drivers/net/wireless/libertas/cfg.c

   1 /*
   2  * Implement cfg80211 ("iw") support.
   3  *
   4  * Copyright (C) 2009 M&N Solutions GmbH, 61191 Rosbach, Germany
   5  * Holger Schurig <hs4233@mail.mn-solutions.de>
   6  *
   7  */
   8
   9 #include <linux/sched.h>
  10 #include <linux/wait.h>
  11 #include <linux/slab.h>
  12 #include <linux/sched.h>
  13 #include <linux/ieee80211.h>
  14 #include <net/cfg80211.h>
  15 #include <asm/unaligned.h>
  16
  17 #include "decl.h"
  18 #include "cfg.h"
  19 #include "cmd.h"
  20
  21
  22 #define CHAN2G(_channel, _freq, _flags) {        \
  23         .band             = IEEE80211_BAND_2GHZ, \
  24         .center_freq      = (_freq),             \
  25         .hw_value         = (_channel),          \
  26         .flags            = (_flags),            \
  27         .max_antenna_gain = 0,                   \
  28         .max_power        = 30,                  \
  29 }
  30
  31 static struct ieee80211_channel lbs_2ghz_channels[] = {
  32         CHAN2G(1,  2412, 0),
  33         CHAN2G(2,  2417, 0),
  34         CHAN2G(3,  2422, 0),
  35         CHAN2G(4,  2427, 0),
  36         CHAN2G(5,  2432, 0),
  37         CHAN2G(6,  2437, 0),
  38         CHAN2G(7,  2442, 0),
  39         CHAN2G(8,  2447, 0),
  40         CHAN2G(9,  2452, 0),
  41         CHAN2G(10, 2457, 0),
  42         CHAN2G(11, 2462, 0),
  43         CHAN2G(12, 2467, 0),
  44         CHAN2G(13, 2472, 0),
  45         CHAN2G(14, 2484, 0),
  46 };
  47
  48 #define RATETAB_ENT(_rate, _hw_value, _flags) { \
  49         .bitrate  = (_rate),                    \
  50         .hw_value = (_hw_value),                \
  51         .flags    = (_flags),                   \
  52 }
  53
  54
  55 /* Table 6 in section 3.2.1.1 */
  56 static struct ieee80211_rate lbs_rates[] = {
  57         RATETAB_ENT(10,  0,  0),
  58         RATETAB_ENT(20,  1,  0),
  59         RATETAB_ENT(55,  2,  0),
  60         RATETAB_ENT(110, 3,  0),
  61         RATETAB_ENT(60,  9,  0),
  62         RATETAB_ENT(90,  6,  0),
  63         RATETAB_ENT(120, 7,  0),
  64         RATETAB_ENT(180, 8,  0),
  65         RATETAB_ENT(240, 9,  0),
  66         RATETAB_ENT(360, 10, 0),
  67         RATETAB_ENT(480, 11, 0),
  68         RATETAB_ENT(540, 12, 0),
  69 };
  70
  71 static struct ieee80211_supported_band lbs_band_2ghz = {
  72         .channels = lbs_2ghz_channels,
  73         .n_channels = ARRAY_SIZE(lbs_2ghz_channels),
  74         .bitrates = lbs_rates,
  75         .n_bitrates = ARRAY_SIZE(lbs_rates),
  76 };
  77
  78
  79 static const u32 cipher_suites[] = {
  80         WLAN_CIPHER_SUITE_WEP40,
  81         WLAN_CIPHER_SUITE_WEP104,
  82         WLAN_CIPHER_SUITE_TKIP,
  83         WLAN_CIPHER_SUITE_CCMP,
  84 };
  85
  86 /* Time to stay on the channel */
  87 #define LBS_DWELL_PASSIVE 100
  88 #define LBS_DWELL_ACTIVE  40
  89
  90
  91 /***************************************************************************
  92  * Misc utility functions
  93  *
  94  * TLVs are Marvell specific. They are very similar to IEs, they have the
  95  * same structure: type, length, data*. The only difference: for IEs, the
  96  * type and length are u8, but for TLVs they're __le16.
  97  */
  98
  99 /*
 100  * Convert NL80211's auth_type to the one from Libertas, see chapter 5.9.1
 101  * in the firmware spec
 102  */
 103 static u8 lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
 104 {
 105         int ret = -ENOTSUPP;
 106
 107         switch (auth_type) {
 108         case NL80211_AUTHTYPE_OPEN_SYSTEM:
 109         case NL80211_AUTHTYPE_SHARED_KEY:
 110                 ret = auth_type;
 111                 break;
 112         case NL80211_AUTHTYPE_AUTOMATIC:
 113                 ret = NL80211_AUTHTYPE_OPEN_SYSTEM;
 114                 break;
 115         case NL80211_AUTHTYPE_NETWORK_EAP:
 116                 ret = 0x80;
 117                 break;
 118         default:
 119                 /* silence compiler */
 120                 break;
 121         }
 122         return ret;
 123 }
 124
 125
 126 /* Various firmware commands need the list of supported rates, but with
 127    the hight-bit set for basic rates */
 128 static int lbs_add_rates(u8 *rates)
 129 {
 130         size_t i;
 131
 132         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
 133                 u8 rate = lbs_rates[i].bitrate / 5;
 134                 if (rate == 0x02 || rate == 0x04 ||
 135                     rate == 0x0b || rate == 0x16)
 136                         rate |= 0x80;
 137                 rates[i] = rate;
 138         }
 139         return ARRAY_SIZE(lbs_rates);
 140 }
 141
 142
 143 /***************************************************************************
 144  * TLV utility functions
 145  *
 146  * TLVs are Marvell specific. They are very similar to IEs, they have the
 147  * same structure: type, length, data*. The only difference: for IEs, the
 148  * type and length are u8, but for TLVs they're __le16.
 149  */
 150
 151
 152 /*
 153  * Add ssid TLV
 154  */
 155 #define LBS_MAX_SSID_TLV_SIZE                   \
 156         (sizeof(struct mrvl_ie_header)          \
 157          + IEEE80211_MAX_SSID_LEN)
 158
 159 static int lbs_add_ssid_tlv(u8 *tlv, const u8 *ssid, int ssid_len)
 160 {
 161         struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
 162
 163         /*
 164          * TLV-ID SSID  00 00
 165          * length       06 00
 166          * ssid         4d 4e 54 45 53 54
 167          */
 168         ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
 169         ssid_tlv->header.len = cpu_to_le16(ssid_len);
 170         memcpy(ssid_tlv->ssid, ssid, ssid_len);
 171         return sizeof(ssid_tlv->header) + ssid_len;
 172 }
 173
 174
 175 /*
 176  * Add channel list TLV (section 8.4.2)
 177  *
 178  * Actual channel data comes from priv->wdev->wiphy->channels.
 179  */
 180 #define LBS_MAX_CHANNEL_LIST_TLV_SIZE                                   \
 181         (sizeof(struct mrvl_ie_header)                                  \
 182          + (LBS_SCAN_BEFORE_NAP * sizeof(struct chanscanparamset)))
 183
 184 static int lbs_add_channel_list_tlv(struct lbs_private *priv, u8 *tlv,
 185                                     int last_channel, int active_scan)
 186 {
 187         int chanscanparamsize = sizeof(struct chanscanparamset) *
 188                 (last_channel - priv->scan_channel);
 189
 190         struct mrvl_ie_header *header = (void *) tlv;
 191
 192         /*
 193          * TLV-ID CHANLIST  01 01
 194          * length           0e 00
 195          * channel          00 01 00 00 00 64 00
 196          *   radio type     00
 197          *   channel           01
 198          *   scan type            00
 199          *   min scan time           00 00
 200          *   max scan time                 64 00
 201          * channel 2        00 02 00 00 00 64 00
 202          *
 203          */
 204
 205         header->type = cpu_to_le16(TLV_TYPE_CHANLIST);
 206         header->len  = cpu_to_le16(chanscanparamsize);
 207         tlv += sizeof(struct mrvl_ie_header);
 208
 209         /* lbs_deb_scan("scan: channels %d to %d\n", priv->scan_channel,
 210                      last_channel); */
 211         memset(tlv, 0, chanscanparamsize);
 212
 213         while (priv->scan_channel < last_channel) {
 214                 struct chanscanparamset *param = (void *) tlv;
 215
 216                 param->radiotype = CMD_SCAN_RADIO_TYPE_BG;
 217                 param->channumber =
 218                         priv->scan_req->channels[priv->scan_channel]->hw_value;
 219                 if (active_scan) {
 220                         param->maxscantime = cpu_to_le16(LBS_DWELL_ACTIVE);
 221                 } else {
 222                         param->chanscanmode.passivescan = 1;
 223                         param->maxscantime = cpu_to_le16(LBS_DWELL_PASSIVE);
 224                 }
 225                 tlv += sizeof(struct chanscanparamset);
 226                 priv->scan_channel++;
 227         }
 228         return sizeof(struct mrvl_ie_header) + chanscanparamsize;
 229 }
 230
 231
 232 /*
 233  * Add rates TLV
 234  *
 235  * The rates are in lbs_bg_rates[], but for the 802.11b
 236  * rates the high bit is set. We add this TLV only because
 237  * there's a firmware which otherwise doesn't report all
 238  * APs in range.
