OSDN Git Service

mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / net / wireless / mwifiex / sta_ioctl.c
1 /*
2  * Marvell Wireless LAN device driver: functions for station ioctl
3  *
4  * Copyright (C) 2011-2014, Marvell International Ltd.
5  *
6  * This software file (the "File") is distributed by Marvell International
7  * Ltd. under the terms of the GNU General Public License Version 2, June 1991
8  * (the "License").  You may use, redistribute and/or modify this File in
9  * accordance with the terms and conditions of the License, a copy of which
10  * is available by writing to the Free Software Foundation, Inc.,
11  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
12  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
13  *
14  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
16  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
17  * this warranty disclaimer.
18  */
19
20 #include "decl.h"
21 #include "ioctl.h"
22 #include "util.h"
23 #include "fw.h"
24 #include "main.h"
25 #include "wmm.h"
26 #include "11n.h"
27 #include "cfg80211.h"
28
29 static int disconnect_on_suspend;
30 module_param(disconnect_on_suspend, int, 0644);
31
32 /*
33  * Copies the multicast address list from device to driver.
34  *
35  * This function does not validate the destination memory for
36  * size, and the calling function must ensure enough memory is
37  * available.
38  */
39 int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
40                             struct net_device *dev)
41 {
42         int i = 0;
43         struct netdev_hw_addr *ha;
44
45         netdev_for_each_mc_addr(ha, dev)
46                 memcpy(&mlist->mac_list[i++], ha->addr, ETH_ALEN);
47
48         return i;
49 }
50
51 /*
52  * Wait queue completion handler.
53  *
54  * This function waits on a cmd wait queue. It also cancels the pending
55  * request after waking up, in case of errors.
56  */
57 int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
58                                 struct cmd_ctrl_node *cmd_queued)
59 {
60         int status;
61
62         /* Wait for completion */
63         status = wait_event_interruptible_timeout(adapter->cmd_wait_q.wait,
64                                                   *(cmd_queued->condition),
65                                                   (12 * HZ));
66         if (status <= 0) {
67                 if (status == 0)
68                         status = -ETIMEDOUT;
69                 mwifiex_dbg(adapter, ERROR, "cmd_wait_q terminated: %d\n",
70                             status);
71                 mwifiex_cancel_all_pending_cmd(adapter);
72                 return status;
73         }
74
75         status = adapter->cmd_wait_q.status;
76         adapter->cmd_wait_q.status = 0;
77
78         return status;
79 }
80
81 /*
82  * This function prepares the correct firmware command and
83  * issues it to set the multicast list.
84  *
85  * This function can be used to enable promiscuous mode, or enable all
86  * multicast packets, or to enable selective multicast.
87  */
88 int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
89                                 struct mwifiex_multicast_list *mcast_list)
90 {
91         int ret = 0;
92         u16 old_pkt_filter;
93
94         old_pkt_filter = priv->curr_pkt_filter;
95
96         if (mcast_list->mode == MWIFIEX_PROMISC_MODE) {
97                 mwifiex_dbg(priv->adapter, INFO,
98                             "info: Enable Promiscuous mode\n");
99                 priv->curr_pkt_filter |= HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
100                 priv->curr_pkt_filter &=
101                         ~HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
102         } else {
103                 /* Multicast */
104                 priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
105                 if (mcast_list->mode == MWIFIEX_ALL_MULTI_MODE) {
106                         mwifiex_dbg(priv->adapter, INFO,
107                                     "info: Enabling All Multicast!\n");
108                         priv->curr_pkt_filter |=
109                                 HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
110                 } else {
111                         priv->curr_pkt_filter &=
112                                 ~HostCmd_ACT_MAC_ALL_MULTICAST_ENABLE;
113                         mwifiex_dbg(priv->adapter, INFO,
114                                     "info: Set multicast list=%d\n",
115                                     mcast_list->num_multicast_addr);
116                         /* Send multicast addresses to firmware */
117                         ret = mwifiex_send_cmd(priv,
118                                                HostCmd_CMD_MAC_MULTICAST_ADR,
119                                                HostCmd_ACT_GEN_SET, 0,
120                                                mcast_list, false);
121                 }
122         }
123         mwifiex_dbg(priv->adapter, INFO,
124                     "info: old_pkt_filter=%#x, curr_pkt_filter=%#x\n",
125                     old_pkt_filter, priv->curr_pkt_filter);
126         if (old_pkt_filter != priv->curr_pkt_filter) {
127                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
128                                        HostCmd_ACT_GEN_SET,
129                                        0, &priv->curr_pkt_filter, false);
130         }
131
132         return ret;
133 }
134
135 /*
136  * This function fills bss descriptor structure using provided
137  * information.
138  * beacon_ie buffer is allocated in this function. It is caller's
139  * responsibility to free the memory.
140  */
141 int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
142                               struct cfg80211_bss *bss,
143                               struct mwifiex_bssdescriptor *bss_desc)
144 {
145         u8 *beacon_ie;
146         size_t beacon_ie_len;
147         struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
148         const struct cfg80211_bss_ies *ies;
149
150         rcu_read_lock();
151         ies = rcu_dereference(bss->ies);
152         beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
153         beacon_ie_len = ies->len;
154         bss_desc->timestamp = ies->tsf;
155         rcu_read_unlock();
156
157         if (!beacon_ie) {
158                 mwifiex_dbg(priv->adapter, ERROR,
159                             " failed to alloc beacon_ie\n");
160                 return -ENOMEM;
161         }
162
163         memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
164         bss_desc->rssi = bss->signal;
165         /* The caller of this function will free beacon_ie */
166         bss_desc->beacon_buf = beacon_ie;
167         bss_desc->beacon_buf_size = beacon_ie_len;
168         bss_desc->beacon_period = bss->beacon_interval;
169         bss_desc->cap_info_bitmap = bss->capability;
170         bss_desc->bss_band = bss_priv->band;
171         bss_desc->fw_tsf = bss_priv->fw_tsf;
172         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_PRIVACY) {
173                 mwifiex_dbg(priv->adapter, INFO,
174                             "info: InterpretIE: AP WEP enabled\n");
175                 bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_8021X_WEP;
176         } else {
177                 bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_ACCEPT_ALL;
178         }
179         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_IBSS)
180                 bss_desc->bss_mode = NL80211_IFTYPE_ADHOC;
181         else
182                 bss_desc->bss_mode = NL80211_IFTYPE_STATION;
183
184         /* Disable 11ac by default. Enable it only where there
185          * exist VHT_CAP IE in AP beacon
186          */
187         bss_desc->disable_11ac = true;
188
189         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_SPECTRUM_MGMT)
190                 bss_desc->sensed_11h = true;
191
192         return mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
193 }
194
195 void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv)
196 {
197         if (priv->adapter->dt_node) {
