1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2010 Broadcom Corporation
4  */
5 
6 #include <linux/kernel.h>
7 #include <linux/etherdevice.h>
8 #include <linux/module.h>
9 #include <linux/inetdevice.h>
10 #include <net/cfg80211.h>
11 #include <net/rtnetlink.h>
12 #include <net/addrconf.h>
13 #include <net/ieee80211_radiotap.h>
14 #include <net/ipv6.h>
15 #include <brcmu_utils.h>
16 #include <brcmu_wifi.h>
17 
18 #include "core.h"
19 #include "bus.h"
20 #include "debug.h"
21 #include "fwil_types.h"
22 #include "p2p.h"
23 #include "pno.h"
24 #include "cfg80211.h"
25 #include "fwil.h"
26 #include "feature.h"
27 #include "proto.h"
28 #include "pcie.h"
29 #include "common.h"
30 
31 #define MAX_WAIT_FOR_8021X_TX			msecs_to_jiffies(950)
32 
33 #define BRCMF_BSSIDX_INVALID			-1
34 
35 #define	RXS_PBPRES				BIT(2)
36 
37 #define	D11_PHY_HDR_LEN				6
38 
39 struct d11rxhdr_le {
40 	__le16 RxFrameSize;
41 	u16 PAD;
42 	__le16 PhyRxStatus_0;
43 	__le16 PhyRxStatus_1;
44 	__le16 PhyRxStatus_2;
45 	__le16 PhyRxStatus_3;
46 	__le16 PhyRxStatus_4;
47 	__le16 PhyRxStatus_5;
48 	__le16 RxStatus1;
49 	__le16 RxStatus2;
50 	__le16 RxTSFTime;
51 	__le16 RxChan;
52 	u8 unknown[12];
53 } __packed;
54 
55 struct wlc_d11rxhdr {
56 	struct d11rxhdr_le rxhdr;
57 	__le32 tsf_l;
58 	s8 rssi;
59 	s8 rxpwr0;
60 	s8 rxpwr1;
61 	s8 do_rssi_ma;
62 	s8 rxpwr[4];
63 } __packed;
64 
65 char *brcmf_ifname(struct brcmf_if *ifp)
66 {
67 	if (!ifp)
68 		return "<if_null>";
69 
70 	if (ifp->ndev)
71 		return ifp->ndev->name;
72 
73 	return "<if_none>";
74 }
75 
76 struct brcmf_if *brcmf_get_ifp(struct brcmf_pub *drvr, int ifidx)
77 {
78 	struct brcmf_if *ifp;
79 	s32 bsscfgidx;
80 
81 	if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
82 		bphy_err(drvr, "ifidx %d out of range\n", ifidx);
83 		return NULL;
84 	}
85 
86 	ifp = NULL;
87 	bsscfgidx = drvr->if2bss[ifidx];
88 	if (bsscfgidx >= 0)
89 		ifp = drvr->iflist[bsscfgidx];
90 
91 	return ifp;
92 }
93 
94 void brcmf_configure_arp_nd_offload(struct brcmf_if *ifp, bool enable)
95 {
96 	s32 err;
97 	u32 mode;
98 
99 	if (enable)
100 		mode = BRCMF_ARP_OL_AGENT | BRCMF_ARP_OL_PEER_AUTO_REPLY;
101 	else
102 		mode = 0;
103 
104 	/* Try to set and enable ARP offload feature, this may fail, then it  */
105 	/* is simply not supported and err 0 will be returned                 */
106 	err = brcmf_fil_iovar_int_set(ifp, "arp_ol", mode);
107 	if (err) {
108 		brcmf_dbg(TRACE, "failed to set ARP offload mode to 0x%x, err = %d\n",
109 			  mode, err);
110 	} else {
111 		err = brcmf_fil_iovar_int_set(ifp, "arpoe", enable);
112 		if (err) {
113 			brcmf_dbg(TRACE, "failed to configure (%d) ARP offload err = %d\n",
114 				  enable, err);
115 		} else {
116 			brcmf_dbg(TRACE, "successfully configured (%d) ARP offload to 0x%x\n",
117 				  enable, mode);
118 		}
119 	}
120 
121 	err = brcmf_fil_iovar_int_set(ifp, "ndoe", enable);
122 	if (err) {
123 		brcmf_dbg(TRACE, "failed to configure (%d) ND offload err = %d\n",
124 			  enable, err);
125 	} else {
126 		brcmf_dbg(TRACE, "successfully configured (%d) ND offload to 0x%x\n",
127 			  enable, mode);
128 	}
129 }
130 
131 static void _brcmf_set_multicast_list(struct work_struct *work)
132 {
133 	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
134 					    multicast_work);
135 	struct brcmf_pub *drvr = ifp->drvr;
136 	struct net_device *ndev;
137 	struct netdev_hw_addr *ha;
138 	u32 cmd_value, cnt;
139 	__le32 cnt_le;
140 	char *buf, *bufp;
141 	u32 buflen;
142 	s32 err;
143 
144 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
145 
146 	ndev = ifp->ndev;
147 
148 	/* Determine initial value of allmulti flag */
149 	cmd_value = (ndev->flags & IFF_ALLMULTI) ? true : false;
150 
151 	/* Send down the multicast list first. */
152 	cnt = netdev_mc_count(ndev);
153 	buflen = sizeof(cnt) + (cnt * ETH_ALEN);
154 	buf = kmalloc(buflen, GFP_ATOMIC);
155 	if (!buf)
156 		return;
157 	bufp = buf;
158 
159 	cnt_le = cpu_to_le32(cnt);
160 	memcpy(bufp, &cnt_le, sizeof(cnt_le));
161 	bufp += sizeof(cnt_le);
162 
163 	netdev_for_each_mc_addr(ha, ndev) {
164 		if (!cnt)
165 			break;
166 		memcpy(bufp, ha->addr, ETH_ALEN);
167 		bufp += ETH_ALEN;
168 		cnt--;
169 	}
170 
171 	err = brcmf_fil_iovar_data_set(ifp, "mcast_list", buf, buflen);
172 	if (err < 0) {
173 		bphy_err(drvr, "Setting mcast_list failed, %d\n", err);
174 		cmd_value = cnt ? true : cmd_value;
175 	}
176 
177 	kfree(buf);
178 
179 	/*
180 	 * Now send the allmulti setting.  This is based on the setting in the
181 	 * net_device flags, but might be modified above to be turned on if we
182 	 * were trying to set some addresses and dongle rejected it...