 239  */
 240 #define LBS_MAX_RATES_TLV_SIZE                  \
 241         (sizeof(struct mrvl_ie_header)          \
 242          + (ARRAY_SIZE(lbs_rates)))
 243
 244 /* Adds a TLV with all rates the hardware supports */
 245 static int lbs_add_supported_rates_tlv(u8 *tlv)
 246 {
 247         size_t i;
 248         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
 249
 250         /*
 251          * TLV-ID RATES  01 00
 252          * length        0e 00
 253          * rates         82 84 8b 96 0c 12 18 24 30 48 60 6c
 254          */
 255         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
 256         tlv += sizeof(rate_tlv->header);
 257         i = lbs_add_rates(tlv);
 258         tlv += i;
 259         rate_tlv->header.len = cpu_to_le16(i);
 260         return sizeof(rate_tlv->header) + i;
 261 }
 262
 263 /* Add common rates from a TLV and return the new end of the TLV */
 264 static u8 *
 265 add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
 266 {
 267         int hw, ap, ap_max = ie[1];
 268         u8 hw_rate;
 269
 270         /* Advance past IE header */
 271         ie += 2;
 272
 273         lbs_deb_hex(LBS_DEB_ASSOC, "AP IE Rates", (u8 *) ie, ap_max);
 274
 275         for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
 276                 hw_rate = lbs_rates[hw].bitrate / 5;
 277                 for (ap = 0; ap < ap_max; ap++) {
 278                         if (hw_rate == (ie[ap] & 0x7f)) {
 279                                 *tlv++ = ie[ap];
 280                                 *nrates = *nrates + 1;
 281                         }
 282                 }
 283         }
 284         return tlv;
 285 }
 286
 287 /*
 288  * Adds a TLV with all rates the hardware *and* BSS supports.
 289  */
 290 static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
 291 {
 292         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
 293         const u8 *rates_eid, *ext_rates_eid;
 294         int n = 0;
 295
 296         rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
 297         ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
 298
 299         /*
 300          * 01 00                   TLV_TYPE_RATES
 301          * 04 00                   len
 302          * 82 84 8b 96             rates
 303          */
 304         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
 305         tlv += sizeof(rate_tlv->header);
 306
 307         /* Add basic rates */
 308         if (rates_eid) {
 309                 tlv = add_ie_rates(tlv, rates_eid, &n);
 310
 311                 /* Add extended rates, if any */
 312                 if (ext_rates_eid)
 313                         tlv = add_ie_rates(tlv, ext_rates_eid, &n);
 314         } else {
 315                 lbs_deb_assoc("assoc: bss had no basic rate IE\n");
 316                 /* Fallback: add basic 802.11b rates */
 317                 *tlv++ = 0x82;
 318                 *tlv++ = 0x84;
 319                 *tlv++ = 0x8b;
 320                 *tlv++ = 0x96;
 321                 n = 4;
 322         }
 323
 324         rate_tlv->header.len = cpu_to_le16(n);
 325         return sizeof(rate_tlv->header) + n;
 326 }
 327
 328
 329 /*
 330  * Add auth type TLV.
 331  *
 332  * This is only needed for newer firmware (V9 and up).
 333  */
 334 #define LBS_MAX_AUTH_TYPE_TLV_SIZE \
 335         sizeof(struct mrvl_ie_auth_type)
 336
 337 static int lbs_add_auth_type_tlv(u8 *tlv, enum nl80211_auth_type auth_type)
 338 {
 339         struct mrvl_ie_auth_type *auth = (void *) tlv;
 340
 341         /*
 342          * 1f 01  TLV_TYPE_AUTH_TYPE
 343          * 01 00  len
 344          * 01     auth type
 345          */
 346         auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
 347         auth->header.len = cpu_to_le16(sizeof(*auth)-sizeof(auth->header));
 348         auth->auth = cpu_to_le16(lbs_auth_to_authtype(auth_type));
 349         return sizeof(*auth);
 350 }
 351
 352
 353 /*
 354  * Add channel (phy ds) TLV
 355  */
 356 #define LBS_MAX_CHANNEL_TLV_SIZE \
 357         sizeof(struct mrvl_ie_header)
 358
 359 static int lbs_add_channel_tlv(u8 *tlv, u8 channel)
 360 {
 361         struct mrvl_ie_ds_param_set *ds = (void *) tlv;
 362
 363         /*
 364          * 03 00  TLV_TYPE_PHY_DS
 365          * 01 00  len
 366          * 06     channel
 367          */
 368         ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
 369         ds->header.len = cpu_to_le16(sizeof(*ds)-sizeof(ds->header));
 370         ds->channel = channel;
 371         return sizeof(*ds);
 372 }
 373
 374
 375 /*
 376  * Add (empty) CF param TLV of the form:
 377  */
 378 #define LBS_MAX_CF_PARAM_TLV_SIZE               \
 379         sizeof(struct mrvl_ie_header)
 380
 381 static int lbs_add_cf_param_tlv(u8 *tlv)
 382 {
 383         struct mrvl_ie_cf_param_set *cf = (void *)tlv;
 384
 385         /*
 386          * 04 00  TLV_TYPE_CF
 387          * 06 00  len
 388          * 00     cfpcnt
 389          * 00     cfpperiod
 390          * 00 00  cfpmaxduration
 391          * 00 00  cfpdurationremaining
 392          */
 393         cf->header.type = cpu_to_le16(TLV_TYPE_CF);
 394         cf->header.len = cpu_to_le16(sizeof(*cf)-sizeof(cf->header));
 395         return sizeof(*cf);
 396 }
 397
 398 /*
 399  * Add WPA TLV
 400  */
 401 #define LBS_MAX_WPA_TLV_SIZE                    \
 402         (sizeof(struct mrvl_ie_header)          \
 403          + 128 /* TODO: I guessed the size */)
 404
 405 static int lbs_add_wpa_tlv(u8 *tlv, const u8 *ie, u8 ie_len)
 406 {
 407         size_t tlv_len;
 408
 409         /*
 410          * We need just convert an IE to an TLV. IEs use u8 for the header,
 411          *   u8      type
 412          *   u8      len
 413          *   u8[]    data
 414          * but TLVs use __le16 instead:
 415          *   __le16  type
 416          *   __le16  len
 417          *   u8[]    data
 418          */
 419         *tlv++ = *ie++;
 420         *tlv++ = 0;
 421         tlv_len = *tlv++ = *ie++;
 422         *tlv++ = 0;
 423         while (tlv_len--)
 424                 *tlv++ = *ie++;
 425         /* the TLV is two bytes larger than the IE */
 426         return ie_len + 2;
 427 }
 428
 429 /***************************************************************************
 430  * Set Channel
 431  */
 432
 433 static int lbs_cfg_set_channel(struct wiphy *wiphy,
 434         struct net_device *netdev,
 435         struct ieee80211_channel *channel,
 436         enum nl80211_channel_type channel_type)
 437 {
 438         struct lbs_private *priv = wiphy_priv(wiphy);
 439         int ret = -ENOTSUPP;
 440
 441         lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d",
 442                            channel->center_freq, channel_type);
 443
 444         if (channel_type != NL80211_CHAN_NO_HT)
 445                 goto out;
 446
 447         ret = lbs_set_channel(priv, channel->hw_value);
 448
 449  out:
 450         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
 451         return ret;
 452 }
 453
 454
 455
 456 /***************************************************************************
 457  * Scanning
 458  */
 459
 460 /*
 461  * When scanning, the firmware doesn't send a nul packet with the power-safe
 462  * bit to the AP. So we cannot stay away from our current channel too long,
 463  * otherwise we loose data. So take a "nap" while scanning every other
 464  * while.
 465  */
 466 #define LBS_SCAN_BEFORE_NAP 4
 467
 468
 469 /*
 470  * When the firmware reports back a scan-result, it gives us an "u8 rssi",
 471  * which isn't really an RSSI, as it becomes larger when moving away from
 472  * the AP. Anyway, we need to convert that into mBm.
 473  */
 474 #define LBS_SCAN_RSSI_TO_MBM(rssi) \
 475         ((-(int)rssi + 3)*100)
 476
 477 static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
 478         struct cmd_header *resp)
 479 {
 480         struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
 481         int bsssize;
 482         const u8 *pos;
 483         u16 nr_sets;
 484         const u8 *tsfdesc;
 485         int tsfsize;
 486         int i;
 487         int ret = -EILSEQ;
 488
 489         lbs_deb_enter(LBS_DEB_CFG80211);
 490
 491         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
 492         nr_sets = le16_to_cpu(scanresp->nr_sets);
 493
 494         lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
 495                         nr_sets, bsssize, le16_to_cpu(resp->size));
 496
 497         if (nr_sets == 0) {
 498                 ret = 0;
 499                 goto done;
 500         }
 501
 502         /*
 503          * The general layout of the scan response is described in chapter
 504          * 5.7.1. Basically we have a common part, then any number of BSS
 505          * descriptor sections. Finally we have section with the same number
 506          * of TSFs.