198                 char txpwr[] = {"marvell,00_txpwrlimit"};
199
200                 memcpy(&txpwr[8], priv->adapter->country_code, 2);
201                 mwifiex_dnld_dt_cfgdata(priv, priv->adapter->dt_node, txpwr);
202         }
203 }
204
205 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
206                                       struct cfg80211_bss *bss)
207 {
208         const u8 *country_ie;
209         u8 country_ie_len;
210         struct mwifiex_802_11d_domain_reg *domain_info =
211                                         &priv->adapter->domain_reg;
212
213         rcu_read_lock();
214         country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
215         if (!country_ie) {
216                 rcu_read_unlock();
217                 return 0;
218         }
219
220         country_ie_len = country_ie[1];
221         if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) {
222                 rcu_read_unlock();
223                 return 0;
224         }
225
226         if (!strncmp(priv->adapter->country_code, &country_ie[2], 2)) {
227                 rcu_read_unlock();
228                 mwifiex_dbg(priv->adapter, INFO,
229                             "11D: skip setting domain info in FW\n");
230                 return 0;
231         }
232
233         if (country_ie_len >
234             (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
235                 mwifiex_dbg(priv->adapter, ERROR,
236                             "11D: country_ie_len overflow!, deauth AP\n");
237                 return -EINVAL;
238         }
239
240         memcpy(priv->adapter->country_code, &country_ie[2], 2);
241
242         domain_info->country_code[0] = country_ie[2];
243         domain_info->country_code[1] = country_ie[3];
244         domain_info->country_code[2] = ' ';
245
246         country_ie_len -= IEEE80211_COUNTRY_STRING_LEN;
247
248         domain_info->no_of_triplet =
249                 country_ie_len / sizeof(struct ieee80211_country_ie_triplet);
250
251         memcpy((u8 *)domain_info->triplet,
252                &country_ie[2] + IEEE80211_COUNTRY_STRING_LEN, country_ie_len);
253
254         rcu_read_unlock();
255
256         if (mwifiex_send_cmd(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
257                              HostCmd_ACT_GEN_SET, 0, NULL, false)) {
258                 mwifiex_dbg(priv->adapter, ERROR,
259                             "11D: setting domain info in FW fail\n");
260                 return -1;
261         }
262
263         mwifiex_dnld_txpwr_table(priv);
264
265         return 0;
266 }
267
268 /*
269  * In Ad-Hoc mode, the IBSS is created if not found in scan list.
270  * In both Ad-Hoc and infra mode, an deauthentication is performed
271  * first.
272  */
273 int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
274                       struct cfg80211_ssid *req_ssid)
275 {
276         int ret;
277         struct mwifiex_adapter *adapter = priv->adapter;
278         struct mwifiex_bssdescriptor *bss_desc = NULL;
279
280         priv->scan_block = false;
281
282         if (bss) {
283                 if (mwifiex_process_country_ie(priv, bss))
284                         return -EINVAL;
285
286                 /* Allocate and fill new bss descriptor */
287                 bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
288                                    GFP_KERNEL);
289                 if (!bss_desc)
290                         return -ENOMEM;
291
292                 ret = mwifiex_fill_new_bss_desc(priv, bss, bss_desc);
293                 if (ret)
294                         goto done;
295         }
296
297         if (priv->bss_mode == NL80211_IFTYPE_STATION ||
298             priv->bss_mode == NL80211_IFTYPE_P2P_CLIENT) {
299                 u8 config_bands;
300
301                 if (!bss_desc)
302                         return -1;
303
304                 if (mwifiex_band_to_radio_type(bss_desc->bss_band) ==
305                                                 HostCmd_SCAN_RADIO_TYPE_BG) {
306                         config_bands = BAND_B | BAND_G | BAND_GN;
307                 } else {
308                         config_bands = BAND_A | BAND_AN;
309                         if (adapter->fw_bands & BAND_AAC)
310                                 config_bands |= BAND_AAC;
311                 }
312
313                 if (!((config_bands | adapter->fw_bands) & ~adapter->fw_bands))
314                         adapter->config_bands = config_bands;
315
316                 ret = mwifiex_check_network_compatibility(priv, bss_desc);
317                 if (ret)
318                         goto done;
319
320                 if (mwifiex_11h_get_csa_closed_channel(priv) ==
321                                                         (u8)bss_desc->channel) {
322                         mwifiex_dbg(adapter, ERROR,
323                                     "Attempt to reconnect on csa closed chan(%d)\n",
324                                     bss_desc->channel);
325                         ret = -1;
326                         goto done;
327                 }
328
329                 mwifiex_dbg(adapter, INFO,
330                             "info: SSID found in scan list ...\t"
331                             "associating...\n");
332
333                 mwifiex_stop_net_dev_queue(priv->netdev, adapter);
334                 if (netif_carrier_ok(priv->netdev))
335                         netif_carrier_off(priv->netdev);
336
337                 /* Clear any past association response stored for
338                  * application retrieval */
339                 priv->assoc_rsp_size = 0;
340                 ret = mwifiex_associate(priv, bss_desc);
341
342                 /* If auth type is auto and association fails using open mode,
343                  * try to connect using shared mode */
344                 if (ret == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
345                     priv->sec_info.is_authtype_auto &&
346                     priv->sec_info.wep_enabled) {
347                         priv->sec_info.authentication_mode =
348                                                 NL80211_AUTHTYPE_SHARED_KEY;
349                         ret = mwifiex_associate(priv, bss_desc);
350                 }
351
352                 if (bss)
353                         cfg80211_put_bss(priv->adapter->wiphy, bss);
354         } else {
355                 /* Adhoc mode */
356                 /* If the requested SSID matches current SSID, return */
357                 if (bss_desc && bss_desc->ssid.ssid_len &&
358                     (!mwifiex_ssid_cmp(&priv->curr_bss_params.bss_descriptor.
359                                        ssid, &bss_desc->ssid))) {
360                         ret = 0;
361                         goto done;
362                 }
363
364                 priv->adhoc_is_link_sensed = false;
365
366                 ret = mwifiex_check_network_compatibility(priv, bss_desc);
367
368                 mwifiex_stop_net_dev_queue(priv->netdev, adapter);
369                 if (netif_carrier_ok(priv->netdev))
370                         netif_carrier_off(priv->netdev);
371
372                 if (!ret) {
373                         mwifiex_dbg(adapter, INFO,
374                                     "info: network found in scan\t"
375                                     " list. Joining...\n");
376                         ret = mwifiex_adhoc_join(priv, bss_desc);
377                         if (bss)
378                                 cfg80211_put_bss(priv->adapter->wiphy, bss);
379                 } else {
380                         mwifiex_dbg(adapter, INFO,
381                                     "info: Network not found in\t"
382                                     "the list, creating adhoc with ssid = %s\n",
383                                     req_ssid->ssid);
384                         ret = mwifiex_adhoc_start(priv, req_ssid);
385                 }
386         }
387
388 done:
389         /* beacon_ie buffer was allocated in function
390          * mwifiex_fill_new_bss_desc(). Free it now.
