drivers/net/wireless/libertas/cfg.c

   1 /*
   2  * Implement cfg80211 ("iw") support.
   3  *
   4  * Copyright (C) 2009 M&N Solutions GmbH, 61191 Rosbach, Germany
   5  * Holger Schurig <hs4233@mail.mn-solutions.de>
   6  *
   7  */
   8
   9 #include <linux/slab.h>
  10 #include <linux/ieee80211.h>
  11 #include <net/cfg80211.h>
  12 #include <asm/unaligned.h>
  13
  14 #include "decl.h"
  15 #include "cfg.h"
  16 #include "cmd.h"
  17
  18
  19 #define CHAN2G(_channel, _freq, _flags) {        \
  20         .band             = IEEE80211_BAND_2GHZ, \
  21         .center_freq      = (_freq),             \
  22         .hw_value         = (_channel),          \
  23         .flags            = (_flags),            \
  24         .max_antenna_gain = 0,                   \
  25         .max_power        = 30,                  \
  26 }
  27
  28 static struct ieee80211_channel lbs_2ghz_channels[] = {
  29         CHAN2G(1,  2412, 0),
  30         CHAN2G(2,  2417, 0),
  31         CHAN2G(3,  2422, 0),
  32         CHAN2G(4,  2427, 0),
  33         CHAN2G(5,  2432, 0),
  34         CHAN2G(6,  2437, 0),
  35         CHAN2G(7,  2442, 0),
  36         CHAN2G(8,  2447, 0),
  37         CHAN2G(9,  2452, 0),
  38         CHAN2G(10, 2457, 0),
  39         CHAN2G(11, 2462, 0),
  40         CHAN2G(12, 2467, 0),
  41         CHAN2G(13, 2472, 0),
  42         CHAN2G(14, 2484, 0),
  43 };
  44
  45 #define RATETAB_ENT(_rate, _hw_value, _flags) { \
  46         .bitrate  = (_rate),                    \
  47         .hw_value = (_hw_value),                \
  48         .flags    = (_flags),                   \
  49 }
  50
  51
  52 /* Table 6 in section 3.2.1.1 */
  53 static struct ieee80211_rate lbs_rates[] = {
  54         RATETAB_ENT(10,  0,  0),
  55         RATETAB_ENT(20,  1,  0),
  56         RATETAB_ENT(55,  2,  0),
  57         RATETAB_ENT(110, 3,  0),
  58         RATETAB_ENT(60,  9,  0),
  59         RATETAB_ENT(90,  6,  0),
  60         RATETAB_ENT(120, 7,  0),
  61         RATETAB_ENT(180, 8,  0),
  62         RATETAB_ENT(240, 9,  0),
  63         RATETAB_ENT(360, 10, 0),
  64         RATETAB_ENT(480, 11, 0),
  65         RATETAB_ENT(540, 12, 0),
  66 };
  67
  68 static struct ieee80211_supported_band lbs_band_2ghz = {
  69         .channels = lbs_2ghz_channels,
  70         .n_channels = ARRAY_SIZE(lbs_2ghz_channels),
  71         .bitrates = lbs_rates,
  72         .n_bitrates = ARRAY_SIZE(lbs_rates),
  73 };
  74
  75
  76 static const u32 cipher_suites[] = {
  77         WLAN_CIPHER_SUITE_WEP40,
  78         WLAN_CIPHER_SUITE_WEP104,
  79         WLAN_CIPHER_SUITE_TKIP,
  80         WLAN_CIPHER_SUITE_CCMP,
  81 };
  82
  83 /* Time to stay on the channel */
  84 #define LBS_DWELL_PASSIVE 100
  85 #define LBS_DWELL_ACTIVE  40
  86
  87
  88 /***************************************************************************
  89  * Misc utility functions
  90  *
  91  * TLVs are Marvell specific. They are very similar to IEs, they have the
  92  * same structure: type, length, data*. The only difference: for IEs, the
  93  * type and length are u8, but for TLVs they're __le16.
  94  */
  95
  96 /*
  97  * Convert NL80211's auth_type to the one from Libertas, see chapter 5.9.1
  98  * in the firmware spec
  99  */
 100 static u8 lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
 101 {
 102         int ret = -ENOTSUPP;
 103
 104         switch (auth_type) {
 105         case NL80211_AUTHTYPE_OPEN_SYSTEM:
 106         case NL80211_AUTHTYPE_SHARED_KEY:
 107                 ret = auth_type;
 108                 break;
 109         case NL80211_AUTHTYPE_AUTOMATIC:
 110                 ret = NL80211_AUTHTYPE_OPEN_SYSTEM;
 111                 break;
 112         case NL80211_AUTHTYPE_NETWORK_EAP:
 113                 ret = 0x80;
 114                 break;
 115         default:
 116                 /* silence compiler */
 117                 break;
 118         }
 119         return ret;
 120 }
 121
 122
 123 /* Various firmware commands need the list of supported rates, but with
 124    the hight-bit set for basic rates */
 125 static int lbs_add_rates(u8 *rates)
 126 {
 127         size_t i;
 128
 129         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
 130                 u8 rate = lbs_rates[i].bitrate / 5;
 131                 if (rate == 0x02 || rate == 0x04 ||
 132                     rate == 0x0b || rate == 0x16)
 133                         rate |= 0x80;
 134                 rates[i] = rate;
 135         }
 136         return ARRAY_SIZE(lbs_rates);
 137 }
 138
 139
 140 /***************************************************************************
 141  * TLV utility functions
 142  *
 143  * TLVs are Marvell specific. They are very similar to IEs, they have the
 144  * same structure: type, length, data*. The only difference: for IEs, the
 145  * type and length are u8, but for TLVs they're __le16.
 146  */
 147
 148
 149 /*
 150  * Add ssid TLV
 151  */
 152 #define LBS_MAX_SSID_TLV_SIZE                   \
 153         (sizeof(struct mrvl_ie_header)          \
 154          + IEEE80211_MAX_SSID_LEN)
 155
 156 static int lbs_add_ssid_tlv(u8 *tlv, const u8 *ssid, int ssid_len)
 157 {
 158         struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
 159
 160         /*
 161          * TLV-ID SSID  00 00
 162          * length       06 00
 163          * ssid         4d 4e 54 45 53 54
 164          */
 165         ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
 166         ssid_tlv->header.len = cpu_to_le16(ssid_len);
 167         memcpy(ssid_tlv->ssid, ssid, ssid_len);
 168         return sizeof(ssid_tlv->header) + ssid_len;
 169 }
 170
 171
 172 /*
 173  * Add channel list TLV (section 8.4.2)
 174  *
 175  * Actual channel data comes from priv->wdev->wiphy->channels.
 176  */
 177 #define LBS_MAX_CHANNEL_LIST_TLV_SIZE                                   \
 178         (sizeof(struct mrvl_ie_header)                                  \
 179          + (LBS_SCAN_BEFORE_NAP * sizeof(struct chanscanparamset)))
 180
 181 static int lbs_add_channel_list_tlv(struct lbs_private *priv, u8 *tlv,
 182                                     int last_channel, int active_scan)
 183 {
 184         int chanscanparamsize = sizeof(struct chanscanparamset) *
 185                 (last_channel - priv->scan_channel);
 186
 187         struct mrvl_ie_header *header = (void *) tlv;
 188
 189         /*
 190          * TLV-ID CHANLIST  01 01
 191          * length           0e 00
 192          * channel          00 01 00 00 00 64 00
 193          *   radio type     00
 194          *   channel           01
 195          *   scan type            00
 196          *   min scan time           00 00
 197          *   max scan time                 64 00
 198          * channel 2        00 02 00 00 00 64 00
 199          *
 200          */
 201
 202         header->type = cpu_to_le16(TLV_TYPE_CHANLIST);
 203         header->len  = cpu_to_le16(chanscanparamsize);
 204         tlv += sizeof(struct mrvl_ie_header);
 205
 206         /* lbs_deb_scan("scan: channels %d to %d\n", priv->scan_channel,
 207                      last_channel); */
 208         memset(tlv, 0, chanscanparamsize);
 209
 210         while (priv->scan_channel < last_channel) {
 211                 struct chanscanparamset *param = (void *) tlv;
 212
 213                 param->radiotype = CMD_SCAN_RADIO_TYPE_BG;
 214                 param->channumber =
 215                         priv->scan_req->channels[priv->scan_channel]->hw_value;
 216                 if (active_scan) {
 217                         param->maxscantime = cpu_to_le16(LBS_DWELL_ACTIVE);
 218                 } else {
 219                         param->chanscanmode.passivescan = 1;
 220                         param->maxscantime = cpu_to_le16(LBS_DWELL_PASSIVE);
 221                 }
 222                 tlv += sizeof(struct chanscanparamset);
 223                 priv->scan_channel++;
 224         }
 225         return sizeof(struct mrvl_ie_header) + chanscanparamsize;
 226 }
 227
 228
 229 /*
 230  * Add rates TLV
 231  *
 232  * The rates are in lbs_bg_rates[], but for the 802.11b
 233  * rates the high bit is set. We add this TLV only because
 234  * there's a firmware which otherwise doesn't report all
 235  * APs in range.