 507          *
 508          * cmd_ds_802_11_scan_rsp
 509          *   cmd_header
 510          *   pos_size
 511          *   nr_sets
 512          *   bssdesc 1
 513          *     bssid
 514          *     rssi
 515          *     timestamp
 516          *     intvl
 517          *     capa
 518          *     IEs
 519          *   bssdesc 2
 520          *   bssdesc n
 521          *   MrvlIEtypes_TsfFimestamp_t
 522          *     TSF for BSS 1
 523          *     TSF for BSS 2
 524          *     TSF for BSS n
 525          */
 526
 527         pos = scanresp->bssdesc_and_tlvbuffer;
 528
 529         tsfdesc = pos + bsssize;
 530         tsfsize = 4 + 8 * scanresp->nr_sets;
 531
 532         /* Validity check: we expect a Marvell-Local TLV */
 533         i = get_unaligned_le16(tsfdesc);
 534         tsfdesc += 2;
 535         if (i != TLV_TYPE_TSFTIMESTAMP)
 536                 goto done;
 537         /* Validity check: the TLV holds TSF values with 8 bytes each, so
 538          * the size in the TLV must match the nr_sets value */
 539         i = get_unaligned_le16(tsfdesc);
 540         tsfdesc += 2;
 541         if (i / 8 != scanresp->nr_sets)
 542                 goto done;
 543
 544         for (i = 0; i < scanresp->nr_sets; i++) {
 545                 const u8 *bssid;
 546                 const u8 *ie;
 547                 int left;
 548                 int ielen;
 549                 int rssi;
 550                 u16 intvl;
 551                 u16 capa;
 552                 int chan_no = -1;
 553                 const u8 *ssid = NULL;
 554                 u8 ssid_len = 0;
 555                 DECLARE_SSID_BUF(ssid_buf);
 556
 557                 int len = get_unaligned_le16(pos);
 558                 pos += 2;
 559
 560                 /* BSSID */
 561                 bssid = pos;
 562                 pos += ETH_ALEN;
 563                 /* RSSI */
 564                 rssi = *pos++;
 565                 /* Packet time stamp */
 566                 pos += 8;
 567                 /* Beacon interval */
 568                 intvl = get_unaligned_le16(pos);
 569                 pos += 2;
 570                 /* Capabilities */
 571                 capa = get_unaligned_le16(pos);
 572                 pos += 2;
 573
 574                 /* To find out the channel, we must parse the IEs */
 575                 ie = pos;
 576                 /* 6+1+8+2+2: size of BSSID, RSSI, time stamp, beacon
 577                    interval, capabilities */
 578                 ielen = left = len - (6 + 1 + 8 + 2 + 2);
 579                 while (left >= 2) {
 580                         u8 id, elen;
 581                         id = *pos++;
 582                         elen = *pos++;
 583                         left -= 2;
 584                         if (elen > left || elen == 0)
 585                                 goto done;
 586                         if (id == WLAN_EID_DS_PARAMS)
 587                                 chan_no = *pos;
 588                         if (id == WLAN_EID_SSID) {
 589                                 ssid = pos;
 590                                 ssid_len = elen;
 591                         }
 592                         left -= elen;
 593                         pos += elen;
 594                 }
 595
 596                 /* No channel, no luck */
 597                 if (chan_no != -1) {
 598                         struct wiphy *wiphy = priv->wdev->wiphy;
 599                         int freq = ieee80211_channel_to_frequency(chan_no);
 600                         struct ieee80211_channel *channel =
 601                                 ieee80211_get_channel(wiphy, freq);
 602
 603                         lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %s, "
 604                                      "%d dBm\n",
 605                                      bssid, capa, chan_no,
 606                                      print_ssid(ssid_buf, ssid, ssid_len),
 607                                      LBS_SCAN_RSSI_TO_MBM(rssi)/100);
 608
 609                         if (channel ||
 610                             !(channel->flags & IEEE80211_CHAN_DISABLED))
 611                                 cfg80211_inform_bss(wiphy, channel,
 612                                         bssid, le64_to_cpu(*(__le64 *)tsfdesc),
 613                                         capa, intvl, ie, ielen,
 614                                         LBS_SCAN_RSSI_TO_MBM(rssi),
 615                                         GFP_KERNEL);
 616                 }
 617                 tsfdesc += 8;
 618         }
 619         ret = 0;
 620
 621  done:
 622         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
 623         return ret;
 624 }
 625
 626
 627 /*
 628  * Our scan command contains a TLV, consting of a SSID TLV, a channel list
 629  * TLV and a rates TLV. Determine the maximum size of them:
 630  */
 631 #define LBS_SCAN_MAX_CMD_SIZE                   \
 632         (sizeof(struct cmd_ds_802_11_scan)      \
 633          + LBS_MAX_SSID_TLV_SIZE                \
 634          + LBS_MAX_CHANNEL_LIST_TLV_SIZE        \
 635          + LBS_MAX_RATES_TLV_SIZE)
 636
 637 /*
 638  * Assumes priv->scan_req is initialized and valid
 639  * Assumes priv->scan_channel is initialized
 640  */
 641 static void lbs_scan_worker(struct work_struct *work)
 642 {
 643         struct lbs_private *priv =
 644                 container_of(work, struct lbs_private, scan_work.work);
 645         struct cmd_ds_802_11_scan *scan_cmd;
 646         u8 *tlv; /* pointer into our current, growing TLV storage area */
 647         int last_channel;
 648         int running, carrier;
 649
 650         lbs_deb_enter(LBS_DEB_SCAN);
 651
 652         scan_cmd = kzalloc(LBS_SCAN_MAX_CMD_SIZE, GFP_KERNEL);
 653         if (scan_cmd == NULL)
 654                 goto out_no_scan_cmd;
 655
 656         /* prepare fixed part of scan command */
 657         scan_cmd->bsstype = CMD_BSS_TYPE_ANY;
 658
 659         /* stop network while we're away from our main channel */
 660         running = !netif_queue_stopped(priv->dev);
 661         carrier = netif_carrier_ok(priv->dev);
 662         if (running)
 663                 netif_stop_queue(priv->dev);
 664         if (carrier)
 665                 netif_carrier_off(priv->dev);
 666
 667         /* prepare fixed part of scan command */
 668         tlv = scan_cmd->tlvbuffer;
 669
 670         /* add SSID TLV */
 671         if (priv->scan_req->n_ssids)
 672                 tlv += lbs_add_ssid_tlv(tlv,
 673                                         priv->scan_req->ssids[0].ssid,
 674                                         priv->scan_req->ssids[0].ssid_len);
 675
 676         /* add channel TLVs */
 677         last_channel = priv->scan_channel + LBS_SCAN_BEFORE_NAP;
 678         if (last_channel > priv->scan_req->n_channels)
 679                 last_channel = priv->scan_req->n_channels;
 680         tlv += lbs_add_channel_list_tlv(priv, tlv, last_channel,
 681                 priv->scan_req->n_ssids);
 682
 683         /* add rates TLV */
 684         tlv += lbs_add_supported_rates_tlv(tlv);
 685
 686         if (priv->scan_channel < priv->scan_req->n_channels) {
 687                 cancel_delayed_work(&priv->scan_work);
 688                 queue_delayed_work(priv->work_thread, &priv->scan_work,
 689                         msecs_to_jiffies(300));
 690         }
 691
 692         /* This is the final data we are about to send */
 693         scan_cmd->hdr.size = cpu_to_le16(tlv - (u8 *)scan_cmd);
 694         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
 695                     sizeof(*scan_cmd));
 696         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
 697                     tlv - scan_cmd->tlvbuffer);
 698
 699         __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
 700                 le16_to_cpu(scan_cmd->hdr.size),
 701                 lbs_ret_scan, 0);
 702
 703         if (priv->scan_channel >= priv->scan_req->n_channels) {
 704                 /* Mark scan done */
 705                 if (priv->internal_scan)
 706                         kfree(priv->scan_req);
 707                 else
 708                         cfg80211_scan_done(priv->scan_req, false);
 709
 710                 priv->scan_req = NULL;
 711                 priv->last_scan = jiffies;
 712         }
 713
 714         /* Restart network */
 715         if (carrier)
 716                 netif_carrier_on(priv->dev);
 717         if (running && !priv->tx_pending_len)
 718                 netif_wake_queue(priv->dev);
 719
 720         kfree(scan_cmd);
 721
 722         /* Wake up anything waiting on scan completion */
 723         if (priv->scan_req == NULL) {
 724                 lbs_deb_scan("scan: waking up waiters\n");
 725                 wake_up_all(&priv->scan_q);
 726         }
 727
 728  out_no_scan_cmd:
 729         lbs_deb_leave(LBS_DEB_SCAN);
 730 }
 731
 732 static void _internal_start_scan(struct lbs_private *priv, bool internal,
 733         struct cfg80211_scan_request *request)
 734 {
 735         lbs_deb_enter(LBS_DEB_CFG80211);
 736
 737         lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
 738                 request->n_ssids, request->n_channels, request->ie_len);
 739
 740         priv->scan_channel = 0;
 741         queue_delayed_work(priv->work_thread, &priv->scan_work,
 742                 msecs_to_jiffies(50));
 743
 744         priv->scan_req = request;
 745         priv->internal_scan = internal;
 746
 747         lbs_deb_leave(LBS_DEB_CFG80211);
 748 }
 749
 750 static int lbs_cfg_scan(struct wiphy *wiphy,
 751         struct net_device *dev,
 752         struct cfg80211_scan_request *request)
 753 {
 754         struct lbs_private *priv = wiphy_priv(wiphy);
 755         int ret = 0;
 756
 757         lbs_deb_enter(LBS_DEB_CFG80211);
 758
 759         if (priv->scan_req || delayed_work_pending(&priv->scan_work)) {
 760                 /* old scan request not yet processed */
 761                 ret = -EAGAIN;
 762                 goto out;
 763         }
 764
 765         _internal_start_scan(priv, false, request);
 766
 767         if (priv->surpriseremoved)
 768                 ret = -EIO;
 769
 770  out:
 771         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
 772         return ret;
 773 }
 774
 775
 776
 777
 778 /***************************************************************************
 779  * Events
 780  */
 781
 782 void lbs_send_disconnect_notification(struct lbs_private *priv)
 783 {
 784         lbs_deb_enter(LBS_DEB_CFG80211);
 785
 786         cfg80211_disconnected(priv->dev,
 787                 0,
 788                 NULL, 0,
 789                 GFP_KERNEL);
 790
 791         lbs_deb_leave(LBS_DEB_CFG80211);
 792 }
 793
 794 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
 795 {
 796         lbs_deb_enter(LBS_DEB_CFG80211);
 797
 798         cfg80211_michael_mic_failure(priv->dev,
 799                 priv->assoc_bss,
 800                 event == MACREG_INT_CODE_MIC_ERR_MULTICAST ?