391          */
392         if (bss_desc)
393                 kfree(bss_desc->beacon_buf);
394         kfree(bss_desc);
395         return ret;
396 }
397
398 /*
399  * IOCTL request handler to set host sleep configuration.
400  *
401  * This function prepares the correct firmware command and
402  * issues it.
403  */
404 int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
405                           int cmd_type, struct mwifiex_ds_hs_cfg *hs_cfg)
406
407 {
408         struct mwifiex_adapter *adapter = priv->adapter;
409         int status = 0;
410         u32 prev_cond = 0;
411
412         if (!hs_cfg)
413                 return -ENOMEM;
414
415         switch (action) {
416         case HostCmd_ACT_GEN_SET:
417                 if (adapter->pps_uapsd_mode) {
418                         mwifiex_dbg(adapter, INFO,
419                                     "info: Host Sleep IOCTL\t"
420                                     "is blocked in UAPSD/PPS mode\n");
421                         status = -1;
422                         break;
423                 }
424                 if (hs_cfg->is_invoke_hostcmd) {
425                         if (hs_cfg->conditions == HS_CFG_CANCEL) {
426                                 if (!adapter->is_hs_configured)
427                                         /* Already cancelled */
428                                         break;
429                                 /* Save previous condition */
430                                 prev_cond = le32_to_cpu(adapter->hs_cfg
431                                                         .conditions);
432                                 adapter->hs_cfg.conditions =
433                                                 cpu_to_le32(hs_cfg->conditions);
434                         } else if (hs_cfg->conditions) {
435                                 adapter->hs_cfg.conditions =
436                                                 cpu_to_le32(hs_cfg->conditions);
437                                 adapter->hs_cfg.gpio = (u8)hs_cfg->gpio;
438                                 if (hs_cfg->gap)
439                                         adapter->hs_cfg.gap = (u8)hs_cfg->gap;
440                         } else if (adapter->hs_cfg.conditions ==
441                                    cpu_to_le32(HS_CFG_CANCEL)) {
442                                 /* Return failure if no parameters for HS
443                                    enable */
444                                 status = -1;
445                                 break;
446                         }
447
448                         status = mwifiex_send_cmd(priv,
449                                                   HostCmd_CMD_802_11_HS_CFG_ENH,
450                                                   HostCmd_ACT_GEN_SET, 0,
451                                                   &adapter->hs_cfg,
452                                                   cmd_type == MWIFIEX_SYNC_CMD);
453
454                         if (hs_cfg->conditions == HS_CFG_CANCEL)
455                                 /* Restore previous condition */
456                                 adapter->hs_cfg.conditions =
457                                                 cpu_to_le32(prev_cond);
458                 } else {
459                         adapter->hs_cfg.conditions =
460                                                 cpu_to_le32(hs_cfg->conditions);
461                         adapter->hs_cfg.gpio = (u8)hs_cfg->gpio;
462                         adapter->hs_cfg.gap = (u8)hs_cfg->gap;
463                 }
464                 break;
465         case HostCmd_ACT_GEN_GET:
466                 hs_cfg->conditions = le32_to_cpu(adapter->hs_cfg.conditions);
467                 hs_cfg->gpio = adapter->hs_cfg.gpio;
468                 hs_cfg->gap = adapter->hs_cfg.gap;
469                 break;
470         default:
471                 status = -1;
472                 break;
473         }
474
475         return status;
476 }
477
478 /*
479  * Sends IOCTL request to cancel the existing Host Sleep configuration.
480  *
481  * This function allocates the IOCTL request buffer, fills it
482  * with requisite parameters and calls the IOCTL handler.
483  */
484 int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type)
485 {
486         struct mwifiex_ds_hs_cfg hscfg;
487
488         hscfg.conditions = HS_CFG_CANCEL;
489         hscfg.is_invoke_hostcmd = true;
490
491         return mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
492                                     cmd_type, &hscfg);
493 }
494 EXPORT_SYMBOL_GPL(mwifiex_cancel_hs);
495
496 /*
497  * Sends IOCTL request to cancel the existing Host Sleep configuration.
498  *
499  * This function allocates the IOCTL request buffer, fills it
500  * with requisite parameters and calls the IOCTL handler.
501  */
502 int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
503 {
504         struct mwifiex_ds_hs_cfg hscfg;
505         struct mwifiex_private *priv;
506         int i;
507
508         if (disconnect_on_suspend) {
509                 for (i = 0; i < adapter->priv_num; i++) {
510                         priv = adapter->priv[i];
511                         if (priv)
512                                 mwifiex_deauthenticate(priv, NULL);
513                 }
514         }
515
516         if (adapter->hs_activated) {
517                 mwifiex_dbg(adapter, CMD,
518                             "cmd: HS Already activated\n");
519                 return true;
520         }
521
522         adapter->hs_activate_wait_q_woken = false;
523
524         memset(&hscfg, 0, sizeof(struct mwifiex_ds_hs_cfg));
525         hscfg.is_invoke_hostcmd = true;
526
527         adapter->hs_enabling = true;
528         mwifiex_cancel_all_pending_cmd(adapter);
529
530         if (mwifiex_set_hs_params(mwifiex_get_priv(adapter,
531                                                    MWIFIEX_BSS_ROLE_STA),
532                                   HostCmd_ACT_GEN_SET, MWIFIEX_SYNC_CMD,
533                                   &hscfg)) {
534                 mwifiex_dbg(adapter, ERROR,
535                             "IOCTL request HS enable failed\n");
536                 return false;
537         }
538
539         if (wait_event_interruptible_timeout(adapter->hs_activate_wait_q,
540                                              adapter->hs_activate_wait_q_woken,
541                                              (10 * HZ)) <= 0) {
542                 mwifiex_dbg(adapter, ERROR,
543                             "hs_activate_wait_q terminated\n");
544                 return false;
545         }
546
547         return true;
548 }
549 EXPORT_SYMBOL_GPL(mwifiex_enable_hs);
550
551 /*
552  * IOCTL request handler to get BSS information.
553  *
554  * This function collates the information from different driver structures
555  * to send to the user.
556  */
557 int mwifiex_get_bss_info(struct mwifiex_private *priv,
558                          struct mwifiex_bss_info *info)
559 {
560         struct mwifiex_adapter *adapter = priv->adapter;
561         struct mwifiex_bssdescriptor *bss_desc;
562
563         if (!info)
564                 return -1;
565
566         bss_desc = &priv->curr_bss_params.bss_descriptor;
567
568         info->bss_mode = priv->bss_mode;
569
570         memcpy(&info->ssid, &bss_desc->ssid, sizeof(struct cfg80211_ssid));
571
572         memcpy(&info->bssid, &bss_desc->mac_address, ETH_ALEN);
573
574         info->bss_chan = bss_desc->channel;
575
576         memcpy(info->country_code, adapter->country_code,
577                IEEE80211_COUNTRY_STRING_LEN);
578
579         info->media_connected = priv->media_connected;
580
581         info->max_power_level = priv->max_tx_power_level;
582         info->min_power_level = priv->min_tx_power_level;
583
584         info->adhoc_state = priv->adhoc_state;
585
586         info->bcn_nf_last = priv->bcn_nf_last;
587
588         if (priv->sec_info.wep_enabled)
589                 info->wep_status = true;
590         else
591                 info->wep_status = false;
592
593         info->is_hs_configured = adapter->is_hs_configured;
594         info->is_deep_sleep = adapter->is_deep_sleep;
595
596         return 0;
597 }
598
599 /*
600  * The function disables auto deep sleep mode.