 236  */
 237 #define LBS_MAX_RATES_TLV_SIZE                  \
 238         (sizeof(struct mrvl_ie_header)          \
 239          + (ARRAY_SIZE(lbs_rates)))
 240
 241 /* Adds a TLV with all rates the hardware supports */
 242 static int lbs_add_supported_rates_tlv(u8 *tlv)
 243 {
 244         size_t i;
 245         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
 246
 247         /*
 248          * TLV-ID RATES  01 00
 249          * length        0e 00
 250          * rates         82 84 8b 96 0c 12 18 24 30 48 60 6c
 251          */
 252         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
 253         tlv += sizeof(rate_tlv->header);
 254         i = lbs_add_rates(tlv);
 255         tlv += i;
 256         rate_tlv->header.len = cpu_to_le16(i);
 257         return sizeof(rate_tlv->header) + i;
 258 }
 259
 260 /* Add common rates from a TLV and return the new end of the TLV */
 261 static u8 *
 262 add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
 263 {
 264         int hw, ap, ap_max = ie[1];
 265         u8 hw_rate;
 266
 267         /* Advance past IE header */
 268         ie += 2;
 269
 270         lbs_deb_hex(LBS_DEB_ASSOC, "AP IE Rates", (u8 *) ie, ap_max);
 271
 272         for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
 273                 hw_rate = lbs_rates[hw].bitrate / 5;
 274                 for (ap = 0; ap < ap_max; ap++) {
 275                         if (hw_rate == (ie[ap] & 0x7f)) {
 276                                 *tlv++ = ie[ap];
 277                                 *nrates = *nrates + 1;
 278                         }
 279                 }
 280         }
 281         return tlv;
 282 }
 283
 284 /*
 285  * Adds a TLV with all rates the hardware *and* BSS supports.
 286  */
 287 static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
 288 {
 289         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
 290         const u8 *rates_eid, *ext_rates_eid;
 291         int n = 0;
 292
 293         rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
 294         ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
 295
 296         /*
 297          * 01 00                   TLV_TYPE_RATES
 298          * 04 00                   len
 299          * 82 84 8b 96             rates
 300          */
 301         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
 302         tlv += sizeof(rate_tlv->header);
 303
 304         /* Add basic rates */
 305         if (rates_eid) {
 306                 tlv = add_ie_rates(tlv, rates_eid, &n);
 307
 308                 /* Add extended rates, if any */
 309                 if (ext_rates_eid)
 310                         tlv = add_ie_rates(tlv, ext_rates_eid, &n);
 311         } else {
 312                 lbs_deb_assoc("assoc: bss had no basic rate IE\n");
 313                 /* Fallback: add basic 802.11b rates */
 314                 *tlv++ = 0x82;
 315                 *tlv++ = 0x84;
 316                 *tlv++ = 0x8b;
 317                 *tlv++ = 0x96;
 318                 n = 4;
 319         }
 320
 321         rate_tlv->header.len = cpu_to_le16(n);
 322         return sizeof(rate_tlv->header) + n;
 323 }
 324
 325
 326 /*
 327  * Add auth type TLV.
 328  *
 329  * This is only needed for newer firmware (V9 and up).
 330  */
 331 #define LBS_MAX_AUTH_TYPE_TLV_SIZE \
 332         sizeof(struct mrvl_ie_auth_type)
 333
 334 static int lbs_add_auth_type_tlv(u8 *tlv, enum nl80211_auth_type auth_type)
 335 {
 336         struct mrvl_ie_auth_type *auth = (void *) tlv;
 337
 338         /*
 339          * 1f 01  TLV_TYPE_AUTH_TYPE
 340          * 01 00  len
 341          * 01     auth type
 342          */
 343         auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
 344         auth->header.len = cpu_to_le16(sizeof(*auth)-sizeof(auth->header));
 345         auth->auth = cpu_to_le16(lbs_auth_to_authtype(auth_type));
 346         return sizeof(*auth);
 347 }
 348
 349
 350 /*
 351  * Add channel (phy ds) TLV
 352  */
 353 #define LBS_MAX_CHANNEL_TLV_SIZE \
 354         sizeof(struct mrvl_ie_header)
 355
 356 static int lbs_add_channel_tlv(u8 *tlv, u8 channel)
 357 {
 358         struct mrvl_ie_ds_param_set *ds = (void *) tlv;
 359
 360         /*
 361          * 03 00  TLV_TYPE_PHY_DS
 362          * 01 00  len
 363          * 06     channel
 364          */
 365         ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
 366         ds->header.len = cpu_to_le16(sizeof(*ds)-sizeof(ds->header));
 367         ds->channel = channel;
 368         return sizeof(*ds);
 369 }
 370
 371
 372 /*
 373  * Add (empty) CF param TLV of the form:
 374  */
 375 #define LBS_MAX_CF_PARAM_TLV_SIZE               \
 376         sizeof(struct mrvl_ie_header)
 377
 378 static int lbs_add_cf_param_tlv(u8 *tlv)
 379 {
 380         struct mrvl_ie_cf_param_set *cf = (void *)tlv;
 381
 382         /*
 383          * 04 00  TLV_TYPE_CF
 384          * 06 00  len
 385          * 00     cfpcnt
 386          * 00     cfpperiod
 387          * 00 00  cfpmaxduration
 388          * 00 00  cfpdurationremaining
 389          */
 390         cf->header.type = cpu_to_le16(TLV_TYPE_CF);
 391         cf->header.len = cpu_to_le16(sizeof(*cf)-sizeof(cf->header));
 392         return sizeof(*cf);
 393 }
 394
 395 /*
 396  * Add WPA TLV
 397  */
 398 #define LBS_MAX_WPA_TLV_SIZE                    \
 399         (sizeof(struct mrvl_ie_header)          \
 400          + 128 /* TODO: I guessed the size */)
 401
 402 static int lbs_add_wpa_tlv(u8 *tlv, const u8 *ie, u8 ie_len)
 403 {
 404         size_t tlv_len;
 405
 406         /*
 407          * We need just convert an IE to an TLV. IEs use u8 for the header,
 408          *   u8      type
 409          *   u8      len
 410          *   u8[]    data
 411          * but TLVs use __le16 instead:
 412          *   __le16  type
 413          *   __le16  len
 414          *   u8[]    data
 415          */
 416         *tlv++ = *ie++;
 417         *tlv++ = 0;
 418         tlv_len = *tlv++ = *ie++;
 419         *tlv++ = 0;
 420         while (tlv_len--)
 421                 *tlv++ = *ie++;
 422         /* the TLV is two bytes larger than the IE */
 423         return ie_len + 2;
 424 }
 425
 426 /***************************************************************************
 427  * Set Channel
 428  */
 429
 430 static int lbs_cfg_set_channel(struct wiphy *wiphy,
 431         struct net_device *netdev,
 432         struct ieee80211_channel *channel,
 433         enum nl80211_channel_type channel_type)
 434 {
 435         struct lbs_private *priv = wiphy_priv(wiphy);
 436         int ret = -ENOTSUPP;
 437
 438         lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d",
 439                            channel->center_freq, channel_type);
 440
 441         if (channel_type != NL80211_CHAN_NO_HT)
 442                 goto out;
 443
 444         ret = lbs_set_channel(priv, channel->hw_value);
 445
 446  out:
 447         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
 448         return ret;
 449 }
 450
 451
 452
 453 /***************************************************************************
 454  * Scanning
 455  */
 456
 457 /*
 458  * When scanning, the firmware doesn't send a nul packet with the power-safe
 459  * bit to the AP. So we cannot stay away from our current channel too long,
 460  * otherwise we loose data. So take a "nap" while scanning every other
 461  * while.
 462  */
 463 #define LBS_SCAN_BEFORE_NAP 4
 464
 465
 466 /*
 467  * When the firmware reports back a scan-result, it gives us an "u8 rssi",
 468  * which isn't really an RSSI, as it becomes larger when moving away from
 469  * the AP. Anyway, we need to convert that into mBm.
 470  */
 471 #define LBS_SCAN_RSSI_TO_MBM(rssi) \
 472         ((-(int)rssi + 3)*100)
 473
 474 static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
 475         struct cmd_header *resp)
 476 {
 477         struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
 478         int bsssize;
 479         const u8 *pos;
 480         u16 nr_sets;
 481         const u8 *tsfdesc;
 482         int tsfsize;
 483         int i;
 484         int ret = -EILSEQ;
 485
 486         lbs_deb_enter(LBS_DEB_CFG80211);
 487
 488         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
 489         nr_sets = le16_to_cpu(scanresp->nr_sets);
 490
 491         lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
 492                         nr_sets, bsssize, le16_to_cpu(resp->size));
 493
 494         if (nr_sets == 0) {
 495                 ret = 0;
 496                 goto done;
 497         }
 498
 499         /*
 500          * The general layout of the scan response is described in chapter
 501          * 5.7.1. Basically we have a common part, then any number of BSS
 502          * descriptor sections. Finally we have section with the same number
 503          * of TSFs.
