open = brcmf_net_mon_open,
741 	.ndo_stop = brcmf_net_mon_stop,
742 	.ndo_start_xmit = brcmf_net_mon_start_xmit,
743 };
744 
745 int brcmf_net_mon_attach(struct brcmf_if *ifp)
746 {
747 	struct brcmf_pub *drvr = ifp->drvr;
748 	struct net_device *ndev;
749 	int err;
750 
751 	brcmf_dbg(TRACE, "Enter\n");
752 
753 	ndev = ifp->ndev;
754 	ndev->netdev_ops = &brcmf_netdev_ops_mon;
755 
756 	err = cfg80211_register_netdevice(ndev);
757 	if (err)
758 		bphy_err(drvr, "Failed to register %s device\n", ndev->name);
759 
760 	return err;
761 }
762 
763 void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
764 {
765 	struct net_device *ndev;
766 
767 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d carrier=%d\n", ifp->bsscfgidx,
768 		  on);
769 
770 	ndev = ifp->ndev;
771 	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_DISCONNECTED, !on);
772 	if (on) {
773 		if (!netif_carrier_ok(ndev))
774 			netif_carrier_on(ndev);
775 
776 	} else {
777 		if (netif_carrier_ok(ndev))
778 			netif_carrier_off(ndev);
779 	}
780 }
781 
782 static int brcmf_net_p2p_open(struct net_device *ndev)
783 {
784 	brcmf_dbg(TRACE, "Enter\n");
785 
786 	return brcmf_cfg80211_up(ndev);
787 }
788 
789 static int brcmf_net_p2p_stop(struct net_device *ndev)
790 {
791 	brcmf_dbg(TRACE, "Enter\n");
792 
793 	return brcmf_cfg80211_down(ndev);
794 }
795 
796 static netdev_tx_t brcmf_net_p2p_start_xmit(struct sk_buff *skb,
797 					    struct net_device *ndev)
798 {
799 	if (skb)
800 		dev_kfree_skb_any(skb);
801 
802 	return NETDEV_TX_OK;
803 }
804 
805 static const struct net_device_ops brcmf_netdev_ops_p2p = {
806 	.ndo_open = brcmf_net_p2p_open,
807 	.ndo_stop = brcmf_net_p2p_stop,
808 	.ndo_start_xmit = brcmf_net_p2p_start_xmit
809 };
810 
811 static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
812 {
813 	struct brcmf_pub *drvr = ifp->drvr;
814 	struct net_device *ndev;
815 
816 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
817 		  ifp->mac_addr);
818 	ndev = ifp->ndev;
819 
820 	ndev->netdev_ops = &brcmf_netdev_ops_p2p;
821 
822 	/* set the mac address */
823 	eth_hw_addr_set(ndev, ifp->mac_addr);
824 
825 	if (register_netdev(ndev) != 0) {
826 		bphy_err(drvr, "couldn't register the p2p net device\n");
827 		goto fail;
828 	}
829 
830 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
831 
832 	return 0;
833 
834 fail:
835 	ifp->drvr->iflist[ifp->bsscfgidx] = NULL;
836 	ndev->netdev_ops = NULL;
837 	return -EBADE;
838 }
839 
840 struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
841 			      bool is_p2pdev, const char *name, u8 *mac_addr)
842 {
843 	struct brcmf_if *ifp;
844 	struct net_device *ndev;
845 
846 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx, ifidx);
847 
848 	ifp = drvr->iflist[bsscfgidx];
849 	/*
850 	 * Delete the existing interface before overwriting it
851 	 * in case we missed the BRCMF_E_IF_DEL event.
