drivers/staging/brcm80211/brcmfmac/dhd_linux.c

   1 /*
   2  * Copyright (c) 2010 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/init.h>
  18 #include <linux/kernel.h>
  19 #include <linux/kthread.h>
  20 #include <linux/slab.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/etherdevice.h>
  24 #include <linux/mmc/sdio_func.h>
  25 #include <linux/random.h>
  26 #include <linux/spinlock.h>
  27 #include <linux/ethtool.h>
  28 #include <linux/fcntl.h>
  29 #include <linux/fs.h>
  30 #include <linux/uaccess.h>
  31 #include <linux/interrupt.h>
  32 #include <linux/hardirq.h>
  33 #include <bcmdefs.h>
  34 #include <bcmutils.h>
  35
  36 #include <dngl_stats.h>
  37 #include <dhd.h>
  38 #include <dhd_bus.h>
  39 #include <dhd_proto.h>
  40 #include <dhd_dbg.h>
  41
  42 #include <wl_cfg80211.h>
  43
  44 #define EPI_VERSION_STR         "4.218.248.5"
  45 #define ETH_P_BRCM                      0x886c
  46
  47 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
  48 #include <linux/wifi_tiwlan.h>
  49
  50 struct semaphore wifi_control_sem;
  51
  52 struct dhd_bus *g_bus;
  53
  54 static struct wifi_platform_data *wifi_control_data;
  55 static struct resource *wifi_irqres;
  56
  57 int wifi_get_irq_number(unsigned long *irq_flags_ptr)
  58 {
  59         if (wifi_irqres) {
  60                 *irq_flags_ptr = wifi_irqres->flags & IRQF_TRIGGER_MASK;
  61                 return (int)wifi_irqres->start;
  62         }
  63 #ifdef CUSTOM_OOB_GPIO_NUM
  64         return CUSTOM_OOB_GPIO_NUM;
  65 #else
  66         return -1;
  67 #endif
  68 }
  69
  70 int wifi_set_carddetect(int on)
  71 {
  72         printk(KERN_ERR "%s = %d\n", __func__, on);
  73         if (wifi_control_data && wifi_control_data->set_carddetect)
  74                 wifi_control_data->set_carddetect(on);
  75         return 0;
  76 }
  77
  78 int wifi_set_power(int on, unsigned long msec)
  79 {
  80         printk(KERN_ERR "%s = %d\n", __func__, on);
  81         if (wifi_control_data && wifi_control_data->set_power)
  82                 wifi_control_data->set_power(on);
  83         if (msec)
  84                 mdelay(msec);
  85         return 0;
  86 }
  87
  88 int wifi_set_reset(int on, unsigned long msec)
  89 {
  90         printk(KERN_ERR "%s = %d\n", __func__, on);
  91         if (wifi_control_data && wifi_control_data->set_reset)
  92                 wifi_control_data->set_reset(on);
  93         if (msec)
  94                 mdelay(msec);
  95         return 0;
  96 }
  97
  98 static int wifi_probe(struct platform_device *pdev)
  99 {
 100         struct wifi_platform_data *wifi_ctrl =
 101             (struct wifi_platform_data *)(pdev->dev.platform_data);
 102
 103         printk(KERN_ERR "## %s\n", __func__);
 104         wifi_irqres =
 105             platform_get_resource_byname(pdev, IORESOURCE_IRQ,
 106                                          "bcm4329_wlan_irq");
 107         wifi_control_data = wifi_ctrl;
 108
 109         wifi_set_power(1, 0);   /* Power On */
 110         wifi_set_carddetect(1); /* CardDetect (0->1) */
 111
 112         up(&wifi_control_sem);
 113         return 0;
 114 }
 115
 116 static int wifi_remove(struct platform_device *pdev)
 117 {
 118         struct wifi_platform_data *wifi_ctrl =
 119             (struct wifi_platform_data *)(pdev->dev.platform_data);
 120
 121         printk(KERN_ERR "## %s\n", __func__);
 122         wifi_control_data = wifi_ctrl;
 123
 124         wifi_set_carddetect(0); /* CardDetect (1->0) */
 125         wifi_set_power(0, 0);   /* Power Off */
 126
 127         up(&wifi_control_sem);
 128         return 0;
 129 }
 130
 131 static int wifi_suspend(struct platform_device *pdev, pm_message_t state)
 132 {
 133         DHD_TRACE(("##> %s\n", __func__));
 134         return 0;
 135 }
 136
 137 static int wifi_resume(struct platform_device *pdev)
 138 {
 139         DHD_TRACE(("##> %s\n", __func__));
 140         return 0;
 141 }
 142
 143 static struct platform_driver wifi_device = {
 144         .probe = wifi_probe,
 145         .remove = wifi_remove,
 146         .suspend = wifi_suspend,
 147         .resume = wifi_resume,
 148         .driver = {
 149                    .name = KBUILD_MODNAME,
 150                    }
 151 };
 152
 153 int wifi_add_dev(void)
 154 {
 155         DHD_TRACE(("## Calling platform_driver_register\n"));
 156         return platform_driver_register(&wifi_device);
 157 }
 158
 159 void wifi_del_dev(void)
 160 {
 161         DHD_TRACE(("## Unregister platform_driver_register\n"));
 162         platform_driver_unregister(&wifi_device);
 163 }
 164 #endif  /* defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC) */
 165
 166 #if defined(CONFIG_PM_SLEEP)
 167 #include <linux/suspend.h>
 168 atomic_t brcmf_mmc_suspend;
 169 #endif  /*  defined(CONFIG_PM_SLEEP) */
 170
 171 MODULE_AUTHOR("Broadcom Corporation");
 172 MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac driver.");
 173 MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac cards");
 174 MODULE_LICENSE("Dual BSD/GPL");
 175
 176
 177 /* Interface control information */
 178 struct brcmf_if {
 179         struct brcmf_info *info;        /* back pointer to brcmf_info */
 180         /* OS/stack specifics */
 181         struct net_device *net;
 182         struct net_device_stats stats;
 183         int idx;                /* iface idx in dongle */
 184         int state;              /* interface state */
 185         uint subunit;           /* subunit */
 186         u8 mac_addr[ETH_ALEN];  /* assigned MAC address */
 187         bool attached;          /* Delayed attachment when unset */
 188         bool txflowcontrol;     /* Per interface flow control indicator */
 189         char name[IFNAMSIZ];    /* linux interface name */
 190 };
 191
 192 /* Local private structure (extension of pub) */
 193 struct brcmf_info {
 194         struct brcmf_pub pub;
 195
 196         /* OS/stack specifics */
 197         struct brcmf_if *iflist[BRCMF_MAX_IFS];
 198
 199         struct semaphore proto_sem;
 200         wait_queue_head_t ioctl_resp_wait;
 201
 202         /* Thread to issue ioctl for multicast */
 203         struct task_struct *sysioc_tsk;
 204         struct semaphore sysioc_sem;
 205         bool set_multicast;
 206         bool set_macaddress;
 207         u8 macvalue[ETH_ALEN];
 208         atomic_t pend_8021x_cnt;
 209 };
 210
 211 /* Error bits */
 212 module_param(brcmf_msg_level, int, 0);
 213
 214 /* Spawn a thread for system ioctls (set mac, set mcast) */
 215 uint brcmf_sysioc = true;
 216 module_param(brcmf_sysioc, uint, 0);
 217
 218 /* ARP offload agent mode : Enable ARP Host Auto-Reply
 219 and ARP Peer Auto-Reply */
 220 uint brcmf_arp_mode = 0xb;
 221 module_param(brcmf_arp_mode, uint, 0);
 222
 223 /* ARP offload enable */
 224 uint brcmf_arp_enable = true;
 225 module_param(brcmf_arp_enable, uint, 0);
 226
 227 /* Global Pkt filter enable control */
 228 uint brcmf_pkt_filter_enable = true;
 229 module_param(brcmf_pkt_filter_enable, uint, 0);
 230
 231 /*  Pkt filter init setup */
 232 uint brcmf_pkt_filter_init;
 233 module_param(brcmf_pkt_filter_init, uint, 0);
 234
 235 /* Pkt filter mode control */
 236 uint brcmf_master_mode = true;
 237 module_param(brcmf_master_mode, uint, 0);
 238
 239 module_param(brcmf_dongle_memsize, int, 0);
 240
 241 /* Contorl fw roaming */
 242 uint brcmf_roam = 1;
 243
 244 /* Control radio state */
 245 uint brcmf_radio_up = 1;
