1 /*
2  * Copyright (c) 2015-2016 Quantenna Communications, Inc.
3  *
4  * This program is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU General Public License
6  * as published by the Free Software Foundation; either version 2
7  * of the License, or (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  */
15 
16 #include <linux/types.h>
17 #include <linux/skbuff.h>
18 
19 #include "cfg80211.h"
20 #include "core.h"
21 #include "qlink.h"
22 #include "qlink_util.h"
23 #include "bus.h"
24 #include "commands.h"
25 
26 static int qtnf_cmd_check_reply_header(const struct qlink_resp *resp,
27 				       u16 cmd_id, u8 mac_id, u8 vif_id,
28 				       size_t resp_size)
29 {
30 	if (unlikely(le16_to_cpu(resp->cmd_id) != cmd_id)) {
31 		pr_warn("VIF%u.%u CMD%x: bad cmd_id in response: 0x%.4X\n",
32 			mac_id, vif_id, cmd_id, le16_to_cpu(resp->cmd_id));
33 		return -EINVAL;
34 	}
35 
36 	if (unlikely(resp->macid != mac_id)) {
37 		pr_warn("VIF%u.%u CMD%x: bad MAC in response: %u\n",
38 			mac_id, vif_id, cmd_id, resp->macid);
39 		return -EINVAL;
40 	}
41 
42 	if (unlikely(resp->vifid != vif_id)) {
43 		pr_warn("VIF%u.%u CMD%x: bad VIF in response: %u\n",
44 			mac_id, vif_id, cmd_id, resp->vifid);
45 		return -EINVAL;
46 	}
47 
48 	if (unlikely(le16_to_cpu(resp->mhdr.len) < resp_size)) {
49 		pr_warn("VIF%u.%u CMD%x: bad response size %u < %zu\n",
50 			mac_id, vif_id, cmd_id,
51 			le16_to_cpu(resp->mhdr.len), resp_size);
52 		return -ENOSPC;
53 	}
54 
55 	return 0;
56 }
57 
58 static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
59 				    struct sk_buff *cmd_skb,
60 				    struct sk_buff **response_skb,
61 				    u16 *result_code,
62 				    size_t const_resp_size,
63 				    size_t *var_resp_size)
64 {
65 	struct qlink_cmd *cmd;
66 	const struct qlink_resp *resp;
67 	struct sk_buff *resp_skb = NULL;
68 	u16 cmd_id;
69 	u8 mac_id, vif_id;
70 	int ret;
71 
72 	cmd = (struct qlink_cmd *)cmd_skb->data;
73 	cmd_id = le16_to_cpu(cmd->cmd_id);
74 	mac_id = cmd->macid;
75 	vif_id = cmd->vifid;
76 	cmd->mhdr.len = cpu_to_le16(cmd_skb->len);
77 
78 	if (unlikely(bus->fw_state != QTNF_FW_STATE_ACTIVE &&
79 		     le16_to_cpu(cmd->cmd_id) != QLINK_CMD_FW_INIT)) {
80 		pr_warn("VIF%u.%u: drop cmd 0x%.4X in fw state %d\n",
81 			mac_id, vif_id, le16_to_cpu(cmd->cmd_id),
82 			bus->fw_state);
83 		return -ENODEV;
84 	}
85 
86 	pr_debug("VIF%u.%u cmd=0x%.4X\n", mac_id, vif_id,
87 		 le16_to_cpu(cmd->cmd_id));
88 
89 	ret = qtnf_trans_send_cmd_with_resp(bus, cmd_skb, &resp_skb);
90 
91 	if (unlikely(ret))
92 		goto out;
93 
94 	resp = (const struct qlink_resp *)resp_skb->data;
95 	ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id,
96 					  const_resp_size);
97 
98 	if (unlikely(ret))
99 		goto out;
100 
101 	if (likely(result_code))
102 		*result_code = le16_to_cpu(resp->result);
103 
104 	/* Return length of variable part of response */
105 	if (response_skb && var_resp_size)
106 		*var_resp_size = le16_to_cpu(resp->mhdr.len) - const_resp_size;
107 
108 out:
109 	if (response_skb)
110 		*response_skb = resp_skb;
111 	else
112 		consume_skb(resp_skb);
113 
114 	return ret;
115 }
116 
117 static inline int qtnf_cmd_send(struct qtnf_bus *bus,
118 				struct sk_buff *cmd_skb,
119 				u16 *result_code)
120 {
121 	return qtnf_cmd_send_with_reply(bus, cmd_skb, NULL, result_code,
122 					sizeof(struct qlink_resp), NULL);
123 }
124 
125 static struct sk_buff *qtnf_cmd_alloc_new_cmdskb(u8 macid, u8 vifid, u16 cmd_no,
126 						 size_t cmd_size)
127 {
128 	struct qlink_cmd *cmd;
129 	struct sk_buff *cmd_skb;
130 
131 	cmd_skb = __dev_alloc_skb(sizeof(*cmd) +
132 				  QTNF_MAX_CMD_BUF_SIZE, GFP_KERNEL);
133 	if (unlikely(!cmd_skb)) {
134 		pr_err("VIF%u.%u CMD %u: alloc failed\n", macid, vifid, cmd_no);
135 		return NULL;
136 	}
137 
138 	memset(skb_put(cmd_skb, cmd_size), 0, cmd_size);
139 
140 	cmd = (struct qlink_cmd *)cmd_skb->data;
141 	cmd->mhdr.len = cpu_to_le16(cmd_skb->len);
142 	cmd->mhdr.type = cpu_to_le16(QLINK_MSG_TYPE_CMD);
143 	cmd->cmd_id = cpu_to_le16(cmd_no);
144 	cmd->macid = macid;
145 	cmd->vifid = vifid;
146 
147 	return cmd_skb;
148 }
149 
150 int qtnf_cmd_send_start_ap(struct qtnf_vif *vif)
151 {
152 	struct sk_buff *cmd_skb;
153 	u16 res_code = QLINK_CMD_RESULT_OK;
154 	int ret;
155 
156 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
157 					    QLINK_CMD_START_AP,
158 					    sizeof(struct qlink_cmd));
159 	if (unlikely(!cmd_skb))
160 		return -ENOMEM;
161 
162 	qtnf_bus_lock(vif->mac->bus);
163 
164 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
165 
166 	if (unlikely(ret))
167 		goto out;
168 
169 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
170 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
171 		       vif->vifid, res_code);
172 		ret = -EFAULT;
173 		goto out;
174 	}
175 
176 	vif->bss_status |= QTNF_STATE_AP_START;
177 	netif_carrier_on(vif->netdev);
178 
179 out:
180 	qtnf_bus_unlock(vif->mac->bus);
181 	return ret;
182 }
183 
184 int qtnf_cmd_send_regulatory_config(struct qtnf_wmac *mac, const char *alpha2)
185 {
186 	struct sk_buff *cmd_skb;
187 	u16 res_code = QLINK_CMD_RESULT_OK;
188 	int ret;
189 
190 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, QLINK_VIFID_RSVD,
191 					    QLINK_CMD_REG_REGION,
192 					    sizeof(struct qlink_cmd));
193 	if (unlikely(!cmd_skb))
194 		return -ENOMEM;
195 
196 	qtnf_cmd_skb_put_tlv_arr(cmd_skb, WLAN_EID_COUNTRY, alpha2,
197 				 QTNF_MAX_ALPHA_LEN);
198 
199 	ret = qtnf_cmd_send(mac->bus, cmd_skb, &res_code);
200 
201 	if (unlikely(ret))
202 		goto out;
203 
204 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
205 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
206 		ret = -EFAULT;
207 		goto out;
208 	}
209 
210 	memcpy(mac->bus->hw_info.alpha2_code, alpha2,
211 	       sizeof(mac->bus->hw_info.alpha2_code));
212 out:
213 	return ret;
214 }
215 
216 int qtnf_cmd_send_config_ap(struct qtnf_vif *vif)
217 {
218 	struct sk_buff *cmd_skb;
219 	struct qtnf_bss_config *bss_cfg = &vif->bss_cfg;
220 	struct cfg80211_chan_def *chandef = &bss_cfg->chandef;
221 	struct qlink_tlv_channel *qchan;
222 	struct qlink_auth_encr aen;
223 	u16 res_code = QLINK_CMD_RESULT_OK;
224 	int ret;
225 	int i;
226 
227 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
228 					    QLINK_CMD_CONFIG_AP,
229 					    sizeof(struct qlink_cmd));
230 	if (unlikely(!cmd_skb))
231 		return -ENOMEM;
232 
233 	qtnf_bus_lock(vif->mac->bus);
234 
235 	qtnf_cmd_skb_put_tlv_arr(cmd_skb, WLAN_EID_SSID, bss_cfg->ssid,
236 				 bss_cfg->ssid_len);
237 	qtnf_cmd_skb_put_tlv_u16(cmd_skb, QTN_TLV_ID_BCN_PERIOD,
238 				 bss_cfg->bcn_period);
239 	qtnf_cmd_skb_put_tlv_u8(cmd_skb, QTN_TLV_ID_DTIM, bss_cfg->dtim);
240 
241 	qchan = (struct qlink_tlv_channel *)skb_put(cmd_skb, sizeof(*qchan));
242 
243 	memset(qchan, 0, sizeof(*qchan));
244 	qchan->hdr.type = cpu_to_le16(QTN_TLV_ID_CHANNEL);
245 	qchan->hdr.len = cpu_to_le16(sizeof(*qchan) -
246 			sizeof(struct qlink_tlv_hdr));
247 	qchan->hw_value = cpu_to_le16(
248 		ieee80211_frequency_to_channel(chandef->chan->center_freq));
249 
250 	memset(&aen, 0, sizeof(aen));
251 	aen.auth_type = bss_cfg->auth_type;
252 	aen.privacy = !!bss_cfg->privacy;
253 	aen.mfp = bss_cfg->mfp;
254 	aen.wpa_versions = cpu_to_le32(bss_cfg->crypto.wpa_versions);
255 	aen.cipher_group = cpu_to_le32(bss_cfg->crypto.cipher_group);
256 	aen.n_ciphers_pairwise = cpu_to_le32(