 801                         NL80211_KEYTYPE_GROUP :
 802                         NL80211_KEYTYPE_PAIRWISE,
 803                 -1,
 804                 NULL,
 805                 GFP_KERNEL);
 806
 807         lbs_deb_leave(LBS_DEB_CFG80211);
 808 }
 809
 810
 811
 812
 813 /***************************************************************************
 814  * Connect/disconnect
 815  */
 816
 817
 818 /*
 819  * This removes all WEP keys
 820  */
 821 static int lbs_remove_wep_keys(struct lbs_private *priv)
 822 {
 823         struct cmd_ds_802_11_set_wep cmd;
 824         int ret;
 825
 826         lbs_deb_enter(LBS_DEB_CFG80211);
 827
 828         memset(&cmd, 0, sizeof(cmd));
 829         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 830         cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
 831         cmd.action = cpu_to_le16(CMD_ACT_REMOVE);
 832
 833         ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
 834
 835         lbs_deb_leave(LBS_DEB_CFG80211);
 836         return ret;
 837 }
 838
 839 /*
 840  * Set WEP keys
 841  */
 842 static int lbs_set_wep_keys(struct lbs_private *priv)
 843 {
 844         struct cmd_ds_802_11_set_wep cmd;
 845         int i;
 846         int ret;
 847
 848         lbs_deb_enter(LBS_DEB_CFG80211);
 849
 850         /*
 851          * command         13 00
 852          * size            50 00
 853          * sequence        xx xx
 854          * result          00 00
 855          * action          02 00     ACT_ADD
 856          * transmit key    00 00
 857          * type for key 1  01        WEP40
 858          * type for key 2  00
 859          * type for key 3  00
 860          * type for key 4  00
 861          * key 1           39 39 39 39 39 00 00 00
 862          *                 00 00 00 00 00 00 00 00
 863          * key 2           00 00 00 00 00 00 00 00
 864          *                 00 00 00 00 00 00 00 00
 865          * key 3           00 00 00 00 00 00 00 00
 866          *                 00 00 00 00 00 00 00 00
 867          * key 4           00 00 00 00 00 00 00 00
 868          */
 869         if (priv->wep_key_len[0] || priv->wep_key_len[1] ||
 870             priv->wep_key_len[2] || priv->wep_key_len[3]) {
 871                 /* Only set wep keys if we have at least one of them */
 872                 memset(&cmd, 0, sizeof(cmd));
 873                 cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 874                 cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
 875                 cmd.action = cpu_to_le16(CMD_ACT_ADD);
 876
 877                 for (i = 0; i < 4; i++) {
 878                         switch (priv->wep_key_len[i]) {
 879                         case WLAN_KEY_LEN_WEP40:
 880                                 cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
 881                                 break;
 882                         case WLAN_KEY_LEN_WEP104:
 883                                 cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
 884                                 break;
 885                         default:
 886                                 cmd.keytype[i] = 0;
 887                                 break;
 888                         }
 889                         memcpy(cmd.keymaterial[i], priv->wep_key[i],
 890                                priv->wep_key_len[i]);
 891                 }
 892
 893                 ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
 894         } else {
 895                 /* Otherwise remove all wep keys */
 896                 ret = lbs_remove_wep_keys(priv);
 897         }
 898
 899         lbs_deb_leave(LBS_DEB_CFG80211);
 900         return ret;
 901 }
 902
 903
 904 /*
 905  * Enable/Disable RSN status
 906  */
 907 static int lbs_enable_rsn(struct lbs_private *priv, int enable)
 908 {
 909         struct cmd_ds_802_11_enable_rsn cmd;
 910         int ret;
 911
 912         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", enable);
 913
 914         /*
 915          * cmd       2f 00
 916          * size      0c 00
 917          * sequence  xx xx
 918          * result    00 00
 919          * action    01 00    ACT_SET
 920          * enable    01 00
 921          */
 922         memset(&cmd, 0, sizeof(cmd));
 923         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 924         cmd.action = cpu_to_le16(CMD_ACT_SET);
 925         cmd.enable = cpu_to_le16(enable);
 926
 927         ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
 928
 929         lbs_deb_leave(LBS_DEB_CFG80211);
 930         return ret;
 931 }
 932
 933
 934 /*
 935  * Set WPA/WPA key material
 936  */
 937
 938 /* like "struct cmd_ds_802_11_key_material", but with cmd_header. Once we
 939  * get rid of WEXT, this should go into host.h */
 940
 941 struct cmd_key_material {
 942         struct cmd_header hdr;
 943
 944         __le16 action;
 945         struct MrvlIEtype_keyParamSet param;
 946 } __packed;
 947
 948 static int lbs_set_key_material(struct lbs_private *priv,
 949                                 int key_type,
 950                                 int key_info,
 951                                 u8 *key, u16 key_len)
 952 {
 953         struct cmd_key_material cmd;
 954         int ret;
 955
 956         lbs_deb_enter(LBS_DEB_CFG80211);
 957
 958         /*
 959          * Example for WPA (TKIP):
 960          *
 961          * cmd       5e 00
 962          * size      34 00
 963          * sequence  xx xx
 964          * result    00 00
 965          * action    01 00
 966          * TLV type  00 01    key param
 967          * length    00 26
 968          * key type  01 00    TKIP
 969          * key info  06 00    UNICAST | ENABLED
 970          * key len   20 00
 971          * key       32 bytes
 972          */
 973         memset(&cmd, 0, sizeof(cmd));
 974         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 975         cmd.action = cpu_to_le16(CMD_ACT_SET);
 976         cmd.param.type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
 977         cmd.param.length = cpu_to_le16(sizeof(cmd.param) - 4);
 978         cmd.param.keytypeid = cpu_to_le16(key_type);
 979         cmd.param.keyinfo = cpu_to_le16(key_info);
 980         cmd.param.keylen = cpu_to_le16(key_len);
 981         if (key && key_len)
 982                 memcpy(cmd.param.key, key, key_len);
 983
 984         ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
 985
 986         lbs_deb_leave(LBS_DEB_CFG80211);
 987         return ret;
 988 }
 989
 990
 991 /*
 992  * Sets the auth type (open, shared, etc) in the firmware. That
 993  * we use CMD_802_11_AUTHENTICATE is misleading, this firmware
 994  * command doesn't send an authentication frame at all, it just
 995  * stores the auth_type.