 504          *
 505          * cmd_ds_802_11_scan_rsp
 506          *   cmd_header
 507          *   pos_size
 508          *   nr_sets
 509          *   bssdesc 1
 510          *     bssid
 511          *     rssi
 512          *     timestamp
 513          *     intvl
 514          *     capa
 515          *     IEs
 516          *   bssdesc 2
 517          *   bssdesc n
 518          *   MrvlIEtypes_TsfFimestamp_t
 519          *     TSF for BSS 1
 520          *     TSF for BSS 2
 521          *     TSF for BSS n
 522          */
 523
 524         pos = scanresp->bssdesc_and_tlvbuffer;
 525
 526         tsfdesc = pos + bsssize;
 527         tsfsize = 4 + 8 * scanresp->nr_sets;
 528
 529         /* Validity check: we expect a Marvell-Local TLV */
 530         i = get_unaligned_le16(tsfdesc);
 531         tsfdesc += 2;
 532         if (i != TLV_TYPE_TSFTIMESTAMP)
 533                 goto done;
 534         /* Validity check: the TLV holds TSF values with 8 bytes each, so
 535          * the size in the TLV must match the nr_sets value */
 536         i = get_unaligned_le16(tsfdesc);
 537         tsfdesc += 2;
 538         if (i / 8 != scanresp->nr_sets)
 539                 goto done;
 540
 541         for (i = 0; i < scanresp->nr_sets; i++) {
 542                 const u8 *bssid;
 543                 const u8 *ie;
 544                 int left;
 545                 int ielen;
 546                 int rssi;
 547                 u16 intvl;
 548                 u16 capa;
 549                 int chan_no = -1;
 550                 const u8 *ssid = NULL;
 551                 u8 ssid_len = 0;
 552                 DECLARE_SSID_BUF(ssid_buf);
 553
 554                 int len = get_unaligned_le16(pos);
 555                 pos += 2;
 556
 557                 /* BSSID */
 558                 bssid = pos;
 559                 pos += ETH_ALEN;
 560                 /* RSSI */
 561                 rssi = *pos++;
 562                 /* Packet time stamp */
 563                 pos += 8;
 564                 /* Beacon interval */
 565                 intvl = get_unaligned_le16(pos);
 566                 pos += 2;
 567                 /* Capabilities */
 568                 capa = get_unaligned_le16(pos);
 569                 pos += 2;
 570
 571                 /* To find out the channel, we must parse the IEs */
 572                 ie = pos;
 573                 /* 6+1+8+2+2: size of BSSID, RSSI, time stamp, beacon
 574                    interval, capabilities */
 575                 ielen = left = len - (6 + 1 + 8 + 2 + 2);
 576                 while (left >= 2) {
 577                         u8 id, elen;
 578                         id = *pos++;
 579                         elen = *pos++;
 580                         left -= 2;
 581                         if (elen > left || elen == 0)
 582                                 goto done;
 583                         if (id == WLAN_EID_DS_PARAMS)
 584                                 chan_no = *pos;
 585                         if (id == WLAN_EID_SSID) {
 586                                 ssid = pos;
 587                                 ssid_len = elen;
 588                         }
 589                         left -= elen;
 590                         pos += elen;
 591                 }
 592
 593                 /* No channel, no luck */
 594                 if (chan_no != -1) {
 595                         struct wiphy *wiphy = priv->wdev->wiphy;
 596                         int freq = ieee80211_channel_to_frequency(chan_no);
 597                         struct ieee80211_channel *channel =
 598                                 ieee80211_get_channel(wiphy, freq);
 599
 600                         lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %s, "
 601                                      "%d dBm\n",
 602                                      bssid, capa, chan_no,
 603                                      print_ssid(ssid_buf, ssid, ssid_len),
 604                                      LBS_SCAN_RSSI_TO_MBM(rssi)/100);
 605
 606                         if (channel ||
 607                             !(channel->flags & IEEE80211_CHAN_DISABLED))
 608                                 cfg80211_inform_bss(wiphy, channel,
 609                                         bssid, le64_to_cpu(*(__le64 *)tsfdesc),
 610                                         capa, intvl, ie, ielen,
 611                                         LBS_SCAN_RSSI_TO_MBM(rssi),
 612                                         GFP_KERNEL);
 613                 }
 614                 tsfdesc += 8;
 615         }
 616         ret = 0;
 617
 618  done:
 619         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
 620         return ret;
 621 }
 622
 623
 624 /*
 625  * Our scan command contains a TLV, consting of a SSID TLV, a channel list
 626  * TLV and a rates TLV. Determine the maximum size of them:
 627  */
 628 #define LBS_SCAN_MAX_CMD_SIZE                   \
 629         (sizeof(struct cmd_ds_802_11_scan)      \
 630          + LBS_MAX_SSID_TLV_SIZE                \
 631          + LBS_MAX_CHANNEL_LIST_TLV_SIZE        \
 632          + LBS_MAX_RATES_TLV_SIZE)
 633
 634 /*
 635  * Assumes priv->scan_req is initialized and valid
 636  * Assumes priv->scan_channel is initialized
 637  */
 638 static void lbs_scan_worker(struct work_struct *work)
 639 {
 640         struct lbs_private *priv =
 641                 container_of(work, struct lbs_private, scan_work.work);
 642         struct cmd_ds_802_11_scan *scan_cmd;
 643         u8 *tlv; /* pointer into our current, growing TLV storage area */
 644         int last_channel;
 645         int running, carrier;
 646
 647         lbs_deb_enter(LBS_DEB_SCAN);
 648
 649         scan_cmd = kzalloc(LBS_SCAN_MAX_CMD_SIZE, GFP_KERNEL);
 650         if (scan_cmd == NULL)
 651                 goto out_no_scan_cmd;
 652
 653         /* prepare fixed part of scan command */
 654         scan_cmd->bsstype = CMD_BSS_TYPE_ANY;
 655
 656         /* stop network while we're away from our main channel */
 657         running = !netif_queue_stopped(priv->dev);
 658         carrier = netif_carrier_ok(priv->dev);
 659         if (running)
 660                 netif_stop_queue(priv->dev);
 661         if (carrier)
 662                 netif_carrier_off(priv->dev);
 663
 664         /* prepare fixed part of scan command */
 665         tlv = scan_cmd->tlvbuffer;
 666
 667         /* add SSID TLV */
 668         if (priv->scan_req->n_ssids)
 669                 tlv += lbs_add_ssid_tlv(tlv,
 670                                         priv->scan_req->ssids[0].ssid,
 671                                         priv->scan_req->ssids[0].ssid_len);
 672
 673         /* add channel TLVs */
 674         last_channel = priv->scan_channel + LBS_SCAN_BEFORE_NAP;
 675         if (last_channel > priv->scan_req->n_channels)
 676                 last_channel = priv->scan_req->n_channels;
 677         tlv += lbs_add_channel_list_tlv(priv, tlv, last_channel,
 678                 priv->scan_req->n_ssids);
 679
 680         /* add rates TLV */
 681         tlv += lbs_add_supported_rates_tlv(tlv);
 682
 683         if (priv->scan_channel < priv->scan_req->n_channels) {
 684                 cancel_delayed_work(&priv->scan_work);
 685                 queue_delayed_work(priv->work_thread, &priv->scan_work,
 686                         msecs_to_jiffies(300));
 687         }
 688
 689         /* This is the final data we are about to send */
 690         scan_cmd->hdr.size = cpu_to_le16(tlv - (u8 *)scan_cmd);
 691         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
 692                     sizeof(*scan_cmd));
 693         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
 694                     tlv - scan_cmd->tlvbuffer);
 695
 696         __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
 697                 le16_to_cpu(scan_cmd->hdr.size),
 698                 lbs_ret_scan, 0);
 699
 700         if (priv->scan_channel >= priv->scan_req->n_channels) {
 701                 /* Mark scan done */
 702                 if (priv->internal_scan)
 703                         kfree(priv->scan_req);
 704                 else
 705                         cfg80211_scan_done(priv->scan_req, false);
 706
 707                 priv->scan_req = NULL;
 708                 priv->last_scan = jiffies;
 709         }
 710
 711         /* Restart network */
 712         if (carrier)
 713                 netif_carrier_on(priv->dev);
 714         if (running && !priv->tx_pending_len)
 715                 netif_wake_queue(priv->dev);
 716
 717         kfree(scan_cmd);
 718
 719         /* Wake up anything waiting on scan completion */
 720         if (priv->scan_req == NULL) {
 721                 lbs_deb_scan("scan: waking up waiters\n");
 722                 wake_up_all(&priv->scan_q);
 723         }
 724
 725  out_no_scan_cmd:
 726         lbs_deb_leave(LBS_DEB_SCAN);
 727 }
 728
 729 static void _internal_start_scan(struct lbs_private *priv, bool internal,
 730         struct cfg80211_scan_request *request)
 731 {
 732         lbs_deb_enter(LBS_DEB_CFG80211);
 733
 734         lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
 735                 request->n_ssids, request->n_channels, request->ie_len);
 736
 737         priv->scan_channel = 0;
 738         queue_delayed_work(priv->work_thread, &priv->scan_work,
 739                 msecs_to_jiffies(50));
 740
 741         priv->scan_req = request;
 742         priv->internal_scan = internal;
 743
 744         lbs_deb_leave(LBS_DEB_CFG80211);
 745 }
 746
 747 static int lbs_cfg_scan(struct wiphy *wiphy,
 748         struct net_device *dev,
 749         struct cfg80211_scan_request *request)
 750 {
 751         struct lbs_private *priv = wiphy_priv(wiphy);
 752         int ret = 0;
 753
 754         lbs_deb_enter(LBS_DEB_CFG80211);
 755
 756         if (priv->scan_req || delayed_work_pending(&priv->scan_work)) {
 757                 /* old scan request not yet processed */
 758                 ret = -EAGAIN;
 759                 goto out;
 760         }
 761
 762         _internal_start_scan(priv, false, request);
 763
 764         if (priv->surpriseremoved)
 765                 ret = -EIO;
 766
 767  out:
 768         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
 769         return ret;
 770 }
 771
 772
 773
 774
 775 /***************************************************************************
 776  * Events
 777  */
 778
 779 void lbs_send_disconnect_notification(struct lbs_private *priv)
 780 {
 781         lbs_deb_enter(LBS_DEB_CFG80211);
 782
 783         cfg80211_disconnected(priv->dev,
 784                 0,
 785                 NULL, 0,
 786                 GFP_KERNEL);
 787
 788         lbs_deb_leave(LBS_DEB_CFG80211);
 789 }
 790
 791 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
 792 {
 793         lbs_deb_enter(LBS_DEB_CFG80211);
 794
 795         cfg80211_michael_mic_failure(priv->dev,
 796                 priv->assoc_bss,
 797                 event == MACREG_INT_CODE_MIC_ERR_MULTICAST ?