257 					bss_cfg->crypto.n_ciphers_pairwise);
258 	for (i = 0; i < QLINK_MAX_NR_CIPHER_SUITES; i++)
259 		aen.ciphers_pairwise[i] = cpu_to_le32(
260 					bss_cfg->crypto.ciphers_pairwise[i]);
261 	aen.n_akm_suites = cpu_to_le32(
262 					bss_cfg->crypto.n_akm_suites);
263 	for (i = 0; i < QLINK_MAX_NR_AKM_SUITES; i++)
264 		aen.akm_suites[i] = cpu_to_le32(
265 					bss_cfg->crypto.akm_suites[i]);
266 	aen.control_port = bss_cfg->crypto.control_port;
267 	aen.control_port_no_encrypt =
268 			bss_cfg->crypto.control_port_no_encrypt;
269 	aen.control_port_ethertype = cpu_to_le16(be16_to_cpu(
270 				bss_cfg->crypto.control_port_ethertype));
271 
272 	qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_CRYPTO, (u8 *)&aen,
273 				 sizeof(aen));
274 
275 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
276 
277 	if (unlikely(ret))
278 		goto out;
279 
280 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
281 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
282 		       vif->vifid, res_code);
283 		ret = -EFAULT;
284 		goto out;
285 	}
286 
287 	vif->bss_status |= QTNF_STATE_AP_CONFIG;
288 
289 out:
290 	qtnf_bus_unlock(vif->mac->bus);
291 	return ret;
292 }
293 
294 int qtnf_cmd_send_stop_ap(struct qtnf_vif *vif)
295 {
296 	struct sk_buff *cmd_skb;
297 	u16 res_code = QLINK_CMD_RESULT_OK;
298 	int ret;
299 
300 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
301 					    QLINK_CMD_STOP_AP,
302 					    sizeof(struct qlink_cmd));
303 	if (unlikely(!cmd_skb))
304 		return -ENOMEM;
305 
306 	qtnf_bus_lock(vif->mac->bus);
307 
308 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
309 
310 	if (unlikely(ret))
311 		goto out;
312 
313 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
314 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
315 		       vif->vifid, res_code);
316 		ret = -EFAULT;
317 		goto out;
318 	}
319 
320 	vif->bss_status &= ~QTNF_STATE_AP_START;
321 	vif->bss_status &= ~QTNF_STATE_AP_CONFIG;
322 
323 	netif_carrier_off(vif->netdev);
324 
325 out:
326 	qtnf_bus_unlock(vif->mac->bus);
327 	return ret;
328 }
329 
330 int qtnf_cmd_send_register_mgmt(struct qtnf_vif *vif, u16 frame_type, bool reg)
331 {
332 	struct sk_buff *cmd_skb;
333 	struct qlink_cmd_mgmt_frame_register *cmd;
334 	u16 res_code = QLINK_CMD_RESULT_OK;
335 	int ret;
336 
337 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
338 					    QLINK_CMD_REGISTER_MGMT,
339 					    sizeof(*cmd));
340 	if (unlikely(!cmd_skb))
341 		return -ENOMEM;
342 
343 	qtnf_bus_lock(vif->mac->bus);
344 
345 	cmd = (struct qlink_cmd_mgmt_frame_register *)cmd_skb->data;
346 	cmd->frame_type = cpu_to_le16(frame_type);
347 	cmd->do_register = reg;
348 
349 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
350 
351 	if (unlikely(ret))
352 		goto out;
353 
354 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
355 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
356 		       vif->vifid, res_code);
357 		ret = -EFAULT;
358 		goto out;
359 	}
360 
361 out:
362 	qtnf_bus_unlock(vif->mac->bus);
363 	return ret;
364 }
365 
366 int qtnf_cmd_send_mgmt_frame(struct qtnf_vif *vif, u32 cookie, u16 flags,
367 			     u16 freq, const u8 *buf, size_t len)
368 {
369 	struct sk_buff *cmd_skb;
370 	struct qlink_cmd_mgmt_frame_tx *cmd;
371 	u16 res_code = QLINK_CMD_RESULT_OK;
372 	int ret;
373 
374 	if (sizeof(*cmd) + len > QTNF_MAX_CMD_BUF_SIZE) {
375 		pr_warn("VIF%u.%u: frame is too big: %zu\n", vif->mac->macid,
376 			vif->vifid, len);
377 		return -E2BIG;
378 	}
379 
380 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
381 					    QLINK_CMD_SEND_MGMT_FRAME,
382 					    sizeof(*cmd));
383 	if (unlikely(!cmd_skb))
384 		return -ENOMEM;
385 
386 	qtnf_bus_lock(vif->mac->bus);
387 
388 	cmd = (struct qlink_cmd_mgmt_frame_tx *)cmd_skb->data;
389 	cmd->cookie = cpu_to_le32(cookie);
390 	cmd->freq = cpu_to_le16(freq);
391 	cmd->flags = cpu_to_le16(flags);
392 
393 	if (len && buf)
394 		qtnf_cmd_skb_put_buffer(cmd_skb, buf, len);
395 
396 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
397 
398 	if (unlikely(ret))
399 		goto out;
400 
401 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
402 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
403 		       vif->vifid, res_code);
404 		ret = -EFAULT;
405 		goto out;
406 	}
407 
408 out:
409 	qtnf_bus_unlock(vif->mac->bus);
410 	return ret;
411 }
412 
413 int qtnf_cmd_send_mgmt_set_appie(struct qtnf_vif *vif, u8 frame_type,
414 				 const u8 *buf, size_t len)
415 {
416 	struct sk_buff *cmd_skb;
417 	struct qlink_cmd_mgmt_append_ie *cmd;
418 	u16 res_code = QLINK_CMD_RESULT_OK;
419 	int ret;
420 
421 	if (sizeof(*cmd) + len > QTNF_MAX_CMD_BUF_SIZE) {
422 		pr_warn("VIF%u.%u: %u frame is too big: %zu\n", vif->mac->macid,
423 			vif->vifid, frame_type, len);
424 		return -E2BIG;
425 	}
426 
427 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
428 					    QLINK_CMD_MGMT_SET_APPIE,
429 					    sizeof(*cmd));
430 	if (unlikely(!cmd_skb))
431 		return -ENOMEM;
432 
433 	qtnf_bus_lock(vif->mac->bus);
434 
435 	cmd = (struct qlink_cmd_mgmt_append_ie *)cmd_skb->data;
436 	cmd->type = frame_type;
437 	cmd->flags = 0;
438 
439 	/* If len == 0 then IE buf for specified frame type
440 	 * should be cleared on EP.
441 	 */
442 	if (len && buf)
443 		qtnf_cmd_skb_put_buffer(cmd_skb, buf, len);
444 
445 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
446 
447 	if (unlikely(ret))
448 		goto out;
449 
450 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
451 		pr_err("VIF%u.%u frame %u: CMD failed: %u\n", vif->mac->macid,
452 		       vif->vifid, frame_type, res_code);
453 		ret = -EFAULT;
454 		goto out;
455 	}
456 
457 out:
458 	qtnf_bus_unlock(vif->mac->bus);
459 	return ret;
460 }
461 
462 static void
463 qtnf_sta_info_parse_basic_counters(struct station_info *sinfo,
464 		const struct qlink_sta_stat_basic_counters *counters)
465 {
466 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES) |
467 			 BIT(NL80211_STA_INFO_TX_BYTES);
468 	sinfo->rx_bytes = get_unaligned_le64(&counters->rx_bytes);
469 	sinfo->tx_bytes = get_unaligned_le64(&counters->tx_bytes);
470 
471 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS) |
472 			 BIT(NL80211_STA_INFO_TX_PACKETS) |
473 			 BIT(NL80211_STA_INFO_BEACON_RX);
474 	sinfo->rx_packets = get_unaligned_le32(&counters->rx_packets);
475 	sinfo->tx_packets = get_unaligned_le32(&counters->tx_packets);
476 	sinfo->rx_beacon = get_unaligned_le64(&counters->rx_beacons);
477 
478 	sinfo->filled |= BIT(NL80211_STA_INFO_RX_DROP_MISC) |
479 			 BIT(NL80211_STA_INFO_TX_FAILED);
480 	sinfo->rx_dropped_misc = get_unaligned_le32(&counters->rx_dropped);
481 	sinfo->tx_failed = get_unaligned_le32(&counters->tx_failed);
482 }
483 
484 static void
485 qtnf_sta_info_parse_rate(struct rate_info *rate_dst,
486 			 const struct  qlink_sta_info_rate *rate_src)
487 {
488 	rate_dst->legacy = get_unaligned_le16(&rate_src->rate) * 10;
489 
490 	rate_dst->mcs = rate_src->mcs;
491 	rate_dst->nss = rate_src->nss;
492 	rate_dst->flags = 0;
493 
494 	switch (rate_src->bw) {
495 	case QLINK_STA_INFO_RATE_BW_5:
496 		rate_dst->bw = RATE_INFO_BW_5;
497 		break;
498 	case QLINK_STA_INFO_RATE_BW_10:
499 		rate_dst->bw = RATE_INFO_BW_10;
500 		break;
501 	case QLINK_STA_INFO_RATE_BW_20:
502 		rate_dst->bw = RATE_INFO_BW_20;
503 		break;
504 	case QLINK_STA_INFO_RATE_BW_40:
505 		rate_dst->bw = RATE_INFO_BW_40;