 996  */
 997 static int lbs_set_authtype(struct lbs_private *priv,
 998                             struct cfg80211_connect_params *sme)
 999 {
1000         struct cmd_ds_802_11_authenticate cmd;
1001         int ret;
1002
1003         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", sme->auth_type);
1004
1005         /*
1006          * cmd        11 00
1007          * size       19 00
1008          * sequence   xx xx
1009          * result     00 00
1010          * BSS id     00 13 19 80 da 30
1011          * auth type  00
1012          * reserved   00 00 00 00 00 00 00 00 00 00
1013          */
1014         memset(&cmd, 0, sizeof(cmd));
1015         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1016         if (sme->bssid)
1017                 memcpy(cmd.bssid, sme->bssid, ETH_ALEN);
1018         /* convert auth_type */
1019         ret = lbs_auth_to_authtype(sme->auth_type);
1020         if (ret < 0)
1021                 goto done;
1022
1023         cmd.authtype = ret;
1024         ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
1025
1026  done:
1027         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1028         return ret;
1029 }
1030
1031
1032 /*
1033  * Create association request
1034  */
1035 #define LBS_ASSOC_MAX_CMD_SIZE                     \
1036         (sizeof(struct cmd_ds_802_11_associate)    \
1037          - 512 /* cmd_ds_802_11_associate.iebuf */ \
1038          + LBS_MAX_SSID_TLV_SIZE                   \
1039          + LBS_MAX_CHANNEL_TLV_SIZE                \
1040          + LBS_MAX_CF_PARAM_TLV_SIZE               \
1041          + LBS_MAX_AUTH_TYPE_TLV_SIZE              \
1042          + LBS_MAX_WPA_TLV_SIZE)
1043
1044 static int lbs_associate(struct lbs_private *priv,
1045                 struct cfg80211_bss *bss,
1046                 struct cfg80211_connect_params *sme)
1047 {
1048         struct cmd_ds_802_11_associate_response *resp;
1049         struct cmd_ds_802_11_associate *cmd = kzalloc(LBS_ASSOC_MAX_CMD_SIZE,
1050                                                       GFP_KERNEL);
1051         const u8 *ssid_eid;
1052         size_t len, resp_ie_len;
1053         int status;
1054         int ret;
1055         u8 *pos = &(cmd->iebuf[0]);
1056         u8 *tmp;
1057
1058         lbs_deb_enter(LBS_DEB_CFG80211);
1059
1060         if (!cmd) {
1061                 ret = -ENOMEM;
1062                 goto done;
1063         }
1064
1065         /*
1066          * cmd              50 00
1067          * length           34 00
1068          * sequence         xx xx
1069          * result           00 00
1070          * BSS id           00 13 19 80 da 30
1071          * capabilities     11 00
1072          * listen interval  0a 00
1073          * beacon interval  00 00
1074          * DTIM period      00
1075          * TLVs             xx   (up to 512 bytes)
1076          */
1077         cmd->hdr.command = cpu_to_le16(CMD_802_11_ASSOCIATE);
1078
1079         /* Fill in static fields */
1080         memcpy(cmd->bssid, bss->bssid, ETH_ALEN);
1081         cmd->listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
1082         cmd->capability = cpu_to_le16(bss->capability);
1083
1084         /* add SSID TLV */
1085         ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
1086         if (ssid_eid)
1087                 pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
1088         else
1089                 lbs_deb_assoc("no SSID\n");
1090
1091         /* add DS param TLV */
1092         if (bss->channel)
1093                 pos += lbs_add_channel_tlv(pos, bss->channel->hw_value);
1094         else
1095                 lbs_deb_assoc("no channel\n");
1096
1097         /* add (empty) CF param TLV */
1098         pos += lbs_add_cf_param_tlv(pos);
1099
1100         /* add rates TLV */
1101         tmp = pos + 4; /* skip Marvell IE header */
1102         pos += lbs_add_common_rates_tlv(pos, bss);
1103         lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
1104
1105         /* add auth type TLV */
1106         if (priv->fwrelease >= 0x09000000)
1107                 pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
1108
1109         /* add WPA/WPA2 TLV */
1110         if (sme->ie && sme->ie_len)
1111                 pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len);
1112
1113         len = (sizeof(*cmd) - sizeof(cmd->iebuf)) +
1114                 (u16)(pos - (u8 *) &cmd->iebuf);
1115         cmd->hdr.size = cpu_to_le16(len);
1116
1117         /* store for later use */
1118         memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
1119
1120         ret = lbs_cmd_with_response(priv, CMD_802_11_ASSOCIATE, cmd);
1121         if (ret)
1122                 goto done;
1123
1124
1125         /* generate connect message to cfg80211 */
1126
1127         resp = (void *) cmd; /* recast for easier field access */
1128         status = le16_to_cpu(resp->statuscode);
1129
1130         /* Convert statis code of old firmware */
1131         if (priv->fwrelease < 0x09000000)
1132                 switch (status) {
1133                 case 0:
1134                         break;
1135                 case 1:
1136                         lbs_deb_assoc("invalid association parameters\n");
1137                         status = WLAN_STATUS_CAPS_UNSUPPORTED;
1138                         break;
1139                 case 2:
1140                         lbs_deb_assoc("timer expired while waiting for AP\n");
1141                         status = WLAN_STATUS_AUTH_TIMEOUT;
1142                         break;
1143                 case 3:
1144                         lbs_deb_assoc("association refused by AP\n");
1145                         status = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
1146                         break;
1147                 case 4:
1148                         lbs_deb_assoc("authentication refused by AP\n");
1149                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1150                         break;
1151                 default:
1152                         lbs_deb_assoc("association failure %d\n", status);
1153                         status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1154         }
1155
1156         lbs_deb_assoc("status %d, capability 0x%04x\n", status,
1157                       le16_to_cpu(resp->capability));
1158
1159         resp_ie_len = le16_to_cpu(resp->hdr.size)
1160                 - sizeof(resp->hdr)
1161                 - 6;
1162         cfg80211_connect_result(priv->dev,
1163                                 priv->assoc_bss,
1164                                 sme->ie, sme->ie_len,
1165                                 resp->iebuf, resp_ie_len,
1166                                 status,
1167                                 GFP_KERNEL);
1168
1169         if (status == 0) {
1170                 /* TODO: get rid of priv->connect_status */
1171                 priv->connect_status = LBS_CONNECTED;
1172                 netif_carrier_on(priv->dev);
1173                 if (!priv->tx_pending_len)
1174                         netif_tx_wake_all_queues(priv->dev);
1175         }
1176
1177
1178 done:
1179         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1180         return ret;
1181 }
1182
1183 static struct cfg80211_scan_request *
1184 _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
1185 {
1186         struct cfg80211_scan_request *creq = NULL;
1187         int i, n_channels = 0;
1188         enum ieee80211_band band;
1189
1190         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1191                 if (wiphy->bands[band])
1192                         n_channels += wiphy->bands[band]->n_channels;
1193         }
1194
1195         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1196                        n_channels * sizeof(void *),
1197                        GFP_ATOMIC);
1198         if (!creq)
1199                 return NULL;
1200
1201         /* SSIDs come after channels */
1202         creq->ssids = (void *)&creq->channels[n_channels];
1203         creq->n_channels = n_channels;
1204         creq->n_ssids = 1;
1205
1206         /* Scan all available channels */
1207         i = 0;
1208         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1209                 int j;
1210
1211                 if (!wiphy->bands[band])
1212                         continue;
1213
1214                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1215                         /* ignore disabled channels */
1216                         if (wiphy->bands[band]->channels[j].flags &
1217                                                 IEEE80211_CHAN_DISABLED)
1218                                 continue;
1219
1220                         creq->channels[i] = &wiphy->bands[band]->channels[j];
1221                         i++;
1222                 }
1223         }
1224         if (i) {
1225                 /* Set real number of channels specified in creq->channels[] */
1226                 creq->n_channels = i;
1227
1228                 /* Scan for the SSID we're going to connect to */
1229                 memcpy(creq->ssids[0].ssid, sme->ssid, sme->ssid_len);
1230                 creq->ssids[0].ssid_len = sme->ssid_len;
1231         } else {
1232                 /* No channels found... */
1233                 kfree(creq);
1234                 creq = NULL;
1235         }
1236
1237         return creq;
1238 }
1239
1240 static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
1241                            struct cfg80211_connect_params *sme)
1242 {
1243         struct lbs_private *priv = wiphy_priv(wiphy);
1244         struct cfg80211_bss *bss = NULL;
1245         int ret = 0;
1246         u8 preamble = RADIO_PREAMBLE_SHORT;
1247
1248         lbs_deb_enter(LBS_DEB_CFG80211);
1249
1250         if (!sme->bssid) {
1251                 /* Run a scan if one isn't in-progress already and if the last
1252                  * scan was done more than 2 seconds ago.
1253                  */
1254                 if (priv->scan_req == NULL &&
1255                     time_after(jiffies, priv->last_scan + (2 * HZ))) {
1256                         struct cfg80211_scan_request *creq;
1257
1258                         creq = _new_connect_scan_req(wiphy, sme);
1259                         if (!creq) {
1260                                 ret = -EINVAL;
1261                                 goto done;
1262                         }
1263
1264                         lbs_deb_assoc("assoc: scanning for compatible AP\n");
1265                         _internal_start_scan(priv, true, creq);
1266                 }
1267
1268                 /* Wait for any in-progress scan to complete */
1269                 lbs_deb_assoc("assoc: waiting for scan to complete\n");
1270                 wait_event_interruptible_timeout(priv->scan_q,
1271                                                  (priv->scan_req == NULL),
1272                                                  (15 * HZ));
1273                 lbs_deb_assoc("assoc: scanning competed\n");
1274         }
1275
1276         /* Find the BSS we want using available scan results */
1277         bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
1278                 sme->ssid, sme->ssid_len,
1279                 WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
1280         if (!bss) {
1281                 lbs_pr_err("assoc: bss %pM not in scan results\n",
1282                            sme->bssid);
1283                 ret = -ENOENT;
1284                 goto done;
1285         }
1286         lbs_deb_assoc("trying %pM\n", bss->bssid);
1287         lbs_deb_assoc("cipher 0x%x, key index %d, key len %d\n",
1288                       sme->crypto.cipher_group,
1289                       sme->key_idx, sme->key_len);
1290
1291         /* As this is a new connection, clear locally stored WEP keys */
1292         priv->wep_tx_key = 0;
1293         memset(priv->wep_key, 0, sizeof(priv->wep_key));
1294         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1295
1296         /* set/remove WEP keys */
1297         switch (sme->crypto.cipher_group) {
1298         case WLAN_CIPHER_SUITE_WEP40:
1299         case WLAN_CIPHER_SUITE_WEP104:
1300                 /* Store provided WEP keys in priv-> */
1301                 priv->wep_tx_key = sme->key_idx;
1302                 priv->wep_key_len[sme->key_idx] = sme->key_len;
1303                 memcpy(priv->wep_key[sme->key_idx], sme->key, sme->key_len);
1304                 /* Set WEP keys and WEP mode */
1305                 lbs_set_wep_keys(priv);
1306                 priv->mac_control |= CMD_ACT_MAC_WEP_ENABLE;
1307                 lbs_set_mac_control(priv);
1308                 /* No RSN mode for WEP */
1309                 lbs_enable_rsn(priv, 0);
1310                 break;
1311         case 0: /* there's no WLAN_CIPHER_SUITE_NONE definition */
1312                 /*
1313                  * If we don't have no WEP, no WPA and no WPA2,
1314                  * we remove all keys like in the WPA/WPA2 setup,
1315                  * we just don't set RSN.