601  */
602 int mwifiex_disable_auto_ds(struct mwifiex_private *priv)
603 {
604         struct mwifiex_ds_auto_ds auto_ds;
605
606         auto_ds.auto_ds = DEEP_SLEEP_OFF;
607
608         return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
609                                 DIS_AUTO_PS, BITMAP_AUTO_DS, &auto_ds, true);
610 }
611 EXPORT_SYMBOL_GPL(mwifiex_disable_auto_ds);
612
613 /*
614  * Sends IOCTL request to get the data rate.
615  *
616  * This function allocates the IOCTL request buffer, fills it
617  * with requisite parameters and calls the IOCTL handler.
618  */
619 int mwifiex_drv_get_data_rate(struct mwifiex_private *priv, u32 *rate)
620 {
621         int ret;
622
623         ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_TX_RATE_QUERY,
624                                HostCmd_ACT_GEN_GET, 0, NULL, true);
625
626         if (!ret) {
627                 if (priv->is_data_rate_auto)
628                         *rate = mwifiex_index_to_data_rate(priv, priv->tx_rate,
629                                                            priv->tx_htinfo);
630                 else
631                         *rate = priv->data_rate;
632         }
633
634         return ret;
635 }
636
637 /*
638  * IOCTL request handler to set tx power configuration.
639  *
640  * This function prepares the correct firmware command and
641  * issues it.
642  *
643  * For non-auto power mode, all the following power groups are set -
644  *      - Modulation class HR/DSSS
645  *      - Modulation class OFDM
646  *      - Modulation class HTBW20
647  *      - Modulation class HTBW40
648  */
649 int mwifiex_set_tx_power(struct mwifiex_private *priv,
650                          struct mwifiex_power_cfg *power_cfg)
651 {
652         int ret;
653         struct host_cmd_ds_txpwr_cfg *txp_cfg;
654         struct mwifiex_types_power_group *pg_tlv;
655         struct mwifiex_power_group *pg;
656         u8 *buf;
657         u16 dbm = 0;
658
659         if (!power_cfg->is_power_auto) {
660                 dbm = (u16) power_cfg->power_level;
661                 if ((dbm < priv->min_tx_power_level) ||
662                     (dbm > priv->max_tx_power_level)) {
663                         mwifiex_dbg(priv->adapter, ERROR,
664                                     "txpower value %d dBm\t"
665                                     "is out of range (%d dBm-%d dBm)\n",
666                                     dbm, priv->min_tx_power_level,
667                                     priv->max_tx_power_level);
668                         return -1;
669                 }
670         }
671         buf = kzalloc(MWIFIEX_SIZE_OF_CMD_BUFFER, GFP_KERNEL);
672         if (!buf)
673                 return -ENOMEM;
674
675         txp_cfg = (struct host_cmd_ds_txpwr_cfg *) buf;
676         txp_cfg->action = cpu_to_le16(HostCmd_ACT_GEN_SET);
677         if (!power_cfg->is_power_auto) {
678                 u16 dbm_min = power_cfg->is_power_fixed ?
679                               dbm : priv->min_tx_power_level;
680
681                 txp_cfg->mode = cpu_to_le32(1);
682                 pg_tlv = (struct mwifiex_types_power_group *)
683                          (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
684                 pg_tlv->type = cpu_to_le16(TLV_TYPE_POWER_GROUP);
685                 pg_tlv->length =
686                         cpu_to_le16(4 * sizeof(struct mwifiex_power_group));
687                 pg = (struct mwifiex_power_group *)
688                      (buf + sizeof(struct host_cmd_ds_txpwr_cfg)
689                       + sizeof(struct mwifiex_types_power_group));
690                 /* Power group for modulation class HR/DSSS */
691                 pg->first_rate_code = 0x00;
692                 pg->last_rate_code = 0x03;
693                 pg->modulation_class = MOD_CLASS_HR_DSSS;
694                 pg->power_step = 0;
695                 pg->power_min = (s8) dbm_min;
696                 pg->power_max = (s8) dbm;
697                 pg++;
698                 /* Power group for modulation class OFDM */
699                 pg->first_rate_code = 0x00;
700                 pg->last_rate_code = 0x07;
701                 pg->modulation_class = MOD_CLASS_OFDM;
702                 pg->power_step = 0;
703                 pg->power_min = (s8) dbm_min;
704                 pg->power_max = (s8) dbm;
705                 pg++;
706                 /* Power group for modulation class HTBW20 */
707                 pg->first_rate_code = 0x00;
708                 pg->last_rate_code = 0x20;
709                 pg->modulation_class = MOD_CLASS_HT;
710                 pg->power_step = 0;
711                 pg->power_min = (s8) dbm_min;
712                 pg->power_max = (s8) dbm;
713                 pg->ht_bandwidth = HT_BW_20;
714                 pg++;
715                 /* Power group for modulation class HTBW40 */
716                 pg->first_rate_code = 0x00;
717                 pg->last_rate_code = 0x20;
718                 pg->modulation_class = MOD_CLASS_HT;
719                 pg->power_step = 0;
720                 pg->power_min = (s8) dbm_min;
721                 pg->power_max = (s8) dbm;
722                 pg->ht_bandwidth = HT_BW_40;
723         }
724         ret = mwifiex_send_cmd(priv, HostCmd_CMD_TXPWR_CFG,
725                                HostCmd_ACT_GEN_SET, 0, buf, true);
726
727         kfree(buf);
728         return ret;
729 }
730
731 /*
732  * IOCTL request handler to get power save mode.
733  *
734  * This function prepares the correct firmware command and
735  * issues it.
736  */
737 int mwifiex_drv_set_power(struct mwifiex_private *priv, u32 *ps_mode)
738 {
739         int ret;
740         struct mwifiex_adapter *adapter = priv->adapter;
741         u16 sub_cmd;
742
743         if (*ps_mode)
744                 adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_PSP;
745         else
746                 adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_CAM;
747         sub_cmd = (*ps_mode) ? EN_AUTO_PS : DIS_AUTO_PS;
748         ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
749                                sub_cmd, BITMAP_STA_PS, NULL, true);
750         if ((!ret) && (sub_cmd == DIS_AUTO_PS))
751                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
752                                        GET_PS, 0, NULL, false);
753
754         return ret;
755 }
756
757 /*
758  * IOCTL request handler to set/reset WPA IE.