506 		break;
507 	case QLINK_STA_INFO_RATE_BW_80:
508 		rate_dst->bw = RATE_INFO_BW_80;
509 		break;
510 	case QLINK_STA_INFO_RATE_BW_160:
511 		rate_dst->bw = RATE_INFO_BW_160;
512 		break;
513 	default:
514 		rate_dst->bw = 0;
515 		break;
516 	}
517 
518 	if (rate_src->flags & QLINK_STA_INFO_RATE_FLAG_HT_MCS)
519 		rate_dst->flags |= RATE_INFO_FLAGS_MCS;
520 	else if (rate_src->flags & QLINK_STA_INFO_RATE_FLAG_VHT_MCS)
521 		rate_dst->flags |= RATE_INFO_FLAGS_VHT_MCS;
522 }
523 
524 static void
525 qtnf_sta_info_parse_flags(struct nl80211_sta_flag_update *dst,
526 			  const struct qlink_sta_info_state *src)
527 {
528 	u32 mask, value;
529 
530 	dst->mask = 0;
531 	dst->set = 0;
532 
533 	mask = le32_to_cpu(src->mask);
534 	value = le32_to_cpu(src->value);
535 
536 	if (mask & QLINK_STA_FLAG_AUTHORIZED) {
537 		dst->mask |= BIT(NL80211_STA_FLAG_AUTHORIZED);
538 		if (value & QLINK_STA_FLAG_AUTHORIZED)
539 			dst->set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
540 	}
541 
542 	if (mask & QLINK_STA_FLAG_SHORT_PREAMBLE) {
543 		dst->mask |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
544 		if (value & QLINK_STA_FLAG_SHORT_PREAMBLE)
545 			dst->set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
546 	}
547 
548 	if (mask & QLINK_STA_FLAG_WME) {
549 		dst->mask |= BIT(NL80211_STA_FLAG_WME);
550 		if (value & QLINK_STA_FLAG_WME)
551 			dst->set |= BIT(NL80211_STA_FLAG_WME);
552 	}
553 
554 	if (mask & QLINK_STA_FLAG_MFP) {
555 		dst->mask |= BIT(NL80211_STA_FLAG_MFP);
556 		if (value & QLINK_STA_FLAG_MFP)
557 			dst->set |= BIT(NL80211_STA_FLAG_MFP);
558 	}
559 
560 	if (mask & QLINK_STA_FLAG_AUTHENTICATED) {
561 		dst->mask |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
562 		if (value & QLINK_STA_FLAG_AUTHENTICATED)
563 			dst->set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
564 	}
565 
566 	if (mask & QLINK_STA_FLAG_TDLS_PEER) {
567 		dst->mask |= BIT(NL80211_STA_FLAG_TDLS_PEER);
568 		if (value & QLINK_STA_FLAG_TDLS_PEER)
569 			dst->set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
570 	}
571 
572 	if (mask & QLINK_STA_FLAG_ASSOCIATED) {
573 		dst->mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
574 		if (value & QLINK_STA_FLAG_ASSOCIATED)
575 			dst->set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
576 	}
577 }
578 
579 static void
580 qtnf_sta_info_parse_generic_info(struct station_info *sinfo,
581 				 const struct qlink_sta_info_generic *info)
582 {
583 	sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME) |
584 			 BIT(NL80211_STA_INFO_INACTIVE_TIME);
585 	sinfo->connected_time = get_unaligned_le32(&info->connected_time);
586 	sinfo->inactive_time = get_unaligned_le32(&info->inactive_time);
587 
588 	sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL) |
589 			 BIT(NL80211_STA_INFO_SIGNAL_AVG);
590 	sinfo->signal = info->rssi - 120;
591 	sinfo->signal_avg = info->rssi_avg - QLINK_RSSI_OFFSET;
592 
593 	if (info->rx_rate.rate) {
594 		sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
595 		qtnf_sta_info_parse_rate(&sinfo->rxrate, &info->rx_rate);
596 	}
597 
598 	if (info->tx_rate.rate) {
599 		sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
600 		qtnf_sta_info_parse_rate(&sinfo->txrate, &info->tx_rate);
601 	}
602 
603 	sinfo->filled |= BIT(NL80211_STA_INFO_STA_FLAGS);
604 	qtnf_sta_info_parse_flags(&sinfo->sta_flags, &info->state);
605 }
606 
607 static int qtnf_cmd_sta_info_parse(struct station_info *sinfo,
608 				   const u8 *payload, size_t payload_size)
609 {
610 	const struct qlink_sta_stat_basic_counters *counters;
611 	const struct qlink_sta_info_generic *sta_info;
612 	u16 tlv_type;
613 	u16 tlv_value_len;
614 	size_t tlv_full_len;
615 	const struct qlink_tlv_hdr *tlv;
616 
617 	sinfo->filled = 0;
618 
619 	tlv = (const struct qlink_tlv_hdr *)payload;
620 	while (payload_size >= sizeof(struct qlink_tlv_hdr)) {
621 		tlv_type = le16_to_cpu(tlv->type);
622 		tlv_value_len = le16_to_cpu(tlv->len);
623 		tlv_full_len = tlv_value_len + sizeof(struct qlink_tlv_hdr);
624 		if (tlv_full_len > payload_size) {
625 			pr_warn("malformed TLV 0x%.2X; LEN: %u\n",
626 				tlv_type, tlv_value_len);
627 			return -EINVAL;
628 		}
629 		switch (tlv_type) {
630 		case QTN_TLV_ID_STA_BASIC_COUNTERS:
631 			if (unlikely(tlv_value_len < sizeof(*counters))) {
632 				pr_err("invalid TLV size %.4X: %u\n",
633 				       tlv_type, tlv_value_len);
634 				break;
635 			}
636 
637 			counters = (void *)tlv->val;
638 			qtnf_sta_info_parse_basic_counters(sinfo, counters);
639 			break;
640 		case QTN_TLV_ID_STA_GENERIC_INFO:
641 			if (unlikely(tlv_value_len < sizeof(*sta_info)))
642 				break;
643 
644 			sta_info = (void *)tlv->val;
645 			qtnf_sta_info_parse_generic_info(sinfo, sta_info);
646 			break;
647 		default:
648 			pr_warn("unexpected TLV type: %.4X\n", tlv_type);
649 			break;
650 		}
651 		payload_size -= tlv_full_len;
652 		tlv = (struct qlink_tlv_hdr *)(tlv->val + tlv_value_len);
653 	}
654 
655 	if (payload_size) {
656 		pr_warn("malformed TLV buf; bytes left: %zu\n", payload_size);
657 		return -EINVAL;
658 	}
659 
660 	return 0;
661 }
662 
663 int qtnf_cmd_get_sta_info(struct qtnf_vif *vif, const u8 *sta_mac,
664 			  struct station_info *sinfo)
665 {
666 	struct sk_buff *cmd_skb, *resp_skb = NULL;
667 	struct qlink_cmd_get_sta_info *cmd;
668 	const struct qlink_resp_get_sta_info *resp;
669 	size_t var_resp_len;
670 	u16 res_code = QLINK_CMD_RESULT_OK;
671 	int ret = 0;
672 
673 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
674 					    QLINK_CMD_GET_STA_INFO,
675 					    sizeof(*cmd));
676 
677 	if (unlikely(!cmd_skb))
678 		return -ENOMEM;
679 
680 	qtnf_bus_lock(vif->mac->bus);
681 
682 	cmd = (struct qlink_cmd_get_sta_info *)cmd_skb->data;
683 	ether_addr_copy(cmd->sta_addr, sta_mac);
684 
685 	ret = qtnf_cmd_send_with_reply(vif->mac->bus, cmd_skb, &resp_skb,
686 				       &res_code, sizeof(*resp),
687 				       &var_resp_len);
688 
689 	if (unlikely(ret))
690 		goto out;
691 
692 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
693 		switch (res_code) {
694 		case QLINK_CMD_RESULT_ENOTFOUND:
695 			pr_warn("VIF%u.%u: %pM STA not found\n",
696 				vif->mac->macid, vif->vifid, sta_mac);
697 			ret = -ENOENT;
698 			break;
699 		default:
700 			pr_err("VIF%u.%u: can't get info for %pM: %u\n",
701 			       vif->mac->macid, vif->vifid, sta_mac, res_code);
702 			ret = -EFAULT;
703 			break;
704 		}
705 		goto out;
706 	}
707 
708 	resp = (const struct qlink_resp_get_sta_info *)resp_skb->data;
709 
710 	if (unlikely(!ether_addr_equal(sta_mac, resp->sta_addr))) {
711 		pr_err("VIF%u.%u: wrong mac in reply: %pM != %pM\n",
712 		       vif->mac->macid, vif->vifid, resp->sta_addr, sta_mac);
713 		ret = -EINVAL;
714 		goto out;
715 	}
716 
717 	ret = qtnf_cmd_sta_info_parse(sinfo, resp->info, var_resp_len);
718 
719 out:
720 	qtnf_bus_unlock(vif->mac->bus);
721 	consume_skb(resp_skb);
722 
723 	return ret;
724 }
725 
726 static int qtnf_cmd_send_add_change_intf(struct qtnf_vif *vif,
727 					 enum nl80211_iftype iftype,
728 					 u8 *mac_addr,
729 					 enum qlink_cmd_type cmd_type)
730 {
731 	struct sk_buff *cmd_skb, *resp_skb = NULL;
732 	struct qlink_cmd_manage_intf *cmd;
733 	const struct qlink_resp_manage_intf *resp;
734 	u16 res_code = QLINK_CMD_RESULT_OK;
735 	int ret = 0;
736 
737 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
738 					    cmd_type,