 246
 247 /* Network inteface name */
 248 char iface_name[IFNAMSIZ] = "wlan";
 249 module_param_string(iface_name, iface_name, IFNAMSIZ, 0);
 250
 251 /* The following are specific to the SDIO dongle */
 252
 253 /* IOCTL response timeout */
 254 int brcmf_ioctl_timeout_msec = IOCTL_RESP_TIMEOUT;
 255
 256 /* Idle timeout for backplane clock */
 257 int brcmf_idletime = BRCMF_IDLETIME_TICKS;
 258 module_param(brcmf_idletime, int, 0);
 259
 260 /* Use polling */
 261 uint brcmf_poll;
 262 module_param(brcmf_poll, uint, 0);
 263
 264 /* Use interrupts */
 265 uint brcmf_intr = true;
 266 module_param(brcmf_intr, uint, 0);
 267
 268 /* SDIO Drive Strength (in milliamps) */
 269 uint brcmf_sdiod_drive_strength = 6;
 270 module_param(brcmf_sdiod_drive_strength, uint, 0);
 271
 272 /* Tx/Rx bounds */
 273 module_param(brcmf_txbound, uint, 0);
 274 module_param(brcmf_rxbound, uint, 0);
 275
 276 #ifdef SDTEST
 277 /* Echo packet generator (pkts/s) */
 278 uint brcmf_pktgen;
 279 module_param(brcmf_pktgen, uint, 0);
 280
 281 /* Echo packet len (0 => sawtooth, max 2040) */
 282 uint brcmf_pktgen_len;
 283 module_param(brcmf_pktgen_len, uint, 0);
 284 #endif
 285
 286 static int brcmf_toe_get(struct brcmf_info *drvr_priv, int idx, u32 *toe_ol);
 287 static int brcmf_toe_set(struct brcmf_info *drvr_priv, int idx, u32 toe_ol);
 288 static int brcmf_host_event(struct brcmf_info *drvr_priv, int *ifidx, void *pktdata,
 289                             struct brcmf_event_msg *event_ptr,
 290                             void **data_ptr);
 291
 292 /*
 293  * Generalized timeout mechanism.  Uses spin sleep with exponential
 294  * back-off until
 295  * the sleep time reaches one jiffy, then switches over to task delay.  Usage:
 296  *
 297  *      brcmf_timeout_start(&tmo, usec);
 298  *      while (!brcmf_timeout_expired(&tmo))
 299  *              if (poll_something())
 300  *                      break;
 301  *      if (brcmf_timeout_expired(&tmo))
 302  *              fatal();
 303  */
 304
 305 void brcmf_timeout_start(struct brcmf_timeout *tmo, uint usec)
 306 {
 307         tmo->limit = usec;
 308         tmo->increment = 0;
 309         tmo->elapsed = 0;
 310         tmo->tick = 1000000 / HZ;
 311 }
 312
 313 int brcmf_timeout_expired(struct brcmf_timeout *tmo)
 314 {
 315         /* Does nothing the first call */
 316         if (tmo->increment == 0) {
 317                 tmo->increment = 1;
 318                 return 0;
 319         }
 320
 321         if (tmo->elapsed >= tmo->limit)
 322                 return 1;
 323
 324         /* Add the delay that's about to take place */
 325         tmo->elapsed += tmo->increment;
 326
 327         if (tmo->increment < tmo->tick) {
 328                 udelay(tmo->increment);
 329                 tmo->increment *= 2;
 330                 if (tmo->increment > tmo->tick)
 331                         tmo->increment = tmo->tick;
 332         } else {
 333                 wait_queue_head_t delay_wait;
 334                 DECLARE_WAITQUEUE(wait, current);
 335                 int pending;
 336                 init_waitqueue_head(&delay_wait);
 337                 add_wait_queue(&delay_wait, &wait);
 338                 set_current_state(TASK_INTERRUPTIBLE);
 339                 schedule_timeout(1);
 340                 pending = signal_pending(current);
 341                 remove_wait_queue(&delay_wait, &wait);
 342                 set_current_state(TASK_RUNNING);
 343                 if (pending)
 344                         return 1;       /* Interrupted */
 345         }
 346
 347         return 0;
 348 }
 349
 350 static int brcmf_net2idx(struct brcmf_info *drvr_priv, struct net_device *net)
 351 {
 352         int i = 0;
 353
 354         while (i < BRCMF_MAX_IFS) {
 355                 if (drvr_priv->iflist[i] && (drvr_priv->iflist[i]->net == net))
 356                         return i;
 357                 i++;
 358         }
 359
 360         return BRCMF_BAD_IF;
 361 }
 362
 363 int brcmf_ifname2idx(struct brcmf_info *drvr_priv, char *name)
 364 {
 365         int i = BRCMF_MAX_IFS;
 366
 367         if (name == NULL || *name == '\0')
 368                 return 0;
 369
 370         while (--i > 0)
 371                 if (drvr_priv->iflist[i]
 372                     && !strncmp(drvr_priv->iflist[i]->name, name, IFNAMSIZ))
 373                         break;
 374
 375         BRCMF_TRACE(("%s: return idx %d for \"%s\"\n", __func__, i, name));
 376
 377         return i;               /* default - the primary interface */
 378 }
 379
 380 char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
 381 {
 382         struct brcmf_info *drvr_priv = drvr->info;
 383
 384         if (ifidx < 0 || ifidx >= BRCMF_MAX_IFS) {
 385                 BRCMF_ERROR(("%s: ifidx %d out of range\n", __func__, ifidx));
 386                 return "<if_bad>";
 387         }
 388
 389         if (drvr_priv->iflist[ifidx] == NULL) {
 390                 BRCMF_ERROR(("%s: null i/f %d\n", __func__, ifidx));
 391                 return "<if_null>";
 392         }
 393
 394         if (drvr_priv->iflist[ifidx]->net)
 395                 return drvr_priv->iflist[ifidx]->net->name;
 396
 397         return "<if_none>";
 398 }
 399
 400 static void _brcmf_set_multicast_list(struct brcmf_info *drvr_priv, int ifidx)
 401 {
 402         struct net_device *dev;
 403         struct netdev_hw_addr *ha;
 404         u32 allmulti, cnt;
 405
 406         struct brcmf_ioctl ioc;
 407         char *buf, *bufp;
 408         uint buflen;
 409         int ret;
 410
 411         dev = drvr_priv->iflist[ifidx]->net;
 412         cnt = netdev_mc_count(dev);
 413
 414         /* Determine initial value of allmulti flag */
 415         allmulti = (dev->flags & IFF_ALLMULTI) ? true : false;
 416
 417         /* Send down the multicast list first. */
 418
 419         buflen = sizeof("mcast_list") + sizeof(cnt) + (cnt * ETH_ALEN);
 420         bufp = buf = kmalloc(buflen, GFP_ATOMIC);
 421         if (!bufp) {
 422                 BRCMF_ERROR(("%s: out of memory for mcast_list, cnt %d\n",
 423                              brcmf_ifname(&drvr_priv->pub, ifidx), cnt));
 424                 return;
 425         }
 426
 427         strcpy(bufp, "mcast_list");
 428         bufp += strlen("mcast_list") + 1;
 429
 430         cnt = cpu_to_le32(cnt);
 431         memcpy(bufp, &cnt, sizeof(cnt));
 432         bufp += sizeof(cnt);
 433
 434         netdev_for_each_mc_addr(ha, dev) {
 435                 if (!cnt)
 436                         break;
 437                 memcpy(bufp, ha->addr, ETH_ALEN);
 438                 bufp += ETH_ALEN;
 439                 cnt--;
 440         }
 441
 442         memset(&ioc, 0, sizeof(ioc));
 443         ioc.cmd = BRCMF_C_SET_VAR;
 444         ioc.buf = buf;
 445         ioc.len = buflen;
 446         ioc.set = true;
 447
 448         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
 449         if (ret < 0) {
 450                 BRCMF_ERROR(("%s: set mcast_list failed, cnt %d\n",
 451                              brcmf_ifname(&drvr_priv->pub, ifidx), cnt));
 452                 allmulti = cnt ? true : allmulti;
 453         }
 454
 455         kfree(buf);
 456
 457         /* Now send the allmulti setting.  This is based on the setting in the
 458          * net_device flags, but might be modified above to be turned on if we
 459          * were trying to set some addresses and dongle rejected it...