 798                         NL80211_KEYTYPE_GROUP :
 799                         NL80211_KEYTYPE_PAIRWISE,
 800                 -1,
 801                 NULL,
 802                 GFP_KERNEL);
 803
 804         lbs_deb_leave(LBS_DEB_CFG80211);
 805 }
 806
 807
 808
 809
 810 /***************************************************************************
 811  * Connect/disconnect
 812  */
 813
 814
 815 /*
 816  * This removes all WEP keys
 817  */
 818 static int lbs_remove_wep_keys(struct lbs_private *priv)
 819 {
 820         struct cmd_ds_802_11_set_wep cmd;
 821         int ret;
 822
 823         lbs_deb_enter(LBS_DEB_CFG80211);
 824
 825         memset(&cmd, 0, sizeof(cmd));
 826         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 827         cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
 828         cmd.action = cpu_to_le16(CMD_ACT_REMOVE);
 829
 830         ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
 831
 832         lbs_deb_leave(LBS_DEB_CFG80211);
 833         return ret;
 834 }
 835
 836 /*
 837  * Set WEP keys
 838  */
 839 static int lbs_set_wep_keys(struct lbs_private *priv)
 840 {
 841         struct cmd_ds_802_11_set_wep cmd;
 842         int i;
 843         int ret;
 844
 845         lbs_deb_enter(LBS_DEB_CFG80211);
 846
 847         /*
 848          * command         13 00
 849          * size            50 00
 850          * sequence        xx xx
 851          * result          00 00
 852          * action          02 00     ACT_ADD
 853          * transmit key    00 00
 854          * type for key 1  01        WEP40
 855          * type for key 2  00
 856          * type for key 3  00
 857          * type for key 4  00
 858          * key 1           39 39 39 39 39 00 00 00
 859          *                 00 00 00 00 00 00 00 00
 860          * key 2           00 00 00 00 00 00 00 00
 861          *                 00 00 00 00 00 00 00 00
 862          * key 3           00 00 00 00 00 00 00 00
 863          *                 00 00 00 00 00 00 00 00
 864          * key 4           00 00 00 00 00 00 00 00
 865          */
 866         if (priv->wep_key_len[0] || priv->wep_key_len[1] ||
 867             priv->wep_key_len[2] || priv->wep_key_len[3]) {
 868                 /* Only set wep keys if we have at least one of them */
 869                 memset(&cmd, 0, sizeof(cmd));
 870                 cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 871                 cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
 872                 cmd.action = cpu_to_le16(CMD_ACT_ADD);
 873
 874                 for (i = 0; i < 4; i++) {
 875                         switch (priv->wep_key_len[i]) {
 876                         case WLAN_KEY_LEN_WEP40:
 877                                 cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
 878                                 break;
 879                         case WLAN_KEY_LEN_WEP104:
 880                                 cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
 881                                 break;
 882                         default:
 883                                 cmd.keytype[i] = 0;
 884                                 break;
 885                         }
 886                         memcpy(cmd.keymaterial[i], priv->wep_key[i],
 887                                priv->wep_key_len[i]);
 888                 }
 889
 890                 ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
 891         } else {
 892                 /* Otherwise remove all wep keys */
 893                 ret = lbs_remove_wep_keys(priv);
 894         }
 895
 896         lbs_deb_leave(LBS_DEB_CFG80211);
 897         return ret;
 898 }
 899
 900
 901 /*
 902  * Enable/Disable RSN status
 903  */
 904 static int lbs_enable_rsn(struct lbs_private *priv, int enable)
 905 {
 906         struct cmd_ds_802_11_enable_rsn cmd;
 907         int ret;
 908
 909         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", enable);
 910
 911         /*
 912          * cmd       2f 00
 913          * size      0c 00
 914          * sequence  xx xx
 915          * result    00 00
 916          * action    01 00    ACT_SET
 917          * enable    01 00
 918          */
 919         memset(&cmd, 0, sizeof(cmd));
 920         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 921         cmd.action = cpu_to_le16(CMD_ACT_SET);
 922         cmd.enable = cpu_to_le16(enable);
 923
 924         ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
 925
 926         lbs_deb_leave(LBS_DEB_CFG80211);
 927         return ret;
 928 }
 929
 930
 931 /*
 932  * Set WPA/WPA key material
 933  */
 934
 935 /* like "struct cmd_ds_802_11_key_material", but with cmd_header. Once we
 936  * get rid of WEXT, this should go into host.h */
 937
 938 struct cmd_key_material {
 939         struct cmd_header hdr;
 940
 941         __le16 action;
 942         struct MrvlIEtype_keyParamSet param;
 943 } __packed;
 944
 945 static int lbs_set_key_material(struct lbs_private *priv,
 946                                 int key_type,
 947                                 int key_info,
 948                                 u8 *key, u16 key_len)
 949 {
 950         struct cmd_key_material cmd;
 951         int ret;
 952
 953         lbs_deb_enter(LBS_DEB_CFG80211);
 954
 955         /*
 956          * Example for WPA (TKIP):
 957          *
 958          * cmd       5e 00
 959          * size      34 00
 960          * sequence  xx xx
 961          * result    00 00
 962          * action    01 00
 963          * TLV type  00 01    key param
 964          * length    00 26
 965          * key type  01 00    TKIP
 966          * key info  06 00    UNICAST | ENABLED
 967          * key len   20 00
 968          * key       32 bytes
 969          */
 970         memset(&cmd, 0, sizeof(cmd));
 971         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 972         cmd.action = cpu_to_le16(CMD_ACT_SET);
 973         cmd.param.type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
 974         cmd.param.length = cpu_to_le16(sizeof(cmd.param) - 4);
 975         cmd.param.keytypeid = cpu_to_le16(key_type);
 976         cmd.param.keyinfo = cpu_to_le16(key_info);
 977         cmd.param.keylen = cpu_to_le16(key_len);
 978         if (key && key_len)
 979                 memcpy(cmd.param.key, key, key_len);
 980
 981         ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
 982
 983         lbs_deb_leave(LBS_DEB_CFG80211);
 984         return ret;
 985 }
 986
 987
 988 /*
 989  * Sets the auth type (open, shared, etc) in the firmware. That
 990  * we use CMD_802_11_AUTHENTICATE is misleading, this firmware
 991  * command doesn't send an authentication frame at all, it just
 992  * stores the auth_type.
 993  */
 994 static int lbs_set_authtype(struct lbs_private *priv,
 995                             struct cfg80211_connect_params *sme)
 996 {
 997         struct cmd_ds_802_11_authenticate cmd;
 998         int ret;
 999
1000         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", sme->auth_type);
1001
1002         /*
1003          * cmd        11 00
1004          * size       19 00
1005          * sequence   xx xx
1006          * result     00 00
1007          * BSS id     00 13 19 80 da 30
1008          * auth type  00
1009          * reserved   00 00 00 00 00 00 00 00 00 00
1010          */
1011         memset(&cmd, 0, sizeof(cmd));
1012         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1013         if (sme->bssid)
1014                 memcpy(cmd.bssid, sme->bssid, ETH_ALEN);
1015         /* convert auth_type */
1016         ret = lbs_auth_to_authtype(sme->auth_type);
1017         if (ret < 0)
1018                 goto done;
1019
1020         cmd.authtype = ret;
1021         ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
1022
1023  done:
1024         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1025         return ret;
1026 }
1027
1028
1029 /*
1030  * Create association request
1031  */
1032 #define LBS_ASSOC_MAX_CMD_SIZE                     \
1033         (sizeof(struct cmd_ds_802_11_associate)    \
1034          - 512 /* cmd_ds_802_11_associate.iebuf */ \
1035          + LBS_MAX_SSID_TLV_SIZE                   \
1036          + LBS_MAX_CHANNEL_TLV_SIZE                \
1037          + LBS_MAX_CF_PARAM_TLV_SIZE               \
1038          + LBS_MAX_AUTH_TYPE_TLV_SIZE              \
1039          + LBS_MAX_WPA_TLV_SIZE)
1040
1041 static int lbs_associate(struct lbs_private *priv,
1042                 struct cfg80211_bss *bss,
1043                 struct cfg80211_connect_params *sme)
1044 {
1045         struct cmd_ds_802_11_associate_response *resp;
1046         struct cmd_ds_802_11_associate *cmd = kzalloc(LBS_ASSOC_MAX_CMD_SIZE,
1047                                                       GFP_KERNEL);
1048         const u8 *ssid_eid;
1049         size_t len, resp_ie_len;
1050         int status;
1051         int ret;
1052         u8 *pos = &(cmd->iebuf[0]);
1053         u8 *tmp;
1054
1055         lbs_deb_enter(LBS_DEB_CFG80211);
1056
1057         if (!cmd) {
1058                 ret = -ENOMEM;
1059                 goto done;
1060         }
1061
1062         /*
1063          * cmd              50 00
1064          * length           34 00
1065          * sequence         xx xx
1066          * result           00 00
1067          * BSS id           00 13 19 80 da 30
1068          * capabilities     11 00
1069          * listen interval  0a 00
1070          * beacon interval  00 00
1071          * DTIM period      00
1072          * TLVs             xx   (up to 512 bytes)
1073          */
1074         cmd->hdr.command = cpu_to_le16(CMD_802_11_ASSOCIATE);
1075
1076         /* Fill in static fields */
1077         memcpy(cmd->bssid, bss->bssid, ETH_ALEN);
1078         cmd->listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
1079         cmd->capability = cpu_to_le16(bss->capability);