183 	 */
184 	err = brcmf_fil_iovar_int_set(ifp, "allmulti", cmd_value);
185 	if (err < 0)
186 		bphy_err(drvr, "Setting allmulti failed, %d\n", err);
187 
188 	/*Finally, pick up the PROMISC flag */
189 	cmd_value = (ndev->flags & IFF_PROMISC) ? true : false;
190 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_PROMISC, cmd_value);
191 	if (err < 0)
192 		bphy_err(drvr, "Setting BRCMF_C_SET_PROMISC failed, %d\n",
193 			 err);
194 	brcmf_configure_arp_nd_offload(ifp, !cmd_value);
195 }
196 
197 #if IS_ENABLED(CONFIG_IPV6)
198 static void _brcmf_update_ndtable(struct work_struct *work)
199 {
200 	struct brcmf_if *ifp = container_of(work, struct brcmf_if,
201 					    ndoffload_work);
202 	struct brcmf_pub *drvr = ifp->drvr;
203 	int i, ret;
204 
205 	/* clear the table in firmware */
206 	ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip_clear", NULL, 0);
207 	if (ret) {
208 		brcmf_dbg(TRACE, "fail to clear nd ip table err:%d\n", ret);
209 		return;
210 	}
211 
212 	for (i = 0; i < ifp->ipv6addr_idx; i++) {
213 		ret = brcmf_fil_iovar_data_set(ifp, "nd_hostip",
214 					       &ifp->ipv6_addr_tbl[i],
215 					       sizeof(struct in6_addr));
216 		if (ret)
217 			bphy_err(drvr, "add nd ip err %d\n", ret);
218 	}
219 }
220 #else
221 static void _brcmf_update_ndtable(struct work_struct *work)
222 {
223 }
224 #endif
225 
226 static int brcmf_netdev_set_mac_address(struct net_device *ndev, void *addr)
227 {
228 	struct brcmf_if *ifp = netdev_priv(ndev);
229 	struct sockaddr *sa = (struct sockaddr *)addr;
230 	struct brcmf_pub *drvr = ifp->drvr;
231 	int err;
232 
233 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
234 
235 	err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", sa->sa_data,
236 				       ETH_ALEN);
237 	if (err < 0) {
238 		bphy_err(drvr, "Setting cur_etheraddr failed, %d\n", err);
239 	} else {
240 		brcmf_dbg(TRACE, "updated to %pM\n", sa->sa_data);
241 		memcpy(ifp->mac_addr, sa->sa_data, ETH_ALEN);
242 		memcpy(ifp->ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
243 	}
244 	return err;
245 }
246 
247 static void brcmf_netdev_set_multicast_list(struct net_device *ndev)
248 {
249 	struct brcmf_if *ifp = netdev_priv(ndev);
250 
251 	schedule_work(&ifp->multicast_work);
252 }
253 
254 /**
255  * brcmf_skb_is_iapp - checks if skb is an IAPP packet
256  *
257  * @skb: skb to check
258  */
259 static bool brcmf_skb_is_iapp(struct sk_buff *skb)
260 {
261 	static const u8 iapp_l2_update_packet[6] __aligned(2) = {
262 		0x00, 0x01, 0xaf, 0x81, 0x01, 0x00,
263 	};
264 	unsigned char *eth_data;
265 #if !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
266 	const u16 *a, *b;
267 #endif
268 
269 	if (skb->len - skb->mac_len != 6 ||
270 	    !is_multicast_ether_addr(eth_hdr(skb)->h_dest))
271 		return false;
272 
273 	eth_data = skb_mac_header(skb) + ETH_HLEN;
274 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
275 	return !(((*(const u32 *)eth_data) ^ (*(const u32 *)iapp_l2_update_packet)) |
276 		 ((*(const u16 *)(eth_data + 4)) ^ (*(const u16 *)(iapp_l2_update_packet + 4))));
277 #else
278 	a = (const u16 *)eth_data;
279 	b = (const u16 *)iapp_l2_update_packet;
280 
281 	return !((a[0] ^ b[0]) | (a[1] ^ b[1]) | (a[2] ^ b[2]));
282 #endif
283 }
284 
285 static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
286 					   struct net_device *ndev)
287 {
288 	int ret;
289 	struct brcmf_if *ifp = netdev_priv(ndev);
290 	struct brcmf_pub *drvr = ifp->drvr;
291 	struct ethhdr *eh;
292 	int head_delta;
293 
294 	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
295 
296 	/* Can the device send data? */
297 	if (drvr->bus_if->state != BRCMF_BUS_UP) {
298 		bphy_err(drvr, "xmit rejected state=%d\n", drvr->bus_if->state);
299 		netif_stop_queue(ndev);
300 		dev_kfree_skb(skb);
301 		ret = -ENODEV;
302 		goto done;
303 	}
304 
305 	/* Some recent Broadcom's firmwares disassociate STA when they receive
306 	 * an 802.11f ADD frame. This behavior can lead to a local DoS security
307 	 * issue. Attacker may trigger disassociation of any STA by sending a
308 	 * proper Ethernet frame to the wireless interface.
309 	 *
310 	 * Moreover this feature may break AP interfaces in some specific
311 	 * setups. This applies e.g. to the bridge with hairpin mode enabled and
312 	 * IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet generated by a firmware
313 	 * will get passed back to the wireless interface and cause immediate
314 	 * disassociation of a just-connected STA.
315 	 */
316 	if (!drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
317 		dev_kfree_skb(skb);
318 		ret = -EINVAL;
319 		goto done;
320 	}
321 
322 	/* Make sure there's enough writeable headroom */
323 	if (skb_headroom(skb) < drvr->hdrlen || skb_header_cloned(skb)) {
324 		head_delta = max_t(int, drvr->hdrlen - skb_headroom(skb), 0);
325 
326 		brcmf_dbg(INFO, "%s: insufficient headroom (%d)\n",
327 			  brcmf_ifname(ifp), head_delta);
328 		atomic_inc(&drvr->bus_if->stats.pktcowed);
329 		ret = pskb_expand_head(skb, ALIGN(head_delta, NET_SKB_PAD), 0,
330 				       GFP_ATOMIC);
331 		if (ret < 0) {
332 			bphy_err(drvr, "%s: failed to expand headroom\n",
333 				 brcmf_ifname(ifp));
334 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
335 			goto done;
336 		}
337 	}
338 
339 	/* validate length for ether packet */
340 	if (skb->len < sizeof(*eh)) {
341 		ret = -EINVAL;
342 		dev_kfree_skb(skb);
343 		goto done;
344 	}
345 
346 	eh = (struct ethhdr *)(skb->data);
347 
348 	if (eh->h_proto == htons(ETH_P_PAE))
349 		atomic_inc(&ifp->pend_8021x_cnt);
350 
351 	/* determine the priority */
352 	if ((skb->priority == 0) || (skb->priority > 7))
353 		skb->priority = cfg80211_classify8021d(skb, NULL);
354 
355 	ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb);
356 	if (ret < 0)
357 		brcmf_txfinalize(ifp, skb, false);
358 
359 done:
360 	if (ret) {
361 		ndev->stats.tx_dropped++;
362 	} else {
363 		ndev->stats.tx_packets++;
364 		ndev->stats.tx_bytes += skb->len;
365 	}
366 
367 	/* Return ok: we always eat the packet */
368 	return NETDEV_TX_OK;
369 }
370 
371 void brcmf_txflowblock_if(struct brcmf_if *ifp,
372 			  enum brcmf_netif_stop_reason reason, bool state)
373 {
374 	unsigned long flags;
375 
376 	if (!ifp || !ifp->ndev)
377 		return;
378 
379 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d stop=0x%X reason=%d state=%d\n",
380 		  ifp->bsscfgidx, ifp->netif_stop, reason, state);
381 
382 	spin_lock_irqsave(&ifp->netif_stop_lock, flags);
383 	if (state) {
384 		if (!ifp->netif_stop)
385 			netif_stop_queue(ifp->ndev);
386 		ifp->netif_stop |= reason;
387 	} else {
388 		ifp->netif_stop &= ~reason;
389 		if (!ifp->netif_stop)
390 			netif_wake_queue(ifp->ndev);
391 	}
392 	spin_unlock_irqrestore(&ifp->netif_stop_lock, flags);
393 }
394 
395 void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
396 {
397 	/* Most of Broadcom's firmwares send 802.11f ADD frame every time a new
398 	 * STA connects to the AP interface. This is an obsoleted standard most
399 	 * users don't use, so don't pass these frames up unless requested.