852 	 */
853 	if (ifp) {
854 		if (ifidx) {
855 			bphy_err(drvr, "ERROR: netdev:%s already exists\n",
856 				 ifp->ndev->name);
857 			netif_stop_queue(ifp->ndev);
858 			brcmf_net_detach(ifp->ndev, false);
859 			drvr->iflist[bsscfgidx] = NULL;
860 		} else {
861 			brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
862 				  ifp->ndev->name);
863 			return ERR_PTR(-EINVAL);
864 		}
865 	}
866 
867 	if (!drvr->settings->p2p_enable && is_p2pdev) {
868 		/* this is P2P_DEVICE interface */
869 		brcmf_dbg(INFO, "allocate non-netdev interface\n");
870 		ifp = kzalloc(sizeof(*ifp), GFP_KERNEL);
871 		if (!ifp)
872 			return ERR_PTR(-ENOMEM);
873 	} else {
874 		brcmf_dbg(INFO, "allocate netdev interface\n");
875 		/* Allocate netdev, including space for private structure */
876 		ndev = alloc_netdev(sizeof(*ifp), is_p2pdev ? "p2p%d" : name,
877 				    NET_NAME_UNKNOWN, ether_setup);
878 		if (!ndev)
879 			return ERR_PTR(-ENOMEM);
880 
881 		ndev->needs_free_netdev = true;
882 		ifp = netdev_priv(ndev);
883 		ifp->ndev = ndev;
884 		/* store mapping ifidx to bsscfgidx */
885 		if (drvr->if2bss[ifidx] == BRCMF_BSSIDX_INVALID)
886 			drvr->if2bss[ifidx] = bsscfgidx;
887 	}
888 
889 	ifp->drvr = drvr;
890 	drvr->iflist[bsscfgidx] = ifp;
891 	ifp->ifidx = ifidx;
892 	ifp->bsscfgidx = bsscfgidx;
893 
894 	init_waitqueue_head(&ifp->pend_8021x_wait);
895 	spin_lock_init(&ifp->netif_stop_lock);
896 
897 	if (mac_addr != NULL)
898 		memcpy(ifp->mac_addr, mac_addr, ETH_ALEN);
899 
900 	brcmf_dbg(TRACE, " ==== pid:%x, if:%s (%pM) created ===\n",
901 		  current->pid, name, ifp->mac_addr);
902 
903 	return ifp;
904 }
905 
906 static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
907 			 bool locked)
908 {
909 	struct brcmf_if *ifp;
910 	int ifidx;
911 
912 	ifp = drvr->iflist[bsscfgidx];
913 	if (!ifp) {
914 		bphy_err(drvr, "Null interface, bsscfgidx=%d\n", bsscfgidx);
915 		return;
916 	}
917 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
918 		  ifp->ifidx);
919 	ifidx = ifp->ifidx;
920 
921 	if (ifp->ndev) {
922 		if (bsscfgidx == 0) {
923 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
924 				rtnl_lock();
925 				brcmf_netdev_stop(ifp->ndev);
926 				rtnl_unlock();
927 			}
928 		} else {
929 			netif_stop_queue(ifp->ndev);
930 		}
931 
932 		if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
933 			cancel_work_sync(&ifp->multicast_work);
934 			cancel_work_sync(&ifp->ndoffload_work);
935 		}
936 		brcmf_net_detach(ifp->ndev, locked);
937 	} else {
938 		/* Only p2p device interfaces which get dynamically created
939 		 * end up here. In this case the p2p module should be informed
940 		 * about the removal of the interface within the firmware. If
941 		 * not then p2p commands towards the firmware will cause some
942 		 * serious troublesome side effects. The p2p module will clean
943 		 * up the ifp if needed.