1080
1081         /* add SSID TLV */
1082         ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
1083         if (ssid_eid)
1084                 pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
1085         else
1086                 lbs_deb_assoc("no SSID\n");
1087
1088         /* add DS param TLV */
1089         if (bss->channel)
1090                 pos += lbs_add_channel_tlv(pos, bss->channel->hw_value);
1091         else
1092                 lbs_deb_assoc("no channel\n");
1093
1094         /* add (empty) CF param TLV */
1095         pos += lbs_add_cf_param_tlv(pos);
1096
1097         /* add rates TLV */
1098         tmp = pos + 4; /* skip Marvell IE header */
1099         pos += lbs_add_common_rates_tlv(pos, bss);
1100         lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
1101
1102         /* add auth type TLV */
1103         if (priv->fwrelease >= 0x09000000)
1104                 pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
1105
1106         /* add WPA/WPA2 TLV */
1107         if (sme->ie && sme->ie_len)
1108                 pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len);
1109
1110         len = (sizeof(*cmd) - sizeof(cmd->iebuf)) +
1111                 (u16)(pos - (u8 *) &cmd->iebuf);
1112         cmd->hdr.size = cpu_to_le16(len);
1113
1114         /* store for later use */
1115         memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
1116
1117         ret = lbs_cmd_with_response(priv, CMD_802_11_ASSOCIATE, cmd);
1118         if (ret)
1119                 goto done;
1120
1121
1122         /* generate connect message to cfg80211 */
1123
1124         resp = (void *) cmd; /* recast for easier field access */
1125         status = le16_to_cpu(resp->statuscode);
1126
1127         /* Convert statis code of old firmware */
1128         if (priv->fwrelease < 0x09000000)
1129                 switch (status) {
1130                 case 0:
1131                         break;
1132                 case 1:
1133                         lbs_deb_assoc("invalid association parameters\n");
1134                         status = WLAN_STATUS_CAPS_UNSUPPORTED;
1135                         break;
1136                 case 2:
1137                         lbs_deb_assoc("timer expired while waiting for AP\n");
1138                         status = WLAN_STATUS_AUTH_TIMEOUT;
1139                         break;
1140                 case 3:
1141                         lbs_deb_assoc("association refused by AP\n");
1142                         status = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
1143                         break;
1144                 case 4:
1145                         lbs_deb_assoc("authentication refused by AP\n");
1146                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1147                         break;
1148                 default:
1149                         lbs_deb_assoc("association failure %d\n", status);
1150                         status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1151         }
1152
1153         lbs_deb_assoc("status %d, capability 0x%04x\n", status,
1154                       le16_to_cpu(resp->capability));
1155
1156         resp_ie_len = le16_to_cpu(resp->hdr.size)
1157                 - sizeof(resp->hdr)
1158                 - 6;
1159         cfg80211_connect_result(priv->dev,
1160                                 priv->assoc_bss,
1161                                 sme->ie, sme->ie_len,
1162                                 resp->iebuf, resp_ie_len,
1163                                 status,
1164                                 GFP_KERNEL);
1165
1166         if (status == 0) {
1167                 /* TODO: get rid of priv->connect_status */
1168                 priv->connect_status = LBS_CONNECTED;
1169                 netif_carrier_on(priv->dev);
1170                 if (!priv->tx_pending_len)
1171                         netif_tx_wake_all_queues(priv->dev);
1172         }
1173
1174
1175 done:
1176         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1177         return ret;
1178 }
1179
1180 static struct cfg80211_scan_request *
1181 _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
1182 {
1183         struct cfg80211_scan_request *creq = NULL;
1184         int i, n_channels = 0;
1185         enum ieee80211_band band;
1186
1187         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1188                 if (wiphy->bands[band])
1189                         n_channels += wiphy->bands[band]->n_channels;
1190         }
1191
1192         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1193                        n_channels * sizeof(void *),
1194                        GFP_ATOMIC);
1195         if (!creq)
1196                 return NULL;
1197
1198         /* SSIDs come after channels */
1199         creq->ssids = (void *)&creq->channels[n_channels];
1200         creq->n_channels = n_channels;
1201         creq->n_ssids = 1;
1202
1203         /* Scan all available channels */
1204         i = 0;
1205         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1206                 int j;
1207
1208                 if (!wiphy->bands[band])
1209                         continue;
1210
1211                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1212                         /* ignore disabled channels */
1213                         if (wiphy->bands[band]->channels[j].flags &
1214                                                 IEEE80211_CHAN_DISABLED)
1215                                 continue;
1216
1217                         creq->channels[i] = &wiphy->bands[band]->channels[j];
1218                         i++;
1219                 }
1220         }
1221         if (i) {
1222                 /* Set real number of channels specified in creq->channels[] */
1223                 creq->n_channels = i;
1224
1225                 /* Scan for the SSID we're going to connect to */
1226                 memcpy(creq->ssids[0].ssid, sme->ssid, sme->ssid_len);
1227                 creq->ssids[0].ssid_len = sme->ssid_len;
1228         } else {
1229                 /* No channels found... */
1230                 kfree(creq);
1231                 creq = NULL;
1232         }
1233
1234         return creq;
1235 }
1236
1237 static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
1238                            struct cfg80211_connect_params *sme)
1239 {
1240         struct lbs_private *priv = wiphy_priv(wiphy);
1241         struct cfg80211_bss *bss = NULL;
1242         int ret = 0;
1243         u8 preamble = RADIO_PREAMBLE_SHORT;
1244
1245         lbs_deb_enter(LBS_DEB_CFG80211);
1246
1247         if (!sme->bssid) {
1248                 /* Run a scan if one isn't in-progress already and if the last
1249                  * scan was done more than 2 seconds ago.
1250                  */
1251                 if (priv->scan_req == NULL &&
1252                     time_after(jiffies, priv->last_scan + (2 * HZ))) {
1253                         struct cfg80211_scan_request *creq;
1254
1255                         creq = _new_connect_scan_req(wiphy, sme);
1256                         if (!creq) {
1257                                 ret = -EINVAL;
1258                                 goto done;
1259                         }
1260
1261                         lbs_deb_assoc("assoc: scanning for compatible AP\n");
1262                         _internal_start_scan(priv, true, creq);
1263                 }
1264
1265                 /* Wait for any in-progress scan to complete */
1266                 lbs_deb_assoc("assoc: waiting for scan to complete\n");
1267                 wait_event_interruptible_timeout(priv->scan_q,
1268                                                  (priv->scan_req == NULL),
1269                                                  (15 * HZ));
1270                 lbs_deb_assoc("assoc: scanning competed\n");
1271         }
1272
1273         /* Find the BSS we want using available scan results */
1274         bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
1275                 sme->ssid, sme->ssid_len,
1276                 WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
1277         if (!bss) {
1278                 lbs_pr_err("assoc: bss %pM not in scan results\n",
1279                            sme->bssid);
1280                 ret = -ENOENT;
1281                 goto done;
1282         }
1283         lbs_deb_assoc("trying %pM\n", bss->bssid);
1284         lbs_deb_assoc("cipher 0x%x, key index %d, key len %d\n",
1285                       sme->crypto.cipher_group,
1286                       sme->key_idx, sme->key_len);
1287
1288         /* As this is a new connection, clear locally stored WEP keys */
1289         priv->wep_tx_key = 0;
1290         memset(priv->wep_key, 0, sizeof(priv->wep_key));
1291         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1292
1293         /* set/remove WEP keys */
1294         switch (sme->crypto.cipher_group) {
1295         case WLAN_CIPHER_SUITE_WEP40:
1296         case WLAN_CIPHER_SUITE_WEP104:
1297                 /* Store provided WEP keys in priv-> */
1298                 priv->wep_tx_key = sme->key_idx;
1299                 priv->wep_key_len[sme->key_idx] = sme->key_len;
1300                 memcpy(priv->wep_key[sme->key_idx], sme->key, sme->key_len);
1301                 /* Set WEP keys and WEP mode */
1302                 lbs_set_wep_keys(priv);
1303                 priv->mac_control |= CMD_ACT_MAC_WEP_ENABLE;
1304                 lbs_set_mac_control(priv);
1305                 /* No RSN mode for WEP */
1306                 lbs_enable_rsn(priv, 0);
1307                 break;
1308         case 0: /* there's no WLAN_CIPHER_SUITE_NONE definition */
1309                 /*
1310                  * If we don't have no WEP, no WPA and no WPA2,
1311                  * we remove all keys like in the WPA/WPA2 setup,
1312                  * we just don't set RSN.