400 	 */
401 	if (!ifp->drvr->settings->iapp && brcmf_skb_is_iapp(skb)) {
402 		brcmu_pkt_buf_free_skb(skb);
403 		return;
404 	}
405 
406 	if (skb->pkt_type == PACKET_MULTICAST)
407 		ifp->ndev->stats.multicast++;
408 
409 	if (!(ifp->ndev->flags & IFF_UP)) {
410 		brcmu_pkt_buf_free_skb(skb);
411 		return;
412 	}
413 
414 	ifp->ndev->stats.rx_bytes += skb->len;
415 	ifp->ndev->stats.rx_packets++;
416 
417 	brcmf_dbg(DATA, "rx proto=0x%X\n", ntohs(skb->protocol));
418 	if (in_interrupt())
419 		netif_rx(skb);
420 	else
421 		/* If the receive is not processed inside an ISR,
422 		 * the softirqd must be woken explicitly to service
423 		 * the NET_RX_SOFTIRQ.  This is handled by netif_rx_ni().
424 		 */
425 		netif_rx_ni(skb);
426 }
427 
428 void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb)
429 {
430 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
431 		/* Do nothing */
432 	} else if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR)) {
433 		struct wlc_d11rxhdr *wlc_rxhdr = (struct wlc_d11rxhdr *)skb->data;
434 		struct ieee80211_radiotap_header *radiotap;
435 		unsigned int offset;
436 		u16 RxStatus1;
437 
438 		RxStatus1 = le16_to_cpu(wlc_rxhdr->rxhdr.RxStatus1);
439 
440 		offset = sizeof(struct wlc_d11rxhdr);
441 		/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU
442 		 * subframes
443 		 */
444 		if (RxStatus1 & RXS_PBPRES)
445 			offset += 2;
446 		offset += D11_PHY_HDR_LEN;
447 
448 		skb_pull(skb, offset);
449 
450 		/* TODO: use RX header to fill some radiotap data */
451 		radiotap = skb_push(skb, sizeof(*radiotap));
452 		memset(radiotap, 0, sizeof(*radiotap));
453 		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
454 
455 		/* TODO: 4 bytes with receive status? */
456 		skb->len -= 4;
457 	} else {
458 		struct ieee80211_radiotap_header *radiotap;
459 
460 		/* TODO: use RX status to fill some radiotap data */
461 		radiotap = skb_push(skb, sizeof(*radiotap));
462 		memset(radiotap, 0, sizeof(*radiotap));
463 		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
464 
465 		/* TODO: 4 bytes with receive status? */
466 		skb->len -= 4;
467 	}
468 
469 	skb->dev = ifp->ndev;
470 	skb_reset_mac_header(skb);
471 	skb->pkt_type = PACKET_OTHERHOST;
472 	skb->protocol = htons(ETH_P_802_2);
473 
474 	brcmf_netif_rx(ifp, skb);
475 }
476 
477 static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
478 			    struct brcmf_if **ifp)
479 {
480 	int ret;
481 
482 	/* process and remove protocol-specific header */
483 	ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
484 
485 	if (ret || !(*ifp) || !(*ifp)->ndev) {
486 		if (ret != -ENODATA && *ifp)
487 			(*ifp)->ndev->stats.rx_errors++;
488 		brcmu_pkt_buf_free_skb(skb);
489 		return -ENODATA;
490 	}
491 
492 	skb->protocol = eth_type_trans(skb, (*ifp)->ndev);
493 	return 0;
494 }
495 
496 void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event)
497 {
498 	struct brcmf_if *ifp;
499 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
500 	struct brcmf_pub *drvr = bus_if->drvr;
501 
502 	brcmf_dbg(DATA, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
503 
504 	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
505 		return;
506 
507 	if (brcmf_proto_is_reorder_skb(skb)) {
508 		brcmf_proto_rxreorder(ifp, skb);
509 	} else {
510 		/* Process special event packets */
511 		if (handle_event)
512 			brcmf_fweh_process_skb(ifp->drvr, skb,
513 					       BCMILCP_SUBTYPE_VENDOR_LONG);
514 
515 		brcmf_netif_rx(ifp, skb);
516 	}
517 }
518 
519 void brcmf_rx_event(struct device *dev, struct sk_buff *skb)
520 {
521 	struct brcmf_if *ifp;
522 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
523 	struct brcmf_pub *drvr = bus_if->drvr;
524 
525 	brcmf_dbg(EVENT, "Enter: %s: rxp=%p\n", dev_name(dev), skb);
526 
527 	if (brcmf_rx_hdrpull(drvr, skb, &ifp))
528 		return;
529 
530 	brcmf_fweh_process_skb(ifp->drvr, skb, 0);
531 	brcmu_pkt_buf_free_skb(skb);
532 }
533 
534 void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success)
535 {
536 	struct ethhdr *eh;
537 	u16 type;
538 
539 	eh = (struct ethhdr *)(txp->data);
540 	type = ntohs(eh->h_proto);
541 
542 	if (type == ETH_P_PAE) {
543 		atomic_dec(&ifp->pend_8021x_cnt);
544 		if (waitqueue_active(&ifp->pend_8021x_wait))
545 			wake_up(&ifp->pend_8021x_wait);
546 	}
547 
548 	if (!success)
549 		ifp->ndev->stats.tx_errors++;
550 
551 	brcmu_pkt_buf_free_skb(txp);
552 }
553 
554 static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
555 				    struct ethtool_drvinfo *info)
556 {
557 	struct brcmf_if *ifp = netdev_priv(ndev);
558 	struct brcmf_pub *drvr = ifp->drvr;
559 	char drev[BRCMU_DOTREV_LEN] = "n/a";
560 
561 	if (drvr->revinfo.result == 0)
562 		brcmu_dotrev_str(drvr->revinfo.driverrev, drev);
563 	strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
564 	strlcpy(info->version, drev, sizeof(info->version));
565 	strlcpy(info->fw_version, drvr->fwver, sizeof(info->fw_version));
566 	strlcpy(info->bus_info, dev_name(drvr->bus_if->dev),
567 		sizeof(info->bus_info));
568 }
569 
570 static const struct ethtool_ops brcmf_ethtool_ops = {
571 	.get_drvinfo = brcmf_ethtool_get_drvinfo,
572 };
573 
574 static int brcmf_netdev_stop(struct net_device *ndev)
575 {
576 	struct brcmf_if *ifp = netdev_priv(ndev);
577 
578 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
579 
580 	brcmf_cfg80211_down(ndev);
581 
582 	if (ifp->drvr->bus_if->state == BRCMF_BUS_UP)
583 		brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear", NULL, 0);
584 
585 	brcmf_net_setcarrier(ifp, false);
586 
587 	return 0;
588 }
589 
590 static int brcmf_netdev_open(struct net_device *ndev)
591 {
592 	struct brcmf_if *ifp = netdev_priv(ndev);
593 	struct brcmf_pub *drvr = ifp->drvr;
594 	struct brcmf_bus *bus_if = drvr->bus_if;
595 	u32 toe_ol;
596 
597 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
598 
599 	/* If bus is not ready, can't continue */
600 	if (bus_if->state != BRCMF_BUS_UP) {
601 		bphy_err(drvr, "failed bus is not ready\n");
602 		return -EAGAIN;
603 	}
604 
605 	atomic_set(&ifp->pend_8021x_cnt, 0);
606 
607 	/* Get current TOE mode from dongle */
608 	if (brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_ol) >= 0
609 	    && (toe_ol & TOE_TX_CSUM_OL) != 0)
610 		ndev->features |= NETIF_F_IP_CSUM;