944 		 */
945 		brcmf_p2p_ifp_removed(ifp, locked);
946 		kfree(ifp);
947 	}
948 
949 	drvr->iflist[bsscfgidx] = NULL;
950 	if (drvr->if2bss[ifidx] == bsscfgidx)
951 		drvr->if2bss[ifidx] = BRCMF_BSSIDX_INVALID;
952 }
953 
954 void brcmf_remove_interface(struct brcmf_if *ifp, bool locked)
955 {
956 	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
957 		return;
958 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
959 		  ifp->ifidx);
960 	brcmf_proto_del_if(ifp->drvr, ifp);
961 	brcmf_del_if(ifp->drvr, ifp->bsscfgidx, locked);
962 }
963 
964 static int brcmf_psm_watchdog_notify(struct brcmf_if *ifp,
965 				     const struct brcmf_event_msg *evtmsg,
966 				     void *data)
967 {
968 	struct brcmf_pub *drvr = ifp->drvr;
969 	int err;
970 
971 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
972 
973 	bphy_err(drvr, "PSM's watchdog has fired!\n");
974 
975 	err = brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
976 					 evtmsg->datalen);
977 	if (err)
978 		bphy_err(drvr, "Failed to get memory dump, %d\n", err);
979 
980 	return err;
981 }
982 
983 #ifdef CONFIG_INET
984 #define ARPOL_MAX_ENTRIES	8
985 static int brcmf_inetaddr_changed(struct notifier_block *nb,
986 				  unsigned long action, void *data)
987 {
988 	struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
989 					      inetaddr_notifier);
990 	struct in_ifaddr *ifa = data;
991 	struct net_device *ndev = ifa->ifa_dev->dev;
992 	struct brcmf_if *ifp;
993 	int idx, i, ret;
994 	u32 val;
995 	__be32 addr_table[ARPOL_MAX_ENTRIES] = {0};
996 
997 	/* Find out if the notification is meant for us */
998 	for (idx = 0; idx < BRCMF_MAX_IFS; idx++) {
999 		ifp = drvr->iflist[idx];
1000 		if (ifp && ifp->ndev == ndev)
1001 			break;
1002 		if (idx == BRCMF_MAX_IFS - 1)
1003 			return NOTIFY_DONE;
1004 	}
1005 
1006 	/* check if arp offload is supported */
1007 	ret = brcmf_fil_iovar_int_get(ifp, "arpoe", &val);
1008 	if (ret)
1009 		return NOTIFY_OK;
1010 
1011 	/* old version only support primary index */
1012 	ret = brcmf_fil_iovar_int_get(ifp, "arp_version", &val);
1013 	if (ret)
1014 		val = 1;
1015 	if (val == 1)
1016 		ifp = drvr->iflist[0];
1017 
1018 	/* retrieve the table from firmware */
1019 	ret = brcmf_fil_iovar_data_get(ifp, "arp_hostip", addr_table,
1020 				       sizeof(addr_table));
1021 	if (ret) {
1022 		bphy_err(drvr, "fail to get arp ip table err:%d\n", ret);
1023 		return NOTIFY_OK;
1024 	}
1025 
1026 	for (i = 0; i < ARPOL_MAX_ENTRIES; i++)
1027 		if (ifa->ifa_address == addr_table[i])
1028 			break;
1029 
1030 	switch (action) {
1031 	case NETDEV_UP:
1032 		if (i == ARPOL_MAX_ENTRIES) {
1033 			brcmf_dbg(TRACE, "add %pI4 to arp table\n",
1034 				  &ifa->ifa_address);
1035 			/* set it directly */
1036 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
1037 				&ifa->ifa_address, sizeof(ifa->ifa_address));
1038 			if (ret)
1039 				bphy_err(drvr, "add arp ip err %d\n", ret);
1040 		}
1041 		break;
1042 	case NETDEV_DOWN:
1043 		if (i < ARPOL_MAX_ENTRIES) {
1044 			addr_table[i] = 0;
1045 			brcmf_dbg(TRACE, "remove %pI4 from arp table\n",
1046 				  &ifa->ifa_address);
1047 			/* clear the table in firmware */
1048 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear",
1049 						       NULL, 0);
1050 			if (ret) {
1051 				bphy_err(drvr, "fail to clear arp ip table err:%d\n",
1052 					 ret);