1313                  *
1314                  * Therefore: fall-throught
1315                  */
1316         case WLAN_CIPHER_SUITE_TKIP:
1317         case WLAN_CIPHER_SUITE_CCMP:
1318                 /* Remove WEP keys and WEP mode */
1319                 lbs_remove_wep_keys(priv);
1320                 priv->mac_control &= ~CMD_ACT_MAC_WEP_ENABLE;
1321                 lbs_set_mac_control(priv);
1322
1323                 /* clear the WPA/WPA2 keys */
1324                 lbs_set_key_material(priv,
1325                         KEY_TYPE_ID_WEP, /* doesn't matter */
1326                         KEY_INFO_WPA_UNICAST,
1327                         NULL, 0);
1328                 lbs_set_key_material(priv,
1329                         KEY_TYPE_ID_WEP, /* doesn't matter */
1330                         KEY_INFO_WPA_MCAST,
1331                         NULL, 0);
1332                 /* RSN mode for WPA/WPA2 */
1333                 lbs_enable_rsn(priv, sme->crypto.cipher_group != 0);
1334                 break;
1335         default:
1336                 lbs_pr_err("unsupported cipher group 0x%x\n",
1337                            sme->crypto.cipher_group);
1338                 ret = -ENOTSUPP;
1339                 goto done;
1340         }
1341
1342         lbs_set_authtype(priv, sme);
1343         lbs_set_radio(priv, preamble, 1);
1344
1345         /* Do the actual association */
1346         ret = lbs_associate(priv, bss, sme);
1347
1348  done:
1349         if (bss)
1350                 cfg80211_put_bss(bss);
1351         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1352         return ret;
1353 }
1354
1355 static int lbs_cfg_disconnect(struct wiphy *wiphy, struct net_device *dev,
1356         u16 reason_code)
1357 {
1358         struct lbs_private *priv = wiphy_priv(wiphy);
1359         struct cmd_ds_802_11_deauthenticate cmd;
1360
1361         lbs_deb_enter_args(LBS_DEB_CFG80211, "reason_code %d", reason_code);
1362
1363         /* store for lbs_cfg_ret_disconnect() */
1364         priv->disassoc_reason = reason_code;
1365
1366         memset(&cmd, 0, sizeof(cmd));
1367         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1368         /* Mildly ugly to use a locally store my own BSSID ... */
1369         memcpy(cmd.macaddr, &priv->assoc_bss, ETH_ALEN);
1370         cmd.reasoncode = cpu_to_le16(reason_code);
1371
1372         if (lbs_cmd_with_response(priv, CMD_802_11_DEAUTHENTICATE, &cmd))
1373                 return -EFAULT;
1374
1375         cfg80211_disconnected(priv->dev,
1376                         priv->disassoc_reason,
1377                         NULL, 0,
1378                         GFP_KERNEL);
1379         priv->connect_status = LBS_DISCONNECTED;
1380
1381         return 0;
1382 }
1383
1384
1385 static int lbs_cfg_set_default_key(struct wiphy *wiphy,
1386                                    struct net_device *netdev,
1387                                    u8 key_index)
1388 {
1389         struct lbs_private *priv = wiphy_priv(wiphy);
1390
1391         lbs_deb_enter(LBS_DEB_CFG80211);
1392
1393         if (key_index != priv->wep_tx_key) {
1394                 lbs_deb_assoc("set_default_key: to %d\n", key_index);
1395                 priv->wep_tx_key = key_index;
1396                 lbs_set_wep_keys(priv);
1397         }
1398
1399         return 0;
1400 }
1401
1402
1403 static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
1404                            u8 idx, const u8 *mac_addr,
1405                            struct key_params *params)
1406 {
1407         struct lbs_private *priv = wiphy_priv(wiphy);
1408         u16 key_info;
1409         u16 key_type;
1410         int ret = 0;
1411
1412         lbs_deb_enter(LBS_DEB_CFG80211);
1413
1414         lbs_deb_assoc("add_key: cipher 0x%x, mac_addr %pM\n",
1415                       params->cipher, mac_addr);
1416         lbs_deb_assoc("add_key: key index %d, key len %d\n",
1417                       idx, params->key_len);
1418         if (params->key_len)
1419                 lbs_deb_hex(LBS_DEB_CFG80211, "KEY",
1420                             params->key, params->key_len);
1421
1422         lbs_deb_assoc("add_key: seq len %d\n", params->seq_len);
1423         if (params->seq_len)
1424                 lbs_deb_hex(LBS_DEB_CFG80211, "SEQ",
1425                             params->seq, params->seq_len);
1426
1427         switch (params->cipher) {
1428         case WLAN_CIPHER_SUITE_WEP40:
1429         case WLAN_CIPHER_SUITE_WEP104:
1430                 /* actually compare if something has changed ... */
1431                 if ((priv->wep_key_len[idx] != params->key_len) ||
1432                         memcmp(priv->wep_key[idx],
1433                                params->key, params->key_len) != 0) {
1434                         priv->wep_key_len[idx] = params->key_len;
1435                         memcpy(priv->wep_key[idx],
1436                                params->key, params->key_len);
1437                         lbs_set_wep_keys(priv);
1438                 }
1439                 break;
1440         case WLAN_CIPHER_SUITE_TKIP:
1441         case WLAN_CIPHER_SUITE_CCMP:
1442                 key_info = KEY_INFO_WPA_ENABLED | ((idx == 0)
1443                                                    ? KEY_INFO_WPA_UNICAST
1444                                                    : KEY_INFO_WPA_MCAST);
1445                 key_type = (params->cipher == WLAN_CIPHER_SUITE_TKIP)
1446                         ? KEY_TYPE_ID_TKIP
1447                         : KEY_TYPE_ID_AES;
1448                 lbs_set_key_material(priv,
1449                                      key_type,
1450                                      key_info,
1451                                      params->key, params->key_len);
1452                 break;
1453         default:
1454                 lbs_pr_err("unhandled cipher 0x%x\n", params->cipher);
1455                 ret = -ENOTSUPP;
1456                 break;
1457         }
1458
1459         return ret;
1460 }
1461
1462
1463 static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
1464                            u8 key_index, const u8 *mac_addr)
1465 {
1466
1467         lbs_deb_enter(LBS_DEB_CFG80211);
1468
1469         lbs_deb_assoc("del_key: key_idx %d, mac_addr %pM\n",
1470                       key_index, mac_addr);
1471
1472 #ifdef TODO
1473         struct lbs_private *priv = wiphy_priv(wiphy);
1474         /*
1475          * I think can keep this a NO-OP, because:
1476
1477          * - we clear all keys whenever we do lbs_cfg_connect() anyway
1478          * - neither "iw" nor "wpa_supplicant" won't call this during
1479          *   an ongoing connection
1480          * - TODO: but I have to check if this is still true when
1481          *   I set the AP to periodic re-keying
1482          * - we've not kzallec() something when we've added a key at
1483          *   lbs_cfg_connect() or lbs_cfg_add_key().
1484          *
1485          * This causes lbs_cfg_del_key() only called at disconnect time,
1486          * where we'd just waste time deleting a key that is not going
1487          * to be used anyway.
1488          */
1489         if (key_index < 3 && priv->wep_key_len[key_index]) {
1490                 priv->wep_key_len[key_index] = 0;
1491                 lbs_set_wep_keys(priv);
1492         }
1493 #endif
1494
1495         return 0;
1496 }
1497
1498
1499 /***************************************************************************
1500  * Get station
1501  */
1502
1503 static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
1504                               u8 *mac, struct station_info *sinfo)
1505 {
1506         struct lbs_private *priv = wiphy_priv(wiphy);
1507         s8 signal, noise;
1508         int ret;
1509         size_t i;
1510
1511         lbs_deb_enter(LBS_DEB_CFG80211);
1512
1513         sinfo->filled |= STATION_INFO_TX_BYTES |
1514                          STATION_INFO_TX_PACKETS |
1515                          STATION_INFO_RX_BYTES |
1516                          STATION_INFO_RX_PACKETS;
1517         sinfo->tx_bytes = priv->dev->stats.tx_bytes;
1518         sinfo->tx_packets = priv->dev->stats.tx_packets;
1519         sinfo->rx_bytes = priv->dev->stats.rx_bytes;
1520         sinfo->rx_packets = priv->dev->stats.rx_packets;
1521
1522         /* Get current RSSI */
1523         ret = lbs_get_rssi(priv, &signal, &noise);
1524         if (ret == 0) {
1525                 sinfo->signal = signal;
1526                 sinfo->filled |= STATION_INFO_SIGNAL;
1527         }
1528
1529         /* Convert priv->cur_rate from hw_value to NL80211 value */
1530         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
1531                 if (priv->cur_rate == lbs_rates[i].hw_value) {
1532                         sinfo->txrate.legacy = lbs_rates[i].bitrate;
1533                         sinfo->filled |= STATION_INFO_TX_BITRATE;
1534                         break;
1535                 }
1536         }
1537
1538         return 0;
1539 }
1540
1541
1542
1543
1544 /***************************************************************************
1545  * "Site survey", here just current channel and noise level
1546  */
1547
1548 static int lbs_get_survey(struct wiphy *wiphy, struct net_device *dev,
1549         int idx, struct survey_info *survey)
1550 {
1551         struct lbs_private *priv = wiphy_priv(wiphy);
1552         s8 signal, noise;
1553         int ret;
1554
1555         if (idx != 0)
1556                 ret = -ENOENT;
1557
1558         lbs_deb_enter(LBS_DEB_CFG80211);
1559
1560         survey->channel = ieee80211_get_channel(wiphy,
1561                 ieee80211_channel_to_frequency(priv->channel));
1562
1563         ret = lbs_get_rssi(priv, &signal, &noise);
1564         if (ret == 0) {
1565                 survey->filled = SURVEY_INFO_NOISE_DBM;
1566                 survey->noise = noise;
1567         }
1568
1569         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1570         return ret;
1571 }
1572
1573
1574
1575
1576 /***************************************************************************
1577  * Change interface
1578  */
1579
1580 static int lbs_change_intf(struct wiphy *wiphy, struct net_device *dev,
1581         enum nl80211_iftype type, u32 *flags,
1582                struct vif_params *params)
1583 {
1584         struct lbs_private *priv = wiphy_priv(wiphy);
1585         int ret = 0;
1586
1587         lbs_deb_enter(LBS_DEB_CFG80211);
1588
1589         switch (type) {
1590         case NL80211_IFTYPE_MONITOR:
1591                 ret = lbs_set_monitor_mode(priv, 1);
1592                 break;
1593         case NL80211_IFTYPE_STATION:
1594                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1595                         ret = lbs_set_monitor_mode(priv, 0);
1596                 if (!ret)
1597                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 1);
1598                 break;
1599         case NL80211_IFTYPE_ADHOC:
1600                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1601                         ret = lbs_set_monitor_mode(priv, 0);
1602                 if (!ret)
1603                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 2);
1604                 break;
1605         default:
1606                 ret = -ENOTSUPP;
1607         }
1608
1609         if (!ret)
1610                 priv->wdev->iftype = type;
1611
1612         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1613         return ret;
1614 }
1615
1616
1617
1618 /***************************************************************************
1619  * IBSS (Ad-Hoc)
1620  */
1621
1622 /* The firmware needs the following bits masked out of the beacon-derived
1623  * capability field when associating/joining to a BSS:
1624  *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
1625  */
1626 #define CAPINFO_MASK (~(0xda00))
1627
1628
1629 static void lbs_join_post(struct lbs_private *priv,
1630                           struct cfg80211_ibss_params *params,
1631                           u8 *bssid, u16 capability)
1632 {
1633         u8 fake_ie[2 + IEEE80211_MAX_SSID_LEN + /* ssid */
1634                    2 + 4 +                      /* basic rates */
1635                    2 + 1 +                      /* DS parameter */
1636                    2 + 2 +                      /* atim */
1637                    2 + 8];                      /* extended rates */
1638         u8 *fake = fake_ie;
1639
1640         lbs_deb_enter(LBS_DEB_CFG80211);
1641
1642         /*
1643          * For cfg80211_inform_bss, we'll need a fake IE, as we can't get
1644          * the real IE from the firmware. So we fabricate a fake IE based on
1645          * what the firmware actually sends (sniffed with wireshark).