611 	else
612 		ndev->features &= ~NETIF_F_IP_CSUM;
613 
614 	if (brcmf_cfg80211_up(ndev)) {
615 		bphy_err(drvr, "failed to bring up cfg80211\n");
616 		return -EIO;
617 	}
618 
619 	/* Clear, carrier, set when connected or AP mode. */
620 	netif_carrier_off(ndev);
621 	return 0;
622 }
623 
624 static const struct net_device_ops brcmf_netdev_ops_pri = {
625 	.ndo_open = brcmf_netdev_open,
626 	.ndo_stop = brcmf_netdev_stop,
627 	.ndo_start_xmit = brcmf_netdev_start_xmit,
628 	.ndo_set_mac_address = brcmf_netdev_set_mac_address,
629 	.ndo_set_rx_mode = brcmf_netdev_set_multicast_list
630 };
631 
632 int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
633 {
634 	struct brcmf_pub *drvr = ifp->drvr;
635 	struct net_device *ndev;
636 	s32 err;
637 
638 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
639 		  ifp->mac_addr);
640 	ndev = ifp->ndev;
641 
642 	/* set appropriate operations */
643 	ndev->netdev_ops = &brcmf_netdev_ops_pri;
644 
645 	ndev->needed_headroom += drvr->hdrlen;
646 	ndev->ethtool_ops = &brcmf_ethtool_ops;
647 
648 	/* set the mac address & netns */
649 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
650 	dev_net_set(ndev, wiphy_net(cfg_to_wiphy(drvr->config)));
651 
652 	INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
653 	INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);
654 
655 	if (rtnl_locked)
656 		err = register_netdevice(ndev);
657 	else
658 		err = register_netdev(ndev);
659 	if (err != 0) {
660 		bphy_err(drvr, "couldn't register the net device\n");
661 		goto fail;
662 	}
663 
664 	netif_carrier_off(ndev);
665 
666 	ndev->priv_destructor = brcmf_cfg80211_free_netdev;
667 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
668 	return 0;
669 
670 fail:
671 	drvr->iflist[ifp->bsscfgidx] = NULL;
672 	ndev->netdev_ops = NULL;
673 	return -EBADE;
674 }
675 
676 void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
677 {
678 	if (ndev->reg_state == NETREG_REGISTERED) {
679 		if (rtnl_locked)
680 			unregister_netdevice(ndev);
681 		else
682 			unregister_netdev(ndev);
683 	} else {
684 		brcmf_cfg80211_free_netdev(ndev);
685 		free_netdev(ndev);
686 	}
687 }
688 
689 static int brcmf_net_mon_open(struct net_device *ndev)
690 {
691 	struct brcmf_if *ifp = netdev_priv(ndev);
692 	struct brcmf_pub *drvr = ifp->drvr;
693 	u32 monitor;
694 	int err;
695 
696 	brcmf_dbg(TRACE, "Enter\n");
697 
698 	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_MONITOR, &monitor);
699 	if (err) {
700 		bphy_err(drvr, "BRCMF_C_GET_MONITOR error (%d)\n", err);
701 		return err;
702 	} else if (monitor) {
703 		bphy_err(drvr, "Monitor mode is already enabled\n");
704 		return -EEXIST;
705 	}
706 
707 	monitor = 3;
708 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
709 	if (err)
710 		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
711 
712 	return err;
713 }
714 
715 static int brcmf_net_mon_stop(struct net_device *ndev)
716 {
717 	struct brcmf_if *ifp = netdev_priv(ndev);
718 	struct brcmf_pub *drvr = ifp->drvr;
719 	u32 monitor;
720 	int err;
721 
722 	brcmf_dbg(TRACE, "Enter\n");
723 
724 	monitor = 0;
725 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
726 	if (err)
727 		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
728 
729 	return err;
730 }
731 
732 static const struct net_device_ops brcmf_netdev_ops_mon = {
733 	.ndo_open = brcmf_net_mon_open,
734 	.ndo_stop = brcmf_net_mon_stop,
735 };
736 
737 int brcmf_net_mon_attach(struct brcmf_if *ifp)
738 {
739 	struct brcmf_pub *drvr = ifp->drvr;
740 	struct net_device *ndev;
741 	int err;
742 
743 	brcmf_dbg(TRACE, "Enter\n");
744 
745 	ndev = ifp->ndev;
746 	ndev->netdev_ops = &brcmf_netdev_ops_mon;
747 
748 	err = register_netdevice(ndev);
749 	if (err)
750 		bphy_err(drvr, "Failed to register %s device\n", ndev->name);
751 
752 	return err;
753 }
754 
755 void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
756 {
757 	struct net_device *ndev;
758 
759 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d carrier=%d\n", ifp->bsscfgidx,
760 		  on);
761 
762 	ndev = ifp->ndev;
763 	brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_DISCONNECTED, !on);
764 	if (on) {
765 		if (!netif_carrier_ok(ndev))
766 			netif_carrier_on(ndev);
767 
768 	} else {
769 		if (netif_carrier_ok(ndev))
770 			netif_carrier_off(ndev);
771 	}
772 }
773 
774 static int brcmf_net_p2p_open(struct net_device *ndev)
775 {
776 	brcmf_dbg(TRACE, "Enter\n");
777 
778 	return brcmf_cfg80211_up(ndev);
779 }
780 
781 static int brcmf_net_p2p_stop(struct net_device *ndev)
782 {
783 	brcmf_dbg(TRACE, "Enter\n");
784 
785 	return brcmf_cfg80211_down(ndev);
786 }
787 
788 static netdev_tx_t brcmf_net_p2p_start_xmit(struct sk_buff *skb,
789 					    struct net_device *ndev)
790 {
791 	if (skb)
792 		dev_kfree_skb_any(skb);
793 
794 	return NETDEV_TX_OK;
795 }
796 
797 static const struct net_device_ops brcmf_netdev_ops_p2p = {
798 	.ndo_open = brcmf_net_p2p_open,
799 	.ndo_stop = brcmf_net_p2p_stop,
800 	.ndo_start_xmit = brcmf_net_p2p_start_xmit
801 };
802 
803 static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
804 {
805 	struct brcmf_pub *drvr = ifp->drvr;
806 	struct net_device *ndev;
807 
808 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d mac=%pM\n", ifp->bsscfgidx,
809 		  ifp->mac_addr);
810 	ndev = ifp->ndev;
811 
812 	ndev->netdev_ops = &brcmf_netdev_ops_p2p;
813 
814 	/* set the mac address */
815 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
816 
817 	if (register_netdev(ndev) != 0) {
818 		bphy_err(drvr, "couldn't register the p2p net device\n");
819 		goto fail;
820 	}
821 
822 	brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
823 
824 	return 0;
825 
826 fail:
827 	ifp->drvr->iflist[ifp->bsscfgidx] = NULL;
828 	ndev->netdev_ops = NULL;
829 	return -EBADE;
830 }
831 
832 struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bsscfgidx, s32 ifidx,
833 			      bool is_p2pdev, const char *name, u8 *mac_addr)
834 {
835 	struct brcmf_if *ifp;
836 	struct net_device *ndev;
837 
838 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx, ifidx);
839 
840 	ifp = drvr->iflist[bsscfgidx];
841 	/*
842 	 * Delete the existing interface before overwriting it
843 	 * in case we missed the BRCMF_E_IF_DEL event.