1053 				return NOTIFY_OK;
1054 			}
1055 			for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
1056 				if (addr_table[i] == 0)
1057 					continue;
1058 				ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
1059 							       &addr_table[i],
1060 							       sizeof(addr_table[i]));
1061 				if (ret)
1062 					bphy_err(drvr, "add arp ip err %d\n",
1063 						 ret);
1064 			}
1065 		}
1066 		break;
1067 	default:
1068 		break;
1069 	}
1070 
1071 	return NOTIFY_OK;
1072 }
1073 #endif
1074 
1075 #if IS_ENABLED(CONFIG_IPV6)
1076 static int brcmf_inet6addr_changed(struct notifier_block *nb,
1077 				   unsigned long action, void *data)
1078 {
1079 	struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
1080 					      inet6addr_notifier);
1081 	struct inet6_ifaddr *ifa = data;
1082 	struct brcmf_if *ifp;
1083 	int i;
1084 	struct in6_addr *table;
1085 
1086 	/* Only handle primary interface */
1087 	ifp = drvr->iflist[0];
1088 	if (!ifp)
1089 		return NOTIFY_DONE;
1090 	if (ifp->ndev != ifa->idev->dev)
1091 		return NOTIFY_DONE;
1092 
1093 	table = ifp->ipv6_addr_tbl;
1094 	for (i = 0; i < NDOL_MAX_ENTRIES; i++)
1095 		if (ipv6_addr_equal(&ifa->addr, &table[i]))
1096 			break;
1097 
1098 	switch (action) {
1099 	case NETDEV_UP:
1100 		if (i == NDOL_MAX_ENTRIES) {
1101 			if (ifp->ipv6addr_idx < NDOL_MAX_ENTRIES) {
1102 				table[ifp->ipv6addr_idx++] = ifa->addr;
1103 			} else {
1104 				for (i = 0; i < NDOL_MAX_ENTRIES - 1; i++)
1105 					table[i] = table[i + 1];
1106 				table[NDOL_MAX_ENTRIES - 1] = ifa->addr;
1107 			}
1108 		}
1109 		break;
1110 	case NETDEV_DOWN:
1111 		if (i < NDOL_MAX_ENTRIES) {
1112 			for (; i < ifp->ipv6addr_idx - 1; i++)
1113 				table[i] = table[i + 1];
1114 			memset(&table[i], 0, sizeof(table[i]));
1115 			ifp->ipv6addr_idx--;
1116 		}
1117 		break;
1118 	default:
1119 		break;
1120 	}
1121 
1122 	schedule_work(&ifp->ndoffload_work);
1123 
1124 	return NOTIFY_OK;
1125 }
1126 #endif
1127 
1128 static int brcmf_revinfo_read(struct seq_file *s, void *data)
1129 {
1130 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
1131 	struct brcmf_rev_info *ri = &bus_if->drvr->revinfo;
1132 	char drev[BRCMU_DOTREV_LEN];
1133 	char brev[BRCMU_BOARDREV_LEN];
1134 
1135 	seq_printf(s, "vendorid: 0x%04x\n", ri->vendorid);
1136 	seq_printf(s, "deviceid: 0x%04x\n", ri->deviceid);
1137 	seq_printf(s, "radiorev: %s\n", brcmu_dotrev_str(ri->radiorev, drev));
1138 	seq_printf(s, "chip: %s\n", ri->chipname);
1139 	seq_printf(s, "chippkg: %u\n", ri->chippkg);
1140 	seq_printf(s, "corerev: %u\n", ri->corerev);
1141 	seq_printf(s, "boardid: 0x%04x\n", ri->boardid);
1142 	seq_printf(s, "boardvendor: 0x%04x\n", ri->boardvendor);
1143 	seq_printf(s, "boardrev: %s\n", brcmu_boardrev_str(ri->boardrev, brev));
1144 	seq_printf(s, "driverrev: %s\n", brcmu_dotrev_str(ri->driverrev, drev));
1145 	seq_printf(s, "ucoderev: %u\n", ri->ucoderev);
1146 	seq_printf(s, "bus: %u\n", ri->bus);
1147 	seq_printf(s, "phytype: %u\n", ri->phytype);
1148 	seq_printf(s, "phyrev: %u\n", ri->phyrev);
1149 	seq_printf(s, "anarev: %u\n", ri->anarev);
1150 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
1151 
1152 	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
1153 
1154 	return 0;
1155 }
1156 
1157 static void brcmf_core_bus_reset(struct work_struct *work)
1158 {
1159 	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