759  *
760  * The supplied WPA IE is treated as a opaque buffer. Only the first field
761  * is checked to determine WPA version. If buffer length is zero, the existing
762  * WPA IE is reset.
763  */
764 static int mwifiex_set_wpa_ie_helper(struct mwifiex_private *priv,
765                                      u8 *ie_data_ptr, u16 ie_len)
766 {
767         if (ie_len) {
768                 if (ie_len > sizeof(priv->wpa_ie)) {
769                         mwifiex_dbg(priv->adapter, ERROR,
770                                     "failed to copy WPA IE, too big\n");
771                         return -1;
772                 }
773                 memcpy(priv->wpa_ie, ie_data_ptr, ie_len);
774                 priv->wpa_ie_len = (u8) ie_len;
775                 mwifiex_dbg(priv->adapter, CMD,
776                             "cmd: Set Wpa_ie_len=%d IE=%#x\n",
777                             priv->wpa_ie_len, priv->wpa_ie[0]);
778
779                 if (priv->wpa_ie[0] == WLAN_EID_VENDOR_SPECIFIC) {
780                         priv->sec_info.wpa_enabled = true;
781                 } else if (priv->wpa_ie[0] == WLAN_EID_RSN) {
782                         priv->sec_info.wpa2_enabled = true;
783                 } else {
784                         priv->sec_info.wpa_enabled = false;
785                         priv->sec_info.wpa2_enabled = false;
786                 }
787         } else {
788                 memset(priv->wpa_ie, 0, sizeof(priv->wpa_ie));
789                 priv->wpa_ie_len = 0;
790                 mwifiex_dbg(priv->adapter, INFO,
791                             "info: reset wpa_ie_len=%d IE=%#x\n",
792                             priv->wpa_ie_len, priv->wpa_ie[0]);
793                 priv->sec_info.wpa_enabled = false;
794                 priv->sec_info.wpa2_enabled = false;
795         }
796
797         return 0;
798 }
799
800 /*
801  * IOCTL request handler to set/reset WAPI IE.
802  *
803  * The supplied WAPI IE is treated as a opaque buffer. Only the first field
804  * is checked to internally enable WAPI. If buffer length is zero, the existing
805  * WAPI IE is reset.
806  */
807 static int mwifiex_set_wapi_ie(struct mwifiex_private *priv,
808                                u8 *ie_data_ptr, u16 ie_len)
809 {
810         if (ie_len) {
811                 if (ie_len > sizeof(priv->wapi_ie)) {
812                         mwifiex_dbg(priv->adapter, ERROR,
813                                     "info: failed to copy WAPI IE, too big\n");
814                         return -1;
815                 }
816                 memcpy(priv->wapi_ie, ie_data_ptr, ie_len);
817                 priv->wapi_ie_len = ie_len;
818                 mwifiex_dbg(priv->adapter, CMD,
819                             "cmd: Set wapi_ie_len=%d IE=%#x\n",
820                             priv->wapi_ie_len, priv->wapi_ie[0]);
821
822                 if (priv->wapi_ie[0] == WLAN_EID_BSS_AC_ACCESS_DELAY)
823                         priv->sec_info.wapi_enabled = true;
824         } else {
825                 memset(priv->wapi_ie, 0, sizeof(priv->wapi_ie));
826                 priv->wapi_ie_len = ie_len;
827                 mwifiex_dbg(priv->adapter, INFO,
828                             "info: Reset wapi_ie_len=%d IE=%#x\n",
829                             priv->wapi_ie_len, priv->wapi_ie[0]);
830                 priv->sec_info.wapi_enabled = false;
831         }
832         return 0;
833 }
834
835 /*
836  * IOCTL request handler to set/reset WPS IE.
837  *
838  * The supplied WPS IE is treated as a opaque buffer. Only the first field
839  * is checked to internally enable WPS. If buffer length is zero, the existing
840  * WPS IE is reset.
841  */
842 static int mwifiex_set_wps_ie(struct mwifiex_private *priv,
843                                u8 *ie_data_ptr, u16 ie_len)
844 {
845         if (ie_len) {
846                 if (ie_len > MWIFIEX_MAX_VSIE_LEN) {
847                         mwifiex_dbg(priv->adapter, ERROR,
848                                     "info: failed to copy WPS IE, too big\n");
849                         return -1;
850                 }
851
852                 priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL);
853                 if (!priv->wps_ie)
854                         return -ENOMEM;
855
856                 memcpy(priv->wps_ie, ie_data_ptr, ie_len);
857                 priv->wps_ie_len = ie_len;
858                 mwifiex_dbg(priv->adapter, CMD,
859                             "cmd: Set wps_ie_len=%d IE=%#x\n",
860                             priv->wps_ie_len, priv->wps_ie[0]);
861         } else {
862                 kfree(priv->wps_ie);
863                 priv->wps_ie_len = ie_len;
864                 mwifiex_dbg(priv->adapter, INFO,
865                             "info: Reset wps_ie_len=%d\n", priv->wps_ie_len);
866         }
867         return 0;
868 }
869
870 /*
871  * IOCTL request handler to set WAPI key.
872  *
873  * This function prepares the correct firmware command and
874  * issues it.
875  */
876 static int mwifiex_sec_ioctl_set_wapi_key(struct mwifiex_private *priv,
877                                struct mwifiex_ds_encrypt_key *encrypt_key)
878 {
879
880         return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
881                                 HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
882                                 encrypt_key, true);
883 }
884
885 /*
886  * IOCTL request handler to set WEP network key.
887  *
888  * This function prepares the correct firmware command and
889  * issues it, after validation checks.