844 	 */
845 	if (ifp) {
846 		if (ifidx) {
847 			bphy_err(drvr, "ERROR: netdev:%s already exists\n",
848 				 ifp->ndev->name);
849 			netif_stop_queue(ifp->ndev);
850 			brcmf_net_detach(ifp->ndev, false);
851 			drvr->iflist[bsscfgidx] = NULL;
852 		} else {
853 			brcmf_dbg(INFO, "netdev:%s ignore IF event\n",
854 				  ifp->ndev->name);
855 			return ERR_PTR(-EINVAL);
856 		}
857 	}
858 
859 	if (!drvr->settings->p2p_enable && is_p2pdev) {
860 		/* this is P2P_DEVICE interface */
861 		brcmf_dbg(INFO, "allocate non-netdev interface\n");
862 		ifp = kzalloc(sizeof(*ifp), GFP_KERNEL);
863 		if (!ifp)
864 			return ERR_PTR(-ENOMEM);
865 	} else {
866 		brcmf_dbg(INFO, "allocate netdev interface\n");
867 		/* Allocate netdev, including space for private structure */
868 		ndev = alloc_netdev(sizeof(*ifp), is_p2pdev ? "p2p%d" : name,
869 				    NET_NAME_UNKNOWN, ether_setup);
870 		if (!ndev)
871 			return ERR_PTR(-ENOMEM);
872 
873 		ndev->needs_free_netdev = true;
874 		ifp = netdev_priv(ndev);
875 		ifp->ndev = ndev;
876 		/* store mapping ifidx to bsscfgidx */
877 		if (drvr->if2bss[ifidx] == BRCMF_BSSIDX_INVALID)
878 			drvr->if2bss[ifidx] = bsscfgidx;
879 	}
880 
881 	ifp->drvr = drvr;
882 	drvr->iflist[bsscfgidx] = ifp;
883 	ifp->ifidx = ifidx;
884 	ifp->bsscfgidx = bsscfgidx;
885 
886 	init_waitqueue_head(&ifp->pend_8021x_wait);
887 	spin_lock_init(&ifp->netif_stop_lock);
888 
889 	if (mac_addr != NULL)
890 		memcpy(ifp->mac_addr, mac_addr, ETH_ALEN);
891 
892 	brcmf_dbg(TRACE, " ==== pid:%x, if:%s (%pM) created ===\n",
893 		  current->pid, name, ifp->mac_addr);
894 
895 	return ifp;
896 }
897 
898 static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
899 			 bool rtnl_locked)
900 {
901 	struct brcmf_if *ifp;
902 	int ifidx;
903 
904 	ifp = drvr->iflist[bsscfgidx];
905 	if (!ifp) {
906 		bphy_err(drvr, "Null interface, bsscfgidx=%d\n", bsscfgidx);
907 		return;
908 	}
909 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
910 		  ifp->ifidx);
911 	ifidx = ifp->ifidx;
912 
913 	if (ifp->ndev) {
914 		if (bsscfgidx == 0) {
915 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
916 				rtnl_lock();
917 				brcmf_netdev_stop(ifp->ndev);
918 				rtnl_unlock();
919 			}
920 		} else {
921 			netif_stop_queue(ifp->ndev);
922 		}
923 
924 		if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
925 			cancel_work_sync(&ifp->multicast_work);
926 			cancel_work_sync(&ifp->ndoffload_work);
927 		}
928 		brcmf_net_detach(ifp->ndev, rtnl_locked);
929 	} else {
930 		/* Only p2p device interfaces which get dynamically created
931 		 * end up here. In this case the p2p module should be informed
932 		 * about the removal of the interface within the firmware. If
933 		 * not then p2p commands towards the firmware will cause some
934 		 * serious troublesome side effects. The p2p module will clean
935 		 * up the ifp if needed.