1160 					      bus_reset);
1161 
1162 	brcmf_bus_reset(drvr->bus_if);
1163 }
1164 
1165 static ssize_t bus_reset_write(struct file *file, const char __user *user_buf,
1166 			       size_t count, loff_t *ppos)
1167 {
1168 	struct brcmf_pub *drvr = file->private_data;
1169 	u8 value;
1170 
1171 	if (kstrtou8_from_user(user_buf, count, 0, &value))
1172 		return -EINVAL;
1173 
1174 	if (value != 1)
1175 		return -EINVAL;
1176 
1177 	schedule_work(&drvr->bus_reset);
1178 
1179 	return count;
1180 }
1181 
1182 static const struct file_operations bus_reset_fops = {
1183 	.open	= simple_open,
1184 	.llseek	= no_llseek,
1185 	.write	= bus_reset_write,
1186 };
1187 
1188 static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
1189 {
1190 	int ret = -1;
1191 	struct brcmf_bus *bus_if = drvr->bus_if;
1192 	struct brcmf_if *ifp;
1193 	struct brcmf_if *p2p_ifp;
1194 
1195 	brcmf_dbg(TRACE, "\n");
1196 
1197 	/* add primary networking interface */
1198 	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d",
1199 			   is_valid_ether_addr(drvr->settings->mac) ? drvr->settings->mac : NULL);
1200 	if (IS_ERR(ifp))
1201 		return PTR_ERR(ifp);
1202 
1203 	p2p_ifp = NULL;
1204 
1205 	/* signal bus ready */
1206 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
1207 
1208 	/* do bus specific preinit here */
1209 	ret = brcmf_bus_preinit(bus_if);
1210 	if (ret < 0)
1211 		goto fail;
1212 
1213 	/* Bus is ready, do any initialization */
1214 	ret = brcmf_c_preinit_dcmds(ifp);
1215 	if (ret < 0)
1216 		goto fail;
1217 
1218 	brcmf_feat_attach(drvr);
1219 
1220 	ret = brcmf_proto_init_done(drvr);
1221 	if (ret < 0)
1222 		goto fail;
1223 
1224 	brcmf_proto_add_if(drvr, ifp);
1225 
1226 	drvr->config = brcmf_cfg80211_attach(drvr, ops,
1227 					     drvr->settings->p2p_enable);
1228 	if (drvr->config == NULL) {
1229 		ret = -ENOMEM;
1230 		goto fail;
1231 	}
1232 
1233 	ret = brcmf_net_attach(ifp, false);
1234 
1235 	if ((!ret) && (drvr->settings->p2p_enable)) {
1236 		p2p_ifp = drvr->iflist[1];
1237 		if (p2p_ifp)
1238 			ret = brcmf_net_p2p_attach(p2p_ifp);
1239 	}
1240 
1241 	if (ret)
1242 		goto fail;
1243 
1244 #ifdef CONFIG_INET
1245 	drvr->inetaddr_notifier.notifier_call = brcmf_inetaddr_changed;
1246 	ret = register_inetaddr_notifier(&drvr->inetaddr_notifier);
1247 	if (ret)
1248 		goto fail;
1249 
1250 #if IS_ENABLED(CONFIG_IPV6)
1251 	drvr->inet6addr_notifier.notifier_call = brcmf_inet6addr_changed;
1252 	ret = register_inet6addr_notifier(&drvr->inet6addr_notifier);
1253 	if (ret) {
1254 		unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
1255 		goto fail;
1256 	}
1257 #endif
1258 #endif /* CONFIG_INET */
1259 
1260 	INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset);
1261 
1262 	/* populate debugfs */
1263 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
1264 	debugfs_create_file("reset", 0600, brcmf_debugfs_get_devdir(drvr), drvr,
1265 			    &bus_reset_fops);
1266 	brcmf_feat_debugfs_create(drvr);
1267 	brcmf_proto_debugfs_create(drvr);
1268 	brcmf_bus_debugfs_create(bus_if);
1269 
1270 	return 0;
1271 
1272 fail:
1273 	bphy_err(drvr, "failed: %d\n", ret);
1274 	if (drvr->config) {
1275 		brcmf_cfg80211_detach(drvr->config);
1276 		drvr->config = NULL;
1277 	}
1278 	brcmf_net_detach(ifp->ndev, false);
1279 	if (p2p_ifp)
1280 		brcmf_net_detach(p2p_ifp->ndev, false);