1316                  *
1317                  * Therefore: fall-throught
1318                  */
1319         case WLAN_CIPHER_SUITE_TKIP:
1320         case WLAN_CIPHER_SUITE_CCMP:
1321                 /* Remove WEP keys and WEP mode */
1322                 lbs_remove_wep_keys(priv);
1323                 priv->mac_control &= ~CMD_ACT_MAC_WEP_ENABLE;
1324                 lbs_set_mac_control(priv);
1325
1326                 /* clear the WPA/WPA2 keys */
1327                 lbs_set_key_material(priv,
1328                         KEY_TYPE_ID_WEP, /* doesn't matter */
1329                         KEY_INFO_WPA_UNICAST,
1330                         NULL, 0);
1331                 lbs_set_key_material(priv,
1332                         KEY_TYPE_ID_WEP, /* doesn't matter */
1333                         KEY_INFO_WPA_MCAST,
1334                         NULL, 0);
1335                 /* RSN mode for WPA/WPA2 */
1336                 lbs_enable_rsn(priv, sme->crypto.cipher_group != 0);
1337                 break;
1338         default:
1339                 lbs_pr_err("unsupported cipher group 0x%x\n",
1340                            sme->crypto.cipher_group);
1341                 ret = -ENOTSUPP;
1342                 goto done;
1343         }
1344
1345         lbs_set_authtype(priv, sme);
1346         lbs_set_radio(priv, preamble, 1);
1347
1348         /* Do the actual association */
1349         ret = lbs_associate(priv, bss, sme);
1350
1351  done:
1352         if (bss)
1353                 cfg80211_put_bss(bss);
1354         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1355         return ret;
1356 }
1357
1358 static int lbs_cfg_disconnect(struct wiphy *wiphy, struct net_device *dev,
1359         u16 reason_code)
1360 {
1361         struct lbs_private *priv = wiphy_priv(wiphy);
1362         struct cmd_ds_802_11_deauthenticate cmd;
1363
1364         lbs_deb_enter_args(LBS_DEB_CFG80211, "reason_code %d", reason_code);
1365
1366         /* store for lbs_cfg_ret_disconnect() */
1367         priv->disassoc_reason = reason_code;
1368
1369         memset(&cmd, 0, sizeof(cmd));
1370         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1371         /* Mildly ugly to use a locally store my own BSSID ... */
1372         memcpy(cmd.macaddr, &priv->assoc_bss, ETH_ALEN);
1373         cmd.reasoncode = cpu_to_le16(reason_code);
1374
1375         if (lbs_cmd_with_response(priv, CMD_802_11_DEAUTHENTICATE, &cmd))
1376                 return -EFAULT;
1377
1378         cfg80211_disconnected(priv->dev,
1379                         priv->disassoc_reason,
1380                         NULL, 0,
1381                         GFP_KERNEL);
1382         priv->connect_status = LBS_DISCONNECTED;
1383
1384         return 0;
1385 }
1386
1387
1388 static int lbs_cfg_set_default_key(struct wiphy *wiphy,
1389                                    struct net_device *netdev,
1390                                    u8 key_index)
1391 {
1392         struct lbs_private *priv = wiphy_priv(wiphy);
1393
1394         lbs_deb_enter(LBS_DEB_CFG80211);
1395
1396         if (key_index != priv->wep_tx_key) {
1397                 lbs_deb_assoc("set_default_key: to %d\n", key_index);
1398                 priv->wep_tx_key = key_index;
1399                 lbs_set_wep_keys(priv);
1400         }
1401
1402         return 0;
1403 }
1404
1405
1406 static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
1407                            u8 idx, const u8 *mac_addr,
1408                            struct key_params *params)
1409 {
1410         struct lbs_private *priv = wiphy_priv(wiphy);
1411         u16 key_info;
1412         u16 key_type;
1413         int ret = 0;
1414
1415         lbs_deb_enter(LBS_DEB_CFG80211);
1416
1417         lbs_deb_assoc("add_key: cipher 0x%x, mac_addr %pM\n",
1418                       params->cipher, mac_addr);
1419         lbs_deb_assoc("add_key: key index %d, key len %d\n",
1420                       idx, params->key_len);
1421         if (params->key_len)
1422                 lbs_deb_hex(LBS_DEB_CFG80211, "KEY",
1423                             params->key, params->key_len);
1424
1425         lbs_deb_assoc("add_key: seq len %d\n", params->seq_len);
1426         if (params->seq_len)
1427                 lbs_deb_hex(LBS_DEB_CFG80211, "SEQ",
1428                             params->seq, params->seq_len);
1429
1430         switch (params->cipher) {
1431         case WLAN_CIPHER_SUITE_WEP40:
1432         case WLAN_CIPHER_SUITE_WEP104:
1433                 /* actually compare if something has changed ... */
1434                 if ((priv->wep_key_len[idx] != params->key_len) ||
1435                         memcmp(priv->wep_key[idx],
1436                                params->key, params->key_len) != 0) {
1437                         priv->wep_key_len[idx] = params->key_len;
1438                         memcpy(priv->wep_key[idx],
1439                                params->key, params->key_len);
1440                         lbs_set_wep_keys(priv);
1441                 }
1442                 break;
1443         case WLAN_CIPHER_SUITE_TKIP:
1444         case WLAN_CIPHER_SUITE_CCMP:
1445                 key_info = KEY_INFO_WPA_ENABLED | ((idx == 0)
1446                                                    ? KEY_INFO_WPA_UNICAST
1447                                                    : KEY_INFO_WPA_MCAST);
1448                 key_type = (params->cipher == WLAN_CIPHER_SUITE_TKIP)
1449                         ? KEY_TYPE_ID_TKIP
1450                         : KEY_TYPE_ID_AES;
1451                 lbs_set_key_material(priv,
1452                                      key_type,
1453                                      key_info,
1454                                      params->key, params->key_len);
1455                 break;
1456         default:
1457                 lbs_pr_err("unhandled cipher 0x%x\n", params->cipher);
1458                 ret = -ENOTSUPP;
1459                 break;
1460         }
1461
1462         return ret;
1463 }
1464
1465
1466 static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
1467                            u8 key_index, const u8 *mac_addr)
1468 {
1469
1470         lbs_deb_enter(LBS_DEB_CFG80211);
1471
1472         lbs_deb_assoc("del_key: key_idx %d, mac_addr %pM\n",
1473                       key_index, mac_addr);
1474
1475 #ifdef TODO
1476         struct lbs_private *priv = wiphy_priv(wiphy);
1477         /*
1478          * I think can keep this a NO-OP, because:
1479
1480          * - we clear all keys whenever we do lbs_cfg_connect() anyway
1481          * - neither "iw" nor "wpa_supplicant" won't call this during
1482          *   an ongoing connection
1483          * - TODO: but I have to check if this is still true when
1484          *   I set the AP to periodic re-keying
1485          * - we've not kzallec() something when we've added a key at
1486          *   lbs_cfg_connect() or lbs_cfg_add_key().
1487          *
1488          * This causes lbs_cfg_del_key() only called at disconnect time,
1489          * where we'd just waste time deleting a key that is not going
1490          * to be used anyway.
1491          */
1492         if (key_index < 3 && priv->wep_key_len[key_index]) {
1493                 priv->wep_key_len[key_index] = 0;
1494                 lbs_set_wep_keys(priv);
1495         }
1496 #endif
1497
1498         return 0;
1499 }
1500
1501
1502 /***************************************************************************
1503  * Get station
1504  */
1505
1506 static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
1507                               u8 *mac, struct station_info *sinfo)
1508 {
1509         struct lbs_private *priv = wiphy_priv(wiphy);
1510         s8 signal, noise;
1511         int ret;
1512         size_t i;
1513
1514         lbs_deb_enter(LBS_DEB_CFG80211);
1515
1516         sinfo->filled |= STATION_INFO_TX_BYTES |
1517                          STATION_INFO_TX_PACKETS |
1518                          STATION_INFO_RX_BYTES |
1519                          STATION_INFO_RX_PACKETS;
1520         sinfo->tx_bytes = priv->dev->stats.tx_bytes;
1521         sinfo->tx_packets = priv->dev->stats.tx_packets;
1522         sinfo->rx_bytes = priv->dev->stats.rx_bytes;
1523         sinfo->rx_packets = priv->dev->stats.rx_packets;
1524
1525         /* Get current RSSI */
1526         ret = lbs_get_rssi(priv, &signal, &noise);
1527         if (ret == 0) {
1528                 sinfo->signal = signal;
1529                 sinfo->filled |= STATION_INFO_SIGNAL;
1530         }
1531
1532         /* Convert priv->cur_rate from hw_value to NL80211 value */
1533         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
1534                 if (priv->cur_rate == lbs_rates[i].hw_value) {
1535                         sinfo->txrate.legacy = lbs_rates[i].bitrate;
1536                         sinfo->filled |= STATION_INFO_TX_BITRATE;
1537                         break;
1538                 }
1539         }
1540
1541         return 0;
1542 }
1543
1544
1545
1546
1547 /***************************************************************************
1548  * "Site survey", here just current channel and noise level
1549  */
1550
1551 static int lbs_get_survey(struct wiphy *wiphy, struct net_device *dev,
1552         int idx, struct survey_info *survey)
1553 {
1554         struct lbs_private *priv = wiphy_priv(wiphy);
1555         s8 signal, noise;
1556         int ret;
1557
1558         if (idx != 0)
1559                 ret = -ENOENT;
1560
1561         lbs_deb_enter(LBS_DEB_CFG80211);
1562
1563         survey->channel = ieee80211_get_channel(wiphy,
1564                 ieee80211_channel_to_frequency(priv->channel));
1565
1566         ret = lbs_get_rssi(priv, &signal, &noise);
1567         if (ret == 0) {
1568                 survey->filled = SURVEY_INFO_NOISE_DBM;
1569                 survey->noise = noise;
1570         }
1571
1572         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1573         return ret;
1574 }
1575
1576
1577
1578
1579 /***************************************************************************
1580  * Change interface
1581  */
1582
1583 static int lbs_change_intf(struct wiphy *wiphy, struct net_device *dev,
1584         enum nl80211_iftype type, u32 *flags,
1585                struct vif_params *params)
1586 {
1587         struct lbs_private *priv = wiphy_priv(wiphy);
1588         int ret = 0;
1589
1590         lbs_deb_enter(LBS_DEB_CFG80211);
1591
1592         switch (type) {
1593         case NL80211_IFTYPE_MONITOR:
1594                 ret = lbs_set_monitor_mode(priv, 1);
1595                 break;
1596         case NL80211_IFTYPE_STATION:
1597                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1598                         ret = lbs_set_monitor_mode(priv, 0);
1599                 if (!ret)
1600                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 1);
1601                 break;
1602         case NL80211_IFTYPE_ADHOC:
1603                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1604                         ret = lbs_set_monitor_mode(priv, 0);
1605                 if (!ret)
1606                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 2);
1607                 break;
1608         default:
1609                 ret = -ENOTSUPP;
1610         }
1611
1612         if (!ret)
1613                 priv->wdev->iftype = type;
1614
1615         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1616         return ret;
1617 }
1618
1619
1620
1621 /***************************************************************************
1622  * IBSS (Ad-Hoc)
1623  */
1624
1625 /* The firmware needs the following bits masked out of the beacon-derived
1626  * capability field when associating/joining to a BSS:
1627  *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
1628  */
1629 #define CAPINFO_MASK (~(0xda00))
1630
1631
1632 static void lbs_join_post(struct lbs_private *priv,
1633                           struct cfg80211_ibss_params *params,
1634                           u8 *bssid, u16 capability)
1635 {
1636         u8 fake_ie[2 + IEEE80211_MAX_SSID_LEN + /* ssid */
1637                    2 + 4 +                      /* basic rates */
1638                    2 + 1 +                      /* DS parameter */
1639                    2 + 2 +                      /* atim */
1640                    2 + 8];                      /* extended rates */
1641         u8 *fake = fake_ie;
1642
1643         lbs_deb_enter(LBS_DEB_CFG80211);
1644
1645         /*
1646          * For cfg80211_inform_bss, we'll need a fake IE, as we can't get
1647          * the real IE from the firmware. So we fabricate a fake IE based on
1648          * what the firmware actually sends (sniffed with wireshark).