739 					    sizeof(*cmd));
740 	if (unlikely(!cmd_skb))
741 		return -ENOMEM;
742 
743 	qtnf_bus_lock(vif->mac->bus);
744 
745 	cmd = (struct qlink_cmd_manage_intf *)cmd_skb->data;
746 
747 	switch (iftype) {
748 	case NL80211_IFTYPE_AP:
749 		cmd->intf_info.if_type = cpu_to_le16(QLINK_IFTYPE_AP);
750 		break;
751 	case NL80211_IFTYPE_STATION:
752 		cmd->intf_info.if_type = cpu_to_le16(QLINK_IFTYPE_STATION);
753 		break;
754 	default:
755 		pr_err("VIF%u.%u: unsupported type %d\n", vif->mac->macid,
756 		       vif->vifid, iftype);
757 		ret = -EINVAL;
758 		goto out;
759 	}
760 
761 	if (mac_addr)
762 		ether_addr_copy(cmd->intf_info.mac_addr, mac_addr);
763 	else
764 		eth_zero_addr(cmd->intf_info.mac_addr);
765 
766 	ret = qtnf_cmd_send_with_reply(vif->mac->bus, cmd_skb, &resp_skb,
767 				       &res_code, sizeof(*resp), NULL);
768 
769 	if (unlikely(ret))
770 		goto out;
771 
772 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
773 		pr_err("VIF%u.%u: CMD %d failed: %u\n", vif->mac->macid,
774 		       vif->vifid, cmd_type, res_code);
775 		ret = -EFAULT;
776 		goto out;
777 	}
778 
779 	resp = (const struct qlink_resp_manage_intf *)resp_skb->data;
780 	ether_addr_copy(vif->mac_addr, resp->intf_info.mac_addr);
781 
782 out:
783 	qtnf_bus_unlock(vif->mac->bus);
784 	consume_skb(resp_skb);
785 
786 	return ret;
787 }
788 
789 int qtnf_cmd_send_add_intf(struct qtnf_vif *vif,
790 			   enum nl80211_iftype iftype, u8 *mac_addr)
791 {
792 	return qtnf_cmd_send_add_change_intf(vif, iftype, mac_addr,
793 			QLINK_CMD_ADD_INTF);
794 }
795 
796 int qtnf_cmd_send_change_intf_type(struct qtnf_vif *vif,
797 				   enum nl80211_iftype iftype, u8 *mac_addr)
798 {
799 	return qtnf_cmd_send_add_change_intf(vif, iftype, mac_addr,
800 					     QLINK_CMD_CHANGE_INTF);
801 }
802 
803 int qtnf_cmd_send_del_intf(struct qtnf_vif *vif)
804 {
805 	struct sk_buff *cmd_skb;
806 	struct qlink_cmd_manage_intf *cmd;
807 	u16 res_code = QLINK_CMD_RESULT_OK;
808 	int ret = 0;
809 
810 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
811 					    QLINK_CMD_DEL_INTF,
812 					    sizeof(*cmd));
813 	if (unlikely(!cmd_skb))
814 		return -ENOMEM;
815 
816 	qtnf_bus_lock(vif->mac->bus);
817 
818 	cmd = (struct qlink_cmd_manage_intf *)cmd_skb->data;
819 
820 	switch (vif->wdev.iftype) {
821 	case NL80211_IFTYPE_AP:
822 		cmd->intf_info.if_type = cpu_to_le16(QLINK_IFTYPE_AP);
823 		break;
824 	case NL80211_IFTYPE_STATION:
825 		cmd->intf_info.if_type = cpu_to_le16(QLINK_IFTYPE_STATION);
826 		break;
827 	default:
828 		pr_warn("VIF%u.%u: unsupported iftype %d\n", vif->mac->macid,
829 			vif->vifid, vif->wdev.iftype);
830 		ret = -EINVAL;
831 		goto out;
832 	}
833 
834 	eth_zero_addr(cmd->intf_info.mac_addr);
835 
836 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
837 
838 	if (unlikely(ret))
839 		goto out;
840 
841 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
842 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
843 		       vif->vifid, res_code);
844 		ret = -EFAULT;
845 		goto out;
846 	}
847 
848 out:
849 	qtnf_bus_unlock(vif->mac->bus);
850 	return ret;
851 }
852 
853 static int
854 qtnf_cmd_resp_proc_hw_info(struct qtnf_bus *bus,
855 			   const struct qlink_resp_get_hw_info *resp)
856 {
857 	struct qtnf_hw_info *hwinfo = &bus->hw_info;
858 
859 	hwinfo->num_mac = resp->num_mac;
860 	hwinfo->mac_bitmap = resp->mac_bitmap;
861 	hwinfo->fw_ver = le32_to_cpu(resp->fw_ver);
862 	hwinfo->ql_proto_ver = le16_to_cpu(resp->ql_proto_ver);
863 	memcpy(hwinfo->alpha2_code, resp->alpha2_code,
864 	       sizeof(hwinfo->alpha2_code));
865 	hwinfo->total_tx_chain = resp->total_tx_chain;
866 	hwinfo->total_rx_chain = resp->total_rx_chain;
867 	hwinfo->hw_capab = le32_to_cpu(resp->hw_capab);
868 
869 	pr_info("fw_version=%d, MACs map %#x, alpha2=\"%c%c\", chains Tx=%u Rx=%u\n",
870 		hwinfo->fw_ver, hwinfo->mac_bitmap,
871 		hwinfo->alpha2_code[0], hwinfo->alpha2_code[1],
872 		hwinfo->total_tx_chain, hwinfo->total_rx_chain);
873 
874 	return 0;
875 }
876 
877 static int qtnf_parse_variable_mac_info(struct qtnf_wmac *mac,
878 					const u8 *tlv_buf, size_t tlv_buf_size)
879 {
880 	struct ieee80211_iface_limit *limits = NULL;
881 	const struct qlink_iface_limit *limit_record;
882 	size_t record_count = 0, rec = 0;
883 	u16 tlv_type, tlv_value_len, mask;
884 	struct qlink_iface_comb_num *comb;
885 	size_t tlv_full_len;
886 	const struct qlink_tlv_hdr *tlv;
887 
888 	mac->macinfo.n_limits = 0;
889 
890 	tlv = (const struct qlink_tlv_hdr *)tlv_buf;
891 	while (tlv_buf_size >= sizeof(struct qlink_tlv_hdr)) {
892 		tlv_type = le16_to_cpu(tlv->type);
893 		tlv_value_len = le16_to_cpu(tlv->len);
894 		tlv_full_len = tlv_value_len + sizeof(struct qlink_tlv_hdr);
895 		if (tlv_full_len > tlv_buf_size) {
896 			pr_warn("MAC%u: malformed TLV 0x%.2X; LEN: %u\n",
897 				mac->macid, tlv_type, tlv_value_len);
898 			return -EINVAL;
899 		}
900 
901 		switch (tlv_type) {
902 		case QTN_TLV_ID_NUM_IFACE_COMB:
903 			if (unlikely(tlv_value_len != sizeof(*comb)))
904 				return -EINVAL;
905 
906 			comb = (void *)tlv->val;
907 			record_count = le16_to_cpu(comb->iface_comb_num);
908 
909 			mac->macinfo.n_limits = record_count;
910 			/* free earlier iface limits memory */
911 			kfree(mac->macinfo.limits);
912 			mac->macinfo.limits =
913 				kzalloc(sizeof(*mac->macinfo.limits) *
914 					record_count, GFP_KERNEL);
915 
916 			if (unlikely(!mac->macinfo.limits))
917 				return -ENOMEM;
918 
919 			limits = mac->macinfo.limits;
920 			break;
921 		case QTN_TLV_ID_IFACE_LIMIT:
922 			if (unlikely(!limits)) {
923 				pr_warn("MAC%u: limits are not inited\n",
924 					mac->macid);
925 				return -EINVAL;
926 			}
927 
928 			if (unlikely(tlv_value_len != sizeof(*limit_record))) {
929 				pr_warn("MAC%u: record size mismatch\n",
930 					mac->macid);
931 				return -EINVAL;
932 			}
933 
934 			limit_record = (void *)tlv->val;
935 			limits[rec].max = le16_to_cpu(limit_record->max_num);
936 			mask = le16_to_cpu(limit_record->type_mask);
937 			limits[rec].types = qlink_iface_type_mask_to_nl(mask);
938 			/* only AP and STA modes are supported */
939 			limits[rec].types &= BIT(NL80211_IFTYPE_AP) |
940 					     BIT(NL80211_IFTYPE_STATION);
941 
942 			pr_debug("MAC%u: MAX: %u; TYPES: %.4X\n", mac->macid,
943 				 limits[rec].max, limits[rec].types);
944 
945 			if (limits[rec].types)
946 				rec++;
947 			break;
948 		default:
949 			break;
950 		}
951 		tlv_buf_size -= tlv_full_len;
952 		tlv = (struct qlink_tlv_hdr *)(tlv->val + tlv_value_len);
953 	}
954 
955 	if (tlv_buf_size) {
956 		pr_warn("MAC%u: malformed TLV buf; bytes left: %zu\n",
957 			mac->macid, tlv_buf_size);
958 		return -EINVAL;
959 	}
960 
961 	if (mac->macinfo.n_limits != rec) {
962 		pr_err("MAC%u: combination mismatch: reported=%zu parsed=%zu\n",
963 		       mac->macid, mac->macinfo.n_limits, rec);
964 		return -EINVAL;
965 	}
966 
967 	return 0;
968 }
969 
970 static void
971 qtnf_cmd_resp_proc_mac_info(struct qtnf_wmac *mac,
972 			    const struct qlink_resp_get_mac_info *resp_info)
973 {
974 	struct qtnf_mac_info *mac_info;
975 	struct qtnf_vif *vif;
976 
977 	mac_info = &mac->macinfo;
978 
979 	mac_info->bands_cap = resp_info->bands_cap;
980 	mac_info->phymode_cap = resp_info->phymode_cap;
981 	memcpy(&mac_info->dev_mac, &resp_info->dev_mac,
982 	       sizeof(mac_info->dev_mac));
983 
984 	ether_addr_copy(mac->macaddr, mac_info->dev_mac);