1281 	drvr->iflist[0] = NULL;
1282 	drvr->iflist[1] = NULL;
1283 	if (drvr->settings->ignore_probe_fail)
1284 		ret = 0;
1285 
1286 	return ret;
1287 }
1288 
1289 int brcmf_alloc(struct device *dev, struct brcmf_mp_device *settings)
1290 {
1291 	struct wiphy *wiphy;
1292 	struct cfg80211_ops *ops;
1293 	struct brcmf_pub *drvr = NULL;
1294 
1295 	brcmf_dbg(TRACE, "Enter\n");
1296 
1297 	ops = brcmf_cfg80211_get_ops(settings);
1298 	if (!ops)
1299 		return -ENOMEM;
1300 
1301 	wiphy = wiphy_new(ops, sizeof(*drvr));
1302 	if (!wiphy) {
1303 		kfree(ops);
1304 		return -ENOMEM;
1305 	}
1306 
1307 	set_wiphy_dev(wiphy, dev);
1308 	drvr = wiphy_priv(wiphy);
1309 	drvr->wiphy = wiphy;
1310 	drvr->ops = ops;
1311 	drvr->bus_if = dev_get_drvdata(dev);
1312 	drvr->bus_if->drvr = drvr;
1313 	drvr->settings = settings;
1314 
1315 	return 0;
1316 }
1317 
1318 int brcmf_attach(struct device *dev)
1319 {
1320 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1321 	struct brcmf_pub *drvr = bus_if->drvr;
1322 	int ret = 0;
1323 	int i;
1324 
1325 	brcmf_dbg(TRACE, "Enter\n");
1326 
1327 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
1328 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
1329 
1330 	mutex_init(&drvr->proto_block);
1331 
1332 	/* Link to bus module */
1333 	drvr->hdrlen = 0;
1334 
1335 	/* Attach and link in the protocol */
1336 	ret = brcmf_proto_attach(drvr);
1337 	if (ret != 0) {
1338 		bphy_err(drvr, "brcmf_prot_attach failed\n");
1339 		goto fail;
1340 	}
1341 
1342 	/* Attach to events important for core code */
1343 	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
1344 			    brcmf_psm_watchdog_notify);
1345 
1346 	/* attach firmware event handler */
1347 	brcmf_fweh_attach(drvr);
1348 
1349 	ret = brcmf_bus_started(drvr, drvr->ops);
1350 	if (ret != 0) {
1351 		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
1352 		goto fail;
1353 	}
1354 
1355 	return 0;
1356 
1357 fail:
1358 	brcmf_detach(dev);
1359 
1360 	return ret;
1361 }
1362 
1363 void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
1364 {
1365 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1366 	struct brcmf_pub *drvr = bus_if->drvr;
1367 
1368 	if (drvr) {
1369 		drvr->hdrlen += len;
1370 	}
1371 }
1372 
1373 void brcmf_dev_reset(struct device *dev)
1374 {
1375 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1376 	struct brcmf_pub *drvr = bus_if->drvr;
1377 
1378 	if (drvr == NULL)
1379 		return;
1380 
1381 	if (drvr->iflist[0])
1382 		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
1383 }
1384 
1385 void brcmf_dev_coredump(struct device *dev)
1386 {
1387 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1388 
1389 	if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
1390 		brcmf_dbg(TRACE, "failed to create coredump\n");
1391 }
1392 
1393 void brcmf_fw_crashed(struct device *dev)
1394 {
1395 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1396 	struct brcmf_pub *drvr = bus_if->drvr;
1397 
1398 	bphy_err(drvr, "Firmware has halted or crashed\n");
1399 
1400 	brcmf_dev_coredump(dev);
1401 
1402 	schedule_work(&drvr->bus_reset);
1403 }
1404 
1405 void brcmf_detach(struct device *dev)
1406 {
1407 	s32 i;
1408 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1409 	struct brcmf_pub *drvr = bus_if->drvr;
1410 
1411 	brcmf_dbg(TRACE, "Enter\n");
1412 
1413 	if (drvr == NULL)