1646          */
1647         /* Fake SSID IE */
1648         *fake++ = WLAN_EID_SSID;
1649         *fake++ = params->ssid_len;
1650         memcpy(fake, params->ssid, params->ssid_len);
1651         fake += params->ssid_len;
1652         /* Fake supported basic rates IE */
1653         *fake++ = WLAN_EID_SUPP_RATES;
1654         *fake++ = 4;
1655         *fake++ = 0x82;
1656         *fake++ = 0x84;
1657         *fake++ = 0x8b;
1658         *fake++ = 0x96;
1659         /* Fake DS channel IE */
1660         *fake++ = WLAN_EID_DS_PARAMS;
1661         *fake++ = 1;
1662         *fake++ = params->channel->hw_value;
1663         /* Fake IBSS params IE */
1664         *fake++ = WLAN_EID_IBSS_PARAMS;
1665         *fake++ = 2;
1666         *fake++ = 0; /* ATIM=0 */
1667         *fake++ = 0;
1668         /* Fake extended rates IE, TODO: don't add this for 802.11b only,
1669          * but I don't know how this could be checked */
1670         *fake++ = WLAN_EID_EXT_SUPP_RATES;
1671         *fake++ = 8;
1672         *fake++ = 0x0c;
1673         *fake++ = 0x12;
1674         *fake++ = 0x18;
1675         *fake++ = 0x24;
1676         *fake++ = 0x30;
1677         *fake++ = 0x48;
1678         *fake++ = 0x60;
1679         *fake++ = 0x6c;
1680         lbs_deb_hex(LBS_DEB_CFG80211, "IE", fake_ie, fake - fake_ie);
1681
1682         cfg80211_inform_bss(priv->wdev->wiphy,
1683                             params->channel,
1684                             bssid,
1685                             0,
1686                             capability,
1687                             params->beacon_interval,
1688                             fake_ie, fake - fake_ie,
1689                             0, GFP_KERNEL);
1690
1691         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
1692         priv->wdev->ssid_len = params->ssid_len;
1693
1694         cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
1695
1696         /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
1697         priv->connect_status = LBS_CONNECTED;
1698         netif_carrier_on(priv->dev);
1699         if (!priv->tx_pending_len)
1700                 netif_wake_queue(priv->dev);
1701
1702         lbs_deb_leave(LBS_DEB_CFG80211);
1703 }
1704
1705 static int lbs_ibss_join_existing(struct lbs_private *priv,
1706         struct cfg80211_ibss_params *params,
1707         struct cfg80211_bss *bss)
1708 {
1709         const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
1710         struct cmd_ds_802_11_ad_hoc_join cmd;
1711         u8 preamble = RADIO_PREAMBLE_SHORT;
1712         int ret = 0;
1713
1714         lbs_deb_enter(LBS_DEB_CFG80211);
1715
1716         /* TODO: set preamble based on scan result */
1717         ret = lbs_set_radio(priv, preamble, 1);
1718         if (ret)
1719                 goto out;
1720
1721         /*
1722          * Example CMD_802_11_AD_HOC_JOIN command:
1723          *
1724          * command         2c 00         CMD_802_11_AD_HOC_JOIN
1725          * size            65 00
1726          * sequence        xx xx
1727          * result          00 00
1728          * bssid           02 27 27 97 2f 96
1729          * ssid            49 42 53 53 00 00 00 00
1730          *                 00 00 00 00 00 00 00 00
1731          *                 00 00 00 00 00 00 00 00
1732          *                 00 00 00 00 00 00 00 00
1733          * type            02            CMD_BSS_TYPE_IBSS
1734          * beacon period   64 00
1735          * dtim period     00
1736          * timestamp       00 00 00 00 00 00 00 00
1737          * localtime       00 00 00 00 00 00 00 00
1738          * IE DS           03
1739          * IE DS len       01
1740          * IE DS channel   01
1741          * reserveed       00 00 00 00
1742          * IE IBSS         06
1743          * IE IBSS len     02
1744          * IE IBSS atim    00 00
1745          * reserved        00 00 00 00
1746          * capability      02 00
1747          * rates           82 84 8b 96 0c 12 18 24 30 48 60 6c 00
1748          * fail timeout    ff 00
1749          * probe delay     00 00
1750          */
1751         memset(&cmd, 0, sizeof(cmd));
1752         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1753
1754         memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN);
1755         memcpy(cmd.bss.ssid, params->ssid, params->ssid_len);
1756         cmd.bss.type = CMD_BSS_TYPE_IBSS;
1757         cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval);
1758         cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS;
1759         cmd.bss.ds.header.len = 1;
1760         cmd.bss.ds.channel = params->channel->hw_value;
1761         cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1762         cmd.bss.ibss.header.len = 2;
1763         cmd.bss.ibss.atimwindow = 0;
1764         cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
1765
1766         /* set rates to the intersection of our rates and the rates in the
1767            bss */
1768         if (!rates_eid) {
1769                 lbs_add_rates(cmd.bss.rates);
1770         } else {
1771                 int hw, i;
1772                 u8 rates_max = rates_eid[1];
1773                 u8 *rates = cmd.bss.rates;
1774                 for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
1775                         u8 hw_rate = lbs_rates[hw].bitrate / 5;
1776                         for (i = 0; i < rates_max; i++) {
1777                                 if (hw_rate == (rates_eid[i+2] & 0x7f)) {
1778                                         u8 rate = rates_eid[i+2];
1779                                         if (rate == 0x02 || rate == 0x04 ||
1780                                             rate == 0x0b || rate == 0x16)
1781                                                 rate |= 0x80;
1782                                         *rates++ = rate;
1783                                 }
1784                         }
1785                 }
1786         }
1787
1788         /* Only v8 and below support setting this */
1789         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
1790                 cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
1791                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1792         }
1793         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
1794         if (ret)
1795                 goto out;
1796
1797         /*
1798          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1799          *
1800          * response        2c 80
1801          * size            09 00
1802          * sequence        xx xx
1803          * result          00 00
1804          * reserved        00
1805          */
1806         lbs_join_post(priv, params, bss->bssid, bss->capability);
1807
1808  out:
1809         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1810         return ret;
1811 }
1812
1813
1814
1815 static int lbs_ibss_start_new(struct lbs_private *priv,
1816         struct cfg80211_ibss_params *params)
1817 {
1818         struct cmd_ds_802_11_ad_hoc_start cmd;
1819         struct cmd_ds_802_11_ad_hoc_result *resp =
1820                 (struct cmd_ds_802_11_ad_hoc_result *) &cmd;
1821         u8 preamble = RADIO_PREAMBLE_SHORT;
1822         int ret = 0;
1823         u16 capability;
1824
1825         lbs_deb_enter(LBS_DEB_CFG80211);
1826
1827         ret = lbs_set_radio(priv, preamble, 1);
1828         if (ret)
1829                 goto out;
1830
1831         /*
1832          * Example CMD_802_11_AD_HOC_START command:
1833          *
1834          * command         2b 00         CMD_802_11_AD_HOC_START
1835          * size            b1 00
1836          * sequence        xx xx
1837          * result          00 00
1838          * ssid            54 45 53 54 00 00 00 00
1839          *                 00 00 00 00 00 00 00 00
1840          *                 00 00 00 00 00 00 00 00
1841          *                 00 00 00 00 00 00 00 00
1842          * bss type        02
1843          * beacon period   64 00
1844          * dtim period     00
1845          * IE IBSS         06
1846          * IE IBSS len     02
1847          * IE IBSS atim    00 00
1848          * reserved        00 00 00 00
1849          * IE DS           03
1850          * IE DS len       01
1851          * IE DS channel   01
1852          * reserved        00 00 00 00
1853          * probe delay     00 00
1854          * capability      02 00
1855          * rates           82 84 8b 96   (basic rates with have bit 7 set)
1856          *                 0c 12 18 24 30 48 60 6c
1857          * padding         100 bytes
1858          */
1859         memset(&cmd, 0, sizeof(cmd));
1860         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1861         memcpy(cmd.ssid, params->ssid, params->ssid_len);
1862         cmd.bsstype = CMD_BSS_TYPE_IBSS;
1863         cmd.beaconperiod = cpu_to_le16(params->beacon_interval);
1864         cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1865         cmd.ibss.header.len = 2;
1866         cmd.ibss.atimwindow = 0;
1867         cmd.ds.header.id = WLAN_EID_DS_PARAMS;