985 
986 	vif = qtnf_mac_get_base_vif(mac);
987 	if (vif)
988 		ether_addr_copy(vif->mac_addr, mac->macaddr);
989 	else
990 		pr_err("could not get valid base vif\n");
991 
992 	mac_info->num_tx_chain = resp_info->num_tx_chain;
993 	mac_info->num_rx_chain = resp_info->num_rx_chain;
994 
995 	mac_info->max_ap_assoc_sta = le16_to_cpu(resp_info->max_ap_assoc_sta);
996 	mac_info->radar_detect_widths =
997 			qlink_chan_width_mask_to_nl(le16_to_cpu(
998 					resp_info->radar_detect_widths));
999 
1000 	memcpy(&mac_info->ht_cap, &resp_info->ht_cap, sizeof(mac_info->ht_cap));
1001 	memcpy(&mac_info->vht_cap, &resp_info->vht_cap,
1002 	       sizeof(mac_info->vht_cap));
1003 }
1004 
1005 static int
1006 qtnf_cmd_resp_fill_channels_info(struct ieee80211_supported_band *band,
1007 				 struct qlink_resp_get_chan_info *resp,
1008 				 size_t payload_len)
1009 {
1010 	u16 tlv_type;
1011 	size_t tlv_len;
1012 	const struct qlink_tlv_hdr *tlv;
1013 	const struct qlink_tlv_channel *qchan;
1014 	struct ieee80211_channel *chan;
1015 	unsigned int chidx = 0;
1016 	u32 qflags;
1017 
1018 	kfree(band->channels);
1019 	band->channels = NULL;
1020 
1021 	band->n_channels = resp->num_chans;
1022 	if (band->n_channels == 0)
1023 		return 0;
1024 
1025 	band->channels = kcalloc(band->n_channels, sizeof(*chan), GFP_KERNEL);
1026 	if (!band->channels) {
1027 		band->n_channels = 0;
1028 		return -ENOMEM;
1029 	}
1030 
1031 	tlv = (struct qlink_tlv_hdr *)resp->info;
1032 
1033 	while (payload_len >= sizeof(*tlv)) {
1034 		tlv_type = le16_to_cpu(tlv->type);
1035 		tlv_len = le16_to_cpu(tlv->len) + sizeof(*tlv);
1036 
1037 		if (tlv_len > payload_len) {
1038 			pr_warn("malformed TLV 0x%.2X; LEN: %zu\n",
1039 				tlv_type, tlv_len);
1040 			goto error_ret;
1041 		}
1042 
1043 		switch (tlv_type) {
1044 		case QTN_TLV_ID_CHANNEL:
1045 			if (unlikely(tlv_len != sizeof(*qchan))) {
1046 				pr_err("invalid channel TLV len %zu\n",
1047 				       tlv_len);
1048 				goto error_ret;
1049 			}
1050 
1051 			if (chidx == band->n_channels) {
1052 				pr_err("too many channel TLVs\n");
1053 				goto error_ret;
1054 			}
1055 
1056 			qchan = (const struct qlink_tlv_channel *)tlv;
1057 			chan = &band->channels[chidx++];
1058 			qflags = le32_to_cpu(qchan->flags);
1059 
1060 			chan->hw_value = le16_to_cpu(qchan->hw_value);
1061 			chan->band = band->band;
1062 			chan->center_freq = le16_to_cpu(qchan->center_freq);
1063 			chan->max_antenna_gain = (int)qchan->max_antenna_gain;
1064 			chan->max_power = (int)qchan->max_power;
1065 			chan->max_reg_power = (int)qchan->max_reg_power;
1066 			chan->beacon_found = qchan->beacon_found;
1067 			chan->dfs_cac_ms = le32_to_cpu(qchan->dfs_cac_ms);
1068 			chan->flags = 0;
1069 
1070 			if (qflags & QLINK_CHAN_DISABLED)
1071 				chan->flags |= IEEE80211_CHAN_DISABLED;
1072 
1073 			if (qflags & QLINK_CHAN_NO_IR)
1074 				chan->flags |= IEEE80211_CHAN_NO_IR;
1075 
1076 			if (qflags & QLINK_CHAN_NO_HT40PLUS)
1077 				chan->flags |= IEEE80211_CHAN_NO_HT40PLUS;
1078 
1079 			if (qflags & QLINK_CHAN_NO_HT40MINUS)
1080 				chan->flags |= IEEE80211_CHAN_NO_HT40MINUS;
1081 
1082 			if (qflags & QLINK_CHAN_NO_OFDM)
1083 				chan->flags |= IEEE80211_CHAN_NO_OFDM;
1084 
1085 			if (qflags & QLINK_CHAN_NO_80MHZ)
1086 				chan->flags |= IEEE80211_CHAN_NO_80MHZ;
1087 
1088 			if (qflags & QLINK_CHAN_NO_160MHZ)
1089 				chan->flags |= IEEE80211_CHAN_NO_160MHZ;
1090 
1091 			if (qflags & QLINK_CHAN_INDOOR_ONLY)
1092 				chan->flags |= IEEE80211_CHAN_INDOOR_ONLY;
1093 
1094 			if (qflags & QLINK_CHAN_IR_CONCURRENT)
1095 				chan->flags |= IEEE80211_CHAN_IR_CONCURRENT;
1096 
1097 			if (qflags & QLINK_CHAN_NO_20MHZ)
1098 				chan->flags |= IEEE80211_CHAN_NO_20MHZ;
1099 
1100 			if (qflags & QLINK_CHAN_NO_10MHZ)
1101 				chan->flags |= IEEE80211_CHAN_NO_10MHZ;
1102 
1103 			if (qflags & QLINK_CHAN_RADAR) {
1104 				chan->flags |= IEEE80211_CHAN_RADAR;
1105 				chan->dfs_state_entered = jiffies;
1106 
1107 				if (qchan->dfs_state == QLINK_DFS_USABLE)
1108 					chan->dfs_state = NL80211_DFS_USABLE;
1109 				else if (qchan->dfs_state ==
1110 					QLINK_DFS_AVAILABLE)
1111 					chan->dfs_state = NL80211_DFS_AVAILABLE;
1112 				else
1113 					chan->dfs_state =
1114 						NL80211_DFS_UNAVAILABLE;
1115 			}
1116 
1117 			pr_debug("chan=%d flags=%#x max_pow=%d max_reg_pow=%d\n",
1118 				 chan->hw_value, chan->flags, chan->max_power,
1119 				 chan->max_reg_power);
1120 			break;
1121 		default:
1122 			pr_warn("unknown TLV type: %#x\n", tlv_type);
1123 			break;
1124 		}
1125 
1126 		payload_len -= tlv_len;
1127 		tlv = (struct qlink_tlv_hdr *)((u8 *)tlv + tlv_len);
1128 	}
1129 
1130 	if (payload_len) {
1131 		pr_err("malformed TLV buf; bytes left: %zu\n", payload_len);
1132 		goto error_ret;
1133 	}
1134 
1135 	if (band->n_channels != chidx) {
1136 		pr_err("channel count mismatch: reported=%d, parsed=%d\n",
1137 		       band->n_channels, chidx);
1138 		goto error_ret;
1139 	}
1140 
1141 	return 0;
1142 
1143 error_ret:
1144 	kfree(band->channels);
1145 	band->channels = NULL;
1146 	band->n_channels = 0;
1147 
1148 	return -EINVAL;
1149 }
1150 
1151 static int qtnf_cmd_resp_proc_phy_params(struct qtnf_wmac *mac,
1152 					 const u8 *payload, size_t payload_len)
1153 {
1154 	struct qtnf_mac_info *mac_info;
1155 	struct qlink_tlv_frag_rts_thr *phy_thr;
1156 	struct qlink_tlv_rlimit *limit;
1157 	struct qlink_tlv_cclass *class;
1158 	u16 tlv_type;
1159 	u16 tlv_value_len;
1160 	size_t tlv_full_len;
1161 	const struct qlink_tlv_hdr *tlv;
1162 
1163 	mac_info = &mac->macinfo;
1164 
1165 	tlv = (struct qlink_tlv_hdr *)payload;
1166 	while (payload_len >= sizeof(struct qlink_tlv_hdr)) {
1167 		tlv_type = le16_to_cpu(tlv->type);
1168 		tlv_value_len = le16_to_cpu(tlv->len);
1169 		tlv_full_len = tlv_value_len + sizeof(struct qlink_tlv_hdr);
1170 
1171 		if (tlv_full_len > payload_len) {
1172 			pr_warn("MAC%u: malformed TLV 0x%.2X; LEN: %u\n",
1173 				mac->macid, tlv_type, tlv_value_len);
1174 			return -EINVAL;
1175 		}
1176 
1177 		switch (tlv_type) {
1178 		case QTN_TLV_ID_FRAG_THRESH:
1179 			phy_thr = (void *)tlv;
1180 			mac_info->frag_thr = (u32)le16_to_cpu(phy_thr->thr);
1181 			break;
1182 		case QTN_TLV_ID_RTS_THRESH:
1183 			phy_thr = (void *)tlv;
1184 			mac_info->rts_thr = (u32)le16_to_cpu(phy_thr->thr);
1185 			break;
1186 		case QTN_TLV_ID_SRETRY_LIMIT:
1187 			limit = (void *)tlv;
1188 			mac_info->sretry_limit = limit->rlimit;
1189 			break;
1190 		case QTN_TLV_ID_LRETRY_LIMIT:
1191 			limit = (void *)tlv;
1192 			mac_info->lretry_limit = limit->rlimit;
1193 			break;
1194 		case QTN_TLV_ID_COVERAGE_CLASS:
1195 			class = (void *)tlv;
1196 			mac_info->coverage_class = class->cclass;
1197 			break;
1198 		default:
1199 			pr_err("MAC%u: Unknown TLV type: %#x\n", mac->macid,
1200 			       le16_to_cpu(tlv->type));
1201 			break;
1202 		}
1203 
1204 		payload_len -= tlv_full_len;
1205 		tlv = (struct qlink_tlv_hdr *)(tlv->val + tlv_value_len);
1206 	}
1207 
1208 	if (payload_len) {
1209 		pr_warn("MAC%u: malformed TLV buf; bytes left: %zu\n",
1210 			mac->macid, payload_len);
1211 		return -EINVAL;
1212 	}
1213 
1214 	return 0;
1215 }
1216 
1217 int qtnf_cmd_get_mac_info(struct qtnf_wmac *mac)
1218 {
1219 	struct sk_buff *cmd_skb, *resp_skb = NULL;
1220 	const struct qlink_resp_get_mac_info *resp;
1221 	size_t var_data_len;
1222 	u16 res_code = QLINK_CMD_RESULT_OK;