1414 		return;
1415 
1416 #ifdef CONFIG_INET
1417 	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
1418 #endif
1419 
1420 #if IS_ENABLED(CONFIG_IPV6)
1421 	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
1422 #endif
1423 
1424 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
1425 	/* make sure primary interface removed last */
1426 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
1427 		if (drvr->iflist[i])
1428 			brcmf_remove_interface(drvr->iflist[i], false);
1429 	}
1430 	brcmf_bus_stop(drvr->bus_if);
1431 
1432 	brcmf_fweh_detach(drvr);
1433 	brcmf_proto_detach(drvr);
1434 
1435 	if (drvr->mon_if) {
1436 		brcmf_net_detach(drvr->mon_if->ndev, false);
1437 		drvr->mon_if = NULL;
1438 	}
1439 
1440 	if (drvr->config) {
1441 		brcmf_p2p_detach(&drvr->config->p2p);
1442 		brcmf_cfg80211_detach(drvr->config);
1443 		drvr->config = NULL;
1444 	}
1445 }
1446 
1447 void brcmf_free(struct device *dev)
1448 {
1449 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1450 	struct brcmf_pub *drvr = bus_if->drvr;
1451 
1452 	if (!drvr)
1453 		return;
1454 
1455 	bus_if->drvr = NULL;
1456 
1457 	kfree(drvr->ops);
1458 
1459 	wiphy_free(drvr->wiphy);
1460 }
1461 
1462 s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
1463 {
1464 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1465 	struct brcmf_if *ifp = bus_if->drvr->iflist[0];
1466 
1467 	return brcmf_fil_iovar_data_set(ifp, name, data, len);
1468 }
1469 
1470 static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
1471 {
1472 	return atomic_read(&ifp->pend_8021x_cnt);
1473 }
1474 
1475 int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
1476 {
1477 	struct brcmf_pub *drvr = ifp->drvr;
1478 	int err;
1479 
1480 	err = wait_event_timeout(ifp->pend_8021x_wait,
1481 				 !brcmf_get_pend_8021x_cnt(ifp),
1482 				 MAX_WAIT_FOR_8021X_TX);
1483 
1484 	if (!err) {
1485 		bphy_err(drvr, "Timed out waiting for no pending 802.1x packets\n");
1486 		atomic_set(&ifp->pend_8021x_cnt, 0);
1487 	}
1488 
1489 	return !err;
1490 }
1491 
1492 void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state)
1493 {
1494 	struct brcmf_pub *drvr = bus->drvr;
1495 	struct net_device *ndev;
1496 	int ifidx;
1497 
1498 	brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
1499 
1500 	if (!drvr) {
1501 		brcmf_dbg(INFO, "ignoring transition, bus not attached yet\n");
1502 		return;
1503 	}
1504 
1505 	bus->state = state;
1506 
1507 	if (state == BRCMF_BUS_UP) {
1508 		for (ifidx = 0; ifidx < BRCMF_MAX_IFS; ifidx++) {
1509 			if ((drvr->iflist[ifidx]) &&
1510 			    (drvr->iflist[ifidx]->ndev)) {
1511 				ndev = drvr->iflist[ifidx]->ndev;
1512 				if (netif_queue_stopped(ndev))
1513 					netif_wake_queue(ndev);
1514 			}
1515 		}
1516 	}
1517 }
1518 
1519 int __init brcmf_core_init(void)
1520 {
1521 	int err;
1522 
1523 	err = brcmf_sdio_register();
1524 	if (err)
1525 		return err;
1526 
1527 	err = brcmf_usb_register();
1528 	if (err)
1529 		goto error_usb_register;
1530 
1531 	err = brcmf_pcie_register();
1532 	if (err)
1533 		goto error_pcie_register;
1534 	return 0;
1535 
1536 error_pcie_register:
1537 	brcmf_usb_exit();
1538 error_usb_register:
1539 	brcmf_sdio_exit();
1540 	return err;
1541 }
1542 
1543 void __exit brcmf_core_exit(void)
1544 {
1545 	brcmf_sdio_exit();
1546 	brcmf_usb_exit();
1547 	brcmf_pcie_exit();
1548 }
1549 
1550