 460          */
 461
 462         buflen = sizeof("allmulti") + sizeof(allmulti);
 463         buf = kmalloc(buflen, GFP_ATOMIC);
 464         if (!buf) {
 465                 BRCMF_ERROR(("%s: out of memory for allmulti\n",
 466                              brcmf_ifname(&drvr_priv->pub, ifidx)));
 467                 return;
 468         }
 469         allmulti = cpu_to_le32(allmulti);
 470
 471         if (!brcmu_mkiovar
 472             ("allmulti", (void *)&allmulti, sizeof(allmulti), buf, buflen)) {
 473                 BRCMF_ERROR(("%s: mkiovar failed for allmulti, datalen %d "
 474                              "buflen %u\n",
 475                              brcmf_ifname(&drvr_priv->pub, ifidx),
 476                              (int)sizeof(allmulti), buflen));
 477                 kfree(buf);
 478                 return;
 479         }
 480
 481         memset(&ioc, 0, sizeof(ioc));
 482         ioc.cmd = BRCMF_C_SET_VAR;
 483         ioc.buf = buf;
 484         ioc.len = buflen;
 485         ioc.set = true;
 486
 487         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
 488         if (ret < 0) {
 489                 BRCMF_ERROR(("%s: set allmulti %d failed\n",
 490                              brcmf_ifname(&drvr_priv->pub, ifidx),
 491                              le32_to_cpu(allmulti)));
 492         }
 493
 494         kfree(buf);
 495
 496         /* Finally, pick up the PROMISC flag as well, like the NIC
 497                  driver does */
 498
 499         allmulti = (dev->flags & IFF_PROMISC) ? true : false;
 500         allmulti = cpu_to_le32(allmulti);
 501
 502         memset(&ioc, 0, sizeof(ioc));
 503         ioc.cmd = BRCMF_C_SET_PROMISC;
 504         ioc.buf = &allmulti;
 505         ioc.len = sizeof(allmulti);
 506         ioc.set = true;
 507
 508         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
 509         if (ret < 0) {
 510                 BRCMF_ERROR(("%s: set promisc %d failed\n",
 511                              brcmf_ifname(&drvr_priv->pub, ifidx),
 512                              le32_to_cpu(allmulti)));
 513         }
 514 }
 515
 516 static int _brcmf_set_mac_address(struct brcmf_info *drvr_priv, int ifidx, u8 *addr)
 517 {
 518         char buf[32];
 519         struct brcmf_ioctl ioc;
 520         int ret;
 521
 522         BRCMF_TRACE(("%s enter\n", __func__));
 523         if (!brcmu_mkiovar
 524             ("cur_etheraddr", (char *)addr, ETH_ALEN, buf, 32)) {
 525                 BRCMF_ERROR(("%s: mkiovar failed for cur_etheraddr\n",
 526                              brcmf_ifname(&drvr_priv->pub, ifidx)));
 527                 return -1;
 528         }
 529         memset(&ioc, 0, sizeof(ioc));
 530         ioc.cmd = BRCMF_C_SET_VAR;
 531         ioc.buf = buf;
 532         ioc.len = 32;
 533         ioc.set = true;
 534
 535         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
 536         if (ret < 0) {
 537                 BRCMF_ERROR(("%s: set cur_etheraddr failed\n",
 538                              brcmf_ifname(&drvr_priv->pub, ifidx)));
 539         } else {
 540                 memcpy(drvr_priv->iflist[ifidx]->net->dev_addr, addr, ETH_ALEN);
 541         }
 542
 543         return ret;
 544 }
 545
 546 #ifdef SOFTAP
 547 extern struct net_device *ap_net_dev;
 548 #endif
 549
 550 /* Virtual interfaces only ((ifp && ifp->info && ifp->idx == true) */
 551 static void brcmf_op_if(struct brcmf_if *ifp)
 552 {
 553         struct brcmf_info *drvr_priv;
 554         int ret = 0, err = 0;
 555
 556         drvr_priv = ifp->info;
 557
 558         BRCMF_TRACE(("%s: idx %d, state %d\n", __func__, ifp->idx, ifp->state));
 559
 560         switch (ifp->state) {
 561         case BRCMF_E_IF_ADD:
 562                 /*
 563                  * Delete the existing interface before overwriting it
 564                  * in case we missed the BRCMF_E_IF_DEL event.
 565                  */
 566                 if (ifp->net != NULL) {
 567                         BRCMF_ERROR(("%s: ERROR: netdev:%s already exists, "
 568                                      "try free & unregister\n",
 569                                      __func__, ifp->net->name));
 570                         netif_stop_queue(ifp->net);
 571                         unregister_netdev(ifp->net);
 572                         free_netdev(ifp->net);
 573                 }
 574                 /* Allocate etherdev, including space for private structure */
 575                 ifp->net = alloc_etherdev(sizeof(drvr_priv));
 576                 if (!ifp->net) {
 577                         BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
 578                         ret = -ENOMEM;
 579                 }
 580                 if (ret == 0) {
 581                         strcpy(ifp->net->name, ifp->name);
 582                         memcpy(netdev_priv(ifp->net), &drvr_priv, sizeof(drvr_priv));
 583                         err = brcmf_net_attach(&drvr_priv->pub, ifp->idx);
 584                         if (err != 0) {
 585                                 BRCMF_ERROR(("%s: brcmf_net_attach failed, "
 586                                              "err %d\n",
 587                                              __func__, err));
 588                                 ret = -EOPNOTSUPP;
 589                         } else {
 590 #ifdef SOFTAP
 591                                 /* semaphore that the soft AP CODE
 592                                          waits on */
 593                                 extern struct semaphore ap_eth_sema;
 594
 595                                 /* save ptr to wl0.1 netdev for use
 596                                          in wl_iw.c  */
 597                                 ap_net_dev = ifp->net;
 598                                 /* signal to the SOFTAP 'sleeper' thread,
 599                                          wl0.1 is ready */
 600                                 up(&ap_eth_sema);
 601 #endif
 602                                 BRCMF_TRACE(("\n ==== pid:%x, net_device for "
 603                                              "if:%s created ===\n\n",
 604                                              current->pid, ifp->net->name));
 605                                 ifp->state = 0;
 606                         }
 607                 }
 608                 break;
 609         case BRCMF_E_IF_DEL:
 610                 if (ifp->net != NULL) {
 611                         BRCMF_TRACE(("\n%s: got 'WLC_E_IF_DEL' state\n",
 612                                      __func__));
 613                         netif_stop_queue(ifp->net);
 614                         unregister_netdev(ifp->net);
 615                         ret = BRCMF_DEL_IF;     /* Make sure the free_netdev()
 616                                                          is called */
 617                 }
 618                 break;
 619         default:
 620                 BRCMF_ERROR(("%s: bad op %d\n", __func__, ifp->state));
 621                 break;
 622         }
 623
 624         if (ret < 0) {
 625                 if (ifp->net)
 626                         free_netdev(ifp->net);
 627
 628                 drvr_priv->iflist[ifp->idx] = NULL;
 629                 kfree(ifp);
 630 #ifdef SOFTAP
 631                 if (ifp->net == ap_net_dev)
 632                         ap_net_dev = NULL;      /*  NULL  SOFTAP global
 633                                                          wl0.1 as well */
 634 #endif                          /*  SOFTAP */
 635         }
 636 }
 637
 638 static int _brcmf_sysioc_thread(void *data)
 639 {
 640         struct brcmf_info *drvr_priv = (struct brcmf_info *) data;
 641         int i;
 642 #ifdef SOFTAP
 643         bool in_ap = false;
 644 #endif
 645
 646         allow_signal(SIGTERM);
 647
 648         while (down_interruptible(&drvr_priv->sysioc_sem) == 0) {
 649                 if (kthread_should_stop())
 650                         break;
 651                 for (i = 0; i < BRCMF_MAX_IFS; i++) {
 652                         struct brcmf_if *ifentry = drvr_priv->iflist[i];
 653                         if (ifentry) {
 654 #ifdef SOFTAP
 655                                 in_ap = (ap_net_dev != NULL);
 656 #endif                          /* SOFTAP */
 657                                 if (ifentry->state)
 658                                         brcmf_op_if(ifentry);
 659 #ifdef SOFTAP
 660                                 if (drvr_priv->iflist[i] == NULL) {
 661                                         BRCMF_TRACE(("\n\n %s: interface %d "
 662                                                      "removed!\n", __func__,
 663                                                      i));
 664                                         continue;
 665                                 }
 666
 667                                 if (in_ap && drvr_priv->set_macaddress) {
 668                                         BRCMF_TRACE(("attempt to set MAC for"
 669                                                      " %s in AP Mode,"
 670                                                      " blocked.\n",
 671                                                      ifentry->net->name));
 672                                         drvr_priv->set_macaddress = false;
 673                                         continue;
