]> bbs.cooldavid.org Git - net-next-2.6.git/blame - drivers/net/wireless/p54/main.c
p54: Write outside array bounds
[net-next-2.6.git] / drivers / net / wireless / p54 / main.c
CommitLineData
0ac0d6ce
CL
1/*
2 * mac80211 glue code for mac80211 Prism54 drivers
3 *
4 * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
5 * Copyright (c) 2007-2009, Christian Lamparter <chunkeey@web.de>
6 * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
7 *
8 * Based on:
9 * - the islsm (softmac prism54) driver, which is:
10 * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
11 * - stlc45xx driver
12 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2 as
16 * published by the Free Software Foundation.
17 */
18
19#include <linux/init.h>
20#include <linux/firmware.h>
21#include <linux/etherdevice.h>
22
23#include <net/mac80211.h>
24
25#include "p54.h"
26#include "lmac.h"
27
28static int modparam_nohwcrypt;
29module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
30MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
31MODULE_AUTHOR("Michael Wu <flamingice@sourmilk.net>");
32MODULE_DESCRIPTION("Softmac Prism54 common code");
33MODULE_LICENSE("GPL");
34MODULE_ALIAS("prism54common");
35
36static void p54_sta_notify(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
37 enum sta_notify_cmd notify_cmd,
38 struct ieee80211_sta *sta)
39{
40 struct p54_common *priv = dev->priv;
41 switch (notify_cmd) {
42 case STA_NOTIFY_ADD:
43 case STA_NOTIFY_REMOVE:
44 /*
45 * Notify the firmware that we don't want or we don't
46 * need to buffer frames for this station anymore.
47 */
48
49 p54_sta_unlock(priv, sta->addr);
50 break;
51 case STA_NOTIFY_AWAKE:
52 /* update the firmware's filter table */
53 p54_sta_unlock(priv, sta->addr);
54 break;
55 default:
56 break;
57 }
58}
59
60static int p54_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
61 bool set)
62{
63 struct p54_common *priv = dev->priv;
64
65 return p54_update_beacon_tim(priv, sta->aid, set);
66}
67
e0f114e8 68u8 *p54_find_ie(struct sk_buff *skb, u8 ie)
0ac0d6ce 69{
0ac0d6ce
CL
70 struct ieee80211_mgmt *mgmt = (void *)skb->data;
71 u8 *pos, *end;
72
73 if (skb->len <= sizeof(mgmt))
e0f114e8 74 return NULL;
0ac0d6ce
CL
75
76 pos = (u8 *)mgmt->u.beacon.variable;
77 end = skb->data + skb->len;
78 while (pos < end) {
79 if (pos + 2 + pos[1] > end)
e0f114e8 80 return NULL;
0ac0d6ce 81
e0f114e8
CL
82 if (pos[0] == ie)
83 return pos;
0ac0d6ce 84
e0f114e8
CL
85 pos += 2 + pos[1];
86 }
87 return NULL;
88}
0ac0d6ce 89
e0f114e8
CL
90static int p54_beacon_format_ie_tim(struct sk_buff *skb)
91{
92 /*
93 * the good excuse for this mess is ... the firmware.
94 * The dummy TIM MUST be at the end of the beacon frame,
95 * because it'll be overwritten!
96 */
97 u8 *tim;
98 u8 dtim_len;
99 u8 dtim_period;
100 u8 *next;
0ac0d6ce 101
e0f114e8
CL
102 tim = p54_find_ie(skb, WLAN_EID_TIM);
103 if (!tim)
104 return 0;
0ac0d6ce 105
e0f114e8
CL
106 dtim_len = tim[1];
107 dtim_period = tim[3];
108 next = tim + 2 + dtim_len;
109
110 if (dtim_len < 3)
111 return -EINVAL;
112
113 memmove(tim, next, skb_tail_pointer(skb) - next);
114 tim = skb_tail_pointer(skb) - (dtim_len + 2);
115
116 /* add the dummy at the end */
117 tim[0] = WLAN_EID_TIM;
118 tim[1] = 3;
119 tim[2] = 0;
120 tim[3] = dtim_period;
121 tim[4] = 0;
122
123 if (dtim_len > 3)
124 skb_trim(skb, skb->len - (dtim_len - 3));
0ac0d6ce 125
0ac0d6ce
CL
126 return 0;
127}
128
129static int p54_beacon_update(struct p54_common *priv,
130 struct ieee80211_vif *vif)
131{
132 struct sk_buff *beacon;
0ac0d6ce
CL
133 int ret;
134
135 beacon = ieee80211_beacon_get(priv->hw, vif);
136 if (!beacon)
137 return -ENOMEM;
138 ret = p54_beacon_format_ie_tim(beacon);
139 if (ret)
140 return ret;
141
46df10ae
CL
142 /*
143 * During operation, the firmware takes care of beaconing.
144 * The driver only needs to upload a new beacon template, once
145 * the template was changed by the stack or userspace.
146 *
147 * LMAC API 3.2.2 also specifies that the driver does not need
148 * to cancel the old beacon template by hand, instead the firmware
149 * will release the previous one through the feedback mechanism.