1223 	int ret = 0;
1224 
1225 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, QLINK_VIFID_RSVD,
1226 					    QLINK_CMD_MAC_INFO,
1227 					    sizeof(struct qlink_cmd));
1228 	if (unlikely(!cmd_skb))
1229 		return -ENOMEM;
1230 
1231 	qtnf_bus_lock(mac->bus);
1232 
1233 	ret = qtnf_cmd_send_with_reply(mac->bus, cmd_skb, &resp_skb, &res_code,
1234 				       sizeof(*resp), &var_data_len);
1235 	if (unlikely(ret))
1236 		goto out;
1237 
1238 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1239 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
1240 		ret = -EFAULT;
1241 		goto out;
1242 	}
1243 
1244 	resp = (const struct qlink_resp_get_mac_info *)resp_skb->data;
1245 	qtnf_cmd_resp_proc_mac_info(mac, resp);
1246 	ret = qtnf_parse_variable_mac_info(mac, resp->var_info, var_data_len);
1247 
1248 out:
1249 	qtnf_bus_unlock(mac->bus);
1250 	consume_skb(resp_skb);
1251 
1252 	return ret;
1253 }
1254 
1255 int qtnf_cmd_get_hw_info(struct qtnf_bus *bus)
1256 {
1257 	struct sk_buff *cmd_skb, *resp_skb = NULL;
1258 	const struct qlink_resp_get_hw_info *resp;
1259 	u16 res_code = QLINK_CMD_RESULT_OK;
1260 	int ret = 0;
1261 
1262 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(QLINK_MACID_RSVD, QLINK_VIFID_RSVD,
1263 					    QLINK_CMD_GET_HW_INFO,
1264 					    sizeof(struct qlink_cmd));
1265 	if (unlikely(!cmd_skb))
1266 		return -ENOMEM;
1267 
1268 	qtnf_bus_lock(bus);
1269 
1270 	ret = qtnf_cmd_send_with_reply(bus, cmd_skb, &resp_skb, &res_code,
1271 				       sizeof(*resp), NULL);
1272 
1273 	if (unlikely(ret))
1274 		goto out;
1275 
1276 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1277 		pr_err("cmd exec failed: 0x%.4X\n", res_code);
1278 		ret = -EFAULT;
1279 		goto out;
1280 	}
1281 
1282 	resp = (const struct qlink_resp_get_hw_info *)resp_skb->data;
1283 	ret = qtnf_cmd_resp_proc_hw_info(bus, resp);
1284 
1285 out:
1286 	qtnf_bus_unlock(bus);
1287 	consume_skb(resp_skb);
1288 
1289 	return ret;
1290 }
1291 
1292 int qtnf_cmd_get_mac_chan_info(struct qtnf_wmac *mac,
1293 			       struct ieee80211_supported_band *band)
1294 {
1295 	struct sk_buff *cmd_skb, *resp_skb = NULL;
1296 	size_t info_len;
1297 	struct qlink_cmd_chans_info_get *cmd;
1298 	struct qlink_resp_get_chan_info *resp;
1299 	u16 res_code = QLINK_CMD_RESULT_OK;
1300 	int ret = 0;
1301 	u8 qband;
1302 
1303 	switch (band->band) {
1304 	case NL80211_BAND_2GHZ:
1305 		qband = QLINK_BAND_2GHZ;
1306 		break;
1307 	case NL80211_BAND_5GHZ:
1308 		qband = QLINK_BAND_5GHZ;
1309 		break;
1310 	case NL80211_BAND_60GHZ:
1311 		qband = QLINK_BAND_60GHZ;
1312 		break;
1313 	default:
1314 		return -EINVAL;
1315 	}
1316 
1317 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, 0,
1318 					    QLINK_CMD_CHANS_INFO_GET,
1319 					    sizeof(*cmd));
1320 	if (!cmd_skb)
1321 		return -ENOMEM;
1322 
1323 	cmd = (struct qlink_cmd_chans_info_get *)cmd_skb->data;
1324 	cmd->band = qband;
1325 	ret = qtnf_cmd_send_with_reply(mac->bus, cmd_skb, &resp_skb, &res_code,
1326 				       sizeof(*resp), &info_len);
1327 
1328 	if (unlikely(ret))
1329 		goto out;
1330 
1331 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1332 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
1333 		ret = -EFAULT;
1334 		goto out;
1335 	}
1336 
1337 	resp = (struct qlink_resp_get_chan_info *)resp_skb->data;
1338 	if (resp->band != qband) {
1339 		pr_err("MAC%u: reply band %u != cmd band %u\n", mac->macid,
1340 		       resp->band, qband);
1341 		ret = -EINVAL;
1342 		goto out;
1343 	}
1344 
1345 	ret = qtnf_cmd_resp_fill_channels_info(band, resp, info_len);
1346 
1347 out:
1348 	consume_skb(resp_skb);
1349 
1350 	return ret;
1351 }
1352 
1353 int qtnf_cmd_send_get_phy_params(struct qtnf_wmac *mac)
1354 {
1355 	struct sk_buff *cmd_skb, *resp_skb = NULL;
1356 	size_t response_size;
1357 	struct qlink_resp_phy_params *resp;
1358 	u16 res_code = QLINK_CMD_RESULT_OK;
1359 	int ret = 0;
1360 
1361 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, 0,
1362 					    QLINK_CMD_PHY_PARAMS_GET,
1363 					    sizeof(struct qlink_cmd));
1364 	if (!cmd_skb)
1365 		return -ENOMEM;
1366 
1367 	qtnf_bus_lock(mac->bus);
1368 
1369 	ret = qtnf_cmd_send_with_reply(mac->bus, cmd_skb, &resp_skb, &res_code,
1370 				       sizeof(*resp), &response_size);
1371 
1372 	if (unlikely(ret))
1373 		goto out;
1374 
1375 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1376 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
1377 		ret = -EFAULT;
1378 		goto out;
1379 	}
1380 
1381 	resp = (struct qlink_resp_phy_params *)resp_skb->data;
1382 	ret = qtnf_cmd_resp_proc_phy_params(mac, resp->info, response_size);
1383 
1384 out:
1385 	qtnf_bus_unlock(mac->bus);
1386 	consume_skb(resp_skb);
1387 
1388 	return ret;
1389 }
1390 
1391 int qtnf_cmd_send_update_phy_params(struct qtnf_wmac *mac, u32 changed)
1392 {
1393 	struct wiphy *wiphy = priv_to_wiphy(mac);
1394 	struct sk_buff *cmd_skb;
1395 	u16 res_code = QLINK_CMD_RESULT_OK;
1396 	int ret = 0;
1397 
1398 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, 0,
1399 					    QLINK_CMD_PHY_PARAMS_SET,
1400 					    sizeof(struct qlink_cmd));
1401 	if (!cmd_skb)
1402 		return -ENOMEM;
1403 
1404 	qtnf_bus_lock(mac->bus);
1405 
1406 	if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1407 		qtnf_cmd_skb_put_tlv_u16(cmd_skb, QTN_TLV_ID_FRAG_THRESH,
1408 					 wiphy->frag_threshold);
1409 	if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1410 		qtnf_cmd_skb_put_tlv_u16(cmd_skb, QTN_TLV_ID_RTS_THRESH,
1411 					 wiphy->rts_threshold);
1412 	if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1413 		qtnf_cmd_skb_put_tlv_u8(cmd_skb, QTN_TLV_ID_COVERAGE_CLASS,
1414 					wiphy->coverage_class);
1415 
1416 	ret = qtnf_cmd_send(mac->bus, cmd_skb, &res_code);
1417 
1418 	if (unlikely(ret))
1419 		goto out;
1420 
1421 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1422 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
1423 		ret = -EFAULT;
1424 		goto out;
1425 	}
1426 
1427 out:
1428 	qtnf_bus_unlock(mac->bus);
1429 	return ret;
1430 }
1431 
1432 int qtnf_cmd_send_init_fw(struct qtnf_bus *bus)
1433 {
1434 	struct sk_buff *cmd_skb;
1435 	u16 res_code = QLINK_CMD_RESULT_OK;
1436 	int ret = 0;
1437 
1438 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(QLINK_MACID_RSVD, QLINK_VIFID_RSVD,
1439 					    QLINK_CMD_FW_INIT,
1440 					    sizeof(struct qlink_cmd));
1441 	if (unlikely(!cmd_skb))
1442 		return -ENOMEM;
1443 
1444 	qtnf_bus_lock(bus);
1445 
1446 	ret = qtnf_cmd_send(bus, cmd_skb, &res_code);
1447 
1448 	if (unlikely(ret))
1449 		goto out;
1450 
1451 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1452 		pr_err("cmd exec failed: 0x%.4X\n", res_code);
1453 		ret = -EFAULT;
1454 		goto out;
1455 	}
1456 
1457 out:
1458 	qtnf_bus_unlock(bus);
1459 	return ret;
1460 }
1461 
1462 void qtnf_cmd_send_deinit_fw(struct qtnf_bus *bus)
1463 {
1464 	struct sk_buff *cmd_skb;
1465 
1466 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(QLINK_MACID_RSVD, QLINK_VIFID_RSVD,
1467 					    QLINK_CMD_FW_DEINIT,
1468 					    sizeof(struct qlink_cmd));
1469 	if (!cmd_skb)
1470 		return;
1471 
1472 	qtnf_bus_lock(bus);
1473 
1474 	qtnf_cmd_send(bus, cmd_skb, NULL);
1475 
1476 	qtnf_bus_unlock(bus);
1477 }
1478 
1479 int qtnf_cmd_send_add_key(struct qtnf_vif *vif, u8 key_index, bool pairwise,
1480 			  const u8 *mac_addr, struct key_params *params)
1481 {
1482 	struct sk_buff *cmd_skb;