 674                                 }
 675
 676                                 if (in_ap && drvr_priv->set_multicast) {
 677                                         BRCMF_TRACE(("attempt to set MULTICAST "
 678                                                      "list for %s in AP Mode, "
 679                                                      "blocked.\n",
 680                                                      ifentry->net->name));
 681                                         drvr_priv->set_multicast = false;
 682                                         continue;
 683                                 }
 684 #endif                          /* SOFTAP */
 685                                 if (drvr_priv->set_multicast) {
 686                                         drvr_priv->set_multicast = false;
 687                                         _brcmf_set_multicast_list(drvr_priv, i);
 688                                 }
 689                                 if (drvr_priv->set_macaddress) {
 690                                         drvr_priv->set_macaddress = false;
 691                                         _brcmf_set_mac_address(drvr_priv, i,
 692                                                 drvr_priv->macvalue);
 693                                 }
 694                         }
 695                 }
 696         }
 697         return 0;
 698 }
 699
 700 static int brcmf_netdev_set_mac_address(struct net_device *dev, void *addr)
 701 {
 702         int ret = 0;
 703
 704         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(dev);
 705         struct sockaddr *sa = (struct sockaddr *)addr;
 706         int ifidx;
 707
 708         ifidx = brcmf_net2idx(drvr_priv, dev);
 709         if (ifidx == BRCMF_BAD_IF)
 710                 return -1;
 711
 712         memcpy(&drvr_priv->macvalue, sa->sa_data, ETH_ALEN);
 713         drvr_priv->set_macaddress = true;
 714         up(&drvr_priv->sysioc_sem);
 715
 716         return ret;
 717 }
 718
 719 static void brcmf_netdev_set_multicast_list(struct net_device *dev)
 720 {
 721         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(dev);
 722         int ifidx;
 723
 724         ifidx = brcmf_net2idx(drvr_priv, dev);
 725         if (ifidx == BRCMF_BAD_IF)
 726                 return;
 727
 728         drvr_priv->set_multicast = true;
 729         up(&drvr_priv->sysioc_sem);
 730 }
 731
 732 int brcmf_sendpkt(struct brcmf_pub *drvr, int ifidx, struct sk_buff *pktbuf)
 733 {
 734         struct brcmf_info *drvr_priv = drvr->info;
 735
 736         /* Reject if down */
 737         if (!drvr->up || (drvr->busstate == BRCMF_BUS_DOWN))
 738                 return -ENODEV;
 739
 740         /* Update multicast statistic */
 741         if (pktbuf->len >= ETH_ALEN) {
 742                 u8 *pktdata = (u8 *) (pktbuf->data);
 743                 struct ethhdr *eh = (struct ethhdr *)pktdata;
 744
 745                 if (is_multicast_ether_addr(eh->h_dest))
 746                         drvr->tx_multicast++;
 747                 if (ntohs(eh->h_proto) == ETH_P_PAE)
 748                         atomic_inc(&drvr_priv->pend_8021x_cnt);
 749         }
 750
 751         /* If the protocol uses a data header, apply it */
 752         brcmf_proto_hdrpush(drvr, ifidx, pktbuf);
 753
 754         /* Use bus module to send data frame */
 755         return brcmf_sdbrcm_bus_txdata(drvr->bus, pktbuf);
 756 }
 757
 758 static int brcmf_netdev_start_xmit(struct sk_buff *skb, struct net_device *net)
 759 {
 760         int ret;
 761         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
 762         int ifidx;
 763
 764         BRCMF_TRACE(("%s: Enter\n", __func__));
 765
 766         /* Reject if down */
 767         if (!drvr_priv->pub.up || (drvr_priv->pub.busstate == BRCMF_BUS_DOWN)) {
 768                 BRCMF_ERROR(("%s: xmit rejected pub.up=%d busstate=%d\n",
 769                              __func__, drvr_priv->pub.up,
 770                              drvr_priv->pub.busstate));
 771                 netif_stop_queue(net);
 772                 return -ENODEV;
 773         }
 774
 775         ifidx = brcmf_net2idx(drvr_priv, net);
 776         if (ifidx == BRCMF_BAD_IF) {
 777                 BRCMF_ERROR(("%s: bad ifidx %d\n", __func__, ifidx));
 778                 netif_stop_queue(net);
 779                 return -ENODEV;
 780         }
 781
 782         /* Make sure there's enough room for any header */
 783         if (skb_headroom(skb) < drvr_priv->pub.hdrlen) {
 784                 struct sk_buff *skb2;
 785
 786                 BRCMF_INFO(("%s: insufficient headroom\n",
 787                             brcmf_ifname(&drvr_priv->pub, ifidx)));
 788                 drvr_priv->pub.tx_realloc++;
 789                 skb2 = skb_realloc_headroom(skb, drvr_priv->pub.hdrlen);
 790                 dev_kfree_skb(skb);
 791                 skb = skb2;
 792                 if (skb == NULL) {
 793                         BRCMF_ERROR(("%s: skb_realloc_headroom failed\n",
 794                                      brcmf_ifname(&drvr_priv->pub, ifidx)));
 795                         ret = -ENOMEM;
 796                         goto done;
 797                 }
 798         }
 799
 800         ret = brcmf_sendpkt(&drvr_priv->pub, ifidx, skb);
 801
 802 done:
 803         if (ret)
 804                 drvr_priv->pub.dstats.tx_dropped++;
 805         else
 806                 drvr_priv->pub.tx_packets++;
 807
 808         /* Return ok: we always eat the packet */
 809         return 0;
 810 }
 811
 812 void brcmf_txflowcontrol(struct brcmf_pub *drvr, int ifidx, bool state)
 813 {
 814         struct net_device *net;
 815         struct brcmf_info *drvr_priv = drvr->info;
 816
 817         BRCMF_TRACE(("%s: Enter\n", __func__));
 818
 819         drvr->txoff = state;
 820         net = drvr_priv->iflist[ifidx]->net;
 821         if (state == ON)
 822                 netif_stop_queue(net);
 823         else
 824                 netif_wake_queue(net);
 825 }
 826
 827 void brcmf_rx_frame(struct brcmf_pub *drvr, int ifidx, struct sk_buff *skb,
 828                   int numpkt)
 829 {
 830         struct brcmf_info *drvr_priv = drvr->info;
 831         unsigned char *eth;
 832         uint len;
 833         void *data;
 834         struct sk_buff *pnext, *save_pktbuf;
 835         int i;
 836         struct brcmf_if *ifp;
 837         struct brcmf_event_msg event;
 838
 839         BRCMF_TRACE(("%s: Enter\n", __func__));
 840
 841         save_pktbuf = skb;
 842
 843         for (i = 0; skb && i < numpkt; i++, skb = pnext) {
 844
 845                 pnext = skb->next;
 846                 skb->next = NULL;
 847
 848                 /* Get the protocol, maintain skb around eth_type_trans()
 849                  * The main reason for this hack is for the limitation of
 850                  * Linux 2.4 where 'eth_type_trans' uses the
 851                  * 'net->hard_header_len'
 852                  * to perform skb_pull inside vs ETH_HLEN. Since to avoid
 853                  * coping of the packet coming from the network stack to add
 854                  * BDC, Hardware header etc, during network interface
 855                  * registration
 856                  * we set the 'net->hard_header_len' to ETH_HLEN + extra space
 857                  * required
 858                  * for BDC, Hardware header etc. and not just the ETH_HLEN
 859                  */
 860                 eth = skb->data;
 861                 len = skb->len;
 862
 863                 ifp = drvr_priv->iflist[ifidx];
 864                 if (ifp == NULL)
 865                         ifp = drvr_priv->iflist[0];
 866
 867                 skb->dev = ifp->net;
 868                 skb->protocol = eth_type_trans(skb, skb->dev);
 869
 870                 if (skb->pkt_type == PACKET_MULTICAST)
 871                         drvr_priv->pub.rx_multicast++;
 872
 873                 skb->data = eth;
 874                 skb->len = len;
 875
 876                 /* Strip header, count, deliver upward */
 877                 skb_pull(skb, ETH_HLEN);
 878
 879                 /* Process special event packets and then discard them */
 880                 if (ntohs(skb->protocol) == ETH_P_LINK_CTL)
 881                         brcmf_host_event(drvr_priv, &ifidx,
 882                                           skb_mac_header(skb),
 883                                           &event, &data);
 884
 885                 if (drvr_priv->iflist[ifidx] &&
 886                     !drvr_priv->iflist[ifidx]->state)
 887                         ifp = drvr_priv->iflist[ifidx];
 888
 889                 if (ifp->net)
 890                         ifp->net->last_rx = jiffies;
 891
 892                 drvr->dstats.rx_bytes += skb->len;
 893                 drvr->rx_packets++;     /* Local count */
 894
 895                 if (in_interrupt()) {
 896                         netif_rx(skb);
 897                 } else {
 898                         /* If the receive is not processed inside an ISR,
 899                          * the softirqd must be woken explicitly to service
 900                          * the NET_RX_SOFTIRQ.  In 2.6 kernels, this is handled
 901                          * by netif_rx_ni(), but in earlier kernels, we need
 902                          * to do it manually.