1649          */
1650         /* Fake SSID IE */
1651         *fake++ = WLAN_EID_SSID;
1652         *fake++ = params->ssid_len;
1653         memcpy(fake, params->ssid, params->ssid_len);
1654         fake += params->ssid_len;
1655         /* Fake supported basic rates IE */
1656         *fake++ = WLAN_EID_SUPP_RATES;
1657         *fake++ = 4;
1658         *fake++ = 0x82;
1659         *fake++ = 0x84;
1660         *fake++ = 0x8b;
1661         *fake++ = 0x96;
1662         /* Fake DS channel IE */
1663         *fake++ = WLAN_EID_DS_PARAMS;
1664         *fake++ = 1;
1665         *fake++ = params->channel->hw_value;
1666         /* Fake IBSS params IE */
1667         *fake++ = WLAN_EID_IBSS_PARAMS;
1668         *fake++ = 2;
1669         *fake++ = 0; /* ATIM=0 */
1670         *fake++ = 0;
1671         /* Fake extended rates IE, TODO: don't add this for 802.11b only,
1672          * but I don't know how this could be checked */
1673         *fake++ = WLAN_EID_EXT_SUPP_RATES;
1674         *fake++ = 8;
1675         *fake++ = 0x0c;
1676         *fake++ = 0x12;
1677         *fake++ = 0x18;
1678         *fake++ = 0x24;
1679         *fake++ = 0x30;
1680         *fake++ = 0x48;
1681         *fake++ = 0x60;
1682         *fake++ = 0x6c;
1683         lbs_deb_hex(LBS_DEB_CFG80211, "IE", fake_ie, fake - fake_ie);
1684
1685         cfg80211_inform_bss(priv->wdev->wiphy,
1686                             params->channel,
1687                             bssid,
1688                             0,
1689                             capability,
1690                             params->beacon_interval,
1691                             fake_ie, fake - fake_ie,
1692                             0, GFP_KERNEL);
1693
1694         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
1695         priv->wdev->ssid_len = params->ssid_len;
1696
1697         cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
1698
1699         /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
1700         priv->connect_status = LBS_CONNECTED;
1701         netif_carrier_on(priv->dev);
1702         if (!priv->tx_pending_len)
1703                 netif_wake_queue(priv->dev);
1704
1705         lbs_deb_leave(LBS_DEB_CFG80211);
1706 }
1707
1708 static int lbs_ibss_join_existing(struct lbs_private *priv,
1709         struct cfg80211_ibss_params *params,
1710         struct cfg80211_bss *bss)
1711 {
1712         const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
1713         struct cmd_ds_802_11_ad_hoc_join cmd;
1714         u8 preamble = RADIO_PREAMBLE_SHORT;
1715         int ret = 0;
1716
1717         lbs_deb_enter(LBS_DEB_CFG80211);
1718
1719         /* TODO: set preamble based on scan result */
1720         ret = lbs_set_radio(priv, preamble, 1);
1721         if (ret)
1722                 goto out;
1723
1724         /*
1725          * Example CMD_802_11_AD_HOC_JOIN command:
1726          *
1727          * command         2c 00         CMD_802_11_AD_HOC_JOIN
1728          * size            65 00
1729          * sequence        xx xx
1730          * result          00 00
1731          * bssid           02 27 27 97 2f 96
1732          * ssid            49 42 53 53 00 00 00 00
1733          *                 00 00 00 00 00 00 00 00
1734          *                 00 00 00 00 00 00 00 00
1735          *                 00 00 00 00 00 00 00 00
1736          * type            02            CMD_BSS_TYPE_IBSS
1737          * beacon period   64 00
1738          * dtim period     00
1739          * timestamp       00 00 00 00 00 00 00 00
1740          * localtime       00 00 00 00 00 00 00 00
1741          * IE DS           03
1742          * IE DS len       01
1743          * IE DS channel   01
1744          * reserveed       00 00 00 00
1745          * IE IBSS         06
1746          * IE IBSS len     02
1747          * IE IBSS atim    00 00
1748          * reserved        00 00 00 00
1749          * capability      02 00
1750          * rates           82 84 8b 96 0c 12 18 24 30 48 60 6c 00
1751          * fail timeout    ff 00
1752          * probe delay     00 00
1753          */
1754         memset(&cmd, 0, sizeof(cmd));
1755         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1756
1757         memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN);
1758         memcpy(cmd.bss.ssid, params->ssid, params->ssid_len);
1759         cmd.bss.type = CMD_BSS_TYPE_IBSS;
1760         cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval);
1761         cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS;
1762         cmd.bss.ds.header.len = 1;
1763         cmd.bss.ds.channel = params->channel->hw_value;
1764         cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1765         cmd.bss.ibss.header.len = 2;
1766         cmd.bss.ibss.atimwindow = 0;
1767         cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
1768
1769         /* set rates to the intersection of our rates and the rates in the
1770            bss */
1771         if (!rates_eid) {
1772                 lbs_add_rates(cmd.bss.rates);
1773         } else {
1774                 int hw, i;
1775                 u8 rates_max = rates_eid[1];
1776                 u8 *rates = cmd.bss.rates;
1777                 for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
1778                         u8 hw_rate = lbs_rates[hw].bitrate / 5;
1779                         for (i = 0; i < rates_max; i++) {
1780                                 if (hw_rate == (rates_eid[i+2] & 0x7f)) {
1781                                         u8 rate = rates_eid[i+2];
1782                                         if (rate == 0x02 || rate == 0x04 ||
1783                                             rate == 0x0b || rate == 0x16)
1784                                                 rate |= 0x80;
1785                                         *rates++ = rate;
1786                                 }
1787                         }
1788                 }
1789         }
1790
1791         /* Only v8 and below support setting this */
1792         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
1793                 cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
1794                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1795         }
1796         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
1797         if (ret)
1798                 goto out;
1799
1800         /*
1801          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1802          *
1803          * response        2c 80
1804          * size            09 00
1805          * sequence        xx xx
1806          * result          00 00
1807          * reserved        00
1808          */
1809         lbs_join_post(priv, params, bss->bssid, bss->capability);
1810
1811  out:
1812         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1813         return ret;
1814 }
1815
1816
1817
1818 static int lbs_ibss_start_new(struct lbs_private *priv,
1819         struct cfg80211_ibss_params *params)
1820 {
1821         struct cmd_ds_802_11_ad_hoc_start cmd;
1822         struct cmd_ds_802_11_ad_hoc_result *resp =
1823                 (struct cmd_ds_802_11_ad_hoc_result *) &cmd;
1824         u8 preamble = RADIO_PREAMBLE_SHORT;
1825         int ret = 0;
1826         u16 capability;
1827
1828         lbs_deb_enter(LBS_DEB_CFG80211);
1829
1830         ret = lbs_set_radio(priv, preamble, 1);
1831         if (ret)
1832                 goto out;
1833
1834         /*
1835          * Example CMD_802_11_AD_HOC_START command:
1836          *
1837          * command         2b 00         CMD_802_11_AD_HOC_START
1838          * size            b1 00
1839          * sequence        xx xx
1840          * result          00 00
1841          * ssid            54 45 53 54 00 00 00 00
1842          *                 00 00 00 00 00 00 00 00
1843          *                 00 00 00 00 00 00 00 00
1844          *                 00 00 00 00 00 00 00 00
1845          * bss type        02
1846          * beacon period   64 00
1847          * dtim period     00
1848          * IE IBSS         06
1849          * IE IBSS len     02
1850          * IE IBSS atim    00 00
1851          * reserved        00 00 00 00
1852          * IE DS           03
1853          * IE DS len       01
1854          * IE DS channel   01
1855          * reserved        00 00 00 00
1856          * probe delay     00 00
1857          * capability      02 00
1858          * rates           82 84 8b 96   (basic rates with have bit 7 set)
1859          *                 0c 12 18 24 30 48 60 6c
1860          * padding         100 bytes
1861          */
1862         memset(&cmd, 0, sizeof(cmd));
1863         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1864         memcpy(cmd.ssid, params->ssid, params->ssid_len);
1865         cmd.bsstype = CMD_BSS_TYPE_IBSS;
1866         cmd.beaconperiod = cpu_to_le16(params->beacon_interval);
1867         cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1868         cmd.ibss.header.len = 2;
1869         cmd.ibss.atimwindow = 0;
1870         cmd.ds.header.id = WLAN_EID_DS_PARAMS;