1868         cmd.ds.header.len = 1;
1869         cmd.ds.channel = params->channel->hw_value;
1870         /* Only v8 and below support setting probe delay */
1871         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8)
1872                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1873         /* TODO: mix in WLAN_CAPABILITY_PRIVACY */
1874         capability = WLAN_CAPABILITY_IBSS;
1875         cmd.capability = cpu_to_le16(capability);
1876         lbs_add_rates(cmd.rates);
1877
1878
1879         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
1880         if (ret)
1881                 goto out;
1882
1883         /*
1884          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1885          *
1886          * response        2b 80
1887          * size            14 00
1888          * sequence        xx xx
1889          * result          00 00
1890          * reserved        00
1891          * bssid           02 2b 7b 0f 86 0e
1892          */
1893         lbs_join_post(priv, params, resp->bssid, capability);
1894
1895  out:
1896         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1897         return ret;
1898 }
1899
1900
1901 static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
1902                 struct cfg80211_ibss_params *params)
1903 {
1904         struct lbs_private *priv = wiphy_priv(wiphy);
1905         int ret = 0;
1906         struct cfg80211_bss *bss;
1907         DECLARE_SSID_BUF(ssid_buf);
1908
1909         lbs_deb_enter(LBS_DEB_CFG80211);
1910
1911         if (!params->channel) {
1912                 ret = -ENOTSUPP;
1913                 goto out;
1914         }
1915
1916         ret = lbs_set_channel(priv, params->channel->hw_value);
1917         if (ret)
1918                 goto out;
1919
1920         /* Search if someone is beaconing. This assumes that the
1921          * bss list is populated already */
1922         bss = cfg80211_get_bss(wiphy, params->channel, params->bssid,
1923                 params->ssid, params->ssid_len,
1924                 WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
1925
1926         if (bss) {
1927                 ret = lbs_ibss_join_existing(priv, params, bss);
1928                 cfg80211_put_bss(bss);
1929         } else
1930                 ret = lbs_ibss_start_new(priv, params);
1931
1932
1933  out:
1934         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1935         return ret;
1936 }
1937
1938
1939 static int lbs_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
1940 {
1941         struct lbs_private *priv = wiphy_priv(wiphy);
1942         struct cmd_ds_802_11_ad_hoc_stop cmd;
1943         int ret = 0;
1944
1945         lbs_deb_enter(LBS_DEB_CFG80211);
1946
1947         memset(&cmd, 0, sizeof(cmd));
1948         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1949         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_STOP, &cmd);
1950
1951         /* TODO: consider doing this at MACREG_INT_CODE_ADHOC_BCN_LOST time */
1952         lbs_mac_event_disconnected(priv);
1953
1954         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1955         return ret;
1956 }
1957
1958
1959
1960
1961 /***************************************************************************
1962  * Initialization
1963  */
1964
1965 static struct cfg80211_ops lbs_cfg80211_ops = {
1966         .set_channel = lbs_cfg_set_channel,
1967         .scan = lbs_cfg_scan,
1968         .connect = lbs_cfg_connect,
1969         .disconnect = lbs_cfg_disconnect,
1970         .add_key = lbs_cfg_add_key,
1971         .del_key = lbs_cfg_del_key,
1972         .set_default_key = lbs_cfg_set_default_key,
1973         .get_station = lbs_cfg_get_station,
1974         .dump_survey = lbs_get_survey,
1975         .change_virtual_intf = lbs_change_intf,
1976         .join_ibss = lbs_join_ibss,
1977         .leave_ibss = lbs_leave_ibss,
1978 };
1979
1980
1981 /*
1982  * At this time lbs_private *priv doesn't even exist, so we just allocate
1983  * memory and don't initialize the wiphy further. This is postponed until we
1984  * can talk to the firmware and happens at registration time in
1985  * lbs_cfg_wiphy_register().
1986  */
1987 struct wireless_dev *lbs_cfg_alloc(struct device *dev)
1988 {
1989         int ret = 0;
1990         struct wireless_dev *wdev;
1991
1992         lbs_deb_enter(LBS_DEB_CFG80211);
1993
1994         wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
1995         if (!wdev) {
1996                 dev_err(dev, "cannot allocate wireless device\n");
1997                 return ERR_PTR(-ENOMEM);
1998         }
1999
2000         wdev->wiphy = wiphy_new(&lbs_cfg80211_ops, sizeof(struct lbs_private));
2001         if (!wdev->wiphy) {
2002                 dev_err(dev, "cannot allocate wiphy\n");
2003                 ret = -ENOMEM;
2004                 goto err_wiphy_new;
2005         }
2006
2007         lbs_deb_leave(LBS_DEB_CFG80211);
2008         return wdev;
2009
2010  err_wiphy_new:
2011         kfree(wdev);
2012         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2013         return ERR_PTR(ret);
2014 }
2015
2016
2017 static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
2018 {
2019         struct region_code_mapping {
2020                 const char *cn;
2021                 int code;
2022         };
2023
2024         /* Section 5.17.2 */
2025         static struct region_code_mapping regmap[] = {
2026                 {"US ", 0x10}, /* US FCC */
2027                 {"CA ", 0x20}, /* Canada */
2028                 {"EU ", 0x30}, /* ETSI   */
2029                 {"ES ", 0x31}, /* Spain  */
2030                 {"FR ", 0x32}, /* France */
2031                 {"JP ", 0x40}, /* Japan  */
2032         };
2033         size_t i;
2034
2035         lbs_deb_enter(LBS_DEB_CFG80211);
2036
2037         for (i = 0; i < ARRAY_SIZE(regmap); i++)
2038                 if (regmap[i].code == priv->regioncode) {
2039                         regulatory_hint(priv->wdev->wiphy, regmap[i].cn);
2040                         break;
2041                 }
2042
2043         lbs_deb_leave(LBS_DEB_CFG80211);
2044 }
2045
2046
2047 /*
2048  * This function get's called after lbs_setup_firmware() determined the
2049  * firmware capabities. So we can setup the wiphy according to our
2050  * hardware/firmware.
2051  */
2052 int lbs_cfg_register(struct lbs_private *priv)
2053 {
2054         struct wireless_dev *wdev = priv->wdev;
2055         int ret;
2056
2057         lbs_deb_enter(LBS_DEB_CFG80211);
2058
2059         wdev->wiphy->max_scan_ssids = 1;
2060         wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
2061
2062         wdev->wiphy->interface_modes =
2063                         BIT(NL80211_IFTYPE_STATION) |
2064                         BIT(NL80211_IFTYPE_ADHOC);
2065         if (lbs_rtap_supported(priv))
2066                 wdev->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
2067
2068         wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
2069
2070         /*
2071          * We could check priv->fwcapinfo && FW_CAPINFO_WPA, but I have
2072          * never seen a firmware without WPA
2073          */
2074         wdev->wiphy->cipher_suites = cipher_suites;
2075         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
2076         wdev->wiphy->reg_notifier = lbs_reg_notifier;
2077
2078         ret = wiphy_register(wdev->wiphy);
2079         if (ret < 0)
2080                 lbs_pr_err("cannot register wiphy device\n");
2081
2082         priv->wiphy_registered = true;
2083
2084         ret = register_netdev(priv->dev);
2085         if (ret)
2086                 lbs_pr_err("cannot register network device\n");
2087
2088         INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
2089
2090         lbs_cfg_set_regulatory_hint(priv);
2091
2092         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2093         return ret;
2094 }
2095
2096 int lbs_reg_notifier(struct wiphy *wiphy,
2097                 struct regulatory_request *request)
2098 {
2099         struct lbs_private *priv = wiphy_priv(wiphy);
2100         int ret;
2101
2102         lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
2103                         "callback for domain %c%c\n", request->alpha2[0],
2104                         request->alpha2[1]);
2105
2106         ret = lbs_set_11d_domain_info(priv, request, wiphy->bands);
2107
2108         lbs_deb_leave(LBS_DEB_CFG80211);
2109         return ret;
2110 }
2111
2112 void lbs_scan_deinit(struct lbs_private *priv)
2113 {
2114         lbs_deb_enter(LBS_DEB_CFG80211);
2115         cancel_delayed_work_sync(&priv->scan_work);
2116 }
2117
2118
2119 void lbs_cfg_free(struct lbs_private *priv)
2120 {
2121         struct wireless_dev *wdev = priv->wdev;
2122
2123         lbs_deb_enter(LBS_DEB_CFG80211);
2124
2125         if (!wdev)
2126                 return;
2127
2128         if (priv->wiphy_registered)
2129                 wiphy_unregister(wdev->wiphy);
2130
2131         if (wdev->wiphy)
2132                 wiphy_free(wdev->wiphy);
2133
2134         kfree(wdev);
2135 }