 903                          */
 904                         netif_rx_ni(skb);
 905                 }
 906         }
 907 }
 908
 909 void brcmf_txcomplete(struct brcmf_pub *drvr, struct sk_buff *txp, bool success)
 910 {
 911         uint ifidx;
 912         struct brcmf_info *drvr_priv = drvr->info;
 913         struct ethhdr *eh;
 914         u16 type;
 915
 916         brcmf_proto_hdrpull(drvr, &ifidx, txp);
 917
 918         eh = (struct ethhdr *)(txp->data);
 919         type = ntohs(eh->h_proto);
 920
 921         if (type == ETH_P_PAE)
 922                 atomic_dec(&drvr_priv->pend_8021x_cnt);
 923
 924 }
 925
 926 static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *net)
 927 {
 928         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
 929         struct brcmf_if *ifp;
 930         int ifidx;
 931
 932         BRCMF_TRACE(("%s: Enter\n", __func__));
 933
 934         ifidx = brcmf_net2idx(drvr_priv, net);
 935         if (ifidx == BRCMF_BAD_IF)
 936                 return NULL;
 937
 938         ifp = drvr_priv->iflist[ifidx];
 939
 940         if (drvr_priv->pub.up) {
 941                 /* Use the protocol to get dongle stats */
 942                 brcmf_proto_dstats(&drvr_priv->pub);
 943         }
 944
 945         /* Copy dongle stats to net device stats */
 946         ifp->stats.rx_packets = drvr_priv->pub.dstats.rx_packets;
 947         ifp->stats.tx_packets = drvr_priv->pub.dstats.tx_packets;
 948         ifp->stats.rx_bytes = drvr_priv->pub.dstats.rx_bytes;
 949         ifp->stats.tx_bytes = drvr_priv->pub.dstats.tx_bytes;
 950         ifp->stats.rx_errors = drvr_priv->pub.dstats.rx_errors;
 951         ifp->stats.tx_errors = drvr_priv->pub.dstats.tx_errors;
 952         ifp->stats.rx_dropped = drvr_priv->pub.dstats.rx_dropped;
 953         ifp->stats.tx_dropped = drvr_priv->pub.dstats.tx_dropped;
 954         ifp->stats.multicast = drvr_priv->pub.dstats.multicast;
 955
 956         return &ifp->stats;
 957 }
 958
 959 /* Retrieve current toe component enables, which are kept
 960          as a bitmap in toe_ol iovar */
 961 static int brcmf_toe_get(struct brcmf_info *drvr_priv, int ifidx, u32 *toe_ol)
 962 {
 963         struct brcmf_ioctl ioc;
 964         char buf[32];
 965         int ret;
 966
 967         memset(&ioc, 0, sizeof(ioc));
 968
 969         ioc.cmd = BRCMF_C_GET_VAR;
 970         ioc.buf = buf;
 971         ioc.len = (uint) sizeof(buf);
 972         ioc.set = false;
 973
 974         strcpy(buf, "toe_ol");
 975         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
 976         if (ret < 0) {
 977                 /* Check for older dongle image that doesn't support toe_ol */
 978                 if (ret == -EIO) {
 979                         BRCMF_ERROR(("%s: toe not supported by device\n",
 980                                      brcmf_ifname(&drvr_priv->pub, ifidx)));
 981                         return -EOPNOTSUPP;
 982                 }
 983
 984                 BRCMF_INFO(("%s: could not get toe_ol: ret=%d\n",
 985                             brcmf_ifname(&drvr_priv->pub, ifidx), ret));
 986                 return ret;
 987         }
 988
 989         memcpy(toe_ol, buf, sizeof(u32));
 990         return 0;
 991 }
 992
 993 /* Set current toe component enables in toe_ol iovar,
 994          and set toe global enable iovar */
 995 static int brcmf_toe_set(struct brcmf_info *drvr_priv, int ifidx, u32 toe_ol)
 996 {
 997         struct brcmf_ioctl ioc;
 998         char buf[32];
 999         int toe, ret;
1000
1001         memset(&ioc, 0, sizeof(ioc));
1002
1003         ioc.cmd = BRCMF_C_SET_VAR;
1004         ioc.buf = buf;
1005         ioc.len = (uint) sizeof(buf);
1006         ioc.set = true;
1007
1008         /* Set toe_ol as requested */
1009
1010         strcpy(buf, "toe_ol");
1011         memcpy(&buf[sizeof("toe_ol")], &toe_ol, sizeof(u32));
1012
1013         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
1014         if (ret < 0) {
1015                 BRCMF_ERROR(("%s: could not set toe_ol: ret=%d\n",
1016                              brcmf_ifname(&drvr_priv->pub, ifidx), ret));
1017                 return ret;
1018         }
1019
1020         /* Enable toe globally only if any components are enabled. */
1021
1022         toe = (toe_ol != 0);
1023
1024         strcpy(buf, "toe");
1025         memcpy(&buf[sizeof("toe")], &toe, sizeof(u32));
1026
1027         ret = brcmf_proto_ioctl(&drvr_priv->pub, ifidx, &ioc, ioc.buf, ioc.len);
1028         if (ret < 0) {
1029                 BRCMF_ERROR(("%s: could not set toe: ret=%d\n",
1030                              brcmf_ifname(&drvr_priv->pub, ifidx), ret));
1031                 return ret;
1032         }
1033
1034         return 0;
1035 }
1036
1037 static void brcmf_ethtool_get_drvinfo(struct net_device *net,
1038                                     struct ethtool_drvinfo *info)
1039 {
1040         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
1041
1042         sprintf(info->driver, KBUILD_MODNAME);
1043         sprintf(info->version, "%lu", drvr_priv->pub.drv_version);
1044         sprintf(info->fw_version, "%s", BCM4329_FW_NAME);
1045         sprintf(info->bus_info, "%s",
1046                 dev_name(&brcmf_cfg80211_get_sdio_func()->dev));
1047 }
1048
1049 struct ethtool_ops brcmf_ethtool_ops = {
1050         .get_drvinfo = brcmf_ethtool_get_drvinfo
1051 };
1052
1053 static int brcmf_ethtool(struct brcmf_info *drvr_priv, void *uaddr)
1054 {
1055         struct ethtool_drvinfo info;
1056         char drvname[sizeof(info.driver)];
1057         u32 cmd;
1058         struct ethtool_value edata;
1059         u32 toe_cmpnt, csum_dir;
1060         int ret;
1061
1062         BRCMF_TRACE(("%s: Enter\n", __func__));
1063
1064         /* all ethtool calls start with a cmd word */
1065         if (copy_from_user(&cmd, uaddr, sizeof(u32)))
1066                 return -EFAULT;
1067
1068         switch (cmd) {
1069         case ETHTOOL_GDRVINFO:
1070                 /* Copy out any request driver name */
1071                 if (copy_from_user(&info, uaddr, sizeof(info)))
1072                         return -EFAULT;
1073                 strncpy(drvname, info.driver, sizeof(info.driver));
1074                 drvname[sizeof(info.driver) - 1] = '\0';
1075
1076                 /* clear struct for return */
1077                 memset(&info, 0, sizeof(info));
1078                 info.cmd = cmd;
1079
1080                 /* if requested, identify ourselves */
1081                 if (strcmp(drvname, "?dhd") == 0) {
1082                         sprintf(info.driver, "dhd");
1083                         strcpy(info.version, BRCMF_VERSION_STR);
1084                 }
1085
1086                 /* otherwise, require dongle to be up */
1087                 else if (!drvr_priv->pub.up) {
1088                         BRCMF_ERROR(("%s: dongle is not up\n", __func__));
1089                         return -ENODEV;
1090                 }
1091
1092                 /* finally, report dongle driver type */
1093                 else if (drvr_priv->pub.iswl)
1094                         sprintf(info.driver, "wl");
1095                 else
1096                         sprintf(info.driver, "xx");
1097
1098                 sprintf(info.version, "%lu", drvr_priv->pub.drv_version);
1099                 if (copy_to_user(uaddr, &info, sizeof(info)))
1100                         return -EFAULT;
1101                 BRCMF_CTL(("%s: given %*s, returning %s\n", __func__,
1102                            (int)sizeof(drvname), drvname, info.driver));
1103                 break;
1104
1105                 /* Get toe offload components from dongle */
1106         case ETHTOOL_GRXCSUM:
1107         case ETHTOOL_GTXCSUM:
1108                 ret = brcmf_toe_get(drvr_priv, 0, &toe_cmpnt);
1109                 if (ret < 0)
1110                         return ret;
1111
1112                 csum_dir =
1113                     (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
1114
1115                 edata.cmd = cmd;
1116                 edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
1117
1118                 if (copy_to_user(uaddr, &edata, sizeof(edata)))
1119                         return -EFAULT;
1120                 break;
1121
1122                 /* Set toe offload components in dongle */
1123         case ETHTOOL_SRXCSUM:
1124         case ETHTOOL_STXCSUM:
1125                 if (copy_from_user(&edata, uaddr, sizeof(edata)))
1126                         return -EFAULT;
1127
1128                 /* Read the current settings, update and write back */
1129                 ret = brcmf_toe_get(drvr_priv, 0, &toe_cmpnt);
1130                 if (ret < 0)