890  */
891 static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
892                               struct mwifiex_ds_encrypt_key *encrypt_key)
893 {
894         struct mwifiex_adapter *adapter = priv->adapter;
895         int ret;
896         struct mwifiex_wep_key *wep_key;
897         int index;
898
899         if (priv->wep_key_curr_index >= NUM_WEP_KEYS)
900                 priv->wep_key_curr_index = 0;
901         wep_key = &priv->wep_key[priv->wep_key_curr_index];
902         index = encrypt_key->key_index;
903         if (encrypt_key->key_disable) {
904                 priv->sec_info.wep_enabled = 0;
905         } else if (!encrypt_key->key_len) {
906                 /* Copy the required key as the current key */
907                 wep_key = &priv->wep_key[index];
908                 if (!wep_key->key_length) {
909                         mwifiex_dbg(adapter, ERROR,
910                                     "key not set, so cannot enable it\n");
911                         return -1;
912                 }
913
914                 if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2) {
915                         memcpy(encrypt_key->key_material,
916                                wep_key->key_material, wep_key->key_length);
917                         encrypt_key->key_len = wep_key->key_length;
918                 }
919
920                 priv->wep_key_curr_index = (u16) index;
921                 priv->sec_info.wep_enabled = 1;
922         } else {
923                 wep_key = &priv->wep_key[index];
924                 memset(wep_key, 0, sizeof(struct mwifiex_wep_key));
925                 /* Copy the key in the driver */
926                 memcpy(wep_key->key_material,
927                        encrypt_key->key_material,
928                        encrypt_key->key_len);
929                 wep_key->key_index = index;
930                 wep_key->key_length = encrypt_key->key_len;
931                 priv->sec_info.wep_enabled = 1;
932         }
933         if (wep_key->key_length) {
934                 void *enc_key;
935
936                 if (encrypt_key->key_disable) {
937                         memset(&priv->wep_key[index], 0,
938                                sizeof(struct mwifiex_wep_key));
939                         if (wep_key->key_length)
940                                 goto done;
941                         }
942
943                 if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2)
944                         enc_key = encrypt_key;
945                 else
946                         enc_key = NULL;
947
948                 /* Send request to firmware */
949                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
950                                        HostCmd_ACT_GEN_SET, 0, enc_key, false);
951                 if (ret)
952                         return ret;
953         }
954
955 done:
956         if (priv->sec_info.wep_enabled)
957                 priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
958         else
959                 priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
960
961         ret = mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
962                                HostCmd_ACT_GEN_SET, 0,
963                                &priv->curr_pkt_filter, true);
964
965         return ret;
966 }
967
968 /*
969  * IOCTL request handler to set WPA key.
970  *
971  * This function prepares the correct firmware command and
972  * issues it, after validation checks.
973  *
974  * Current driver only supports key length of up to 32 bytes.
975  *
976  * This function can also be used to disable a currently set key.
977  */
978 static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_private *priv,
979                               struct mwifiex_ds_encrypt_key *encrypt_key)
980 {
981         int ret;
982         u8 remove_key = false;
983         struct host_cmd_ds_802_11_key_material *ibss_key;
984
985         /* Current driver only supports key length of up to 32 bytes */
986         if (encrypt_key->key_len > WLAN_MAX_KEY_LEN) {
987                 mwifiex_dbg(priv->adapter, ERROR,
988                             "key length too long\n");
989                 return -1;
990         }
991
992         if (priv->bss_mode == NL80211_IFTYPE_ADHOC) {
993                 /*
994                  * IBSS/WPA-None uses only one key (Group) for both receiving
995                  * and sending unicast and multicast packets.
996                  */
997                 /* Send the key as PTK to firmware */
998                 encrypt_key->key_index = MWIFIEX_KEY_INDEX_UNICAST;
999                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
1000                                        HostCmd_ACT_GEN_SET,
1001                                        KEY_INFO_ENABLED, encrypt_key, false);
1002                 if (ret)
1003                         return ret;
1004
1005                 ibss_key = &priv->aes_key;
1006                 memset(ibss_key, 0,
1007                        sizeof(struct host_cmd_ds_802_11_key_material));
1008                 /* Copy the key in the driver */
1009                 memcpy(ibss_key->key_param_set.key, encrypt_key->key_material,
1010                        encrypt_key->key_len);
1011                 memcpy(&ibss_key->key_param_set.key_len, &encrypt_key->key_len,
1012                        sizeof(ibss_key->key_param_set.key_len));
1013                 ibss_key->key_param_set.key_type_id
1014                         = cpu_to_le16(KEY_TYPE_ID_TKIP);
1015                 ibss_key->key_param_set.key_info = cpu_to_le16(KEY_ENABLED);
1016
1017                 /* Send the key as GTK to firmware */
1018                 encrypt_key->key_index = ~MWIFIEX_KEY_INDEX_UNICAST;
1019         }
1020
1021         if (!encrypt_key->key_index)
1022                 encrypt_key->key_index = MWIFIEX_KEY_INDEX_UNICAST;
1023
1024         if (remove_key)
1025                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
1026                                        HostCmd_ACT_GEN_SET,
1027                                        !KEY_INFO_ENABLED, encrypt_key, true);
1028         else
1029                 ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
1030                                        HostCmd_ACT_GEN_SET,
1031                                        KEY_INFO_ENABLED, encrypt_key, true);
1032
1033         return ret;
1034 }
1035
1036 /*
1037  * IOCTL request handler to set/get network keys.
1038  *
1039  * This is a generic key handling function which supports WEP, WPA
1040  * and WAPI.
1041  */
1042 static int
1043 mwifiex_sec_ioctl_encrypt_key(struct mwifiex_private *priv,
1044                               struct mwifiex_ds_encrypt_key *encrypt_key)
1045 {
1046         int status;
1047
1048         if (encrypt_key->is_wapi_key)
1049                 status = mwifiex_sec_ioctl_set_wapi_key(priv, encrypt_key);
1050         else if (encrypt_key->key_len > WLAN_KEY_LEN_WEP104)
1051                 status = mwifiex_sec_ioctl_set_wpa_key(priv, encrypt_key);
1052         else
1053                 status = mwifiex_sec_ioctl_set_wep_key(priv, encrypt_key);
1054         return status;
1055 }
1056
1057 /*
1058  * This function returns the driver version.
1059  */
1060 int
1061 mwifiex_drv_get_driver_version(struct mwifiex_adapter *adapter, char *version,
1062                                int max_len)
1063 {
1064         union {
1065                 __le32 l;
1066                 u8 c[4];
1067         } ver;
1068         char fw_ver[32];
1069
1070         ver.l = cpu_to_le32(adapter->fw_release_number);
1071         sprintf(fw_ver, "%u.%u.%u.p%u", ver.c[2], ver.c[1], ver.c[0], ver.c[3]);
1072
1073         snprintf(version, max_len, driver_version, fw_ver);
1074
1075         mwifiex_dbg(adapter, MSG, "info: MWIFIEX VERSION: %s\n", version);
1076
1077         return 0;
1078 }
1079
1080 /*
1081  * Sends IOCTL request to set encoding parameters.
1082  *
1083  * This function allocates the IOCTL request buffer, fills it
1084  * with requisite parameters and calls the IOCTL handler.
1085  */
1086 int mwifiex_set_encode(struct mwifiex_private *priv, struct key_params *kp,
1087                        const u8 *key, int key_len, u8 key_index,
1088                        const u8 *mac_addr, int disable)
1089 {
1090         struct mwifiex_ds_encrypt_key encrypt_key;
1091
1092         memset(&encrypt_key, 0, sizeof(struct mwifiex_ds_encrypt_key));
1093         encrypt_key.key_len = key_len;
1094         encrypt_key.key_index = key_index;
1095
1096         if (kp && kp->cipher == WLAN_CIPHER_SUITE_AES_CMAC)
1097                 encrypt_key.is_igtk_key = true;
1098
1099         if (!disable) {
1100                 if (key_len)
1101                         memcpy(encrypt_key.key_material, key, key_len);
1102                 else
1103                         encrypt_key.is_current_wep_key = true;
1104
1105                 if (mac_addr)
1106                         memcpy(encrypt_key.mac_addr, mac_addr, ETH_ALEN);
1107                 if (kp && kp->seq && kp->seq_len) {
1108                         memcpy(encrypt_key.pn, kp->seq, kp->seq_len);
1109                         encrypt_key.pn_len = kp->seq_len;
1110                         encrypt_key.is_rx_seq_valid = true;
1111                 }
1112         } else {
1113                 encrypt_key.key_disable = true;
1114                 if (mac_addr)
1115                         memcpy(encrypt_key.mac_addr, mac_addr, ETH_ALEN);
1116         }
1117
1118         return mwifiex_sec_ioctl_encrypt_key(priv, &encrypt_key);
1119 }
1120
1121 /*
1122  * Sends IOCTL request to get extended version.