1483 	struct qlink_cmd_add_key *cmd;
1484 	u16 res_code = QLINK_CMD_RESULT_OK;
1485 	int ret = 0;
1486 
1487 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1488 					    QLINK_CMD_ADD_KEY,
1489 					    sizeof(*cmd));
1490 	if (unlikely(!cmd_skb))
1491 		return -ENOMEM;
1492 
1493 	qtnf_bus_lock(vif->mac->bus);
1494 
1495 	cmd = (struct qlink_cmd_add_key *)cmd_skb->data;
1496 
1497 	if (mac_addr)
1498 		ether_addr_copy(cmd->addr, mac_addr);
1499 	else
1500 		eth_broadcast_addr(cmd->addr);
1501 
1502 	cmd->cipher = cpu_to_le32(params->cipher);
1503 	cmd->key_index = key_index;
1504 	cmd->pairwise = pairwise;
1505 
1506 	if (params->key && params->key_len > 0)
1507 		qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_KEY,
1508 					 params->key,
1509 					 params->key_len);
1510 
1511 	if (params->seq && params->seq_len > 0)
1512 		qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_SEQ,
1513 					 params->seq,
1514 					 params->seq_len);
1515 
1516 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1517 	if (unlikely(ret))
1518 		goto out;
1519 
1520 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1521 		pr_err("VIF%u.%u: CMD failed: %u\n",
1522 		       vif->mac->macid, vif->vifid, res_code);
1523 		ret = -EFAULT;
1524 		goto out;
1525 	}
1526 
1527 out:
1528 	qtnf_bus_unlock(vif->mac->bus);
1529 	return ret;
1530 }
1531 
1532 int qtnf_cmd_send_del_key(struct qtnf_vif *vif, u8 key_index, bool pairwise,
1533 			  const u8 *mac_addr)
1534 {
1535 	struct sk_buff *cmd_skb;
1536 	struct qlink_cmd_del_key *cmd;
1537 	u16 res_code = QLINK_CMD_RESULT_OK;
1538 	int ret = 0;
1539 
1540 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1541 					    QLINK_CMD_DEL_KEY,
1542 					    sizeof(*cmd));
1543 	if (unlikely(!cmd_skb))
1544 		return -ENOMEM;
1545 
1546 	qtnf_bus_lock(vif->mac->bus);
1547 
1548 	cmd = (struct qlink_cmd_del_key *)cmd_skb->data;
1549 
1550 	if (mac_addr)
1551 		ether_addr_copy(cmd->addr, mac_addr);
1552 	else
1553 		eth_broadcast_addr(cmd->addr);
1554 
1555 	cmd->key_index = key_index;
1556 	cmd->pairwise = pairwise;
1557 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1558 	if (unlikely(ret))
1559 		goto out;
1560 
1561 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1562 		pr_err("VIF%u.%u: CMD failed: %u\n",
1563 		       vif->mac->macid, vif->vifid, res_code);
1564 		ret = -EFAULT;
1565 		goto out;
1566 	}
1567 
1568 out:
1569 	qtnf_bus_unlock(vif->mac->bus);
1570 	return ret;
1571 }
1572 
1573 int qtnf_cmd_send_set_default_key(struct qtnf_vif *vif, u8 key_index,
1574 				  bool unicast, bool multicast)
1575 {
1576 	struct sk_buff *cmd_skb;
1577 	struct qlink_cmd_set_def_key *cmd;
1578 	u16 res_code = QLINK_CMD_RESULT_OK;
1579 	int ret = 0;
1580 
1581 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1582 					    QLINK_CMD_SET_DEFAULT_KEY,
1583 					    sizeof(*cmd));
1584 	if (unlikely(!cmd_skb))
1585 		return -ENOMEM;
1586 
1587 	qtnf_bus_lock(vif->mac->bus);
1588 
1589 	cmd = (struct qlink_cmd_set_def_key *)cmd_skb->data;
1590 	cmd->key_index = key_index;
1591 	cmd->unicast = unicast;
1592 	cmd->multicast = multicast;
1593 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1594 	if (unlikely(ret))
1595 		goto out;
1596 
1597 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1598 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1599 		       vif->vifid, res_code);
1600 		ret = -EFAULT;
1601 		goto out;
1602 	}
1603 
1604 out:
1605 	qtnf_bus_unlock(vif->mac->bus);
1606 	return ret;
1607 }
1608 
1609 int qtnf_cmd_send_set_default_mgmt_key(struct qtnf_vif *vif, u8 key_index)
1610 {
1611 	struct sk_buff *cmd_skb;
1612 	struct qlink_cmd_set_def_mgmt_key *cmd;
1613 	u16 res_code = QLINK_CMD_RESULT_OK;
1614 	int ret = 0;
1615 
1616 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1617 					    QLINK_CMD_SET_DEFAULT_MGMT_KEY,
1618 					    sizeof(*cmd));
1619 	if (unlikely(!cmd_skb))
1620 		return -ENOMEM;
1621 
1622 	qtnf_bus_lock(vif->mac->bus);
1623 
1624 	cmd = (struct qlink_cmd_set_def_mgmt_key *)cmd_skb->data;
1625 	cmd->key_index = key_index;
1626 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1627 	if (unlikely(ret))
1628 		goto out;
1629 
1630 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1631 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1632 		       vif->vifid, res_code);
1633 		ret = -EFAULT;
1634 		goto out;
1635 	}
1636 
1637 out:
1638 	qtnf_bus_unlock(vif->mac->bus);
1639 	return ret;
1640 }
1641 
1642 static u32 qtnf_encode_sta_flags(u32 flags)
1643 {
1644 	u32 code = 0;
1645 
1646 	if (flags & BIT(NL80211_STA_FLAG_AUTHORIZED))
1647 		code |= QLINK_STA_FLAG_AUTHORIZED;
1648 	if (flags & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
1649 		code |= QLINK_STA_FLAG_SHORT_PREAMBLE;
1650 	if (flags & BIT(NL80211_STA_FLAG_WME))
1651 		code |= QLINK_STA_FLAG_WME;
1652 	if (flags & BIT(NL80211_STA_FLAG_MFP))
1653 		code |= QLINK_STA_FLAG_MFP;
1654 	if (flags & BIT(NL80211_STA_FLAG_AUTHENTICATED))
1655 		code |= QLINK_STA_FLAG_AUTHENTICATED;
1656 	if (flags & BIT(NL80211_STA_FLAG_TDLS_PEER))
1657 		code |= QLINK_STA_FLAG_TDLS_PEER;
1658 	if (flags & BIT(NL80211_STA_FLAG_ASSOCIATED))
1659 		code |= QLINK_STA_FLAG_ASSOCIATED;
1660 	return code;
1661 }
1662 
1663 int qtnf_cmd_send_change_sta(struct qtnf_vif *vif, const u8 *mac,
1664 			     struct station_parameters *params)
1665 {
1666 	struct sk_buff *cmd_skb;
1667 	struct qlink_cmd_change_sta *cmd;
1668 	u16 res_code = QLINK_CMD_RESULT_OK;
1669 	int ret = 0;
1670 
1671 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1672 					    QLINK_CMD_CHANGE_STA,
1673 					    sizeof(*cmd));
1674 	if (unlikely(!cmd_skb))
1675 		return -ENOMEM;
1676 
1677 	qtnf_bus_lock(vif->mac->bus);
1678 
1679 	cmd = (struct qlink_cmd_change_sta *)cmd_skb->data;
1680 	ether_addr_copy(cmd->sta_addr, mac);
1681 	cmd->sta_flags_mask = cpu_to_le32(qtnf_encode_sta_flags(
1682 					  params->sta_flags_mask));
1683 	cmd->sta_flags_set = cpu_to_le32(qtnf_encode_sta_flags(
1684 					 params->sta_flags_set));
1685 
1686 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1687 	if (unlikely(ret))
1688 		goto out;
1689 
1690 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1691 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1692 		       vif->vifid, res_code);
1693 		ret = -EFAULT;
1694 		goto out;
1695 	}
1696 
1697 out:
1698 	qtnf_bus_unlock(vif->mac->bus);
1699 	return ret;
1700 }
1701 
1702 int qtnf_cmd_send_del_sta(struct qtnf_vif *vif,
1703 			  struct station_del_parameters *params)
1704 {
1705 	struct sk_buff *cmd_skb;
1706 	struct qlink_cmd_del_sta *cmd;
1707 	u16 res_code = QLINK_CMD_RESULT_OK;
1708 	int ret = 0;
1709 
1710 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1711 					    QLINK_CMD_DEL_STA,
1712 					    sizeof(*cmd));
1713 	if (unlikely(!cmd_skb))
1714 		return -ENOMEM;
1715 
1716 	qtnf_bus_lock(vif->mac->bus);
1717 
1718 	cmd = (struct qlink_cmd_del_sta *)cmd_skb->data;
1719 
1720 	if (params->mac)
1721 		ether_addr_copy(cmd->sta_addr, params->mac);
1722 	else
1723 		eth_broadcast_addr(cmd->sta_addr);	/* flush all stations */
1724 
1725 	cmd->subtype = params->subtype;
1726 	cmd->reason_code = cpu_to_le16(params->reason_code);
1727 
1728 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1729 	if (unlikely(ret))
1730 		goto out;
1731 