1131                         return ret;
1132
1133                 csum_dir =
1134                     (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
1135
1136                 if (edata.data != 0)
1137                         toe_cmpnt |= csum_dir;
1138                 else
1139                         toe_cmpnt &= ~csum_dir;
1140
1141                 ret = brcmf_toe_set(drvr_priv, 0, toe_cmpnt);
1142                 if (ret < 0)
1143                         return ret;
1144
1145                 /* If setting TX checksum mode, tell Linux the new mode */
1146                 if (cmd == ETHTOOL_STXCSUM) {
1147                         if (edata.data)
1148                                 drvr_priv->iflist[0]->net->features |=
1149                                     NETIF_F_IP_CSUM;
1150                         else
1151                                 drvr_priv->iflist[0]->net->features &=
1152                                     ~NETIF_F_IP_CSUM;
1153                 }
1154
1155                 break;
1156
1157         default:
1158                 return -EOPNOTSUPP;
1159         }
1160
1161         return 0;
1162 }
1163
1164 static int brcmf_netdev_ioctl_entry(struct net_device *net, struct ifreq *ifr,
1165                                     int cmd)
1166 {
1167         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
1168         struct brcmf_c_ioctl ioc;
1169         int bcmerror = 0;
1170         int buflen = 0;
1171         void *buf = NULL;
1172         uint driver = 0;
1173         int ifidx;
1174         bool is_set_key_cmd;
1175
1176         ifidx = brcmf_net2idx(drvr_priv, net);
1177         BRCMF_TRACE(("%s: ifidx %d, cmd 0x%04x\n", __func__, ifidx, cmd));
1178
1179         if (ifidx == BRCMF_BAD_IF)
1180                 return -1;
1181
1182         if (cmd == SIOCETHTOOL)
1183                 return brcmf_ethtool(drvr_priv, (void *)ifr->ifr_data);
1184
1185         if (cmd != SIOCDEVPRIVATE)
1186                 return -EOPNOTSUPP;
1187
1188         memset(&ioc, 0, sizeof(ioc));
1189
1190         /* Copy the ioc control structure part of ioctl request */
1191         if (copy_from_user(&ioc, ifr->ifr_data, sizeof(struct brcmf_ioctl))) {
1192                 bcmerror = -EINVAL;
1193                 goto done;
1194         }
1195
1196         /* Copy out any buffer passed */
1197         if (ioc.buf) {
1198                 buflen = min_t(int, ioc.len, BRCMF_IOCTL_MAXLEN);
1199                 /* optimization for direct ioctl calls from kernel */
1200                 /*
1201                    if (segment_eq(get_fs(), KERNEL_DS)) {
1202                    buf = ioc.buf;
1203                    } else {
1204                  */
1205                 {
1206                         buf = kmalloc(buflen, GFP_ATOMIC);
1207                         if (!buf) {
1208                                 bcmerror = -ENOMEM;
1209                                 goto done;
1210                         }
1211                         if (copy_from_user(buf, ioc.buf, buflen)) {
1212                                 bcmerror = -EINVAL;
1213                                 goto done;
1214                         }
1215                 }
1216         }
1217
1218         /* To differentiate read 4 more byes */
1219         if ((copy_from_user(&driver, (char *)ifr->ifr_data +
1220                             sizeof(struct brcmf_ioctl), sizeof(uint)) != 0)) {
1221                 bcmerror = -EINVAL;
1222                 goto done;
1223         }
1224
1225         if (!capable(CAP_NET_ADMIN)) {
1226                 bcmerror = -EPERM;
1227                 goto done;
1228         }
1229
1230         /* check for local brcmf ioctl and handle it */
1231         if (driver == BRCMF_IOCTL_MAGIC) {
1232                 bcmerror = brcmf_c_ioctl((void *)&drvr_priv->pub, &ioc, buf, buflen);
1233                 if (bcmerror)
1234                         drvr_priv->pub.bcmerror = bcmerror;
1235                 goto done;
1236         }
1237
1238         /* send to dongle (must be up, and wl) */
1239         if ((drvr_priv->pub.busstate != BRCMF_BUS_DATA)) {
1240                 BRCMF_ERROR(("%s DONGLE_DOWN,__func__\n", __func__));
1241                 bcmerror = -EIO;
1242                 goto done;
1243         }
1244
1245         if (!drvr_priv->pub.iswl) {
1246                 bcmerror = -EIO;
1247                 goto done;
1248         }
1249
1250         /*
1251          * Intercept BRCMF_C_SET_KEY IOCTL - serialize M4 send and
1252          * set key IOCTL to prevent M4 encryption.
1253          */
1254         is_set_key_cmd = ((ioc.cmd == BRCMF_C_SET_KEY) ||
1255                           ((ioc.cmd == BRCMF_C_SET_VAR) &&
1256                            !(strncmp("wsec_key", ioc.buf, 9))) ||
1257                           ((ioc.cmd == BRCMF_C_SET_VAR) &&
1258                            !(strncmp("bsscfg:wsec_key", ioc.buf, 15))));
1259         if (is_set_key_cmd)
1260                 brcmf_netdev_wait_pend8021x(net);
1261
1262         bcmerror =
1263             brcmf_proto_ioctl(&drvr_priv->pub, ifidx, (struct brcmf_ioctl *)&ioc,
1264                               buf, buflen);
1265
1266 done:
1267         if (!bcmerror && buf && ioc.buf) {
1268                 if (copy_to_user(ioc.buf, buf, buflen))
1269                         bcmerror = -EFAULT;
1270         }
1271
1272         kfree(buf);
1273
1274         if (bcmerror > 0)
1275                 bcmerror = 0;
1276
1277         return bcmerror;
1278 }
1279
1280 static int brcmf_netdev_stop(struct net_device *net)
1281 {
1282 #if !defined(IGNORE_ETH0_DOWN)
1283         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
1284
1285         BRCMF_TRACE(("%s: Enter\n", __func__));
1286         brcmf_cfg80211_down();
1287         if (drvr_priv->pub.up == 0)
1288                 return 0;
1289
1290         /* Set state and stop OS transmissions */
1291         drvr_priv->pub.up = 0;
1292         netif_stop_queue(net);
1293 #else
1294         BRCMF_ERROR(("BYPASS %s:due to BRCM compilation: under investigation\n",
1295                      __func__));
1296 #endif                          /* !defined(IGNORE_ETH0_DOWN) */
1297
1298         return 0;
1299 }
1300
1301 static int brcmf_netdev_open(struct net_device *net)
1302 {
1303         struct brcmf_info *drvr_priv = *(struct brcmf_info **) netdev_priv(net);
1304         u32 toe_ol;
1305         int ifidx = brcmf_net2idx(drvr_priv, net);
1306         s32 ret = 0;
1307
1308         BRCMF_TRACE(("%s: ifidx %d\n", __func__, ifidx));
1309
1310         if (ifidx == 0) {       /* do it only for primary eth0 */
1311
1312                 /* try to bring up bus */
1313                 ret = brcmf_bus_start(&drvr_priv->pub);
1314                 if (ret != 0) {
1315                         BRCMF_ERROR(("%s: failed with code %d\n",
1316                                      __func__, ret));
1317                         return -1;
1318                 }
1319                 atomic_set(&drvr_priv->pend_8021x_cnt, 0);
1320
1321                 memcpy(net->dev_addr, drvr_priv->pub.mac, ETH_ALEN);
1322
1323                 /* Get current TOE mode from dongle */
1324                 if (brcmf_toe_get(drvr_priv, ifidx, &toe_ol) >= 0
1325                     && (toe_ol & TOE_TX_CSUM_OL) != 0)
1326                         drvr_priv->iflist[ifidx]->net->features |=
1327                                 NETIF_F_IP_CSUM;
1328                 else
1329                         drvr_priv->iflist[ifidx]->net->features &=
1330                                 ~NETIF_F_IP_CSUM;
1331         }
1332         /* Allow transmit calls */
1333         netif_start_queue(net);
1334         drvr_priv->pub.up = 1;
1335         if (unlikely(brcmf_cfg80211_up())) {
1336                 BRCMF_ERROR(("%s: failed to bring up cfg80211\n",
1337                              __func__));
1338                 return -1;
1339         }
1340
1341         return ret;
1342 }
1343
1344 int
1345 brcmf_add_if(struct brcmf_info *drvr_priv, int ifidx, void *handle, char *name,
1346            u8 *mac_addr, u32 flags, u8 bssidx)
1347 {
1348         struct brcmf_if *ifp;
1349
1350         BRCMF_TRACE(("%s: idx %d, handle->%p\n", __func__, ifidx, handle));
1351
1352         ifp = drvr_priv->iflist[ifidx];
1353         if (!ifp) {
1354                 ifp = kmalloc(sizeof(struct brcmf_if), GFP_ATOMIC);
1355                 if (!ifp) {
1356                         BRCMF_ERROR(("%s: OOM - struct brcmf_if\n", __func__));
1357                         return -ENOMEM;
1358                 }
1359         }
1360
1361         memset(ifp, 0, sizeof(struct brcmf_if));
1362         ifp->info = drvr_priv;