1871         cmd.ds.header.len = 1;
1872         cmd.ds.channel = params->channel->hw_value;
1873         /* Only v8 and below support setting probe delay */
1874         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8)
1875                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1876         /* TODO: mix in WLAN_CAPABILITY_PRIVACY */
1877         capability = WLAN_CAPABILITY_IBSS;
1878         cmd.capability = cpu_to_le16(capability);
1879         lbs_add_rates(cmd.rates);
1880
1881
1882         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
1883         if (ret)
1884                 goto out;
1885
1886         /*
1887          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1888          *
1889          * response        2b 80
1890          * size            14 00
1891          * sequence        xx xx
1892          * result          00 00
1893          * reserved        00
1894          * bssid           02 2b 7b 0f 86 0e
1895          */
1896         lbs_join_post(priv, params, resp->bssid, capability);
1897
1898  out:
1899         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1900         return ret;
1901 }
1902
1903
1904 static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
1905                 struct cfg80211_ibss_params *params)
1906 {
1907         struct lbs_private *priv = wiphy_priv(wiphy);
1908         int ret = 0;
1909         struct cfg80211_bss *bss;
1910         DECLARE_SSID_BUF(ssid_buf);
1911
1912         lbs_deb_enter(LBS_DEB_CFG80211);
1913
1914         if (!params->channel) {
1915                 ret = -ENOTSUPP;
1916                 goto out;
1917         }
1918
1919         ret = lbs_set_channel(priv, params->channel->hw_value);
1920         if (ret)
1921                 goto out;
1922
1923         /* Search if someone is beaconing. This assumes that the
1924          * bss list is populated already */
1925         bss = cfg80211_get_bss(wiphy, params->channel, params->bssid,
1926                 params->ssid, params->ssid_len,
1927                 WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
1928
1929         if (bss) {
1930                 ret = lbs_ibss_join_existing(priv, params, bss);
1931                 cfg80211_put_bss(bss);
1932         } else
1933                 ret = lbs_ibss_start_new(priv, params);
1934
1935
1936  out:
1937         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1938         return ret;
1939 }
1940
1941
1942 static int lbs_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
1943 {
1944         struct lbs_private *priv = wiphy_priv(wiphy);
1945         struct cmd_ds_802_11_ad_hoc_stop cmd;
1946         int ret = 0;
1947
1948         lbs_deb_enter(LBS_DEB_CFG80211);
1949
1950         memset(&cmd, 0, sizeof(cmd));
1951         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1952         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_STOP, &cmd);
1953
1954         /* TODO: consider doing this at MACREG_INT_CODE_ADHOC_BCN_LOST time */
1955         lbs_mac_event_disconnected(priv);
1956
1957         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1958         return ret;
1959 }
1960
1961
1962
1963
1964 /***************************************************************************
1965  * Initialization
1966  */
1967
1968 static struct cfg80211_ops lbs_cfg80211_ops = {
1969         .set_channel = lbs_cfg_set_channel,
1970         .scan = lbs_cfg_scan,
1971         .connect = lbs_cfg_connect,
1972         .disconnect = lbs_cfg_disconnect,
1973         .add_key = lbs_cfg_add_key,
1974         .del_key = lbs_cfg_del_key,
1975         .set_default_key = lbs_cfg_set_default_key,
1976         .get_station = lbs_cfg_get_station,
1977         .dump_survey = lbs_get_survey,
1978         .change_virtual_intf = lbs_change_intf,
1979         .join_ibss = lbs_join_ibss,
1980         .leave_ibss = lbs_leave_ibss,
1981 };
1982
1983
1984 /*
1985  * At this time lbs_private *priv doesn't even exist, so we just allocate
1986  * memory and don't initialize the wiphy further. This is postponed until we
1987  * can talk to the firmware and happens at registration time in
1988  * lbs_cfg_wiphy_register().
1989  */
1990 struct wireless_dev *lbs_cfg_alloc(struct device *dev)
1991 {
1992         int ret = 0;
1993         struct wireless_dev *wdev;
1994
1995         lbs_deb_enter(LBS_DEB_CFG80211);
1996
1997         wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
1998         if (!wdev) {
1999                 dev_err(dev, "cannot allocate wireless device\n");
2000                 return ERR_PTR(-ENOMEM);
2001         }
2002
2003         wdev->wiphy = wiphy_new(&lbs_cfg80211_ops, sizeof(struct lbs_private));
2004         if (!wdev->wiphy) {
2005                 dev_err(dev, "cannot allocate wiphy\n");
2006                 ret = -ENOMEM;
2007                 goto err_wiphy_new;
2008         }
2009
2010         lbs_deb_leave(LBS_DEB_CFG80211);
2011         return wdev;
2012
2013  err_wiphy_new:
2014         kfree(wdev);
2015         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2016         return ERR_PTR(ret);
2017 }
2018
2019
2020 static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
2021 {
2022         struct region_code_mapping {
2023                 const char *cn;
2024                 int code;
2025         };
2026
2027         /* Section 5.17.2 */
2028         static struct region_code_mapping regmap[] = {
2029                 {"US ", 0x10}, /* US FCC */
2030                 {"CA ", 0x20}, /* Canada */
2031                 {"EU ", 0x30}, /* ETSI   */
2032                 {"ES ", 0x31}, /* Spain  */
2033                 {"FR ", 0x32}, /* France */
2034                 {"JP ", 0x40}, /* Japan  */
2035         };
2036         size_t i;
2037
2038         lbs_deb_enter(LBS_DEB_CFG80211);
2039
2040         for (i = 0; i < ARRAY_SIZE(regmap); i++)
2041                 if (regmap[i].code == priv->regioncode) {
2042                         regulatory_hint(priv->wdev->wiphy, regmap[i].cn);
2043                         break;
2044                 }
2045
2046         lbs_deb_leave(LBS_DEB_CFG80211);
2047 }
2048
2049
2050 /*
2051  * This function get's called after lbs_setup_firmware() determined the
2052  * firmware capabities. So we can setup the wiphy according to our
2053  * hardware/firmware.
2054  */
2055 int lbs_cfg_register(struct lbs_private *priv)
2056 {
2057         struct wireless_dev *wdev = priv->wdev;
2058         int ret;
2059
2060         lbs_deb_enter(LBS_DEB_CFG80211);
2061
2062         wdev->wiphy->max_scan_ssids = 1;
2063         wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
2064
2065         wdev->wiphy->interface_modes =
2066                         BIT(NL80211_IFTYPE_STATION) |
2067                         BIT(NL80211_IFTYPE_ADHOC);
2068         if (lbs_rtap_supported(priv))
2069                 wdev->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
2070
2071         wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
2072
2073         /*
2074          * We could check priv->fwcapinfo && FW_CAPINFO_WPA, but I have
2075          * never seen a firmware without WPA
2076          */
2077         wdev->wiphy->cipher_suites = cipher_suites;
2078         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
2079         wdev->wiphy->reg_notifier = lbs_reg_notifier;
2080
2081         ret = wiphy_register(wdev->wiphy);
2082         if (ret < 0)
2083                 lbs_pr_err("cannot register wiphy device\n");
2084
2085         priv->wiphy_registered = true;
2086
2087         ret = register_netdev(priv->dev);
2088         if (ret)
2089                 lbs_pr_err("cannot register network device\n");
2090
2091         INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
2092
2093         lbs_cfg_set_regulatory_hint(priv);
2094
2095         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2096         return ret;
2097 }
2098
2099 int lbs_reg_notifier(struct wiphy *wiphy,
2100                 struct regulatory_request *request)
2101 {
2102         struct lbs_private *priv = wiphy_priv(wiphy);
2103         int ret;
2104
2105         lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
2106                         "callback for domain %c%c\n", request->alpha2[0],
2107                         request->alpha2[1]);
2108
2109         ret = lbs_set_11d_domain_info(priv, request, wiphy->bands);
2110
2111         lbs_deb_leave(LBS_DEB_CFG80211);
2112         return ret;
2113 }
2114
2115 void lbs_scan_deinit(struct lbs_private *priv)
2116 {
2117         lbs_deb_enter(LBS_DEB_CFG80211);
2118         cancel_delayed_work_sync(&priv->scan_work);
2119 }
2120
2121
2122 void lbs_cfg_free(struct lbs_private *priv)
2123 {
2124         struct wireless_dev *wdev = priv->wdev;
2125
2126         lbs_deb_enter(LBS_DEB_CFG80211);
2127
2128         if (!wdev)
2129                 return;
2130
2131         if (priv->wiphy_registered)
2132                 wiphy_unregister(wdev->wiphy);
2133
2134         if (wdev->wiphy)
2135                 wiphy_free(wdev->wiphy);
2136
2137         kfree(wdev);
2138 }