936 		 */
937 		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
938 		kfree(ifp);
939 	}
940 
941 	drvr->iflist[bsscfgidx] = NULL;
942 	if (drvr->if2bss[ifidx] == bsscfgidx)
943 		drvr->if2bss[ifidx] = BRCMF_BSSIDX_INVALID;
944 }
945 
946 void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)
947 {
948 	if (!ifp || WARN_ON(ifp->drvr->iflist[ifp->bsscfgidx] != ifp))
949 		return;
950 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
951 		  ifp->ifidx);
952 	brcmf_proto_del_if(ifp->drvr, ifp);
953 	brcmf_del_if(ifp->drvr, ifp->bsscfgidx, rtnl_locked);
954 }
955 
956 static int brcmf_psm_watchdog_notify(struct brcmf_if *ifp,
957 				     const struct brcmf_event_msg *evtmsg,
958 				     void *data)
959 {
960 	struct brcmf_pub *drvr = ifp->drvr;
961 	int err;
962 
963 	brcmf_dbg(TRACE, "enter: bsscfgidx=%d\n", ifp->bsscfgidx);
964 
965 	bphy_err(drvr, "PSM's watchdog has fired!\n");
966 
967 	err = brcmf_debug_create_memdump(ifp->drvr->bus_if, data,
968 					 evtmsg->datalen);
969 	if (err)
970 		bphy_err(drvr, "Failed to get memory dump, %d\n", err);
971 
972 	return err;
973 }
974 
975 #ifdef CONFIG_INET
976 #define ARPOL_MAX_ENTRIES	8
977 static int brcmf_inetaddr_changed(struct notifier_block *nb,
978 				  unsigned long action, void *data)
979 {
980 	struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
981 					      inetaddr_notifier);
982 	struct in_ifaddr *ifa = data;
983 	struct net_device *ndev = ifa->ifa_dev->dev;
984 	struct brcmf_if *ifp;
985 	int idx, i, ret;
986 	u32 val;
987 	__be32 addr_table[ARPOL_MAX_ENTRIES] = {0};
988 
989 	/* Find out if the notification is meant for us */
990 	for (idx = 0; idx < BRCMF_MAX_IFS; idx++) {
991 		ifp = drvr->iflist[idx];
992 		if (ifp && ifp->ndev == ndev)
993 			break;
994 		if (idx == BRCMF_MAX_IFS - 1)
995 			return NOTIFY_DONE;
996 	}
997 
998 	/* check if arp offload is supported */
999 	ret = brcmf_fil_iovar_int_get(ifp, "arpoe", &val);
1000 	if (ret)
1001 		return NOTIFY_OK;
1002 
1003 	/* old version only support primary index */
1004 	ret = brcmf_fil_iovar_int_get(ifp, "arp_version", &val);
1005 	if (ret)
1006 		val = 1;
1007 	if (val == 1)
1008 		ifp = drvr->iflist[0];
1009 
1010 	/* retrieve the table from firmware */
1011 	ret = brcmf_fil_iovar_data_get(ifp, "arp_hostip", addr_table,
1012 				       sizeof(addr_table));
1013 	if (ret) {
1014 		bphy_err(drvr, "fail to get arp ip table err:%d\n", ret);
1015 		return NOTIFY_OK;
1016 	}
1017 
1018 	for (i = 0; i < ARPOL_MAX_ENTRIES; i++)
1019 		if (ifa->ifa_address == addr_table[i])
1020 			break;
1021 
1022 	switch (action) {
1023 	case NETDEV_UP:
1024 		if (i == ARPOL_MAX_ENTRIES) {
1025 			brcmf_dbg(TRACE, "add %pI4 to arp table\n",
1026 				  &ifa->ifa_address);
1027 			/* set it directly */
1028 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
1029 				&ifa->ifa_address, sizeof(ifa->ifa_address));
1030 			if (ret)
1031 				bphy_err(drvr, "add arp ip err %d\n", ret);
1032 		}
1033 		break;
1034 	case NETDEV_DOWN:
1035 		if (i < ARPOL_MAX_ENTRIES) {
1036 			addr_table[i] = 0;
1037 			brcmf_dbg(TRACE, "remove %pI4 from arp table\n",
1038 				  &ifa->ifa_address);
1039 			/* clear the table in firmware */
1040 			ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear",
1041 						       NULL, 0);
1042 			if (ret) {
1043 				bphy_err(drvr, "fail to clear arp ip table err:%d\n",
1044 					 ret);
1045 				return NOTIFY_OK;
1046 			}
1047 			for (i = 0; i < ARPOL_MAX_ENTRIES; i++) {
1048 				if (addr_table[i] == 0)
1049 					continue;
1050 				ret = brcmf_fil_iovar_data_set(ifp, "arp_hostip",
1051 							       &addr_table[i],
1052 							       sizeof(addr_table[i]));
1053 				if (ret)
1054 					bphy_err(drvr, "add arp ip err %d\n",
1055 						 ret);
1056 			}
1057 		}
1058 		break;
1059 	default:
1060 		break;
1061 	}
1062 
1063 	return NOTIFY_OK;
1064 }
1065 #endif
1066 
1067 #if IS_ENABLED(CONFIG_IPV6)
1068 static int brcmf_inet6addr_changed(struct notifier_block *nb,
1069 				   unsigned long action, void *data)
1070 {
1071 	struct brcmf_pub *drvr = container_of(nb, struct brcmf_pub,
1072 					      inet6addr_notifier);
1073 	struct inet6_ifaddr *ifa = data;
1074 	struct brcmf_if *ifp;
1075 	int i;
1076 	struct in6_addr *table;
1077 
1078 	/* Only handle primary interface */
1079 	ifp = drvr->iflist[0];
1080 	if (!ifp)
1081 		return NOTIFY_DONE;
1082 	if (ifp->ndev != ifa->idev->dev)
1083 		return NOTIFY_DONE;
1084 
1085 	table = ifp->ipv6_addr_tbl;
1086 	for (i = 0; i < NDOL_MAX_ENTRIES; i++)
1087 		if (ipv6_addr_equal(&ifa->addr, &table[i]))
1088 			break;
1089 
1090 	switch (action) {
1091 	case NETDEV_UP:
1092 		if (i == NDOL_MAX_ENTRIES) {
1093 			if (ifp->ipv6addr_idx < NDOL_MAX_ENTRIES) {
1094 				table[ifp->ipv6addr_idx++] = ifa->addr;
1095 			} else {
1096 				for (i = 0; i < NDOL_MAX_ENTRIES - 1; i++)
1097 					table[i] = table[i + 1];
1098 				table[NDOL_MAX_ENTRIES - 1] = ifa->addr;
1099 			}
1100 		}
1101 		break;
1102 	case NETDEV_DOWN:
1103 		if (i < NDOL_MAX_ENTRIES) {
1104 			for (; i < ifp->ipv6addr_idx - 1; i++)
1105 				table[i] = table[i + 1];
1106 			memset(&table[i], 0, sizeof(table[i]));
1107 			ifp->ipv6addr_idx--;
1108 		}
1109 		break;
1110 	default:
1111 		break;
1112 	}
1113 
1114 	schedule_work(&ifp->ndoffload_work);
1115 
1116 	return NOTIFY_OK;
1117 }
1118 #endif
1119 
1120 static int brcmf_revinfo_read(struct seq_file *s, void *data)
1121 {
1122 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
1123 	struct brcmf_rev_info *ri = &bus_if->drvr->revinfo;
1124 	char drev[BRCMU_DOTREV_LEN];
1125 	char brev[BRCMU_BOARDREV_LEN];
1126 
1127 	seq_printf(s, "vendorid: 0x%04x\n", ri->vendorid);