1123  *
1124  * This function allocates the IOCTL request buffer, fills it
1125  * with requisite parameters and calls the IOCTL handler.
1126  */
1127 int
1128 mwifiex_get_ver_ext(struct mwifiex_private *priv)
1129 {
1130         struct mwifiex_ver_ext ver_ext;
1131
1132         memset(&ver_ext, 0, sizeof(struct host_cmd_ds_version_ext));
1133         if (mwifiex_send_cmd(priv, HostCmd_CMD_VERSION_EXT,
1134                              HostCmd_ACT_GEN_GET, 0, &ver_ext, true))
1135                 return -1;
1136
1137         return 0;
1138 }
1139
1140 int
1141 mwifiex_remain_on_chan_cfg(struct mwifiex_private *priv, u16 action,
1142                            struct ieee80211_channel *chan,
1143                            unsigned int duration)
1144 {
1145         struct host_cmd_ds_remain_on_chan roc_cfg;
1146         u8 sc;
1147
1148         memset(&roc_cfg, 0, sizeof(roc_cfg));
1149         roc_cfg.action = cpu_to_le16(action);
1150         if (action == HostCmd_ACT_GEN_SET) {
1151                 roc_cfg.band_cfg = chan->band;
1152                 sc = mwifiex_chan_type_to_sec_chan_offset(NL80211_CHAN_NO_HT);
1153                 roc_cfg.band_cfg |= (sc << 2);
1154
1155                 roc_cfg.channel =
1156                         ieee80211_frequency_to_channel(chan->center_freq);
1157                 roc_cfg.duration = cpu_to_le32(duration);
1158         }
1159         if (mwifiex_send_cmd(priv, HostCmd_CMD_REMAIN_ON_CHAN,
1160                              action, 0, &roc_cfg, true)) {
1161                 mwifiex_dbg(priv->adapter, ERROR,
1162                             "failed to remain on channel\n");
1163                 return -1;
1164         }
1165
1166         return roc_cfg.status;
1167 }
1168
1169 /*
1170  * Sends IOCTL request to get statistics information.
1171  *
1172  * This function allocates the IOCTL request buffer, fills it
1173  * with requisite parameters and calls the IOCTL handler.
1174  */
1175 int
1176 mwifiex_get_stats_info(struct mwifiex_private *priv,
1177                        struct mwifiex_ds_get_stats *log)
1178 {
1179         return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_GET_LOG,
1180                                 HostCmd_ACT_GEN_GET, 0, log, true);
1181 }
1182
1183 /*
1184  * IOCTL request handler to read/write register.
1185  *
1186  * This function prepares the correct firmware command and
1187  * issues it.
1188  *
1189  * Access to the following registers are supported -
1190  *      - MAC
1191  *      - BBP
1192  *      - RF
1193  *      - PMIC
1194  *      - CAU
1195  */
1196 static int mwifiex_reg_mem_ioctl_reg_rw(struct mwifiex_private *priv,
1197                                         struct mwifiex_ds_reg_rw *reg_rw,
1198                                         u16 action)
1199 {
1200         u16 cmd_no;
1201
1202         switch (le32_to_cpu(reg_rw->type)) {
1203         case MWIFIEX_REG_MAC:
1204                 cmd_no = HostCmd_CMD_MAC_REG_ACCESS;
1205                 break;
1206         case MWIFIEX_REG_BBP:
1207                 cmd_no = HostCmd_CMD_BBP_REG_ACCESS;
1208                 break;
1209         case MWIFIEX_REG_RF:
1210                 cmd_no = HostCmd_CMD_RF_REG_ACCESS;
1211                 break;
1212         case MWIFIEX_REG_PMIC:
1213                 cmd_no = HostCmd_CMD_PMIC_REG_ACCESS;
1214                 break;
1215         case MWIFIEX_REG_CAU:
1216                 cmd_no = HostCmd_CMD_CAU_REG_ACCESS;
1217                 break;
1218         default:
1219                 return -1;
1220         }
1221
1222         return mwifiex_send_cmd(priv, cmd_no, action, 0, reg_rw, true);
1223 }
1224
1225 /*
1226  * Sends IOCTL request to write to a register.
1227  *
1228  * This function allocates the IOCTL request buffer, fills it
1229  * with requisite parameters and calls the IOCTL handler.
1230  */
1231 int
1232 mwifiex_reg_write(struct mwifiex_private *priv, u32 reg_type,
1233                   u32 reg_offset, u32 reg_value)
1234 {
1235         struct mwifiex_ds_reg_rw reg_rw;
1236
1237         reg_rw.type = cpu_to_le32(reg_type);
1238         reg_rw.offset = cpu_to_le32(reg_offset);
1239         reg_rw.value = cpu_to_le32(reg_value);
1240
1241         return mwifiex_reg_mem_ioctl_reg_rw(priv, &reg_rw, HostCmd_ACT_GEN_SET);
1242 }
1243
1244 /*
1245  * Sends IOCTL request to read from a register.
1246  *
1247  * This function allocates the IOCTL request buffer, fills it
1248  * with requisite parameters and calls the IOCTL handler.
1249  */
1250 int
1251 mwifiex_reg_read(struct mwifiex_private *priv, u32 reg_type,
1252                  u32 reg_offset, u32 *value)
1253 {
1254         int ret;
1255         struct mwifiex_ds_reg_rw reg_rw;
1256
1257         reg_rw.type = cpu_to_le32(reg_type);
1258         reg_rw.offset = cpu_to_le32(reg_offset);
1259         ret = mwifiex_reg_mem_ioctl_reg_rw(priv, &reg_rw, HostCmd_ACT_GEN_GET);
1260
1261         if (ret)
1262                 goto done;
1263
1264         *value = le32_to_cpu(reg_rw.value);
1265
1266 done:
1267         return ret;
1268 }
1269
1270 /*
1271  * Sends IOCTL request to read from EEPROM.
1272  *
1273  * This function allocates the IOCTL request buffer, fills it
1274  * with requisite parameters and calls the IOCTL handler.