1363         drvr_priv->iflist[ifidx] = ifp;
1364         strlcpy(ifp->name, name, IFNAMSIZ);
1365         if (mac_addr != NULL)
1366                 memcpy(&ifp->mac_addr, mac_addr, ETH_ALEN);
1367
1368         if (handle == NULL) {
1369                 ifp->state = BRCMF_E_IF_ADD;
1370                 ifp->idx = ifidx;
1371                 up(&drvr_priv->sysioc_sem);
1372         } else
1373                 ifp->net = (struct net_device *)handle;
1374
1375         return 0;
1376 }
1377
1378 void brcmf_del_if(struct brcmf_info *drvr_priv, int ifidx)
1379 {
1380         struct brcmf_if *ifp;
1381
1382         BRCMF_TRACE(("%s: idx %d\n", __func__, ifidx));
1383
1384         ifp = drvr_priv->iflist[ifidx];
1385         if (!ifp) {
1386                 BRCMF_ERROR(("%s: Null interface\n", __func__));
1387                 return;
1388         }
1389
1390         ifp->state = BRCMF_E_IF_DEL;
1391         ifp->idx = ifidx;
1392         up(&drvr_priv->sysioc_sem);
1393 }
1394
1395 struct brcmf_pub *brcmf_attach(struct brcmf_bus *bus, uint bus_hdrlen)
1396 {
1397         struct brcmf_info *drvr_priv = NULL;
1398         struct net_device *net;
1399
1400         BRCMF_TRACE(("%s: Enter\n", __func__));
1401
1402         /* Allocate etherdev, including space for private structure */
1403         net = alloc_etherdev(sizeof(drvr_priv));
1404         if (!net) {
1405                 BRCMF_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
1406                 goto fail;
1407         }
1408
1409         /* Allocate primary brcmf_info */
1410         drvr_priv = kzalloc(sizeof(struct brcmf_info), GFP_ATOMIC);
1411         if (!drvr_priv) {
1412                 BRCMF_ERROR(("%s: OOM - alloc brcmf_info\n", __func__));
1413                 goto fail;
1414         }
1415
1416         /*
1417          * Save the brcmf_info into the priv
1418          */
1419         memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
1420
1421         /* Set network interface name if it was provided as module parameter */
1422         if (iface_name[0]) {
1423                 int len;
1424                 char ch;
1425                 strncpy(net->name, iface_name, IFNAMSIZ);
1426                 net->name[IFNAMSIZ - 1] = 0;
1427                 len = strlen(net->name);
1428                 ch = net->name[len - 1];
1429                 if ((ch > '9' || ch < '0') && (len < IFNAMSIZ - 2))
1430                         strcat(net->name, "%d");
1431         }
1432
1433         if (brcmf_add_if(drvr_priv, 0, (void *)net, net->name, NULL, 0, 0) ==
1434             BRCMF_BAD_IF)
1435                 goto fail;
1436
1437         net->netdev_ops = NULL;
1438         sema_init(&drvr_priv->proto_sem, 1);
1439         /* Initialize other structure content */
1440         init_waitqueue_head(&drvr_priv->ioctl_resp_wait);
1441
1442         /* Link to info module */
1443         drvr_priv->pub.info = drvr_priv;
1444
1445         /* Link to bus module */
1446         drvr_priv->pub.bus = bus;
1447         drvr_priv->pub.hdrlen = bus_hdrlen;
1448
1449         /* Attach and link in the protocol */
1450         if (brcmf_proto_attach(&drvr_priv->pub) != 0) {
1451                 BRCMF_ERROR(("brcmf_prot_attach failed\n"));
1452                 goto fail;
1453         }
1454
1455         /* Attach and link in the cfg80211 */
1456         if (unlikely(brcmf_cfg80211_attach(net, &drvr_priv->pub))) {
1457                 BRCMF_ERROR(("wl_cfg80211_attach failed\n"));
1458                 goto fail;
1459         }
1460
1461         if (brcmf_sysioc) {
1462                 sema_init(&drvr_priv->sysioc_sem, 0);
1463                 drvr_priv->sysioc_tsk = kthread_run(_brcmf_sysioc_thread, drvr_priv,
1464                                                 "_brcmf_sysioc");
1465                 if (IS_ERR(drvr_priv->sysioc_tsk)) {
1466                         printk(KERN_WARNING
1467                                 "_brcmf_sysioc thread failed to start\n");
1468                         drvr_priv->sysioc_tsk = NULL;
1469                 }
1470         } else
1471                 drvr_priv->sysioc_tsk = NULL;
1472
1473         /*
1474          * Save the brcmf_info into the priv
1475          */
1476         memcpy(netdev_priv(net), &drvr_priv, sizeof(drvr_priv));
1477
1478 #if defined(CONFIG_PM_SLEEP)
1479         atomic_set(&brcmf_mmc_suspend, false);
1480 #endif  /* defined(CONFIG_PM_SLEEP) */
1481         return &drvr_priv->pub;
1482
1483 fail:
1484         if (net)
1485                 free_netdev(net);
1486         if (drvr_priv)
1487                 brcmf_detach(&drvr_priv->pub);
1488
1489         return NULL;
1490 }
1491
1492 int brcmf_bus_start(struct brcmf_pub *drvr)
1493 {
1494         int ret = -1;
1495         struct brcmf_info *drvr_priv = drvr->info;
1496         /* Room for "event_msgs" + '\0' + bitvec */
1497         char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];
1498
1499         BRCMF_TRACE(("%s:\n", __func__));
1500
1501         /* Bring up the bus */
1502         ret = brcmf_sdbrcm_bus_init(&drvr_priv->pub, true);
1503         if (ret != 0) {
1504                 BRCMF_ERROR(("%s, brcmf_sdbrcm_bus_init failed %d\n", __func__,
1505                              ret));
1506                 return ret;
1507         }
1508
1509         /* If bus is not ready, can't come up */
1510         if (drvr_priv->pub.busstate != BRCMF_BUS_DATA) {
1511                 BRCMF_ERROR(("%s failed bus is not ready\n", __func__));
1512                 return -ENODEV;
1513         }
1514
1515         brcmu_mkiovar("event_msgs", drvr->eventmask, BRCMF_EVENTING_MASK_LEN,
1516                       iovbuf, sizeof(iovbuf));
1517         brcmf_proto_cdc_query_ioctl(drvr, 0, BRCMF_C_GET_VAR, iovbuf,
1518                                     sizeof(iovbuf));
1519         memcpy(drvr->eventmask, iovbuf, BRCMF_EVENTING_MASK_LEN);
1520
1521         setbit(drvr->eventmask, BRCMF_E_SET_SSID);
1522         setbit(drvr->eventmask, BRCMF_E_PRUNE);
1523         setbit(drvr->eventmask, BRCMF_E_AUTH);
1524         setbit(drvr->eventmask, BRCMF_E_REASSOC);
1525         setbit(drvr->eventmask, BRCMF_E_REASSOC_IND);
1526         setbit(drvr->eventmask, BRCMF_E_DEAUTH_IND);
1527         setbit(drvr->eventmask, BRCMF_E_DISASSOC_IND);
1528         setbit(drvr->eventmask, BRCMF_E_DISASSOC);
1529         setbit(drvr->eventmask, BRCMF_E_JOIN);
1530         setbit(drvr->eventmask, BRCMF_E_ASSOC_IND);
1531         setbit(drvr->eventmask, BRCMF_E_PSK_SUP);
1532         setbit(drvr->eventmask, BRCMF_E_LINK);
1533         setbit(drvr->eventmask, BRCMF_E_NDIS_LINK);
1534         setbit(drvr->eventmask, BRCMF_E_MIC_ERROR);
1535         setbit(drvr->eventmask, BRCMF_E_PMKID_CACHE);
1536         setbit(drvr->eventmask, BRCMF_E_TXFAIL);
1537         setbit(drvr->eventmask, BRCMF_E_JOIN_START);
1538         setbit(drvr->eventmask, BRCMF_E_SCAN_COMPLETE);
1539
1540 /* enable dongle roaming event */
1541
1542         drvr->pktfilter_count = 1;
1543         /* Setup filter to allow only unicast */
1544         drvr->pktfilter[0] = "100 0 0 0 0x01 0x00";
1545
1546         /* Bus is ready, do any protocol initialization */
1547         ret = brcmf_proto_init(&drvr_priv->pub);
1548         if (ret < 0)
1549                 return ret;
1550
1551         return 0;
1552 }
1553
1554 static struct net_device_ops brcmf_netdev_ops_pri = {
1555         .ndo_open = brcmf_netdev_open,
1556         .ndo_stop = brcmf_netdev_stop,
1557         .ndo_get_stats = brcmf_netdev_get_stats,
1558         .ndo_do_ioctl = brcmf_netdev_ioctl_entry,
1559         .ndo_start_xmit = brcmf_netdev_start_xmit,
1560         .ndo_set_mac_address = brcmf_netdev_set_mac_address,
1561         .ndo_set_multicast_list = brcmf_netdev_set_multicast_list
1562 };
1563
1564 int brcmf_net_attach(struct brcmf_pub *drvr, int ifidx)
1565 {
1566         struct brcmf_info *drvr_priv = drvr->info;
1567         struct net_device *net;
1568         u8 temp_addr[ETH_ALEN] = {
1569                 0x00, 0x90, 0x4c, 0x11, 0x22, 0x33};
1570
1571         BRCMF_TRACE(("%s: ifidx %d\n", __func__, ifidx));
1572
1573         net = drvr_priv->iflist[ifidx]->net;
1574         net->netdev_ops = &brcmf_netdev_ops_pri;
1575
1576         /*
1577          * We have to use the primary MAC for virtual interfaces
1578          */
1579         if (ifidx != 0) {
1580                 /* for virtual interfaces use the primary MAC  */
1581                 memcpy(temp_addr, drvr_priv->pub.mac, ETH_ALEN);
1582
1583         }
1584
1585         if (ifidx == 1) {
1586                 BRCMF_TRACE(("%s ACCESS POINT MAC:\n", __func__));
1587                 /*  ACCESSPOINT INTERFACE CASE */
1588                 temp_addr[0] |= 0X02;   /* set bit 2 ,