1732 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1733 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1734 		       vif->vifid, res_code);
1735 		ret = -EFAULT;
1736 		goto out;
1737 	}
1738 
1739 out:
1740 	qtnf_bus_unlock(vif->mac->bus);
1741 	return ret;
1742 }
1743 
1744 int qtnf_cmd_send_scan(struct qtnf_wmac *mac)
1745 {
1746 	struct sk_buff *cmd_skb;
1747 	u16 res_code = QLINK_CMD_RESULT_OK;
1748 	struct ieee80211_channel *sc;
1749 	struct cfg80211_scan_request *scan_req = mac->scan_req;
1750 	struct qlink_tlv_channel *qchan;
1751 	int n_channels;
1752 	int count = 0;
1753 	int ret;
1754 	u32 flags;
1755 
1756 	if (scan_req->n_ssids > QTNF_MAX_SSID_LIST_LENGTH) {
1757 		pr_err("MAC%u: too many SSIDs in scan request\n", mac->macid);
1758 		return -EINVAL;
1759 	}
1760 
1761 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(mac->macid, QLINK_VIFID_RSVD,
1762 					    QLINK_CMD_SCAN,
1763 					    sizeof(struct qlink_cmd));
1764 	if (unlikely(!cmd_skb))
1765 		return -ENOMEM;
1766 
1767 	qtnf_bus_lock(mac->bus);
1768 
1769 	if (scan_req->n_ssids != 0) {
1770 		while (count < scan_req->n_ssids) {
1771 			qtnf_cmd_skb_put_tlv_arr(cmd_skb, WLAN_EID_SSID,
1772 				scan_req->ssids[count].ssid,
1773 				scan_req->ssids[count].ssid_len);
1774 			count++;
1775 		}
1776 	}
1777 
1778 	if (scan_req->ie_len != 0)
1779 		qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_IE_SET,
1780 					 scan_req->ie,
1781 					 scan_req->ie_len);
1782 
1783 	if (scan_req->n_channels) {
1784 		n_channels = scan_req->n_channels;
1785 		count = 0;
1786 
1787 		while (n_channels != 0) {
1788 			sc = scan_req->channels[count];
1789 			if (sc->flags & IEEE80211_CHAN_DISABLED) {
1790 				n_channels--;
1791 				continue;
1792 			}
1793 
1794 			pr_debug("MAC%u: scan chan=%d, freq=%d, flags=%#x\n",
1795 				 mac->macid, sc->hw_value, sc->center_freq,
1796 				 sc->flags);
1797 			qchan = (struct qlink_tlv_channel *)
1798 					skb_put(cmd_skb, sizeof(*qchan));
1799 			memset(qchan, 0, sizeof(*qchan));
1800 			flags = 0;
1801 
1802 			qchan->hdr.type = cpu_to_le16(QTN_TLV_ID_CHANNEL);
1803 			qchan->hdr.len = cpu_to_le16(sizeof(*qchan) -
1804 					sizeof(struct qlink_tlv_hdr));
1805 			qchan->center_freq = cpu_to_le16(sc->center_freq);
1806 			qchan->hw_value = cpu_to_le16(sc->hw_value);
1807 
1808 			if (sc->flags & IEEE80211_CHAN_NO_IR)
1809 				flags |= QLINK_CHAN_NO_IR;
1810 
1811 			if (sc->flags & IEEE80211_CHAN_RADAR)
1812 				flags |= QLINK_CHAN_RADAR;
1813 
1814 			qchan->flags = cpu_to_le32(flags);
1815 			n_channels--;
1816 			count++;
1817 		}
1818 	}
1819 
1820 	ret = qtnf_cmd_send(mac->bus, cmd_skb, &res_code);
1821 
1822 	if (unlikely(ret))
1823 		goto out;
1824 
1825 	pr_debug("MAC%u: scan started\n", mac->macid);
1826 
1827 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1828 		pr_err("MAC%u: CMD failed: %u\n", mac->macid, res_code);
1829 		ret = -EFAULT;
1830 		goto out;
1831 	}
1832 out:
1833 	qtnf_bus_unlock(mac->bus);
1834 	return ret;
1835 }
1836 
1837 int qtnf_cmd_send_connect(struct qtnf_vif *vif,
1838 			  struct cfg80211_connect_params *sme)
1839 {
1840 	struct sk_buff *cmd_skb;
1841 	struct qlink_cmd_connect *cmd;
1842 	struct qtnf_bss_config *bss_cfg = &vif->bss_cfg;
1843 	struct qlink_auth_encr aen;
1844 	u16 res_code = QLINK_CMD_RESULT_OK;
1845 	int ret;
1846 	int i;
1847 
1848 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1849 					    QLINK_CMD_CONNECT,
1850 					    sizeof(*cmd));
1851 	if (unlikely(!cmd_skb))
1852 		return -ENOMEM;
1853 
1854 	qtnf_bus_lock(vif->mac->bus);
1855 
1856 	cmd = (struct qlink_cmd_connect *)cmd_skb->data;
1857 
1858 	ether_addr_copy(cmd->bssid, bss_cfg->bssid);
1859 
1860 	if (bss_cfg->chandef.chan)
1861 		cmd->freq = cpu_to_le16(bss_cfg->chandef.chan->center_freq);
1862 
1863 	cmd->bg_scan_period = cpu_to_le16(bss_cfg->bg_scan_period);
1864 
1865 	memset(&aen, 0, sizeof(aen));
1866 	aen.auth_type = bss_cfg->auth_type;
1867 	aen.privacy = !!bss_cfg->privacy;
1868 	aen.mfp = bss_cfg->mfp;
1869 	aen.wpa_versions = cpu_to_le32(bss_cfg->crypto.wpa_versions);
1870 	aen.cipher_group = cpu_to_le32(bss_cfg->crypto.cipher_group);
1871 	aen.n_ciphers_pairwise = cpu_to_le32(
1872 					bss_cfg->crypto.n_ciphers_pairwise);
1873 
1874 	for (i = 0; i < QLINK_MAX_NR_CIPHER_SUITES; i++)
1875 		aen.ciphers_pairwise[i] = cpu_to_le32(
1876 					bss_cfg->crypto.ciphers_pairwise[i]);
1877 
1878 	aen.n_akm_suites = cpu_to_le32(bss_cfg->crypto.n_akm_suites);
1879 
1880 	for (i = 0; i < QLINK_MAX_NR_AKM_SUITES; i++)
1881 		aen.akm_suites[i] = cpu_to_le32(
1882 					bss_cfg->crypto.akm_suites[i]);
1883 
1884 	aen.control_port = bss_cfg->crypto.control_port;
1885 	aen.control_port_no_encrypt =
1886 			bss_cfg->crypto.control_port_no_encrypt;
1887 	aen.control_port_ethertype = cpu_to_le16(be16_to_cpu(
1888 				bss_cfg->crypto.control_port_ethertype));
1889 
1890 	qtnf_cmd_skb_put_tlv_arr(cmd_skb, WLAN_EID_SSID, bss_cfg->ssid,
1891 				 bss_cfg->ssid_len);
1892 	qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_CRYPTO, (u8 *)&aen,
1893 				 sizeof(aen));
1894 
1895 	if (sme->ie_len != 0)
1896 		qtnf_cmd_skb_put_tlv_arr(cmd_skb, QTN_TLV_ID_IE_SET,
1897 					 sme->ie,
1898 					 sme->ie_len);
1899 
1900 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1901 
1902 	if (unlikely(ret))
1903 		goto out;
1904 
1905 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1906 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1907 		       vif->vifid, res_code);
1908 		ret = -EFAULT;
1909 		goto out;
1910 	}
1911 out:
1912 	qtnf_bus_unlock(vif->mac->bus);
1913 	return ret;
1914 }
1915 
1916 int qtnf_cmd_send_disconnect(struct qtnf_vif *vif, u16 reason_code)
1917 {
1918 	struct sk_buff *cmd_skb;
1919 	struct qlink_cmd_disconnect *cmd;
1920 	u16 res_code = QLINK_CMD_RESULT_OK;
1921 	int ret;
1922 
1923 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1924 					    QLINK_CMD_DISCONNECT,
1925 					    sizeof(*cmd));
1926 	if (unlikely(!cmd_skb))
1927 		return -ENOMEM;
1928 
1929 	qtnf_bus_lock(vif->mac->bus);
1930 
1931 	cmd = (struct qlink_cmd_disconnect *)cmd_skb->data;
1932 	cmd->reason = cpu_to_le16(reason_code);
1933 
1934 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1935 
1936 	if (unlikely(ret))
1937 		goto out;
1938 
1939 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1940 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1941 		       vif->vifid, res_code);
1942 		ret = -EFAULT;
1943 		goto out;
1944 	}
1945 out:
1946 	qtnf_bus_unlock(vif->mac->bus);
1947 	return ret;
1948 }
1949 
1950 int qtnf_cmd_send_updown_intf(struct qtnf_vif *vif, bool up)
1951 {
1952 	struct sk_buff *cmd_skb;
1953 	struct qlink_cmd_updown *cmd;
1954 	u16 res_code = QLINK_CMD_RESULT_OK;
1955 	int ret;
1956 
1957 	cmd_skb = qtnf_cmd_alloc_new_cmdskb(vif->mac->macid, vif->vifid,
1958 					    QLINK_CMD_UPDOWN_INTF,
1959 					    sizeof(*cmd));
1960 	if (unlikely(!cmd_skb))
1961 		return -ENOMEM;
1962 
1963 	cmd = (struct qlink_cmd_updown *)cmd_skb->data;
1964 	cmd->if_up = !!up;
1965 
1966 	qtnf_bus_lock(vif->mac->bus);
1967 
1968 	ret = qtnf_cmd_send(vif->mac->bus, cmd_skb, &res_code);
1969 
1970 	if (unlikely(ret))
1971 		goto out;
1972 
1973 	if (unlikely(res_code != QLINK_CMD_RESULT_OK)) {
1974 		pr_err("VIF%u.%u: CMD failed: %u\n", vif->mac->macid,
1975 		       vif->vifid, res_code);
1976 		ret = -EFAULT;
1977 		goto out;
1978 	}
1979 out:
1980 	qtnf_bus_unlock(vif->mac->bus);
1981 	return ret;
1982 }
1983