1275  */
1276 int
1277 mwifiex_eeprom_read(struct mwifiex_private *priv, u16 offset, u16 bytes,
1278                     u8 *value)
1279 {
1280         int ret;
1281         struct mwifiex_ds_read_eeprom rd_eeprom;
1282
1283         rd_eeprom.offset = cpu_to_le16((u16) offset);
1284         rd_eeprom.byte_count = cpu_to_le16((u16) bytes);
1285
1286         /* Send request to firmware */
1287         ret = mwifiex_send_cmd(priv, HostCmd_CMD_802_11_EEPROM_ACCESS,
1288                                HostCmd_ACT_GEN_GET, 0, &rd_eeprom, true);
1289
1290         if (!ret)
1291                 memcpy(value, rd_eeprom.value, MAX_EEPROM_DATA);
1292         return ret;
1293 }
1294
1295 /*
1296  * This function sets a generic IE. In addition to generic IE, it can
1297  * also handle WPA, WPA2 and WAPI IEs.
1298  */
1299 static int
1300 mwifiex_set_gen_ie_helper(struct mwifiex_private *priv, u8 *ie_data_ptr,
1301                           u16 ie_len)
1302 {
1303         int ret = 0;
1304         struct ieee_types_vendor_header *pvendor_ie;
1305         const u8 wpa_oui[] = { 0x00, 0x50, 0xf2, 0x01 };
1306         const u8 wps_oui[] = { 0x00, 0x50, 0xf2, 0x04 };
1307
1308         /* If the passed length is zero, reset the buffer */
1309         if (!ie_len) {
1310                 priv->gen_ie_buf_len = 0;
1311                 priv->wps.session_enable = false;
1312
1313                 return 0;
1314         } else if (!ie_data_ptr) {
1315                 return -1;
1316         }
1317         pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr;
1318         /* Test to see if it is a WPA IE, if not, then it is a gen IE */
1319         if (((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) &&
1320              (!memcmp(&pvendor_ie->oui, wpa_oui, sizeof(wpa_oui)))) ||
1321             (pvendor_ie->element_id == WLAN_EID_RSN)) {
1322
1323                 /* IE is a WPA/WPA2 IE so call set_wpa function */
1324                 ret = mwifiex_set_wpa_ie_helper(priv, ie_data_ptr, ie_len);
1325                 priv->wps.session_enable = false;
1326
1327                 return ret;
1328         } else if (pvendor_ie->element_id == WLAN_EID_BSS_AC_ACCESS_DELAY) {
1329                 /* IE is a WAPI IE so call set_wapi function */
1330                 ret = mwifiex_set_wapi_ie(priv, ie_data_ptr, ie_len);
1331
1332                 return ret;
1333         }
1334         /*
1335          * Verify that the passed length is not larger than the
1336          * available space remaining in the buffer
1337          */
1338         if (ie_len < (sizeof(priv->gen_ie_buf) - priv->gen_ie_buf_len)) {
1339
1340                 /* Test to see if it is a WPS IE, if so, enable
1341                  * wps session flag
1342                  */
1343                 pvendor_ie = (struct ieee_types_vendor_header *) ie_data_ptr;
1344                 if ((pvendor_ie->element_id == WLAN_EID_VENDOR_SPECIFIC) &&
1345                     (!memcmp(&pvendor_ie->oui, wps_oui, sizeof(wps_oui)))) {
1346                         priv->wps.session_enable = true;
1347                         mwifiex_dbg(priv->adapter, INFO,
1348                                     "info: WPS Session Enabled.\n");
1349                         ret = mwifiex_set_wps_ie(priv, ie_data_ptr, ie_len);
1350                 }
1351
1352                 /* Append the passed data to the end of the
1353                    genIeBuffer */
1354                 memcpy(priv->gen_ie_buf + priv->gen_ie_buf_len, ie_data_ptr,
1355                        ie_len);
1356                 /* Increment the stored buffer length by the
1357                    size passed */
1358                 priv->gen_ie_buf_len += ie_len;
1359         } else {
1360                 /* Passed data does not fit in the remaining
1361                    buffer space */
1362                 ret = -1;
1363         }
1364
1365         /* Return 0, or -1 for error case */
1366         return ret;
1367 }
1368
1369 /*
1370  * IOCTL request handler to set/get generic IE.
1371  *
1372  * In addition to various generic IEs, this function can also be
1373  * used to set the ARP filter.
1374  */
1375 static int mwifiex_misc_ioctl_gen_ie(struct mwifiex_private *priv,
1376                                      struct mwifiex_ds_misc_gen_ie *gen_ie,
1377                                      u16 action)
1378 {
1379         struct mwifiex_adapter *adapter = priv->adapter;
1380
1381         switch (gen_ie->type) {
1382         case MWIFIEX_IE_TYPE_GEN_IE:
1383                 if (action == HostCmd_ACT_GEN_GET) {
1384                         gen_ie->len = priv->wpa_ie_len;
1385                         memcpy(gen_ie->ie_data, priv->wpa_ie, gen_ie->len);
1386                 } else {
1387                         mwifiex_set_gen_ie_helper(priv, gen_ie->ie_data,
1388                                                   (u16) gen_ie->len);
1389                 }
1390                 break;
1391         case MWIFIEX_IE_TYPE_ARP_FILTER:
1392                 memset(adapter->arp_filter, 0, sizeof(adapter->arp_filter));
1393                 if (gen_ie->len > ARP_FILTER_MAX_BUF_SIZE) {
1394                         adapter->arp_filter_size = 0;
1395                         mwifiex_dbg(adapter, ERROR,
1396                                     "invalid ARP filter size\n");
1397                         return -1;
1398                 } else {
1399                         memcpy(adapter->arp_filter, gen_ie->ie_data,
1400                                gen_ie->len);
1401                         adapter->arp_filter_size = gen_ie->len;
1402                 }
1403                 break;
1404         default:
1405                 mwifiex_dbg(adapter, ERROR, "invalid IE type\n");
1406                 return -1;
1407         }
1408         return 0;
1409 }
1410
1411 /*
1412  * Sends IOCTL request to set a generic IE.
1413  *
1414  * This function allocates the IOCTL request buffer, fills it
1415  * with requisite parameters and calls the IOCTL handler.
1416  */
1417 int
1418 mwifiex_set_gen_ie(struct mwifiex_private *priv, const u8 *ie, int ie_len)
1419 {
1420         struct mwifiex_ds_misc_gen_ie gen_ie;
1421
1422         if (ie_len > IEEE_MAX_IE_SIZE)
1423                 return -EFAULT;
1424
1425         gen_ie.type = MWIFIEX_IE_TYPE_GEN_IE;
1426         gen_ie.len = ie_len;
1427         memcpy(gen_ie.ie_data, ie, ie_len);
1428         if (mwifiex_misc_ioctl_gen_ie(priv, &gen_ie, HostCmd_ACT_GEN_SET))
1429                 return -EFAULT;
1430
1431         return 0;
1432 }