1589                          - Locally Administered address  */
1590
1591         }
1592         net->hard_header_len = ETH_HLEN + drvr_priv->pub.hdrlen;
1593         net->ethtool_ops = &brcmf_ethtool_ops;
1594
1595         drvr_priv->pub.rxsz = net->mtu + net->hard_header_len +
1596                                 drvr_priv->pub.hdrlen;
1597
1598         memcpy(net->dev_addr, temp_addr, ETH_ALEN);
1599
1600         if (register_netdev(net) != 0) {
1601                 BRCMF_ERROR(("%s: couldn't register the net device\n",
1602                              __func__));
1603                 goto fail;
1604         }
1605
1606         BRCMF_INFO(("%s: Broadcom Dongle Host Driver\n", net->name));
1607
1608         return 0;
1609
1610 fail:
1611         net->netdev_ops = NULL;
1612         return -EBADE;
1613 }
1614
1615 static void brcmf_bus_detach(struct brcmf_pub *drvr)
1616 {
1617         struct brcmf_info *drvr_priv;
1618
1619         BRCMF_TRACE(("%s: Enter\n", __func__));
1620
1621         if (drvr) {
1622                 drvr_priv = drvr->info;
1623                 if (drvr_priv) {
1624                         /* Stop the protocol module */
1625                         brcmf_proto_stop(&drvr_priv->pub);
1626
1627                         /* Stop the bus module */
1628                         brcmf_sdbrcm_bus_stop(drvr_priv->pub.bus, true);
1629                 }
1630         }
1631 }
1632
1633 void brcmf_detach(struct brcmf_pub *drvr)
1634 {
1635         struct brcmf_info *drvr_priv;
1636
1637         BRCMF_TRACE(("%s: Enter\n", __func__));
1638
1639         if (drvr) {
1640                 drvr_priv = drvr->info;
1641                 if (drvr_priv) {
1642                         struct brcmf_if *ifp;
1643                         int i;
1644
1645                         for (i = 1; i < BRCMF_MAX_IFS; i++)
1646                                 if (drvr_priv->iflist[i])
1647                                         brcmf_del_if(drvr_priv, i);
1648
1649                         ifp = drvr_priv->iflist[0];
1650                         if (ifp->net->netdev_ops == &brcmf_netdev_ops_pri) {
1651                                 brcmf_netdev_stop(ifp->net);
1652                                 unregister_netdev(ifp->net);
1653                         }
1654
1655                         if (drvr_priv->sysioc_tsk) {
1656                                 send_sig(SIGTERM, drvr_priv->sysioc_tsk, 1);
1657                                 kthread_stop(drvr_priv->sysioc_tsk);
1658                                 drvr_priv->sysioc_tsk = NULL;
1659                         }
1660
1661                         brcmf_bus_detach(drvr);
1662
1663                         if (drvr->prot)
1664                                 brcmf_proto_detach(drvr);
1665
1666                         brcmf_cfg80211_detach();
1667
1668                         free_netdev(ifp->net);
1669                         kfree(ifp);
1670                         kfree(drvr_priv);
1671                 }
1672         }
1673 }
1674
1675 static void __exit brcmf_module_cleanup(void)
1676 {
1677         BRCMF_TRACE(("%s: Enter\n", __func__));
1678
1679         brcmf_bus_unregister();
1680 }
1681
1682 static int __init brcmf_module_init(void)
1683 {
1684         int error;
1685
1686         BRCMF_TRACE(("%s: Enter\n", __func__));
1687
1688         error = brcmf_bus_register();
1689
1690         if (error) {
1691                 BRCMF_ERROR(("%s: brcmf_bus_register failed\n", __func__));
1692                 goto failed;
1693         }
1694         return 0;
1695
1696 failed:
1697         return -EINVAL;
1698 }
1699
1700 module_init(brcmf_module_init);
1701 module_exit(brcmf_module_cleanup);
1702
1703 int brcmf_os_proto_block(struct brcmf_pub *drvr)
1704 {
1705         struct brcmf_info *drvr_priv = drvr->info;
1706
1707         if (drvr_priv) {
1708                 down(&drvr_priv->proto_sem);
1709                 return 1;
1710         }
1711         return 0;
1712 }
1713
1714 int brcmf_os_proto_unblock(struct brcmf_pub *drvr)
1715 {
1716         struct brcmf_info *drvr_priv = drvr->info;
1717
1718         if (drvr_priv) {
1719                 up(&drvr_priv->proto_sem);
1720                 return 1;
1721         }
1722
1723         return 0;
1724 }
1725
1726 unsigned int brcmf_os_get_ioctl_resp_timeout(void)
1727 {
1728         return (unsigned int)brcmf_ioctl_timeout_msec;
1729 }
1730
1731 void brcmf_os_set_ioctl_resp_timeout(unsigned int timeout_msec)
1732 {
1733         brcmf_ioctl_timeout_msec = (int)timeout_msec;
1734 }
1735
1736 int brcmf_os_ioctl_resp_wait(struct brcmf_pub *drvr, uint *condition,
1737                              bool *pending)
1738 {
1739         struct brcmf_info *drvr_priv = drvr->info;
1740         DECLARE_WAITQUEUE(wait, current);
1741         int timeout = brcmf_ioctl_timeout_msec;
1742
1743         /* Convert timeout in millsecond to jiffies */
1744         timeout = timeout * HZ / 1000;
1745
1746         /* Wait until control frame is available */
1747         add_wait_queue(&drvr_priv->ioctl_resp_wait, &wait);
1748         set_current_state(TASK_INTERRUPTIBLE);
1749
1750         while (!(*condition) && (!signal_pending(current) && timeout))
1751                 timeout = schedule_timeout(timeout);
1752
1753         if (signal_pending(current))
1754                 *pending = true;
1755
1756         set_current_state(TASK_RUNNING);
1757         remove_wait_queue(&drvr_priv->ioctl_resp_wait, &wait);
1758
1759         return timeout;
1760 }
1761
1762 int brcmf_os_ioctl_resp_wake(struct brcmf_pub *drvr)
1763 {
1764         struct brcmf_info *drvr_priv = drvr->info;
1765
1766         if (waitqueue_active(&drvr_priv->ioctl_resp_wait))
1767                 wake_up_interruptible(&drvr_priv->ioctl_resp_wait);
1768
1769         return 0;
1770 }
1771
1772 static int brcmf_host_event(struct brcmf_info *drvr_priv, int *ifidx, void *pktdata,
1773                             struct brcmf_event_msg *event, void **data)
1774 {
1775         int bcmerror = 0;
1776
1777         bcmerror = brcmf_c_host_event(drvr_priv, ifidx, pktdata, event, data);
1778         if (bcmerror != 0)
1779                 return bcmerror;
1780
1781         if (drvr_priv->iflist[*ifidx]->net)
1782                 brcmf_cfg80211_event(drvr_priv->iflist[*ifidx]->net,
1783                                      event, *data);
1784
1785         return bcmerror;
1786 }
1787
1788 int brcmf_netdev_reset(struct net_device *dev, u8 flag)
1789 {
1790         struct brcmf_info *drvr_priv = *(struct brcmf_info **)netdev_priv(dev);
1791
1792         brcmf_bus_devreset(&drvr_priv->pub, flag);
1793
1794         return 1;
1795 }
1796
1797 static int brcmf_get_pend_8021x_cnt(struct brcmf_info *drvr_priv)
1798 {
1799         return atomic_read(&drvr_priv->pend_8021x_cnt);
1800 }
1801
1802 #define MAX_WAIT_FOR_8021X_TX   10
1803
1804 int brcmf_netdev_wait_pend8021x(struct net_device *dev)
1805 {
1806         struct brcmf_info *drvr_priv = *(struct brcmf_info **)netdev_priv(dev);
1807         int timeout = 10 * HZ / 1000;
1808         int ntimes = MAX_WAIT_FOR_8021X_TX;
1809         int pend = brcmf_get_pend_8021x_cnt(drvr_priv);
1810
1811         while (ntimes && pend) {
1812                 if (pend) {
1813                         set_current_state(TASK_INTERRUPTIBLE);
1814                         schedule_timeout(timeout);
1815                         set_current_state(TASK_RUNNING);
1816                         ntimes--;
1817                 }
1818                 pend = brcmf_get_pend_8021x_cnt(drvr_priv);
1819         }
1820         return pend;
1821 }
1822
1823 #ifdef BCMDBG
1824 int brcmf_write_to_file(struct brcmf_pub *drvr, u8 *buf, int size)
1825 {
1826         int ret = 0;
1827         struct file *fp;
1828         mm_segment_t old_fs;
1829         loff_t pos = 0;
1830
1831         /* change to KERNEL_DS address limit */
1832         old_fs = get_fs();
1833         set_fs(KERNEL_DS);
1834
1835         /* open file to write */
1836         fp = filp_open("/tmp/mem_dump", O_WRONLY | O_CREAT, 0640);
1837         if (!fp) {
1838                 BRCMF_ERROR(("%s: open file error\n", __func__));
1839                 ret = -1;
1840                 goto exit;
1841         }
1842
1843         /* Write buf to file */
1844         fp->f_op->write(fp, buf, size, &pos);
1845
1846 exit:
1847         /* free buf before return */
1848         kfree(buf);
1849         /* close file before return */
1850         if (fp)
1851                 filp_close(fp, current->files);
1852         /* restore previous address limit */
1853         set_fs(old_fs);
1854
1855         return ret;
1856 }
1857 #endif                          /* BCMDBG */