1128 	seq_printf(s, "deviceid: 0x%04x\n", ri->deviceid);
1129 	seq_printf(s, "radiorev: %s\n", brcmu_dotrev_str(ri->radiorev, drev));
1130 	seq_printf(s, "chip: %s\n", ri->chipname);
1131 	seq_printf(s, "chippkg: %u\n", ri->chippkg);
1132 	seq_printf(s, "corerev: %u\n", ri->corerev);
1133 	seq_printf(s, "boardid: 0x%04x\n", ri->boardid);
1134 	seq_printf(s, "boardvendor: 0x%04x\n", ri->boardvendor);
1135 	seq_printf(s, "boardrev: %s\n", brcmu_boardrev_str(ri->boardrev, brev));
1136 	seq_printf(s, "driverrev: %s\n", brcmu_dotrev_str(ri->driverrev, drev));
1137 	seq_printf(s, "ucoderev: %u\n", ri->ucoderev);
1138 	seq_printf(s, "bus: %u\n", ri->bus);
1139 	seq_printf(s, "phytype: %u\n", ri->phytype);
1140 	seq_printf(s, "phyrev: %u\n", ri->phyrev);
1141 	seq_printf(s, "anarev: %u\n", ri->anarev);
1142 	seq_printf(s, "nvramrev: %08x\n", ri->nvramrev);
1143 
1144 	seq_printf(s, "clmver: %s\n", bus_if->drvr->clmver);
1145 
1146 	return 0;
1147 }
1148 
1149 static void brcmf_core_bus_reset(struct work_struct *work)
1150 {
1151 	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
1152 					      bus_reset);
1153 
1154 	brcmf_bus_reset(drvr->bus_if);
1155 }
1156 
1157 static ssize_t bus_reset_write(struct file *file, const char __user *user_buf,
1158 			       size_t count, loff_t *ppos)
1159 {
1160 	struct brcmf_pub *drvr = file->private_data;
1161 	u8 value;
1162 
1163 	if (kstrtou8_from_user(user_buf, count, 0, &value))
1164 		return -EINVAL;
1165 
1166 	if (value != 1)
1167 		return -EINVAL;
1168 
1169 	schedule_work(&drvr->bus_reset);
1170 
1171 	return count;
1172 }
1173 
1174 static const struct file_operations bus_reset_fops = {
1175 	.open	= simple_open,
1176 	.llseek	= no_llseek,
1177 	.write	= bus_reset_write,
1178 };
1179 
1180 static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
1181 {
1182 	int ret = -1;
1183 	struct brcmf_bus *bus_if = drvr->bus_if;
1184 	struct brcmf_if *ifp;
1185 	struct brcmf_if *p2p_ifp;
1186 
1187 	brcmf_dbg(TRACE, "\n");
1188 
1189 	/* add primary networking interface */
1190 	ifp = brcmf_add_if(drvr, 0, 0, false, "wlan%d", NULL);
1191 	if (IS_ERR(ifp))
1192 		return PTR_ERR(ifp);
1193 
1194 	p2p_ifp = NULL;
1195 
1196 	/* signal bus ready */
1197 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
1198 
1199 	/* do bus specific preinit here */
1200 	ret = brcmf_bus_preinit(bus_if);
1201 	if (ret < 0)
1202 		goto fail;
1203 
1204 	/* Bus is ready, do any initialization */
1205 	ret = brcmf_c_preinit_dcmds(ifp);
1206 	if (ret < 0)
1207 		goto fail;
1208 
1209 	brcmf_feat_attach(drvr);
1210 
1211 	ret = brcmf_proto_init_done(drvr);
1212 	if (ret < 0)
1213 		goto fail;
1214 
1215 	brcmf_proto_add_if(drvr, ifp);
1216 
1217 	drvr->config = brcmf_cfg80211_attach(drvr, ops,
1218 					     drvr->settings->p2p_enable);
1219 	if (drvr->config == NULL) {
1220 		ret = -ENOMEM;
1221 		goto fail;
1222 	}
1223 
1224 	ret = brcmf_net_attach(ifp, false);
1225 
1226 	if ((!ret) && (drvr->settings->p2p_enable)) {
1227 		p2p_ifp = drvr->iflist[1];
1228 		if (p2p_ifp)
1229 			ret = brcmf_net_p2p_attach(p2p_ifp);
1230 	}
1231 
1232 	if (ret)
1233 		goto fail;
1234 
1235 #ifdef CONFIG_INET
1236 	drvr->inetaddr_notifier.notifier_call = brcmf_inetaddr_changed;
1237 	ret = register_inetaddr_notifier(&drvr->inetaddr_notifier);
1238 	if (ret)
1239 		goto fail;
1240 
1241 #if IS_ENABLED(CONFIG_IPV6)
1242 	drvr->inet6addr_notifier.notifier_call = brcmf_inet6addr_changed;
1243 	ret = register_inet6addr_notifier(&drvr->inet6addr_notifier);
1244 	if (ret) {
1245 		unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
1246 		goto fail;
1247 	}
1248 #endif
1249 #endif /* CONFIG_INET */
1250 
1251 	INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset);
1252 
1253 	/* populate debugfs */
1254 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
1255 	debugfs_create_file("reset", 0600, brcmf_debugfs_get_devdir(drvr), drvr,
1256 			    &bus_reset_fops);
1257 	brcmf_feat_debugfs_create(drvr);
1258 	brcmf_proto_debugfs_create(drvr);
1259 	brcmf_bus_debugfs_create(bus_if);
1260 
1261 	return 0;
1262 
1263 fail:
1264 	bphy_err(drvr, "failed: %d\n", ret);
1265 	if (drvr->config) {
1266 		brcmf_cfg80211_detach(drvr->config);
1267 		drvr->config = NULL;
1268 	}
1269 	brcmf_net_detach(ifp->ndev, false);
1270 	if (p2p_ifp)
1271 		brcmf_net_detach(p2p_ifp->ndev, false);
1272 	drvr->iflist[0] = NULL;
1273 	drvr->iflist[1] = NULL;
1274 	if (drvr->settings->ignore_probe_fail)
1275 		ret = 0;
1276 
1277 	return ret;
1278 }
1279 
1280 int brcmf_alloc(struct device *dev, struct brcmf_mp_device *settings)
1281 {
1282 	struct wiphy *wiphy;
1283 	struct cfg80211_ops *ops;
1284 	struct brcmf_pub *drvr = NULL;
1285 
1286 	brcmf_dbg(TRACE, "Enter\n");
1287 
1288 	ops = brcmf_cfg80211_get_ops(settings);
1289 	if (!ops)
1290 		return -ENOMEM;
1291 
1292 	wiphy = wiphy_new(ops, sizeof(*drvr));
1293 	if (!wiphy) {
1294 		kfree(ops);
1295 		return -ENOMEM;
1296 	}
1297 
1298 	set_wiphy_dev(wiphy, dev);
1299 	drvr = wiphy_priv(wiphy);
1300 	drvr->wiphy = wiphy;
1301 	drvr->ops = ops;
1302 	drvr->bus_if = dev_get_drvdata(dev);
1303 	drvr->bus_if->drvr = drvr;
1304 	drvr->settings = settings;
1305 
1306 	return 0;
1307 }
1308 
1309 int brcmf_attach(struct device *dev)
1310 {
1311 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1312 	struct brcmf_pub *drvr = bus_if->drvr;
1313 	int ret = 0;
1314 	int i;
1315 
1316 	brcmf_dbg(TRACE, "Enter\n");
1317 
1318 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
1319 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
1320 
1321 	mutex_init(&drvr->proto_block);
1322 
1323 	/* Link to bus module */
1324 	drvr->hdrlen = 0;
1325 
1326 	/* Attach and link in the protocol */
1327 	ret = brcmf_proto_attach(drvr);
1328 	if (ret != 0) {
1329 		bphy_err(drvr, "brcmf_prot_attach failed\n");
1330 		goto fail;
1331 	}
1332 
1333 	/* Attach to events important for core code */
1334 	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
1335 			    brcmf_psm_watchdog_notify);
1336 
1337 	/* attach firmware event handler */
1338 	brcmf_fweh_attach(drvr);
1339 
1340 	ret = brcmf_bus_started(drvr, drvr->ops);
1341 	if (ret != 0) {
1342 		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
1343 		goto fail;
1344 	}
1345 
1346 	return 0;
1347 
1348 fail:
1349 	brcmf_detach(dev);
1350 
1351 	return ret;
1352 }
1353 
1354 void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
1355 {
1356 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1357 	struct brcmf_pub *drvr = bus_if->drvr;
1358 
1359 	if (drvr) {
1360 		drvr->hdrlen += len;
1361 	}
1362 }
1363 
1364 void brcmf_dev_reset(struct device *dev)
1365 {
1366 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1367 	struct brcmf_pub *drvr = bus_if->drvr;
1368 
1369 	if (drvr == NULL)
1370 		return;
1371 
1372 	if (drvr->iflist[0])
1373 		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
1374 }
1375 
1376 void brcmf_dev_coredump(struct device *dev)
1377 {
1378 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1379 
1380 	if (brcmf_debug_create_memdump(bus_if, NULL, 0) < 0)
1381 		brcmf_dbg(TRACE, "failed to create coredump\n");
1382 }
1383 
1384 void brcmf_fw_crashed(struct device *dev)
1385 {
1386 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1387 	struct brcmf_pub *drvr = bus_if->drvr;
1388 
1389 	bphy_err(drvr, "Firmware has halted or crashed\n");
1390 
1391 	brcmf_dev_coredump(dev);
1392 
1393 	schedule_work(&drvr->bus_reset);
1394 }
1395 
1396 void brcmf_detach(struct device *dev)
1397 {
1398 	s32 i;
1399 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1400 	struct brcmf_pub *drvr = bus_if->drvr;
1401 
1402 	brcmf_dbg(TRACE, "Enter\n");
1403 
1404 	if (drvr == NULL)
1405 		return;
1406 
1407 #ifdef CONFIG_INET
1408 	unregister_inetaddr_notifier(&drvr->inetaddr_notifier);
1409 #endif
1410 
1411 #if IS_ENABLED(CONFIG_IPV6)
1412 	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
1413 #endif
1414 
1415 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
1416 	brcmf_bus_stop(drvr->bus_if);
1417 
1418 	brcmf_fweh_detach(drvr);
1419 	brcmf_proto_detach(drvr);
1420 
1421 	if (drvr->mon_if) {
1422 		brcmf_net_detach(drvr->mon_if->ndev, false);
1423 		drvr->mon_if = NULL;
1424 	}
1425 
1426 	/* make sure primary interface removed last */
1427 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
1428 		if (drvr->iflist[i])
1429 			brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
1430 	}
1431 
1432 	if (drvr->config) {
1433 		brcmf_p2p_detach(&drvr->config->p2p);
1434 		brcmf_cfg80211_detach(drvr->config);
1435 		drvr->config = NULL;
1436 	}
1437 }
1438 
1439 void brcmf_free(struct device *dev)
1440 {
1441 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1442 	struct brcmf_pub *drvr = bus_if->drvr;
1443 
1444 	if (!drvr)
1445 		return;
1446 
1447 	bus_if->drvr = NULL;
1448 
1449 	kfree(drvr->ops);
1450 
1451 	wiphy_free(drvr->wiphy);
1452 }
1453 
1454 s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
1455 {
1456 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
1457 	struct brcmf_if *ifp = bus_if->drvr->iflist[0];
1458 
1459 	return brcmf_fil_iovar_data_set(ifp, name, data, len);
1460 }
1461 
1462 static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
1463 {
1464 	return atomic_read(&ifp->pend_8021x_cnt);
1465 }
1466 
1467 int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
1468 {
1469 	struct brcmf_pub *drvr = ifp->drvr;
1470 	int err;
1471 
1472 	err = wait_event_timeout(ifp->pend_8021x_wait,
1473 				 !brcmf_get_pend_8021x_cnt(ifp),
1474 				 MAX_WAIT_FOR_8021X_TX);
1475 
1476 	if (!err)
1477 		bphy_err(drvr, "Timed out waiting for no pending 802.1x packets\n");
1478 
1479 	return !err;
1480 }
1481 
1482 void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state)
1483 {
1484 	struct brcmf_pub *drvr = bus->drvr;
1485 	struct net_device *ndev;
1486 	int ifidx;
1487 
1488 	brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
1489 
1490 	if (!drvr) {
1491 		brcmf_dbg(INFO, "ignoring transition, bus not attached yet\n");
1492 		return;
1493 	}
1494 
1495 	bus->state = state;
1496 
1497 	if (state == BRCMF_BUS_UP) {
1498 		for (ifidx = 0; ifidx < BRCMF_MAX_IFS; ifidx++) {
1499 			if ((drvr->iflist[ifidx]) &&
1500 			    (drvr->iflist[ifidx]->ndev)) {
1501 				ndev = drvr->iflist[ifidx]->ndev;
1502 				if (netif_queue_stopped(ndev))
1503 					netif_wake_queue(ndev);
1504 			}
1505 		}
1506 	}
1507 }
1508 
1509 static void brcmf_driver_register(struct work_struct *work)
1510 {
1511 #ifdef CONFIG_BRCMFMAC_SDIO
1512 	brcmf_sdio_register();
1513 #endif
1514 #ifdef CONFIG_BRCMFMAC_USB
1515 	brcmf_usb_register();
1516 #endif
1517 #ifdef CONFIG_BRCMFMAC_PCIE
1518 	brcmf_pcie_register();
1519 #endif
1520 }
1521 static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register);
1522 
1523 int __init brcmf_core_init(void)
1524 {
1525 	if (!schedule_work(&brcmf_driver_work))
1526 		return -EBUSY;
1527 
1528 	return 0;
1529 }
1530 
1531 void __exit brcmf_core_exit(void)
1532 {
1533 	cancel_work_sync(&brcmf_driver_work);
1534 
1535 #ifdef CONFIG_BRCMFMAC_SDIO
1536 	brcmf_sdio_exit();
1537 #endif
1538 #ifdef CONFIG_BRCMFMAC_USB
1539 	brcmf_usb_exit();
1540 #endif
1541 #ifdef CONFIG_BRCMFMAC_PCIE
1542 	brcmf_pcie_exit();
1543 #endif
1544 }
1545 
1546