150 */
151 WARN_ON(p54_tx_80211(priv->hw, beacon));
0ac0d6ce
CL
152 priv->tsf_high32 = 0;
153 priv->tsf_low32 = 0;
154
155 return 0;
156}
157
158static int p54_start(struct ieee80211_hw *dev)
159{
160 struct p54_common *priv = dev->priv;
161 int err;
162
163 mutex_lock(&priv->conf_mutex);
164 err = priv->open(dev);
165 if (err)
166 goto out;
167 P54_SET_QUEUE(priv->qos_params[0], 0x0002, 0x0003, 0x0007, 47);
168 P54_SET_QUEUE(priv->qos_params[1], 0x0002, 0x0007, 0x000f, 94);
169 P54_SET_QUEUE(priv->qos_params[2], 0x0003, 0x000f, 0x03ff, 0);
170 P54_SET_QUEUE(priv->qos_params[3], 0x0007, 0x000f, 0x03ff, 0);
171 err = p54_set_edcf(priv);
172 if (err)
173 goto out;
174
175 memset(priv->bssid, ~0, ETH_ALEN);
176 priv->mode = NL80211_IFTYPE_MONITOR;
177 err = p54_setup_mac(priv);
178 if (err) {
179 priv->mode = NL80211_IFTYPE_UNSPECIFIED;
180 goto out;
181 }
182
42935eca 183 ieee80211_queue_delayed_work(dev, &priv->work, 0);
0ac0d6ce
CL
184
185 priv->softled_state = 0;
186 err = p54_set_leds(priv);
187
188out:
189 mutex_unlock(&priv->conf_mutex);
190 return err;
191}
192
193static void p54_stop(struct ieee80211_hw *dev)
194{
195 struct p54_common *priv = dev->priv;
196 int i;
197
198 mutex_lock(&priv->conf_mutex);
199 priv->mode = NL80211_IFTYPE_UNSPECIFIED;
200 priv->softled_state = 0;
201 p54_set_leds(priv);
202
203 cancel_delayed_work_sync(&priv->work);
204
205 priv->stop(dev);
206 skb_queue_purge(&priv->tx_pending);
207 skb_queue_purge(&priv->tx_queue);
208 for (i = 0; i < P54_QUEUE_NUM; i++) {
209 priv->tx_stats[i].count = 0;
210 priv->tx_stats[i].len = 0;
211 }
212
213 priv->beacon_req_id = cpu_to_le32(0);
214 priv->tsf_high32 = priv->tsf_low32 = 0;
215 mutex_unlock(&priv->conf_mutex);
216}
217
218static int p54_add_interface(struct ieee80211_hw *dev,
219 struct ieee80211_if_init_conf *conf)
220{
221 struct p54_common *priv = dev->priv;
222
223 mutex_lock(&priv->conf_mutex);
224 if (priv->mode != NL80211_IFTYPE_MONITOR) {
225 mutex_unlock(&priv->conf_mutex);
226 return -EOPNOTSUPP;
227 }
228
229 priv->vif = conf->vif;
230
231 switch (conf->type) {
232 case NL80211_IFTYPE_STATION:
233 case NL80211_IFTYPE_ADHOC:
234 case NL80211_IFTYPE_AP:
235 case NL80211_IFTYPE_MESH_POINT:
236 priv->mode = conf->type;
237 break;
238 default:
239 mutex_unlock(&priv->conf_mutex);
240 return -EOPNOTSUPP;
241 }
242
243 memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
244 p54_setup_mac(priv);
245 mutex_unlock(&priv->conf_mutex);
246 return 0;
247}
248
249static void p54_remove_interface(struct ieee80211_hw *dev,
250 struct ieee80211_if_init_conf *conf)
251{
252 struct p54_common *priv = dev->priv;
253
254 mutex_lock(&priv->conf_mutex);
255 priv->vif = NULL;
46df10ae
CL
256
257 /*
258 * LMAC API 3.2.2 states that any active beacon template must be
259 * canceled by the driver before attempting a mode transition.
260 */
261 if (le32_to_cpu(priv->beacon_req_id) != 0) {
0ac0d6ce 262 p54_tx_cancel(priv, priv->beacon_req_id);
46df10ae 263 wait_for_completion_interruptible_timeout(&priv->beacon_comp, HZ);
0ac0d6ce
CL
264 }
265 priv->mode = NL80211_IFTYPE_MONITOR;
266 memset(priv->mac_addr, 0, ETH_ALEN);
267 memset(priv->bssid, 0, ETH_ALEN);
268 p54_setup_mac(priv);
269 mutex_unlock(&priv->conf_mutex);
270}
271
272static int p54_config(struct ieee80211_hw *dev, u32 changed)
273{
274 int ret = 0;
275 struct p54_common *priv = dev->priv;
276 struct ieee80211_conf *conf = &dev->conf;
277
278 mutex_lock(&priv->conf_mutex);
279 if (changed & IEEE80211_CONF_CHANGE_POWER)
280 priv->output_power = conf->power_level << 2;
281 if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
282 ret = p54_scan(priv, P54_SCAN_EXIT, 0);
283 if (ret)
284 goto out;
285 }
286 if (changed & IEEE80211_CONF_CHANGE_PS) {
287 ret = p54_set_ps(priv);
288 if (ret)
289 goto out;
290 }
291
292out:
293 mutex_unlock(&priv->conf_mutex);
294 return ret;
295}
296
297static void p54_configure_filter(struct ieee80211_hw *dev,
298 unsigned int changed_flags,
299 unsigned int *total_flags,
300 int mc_count, struct dev_mc_list *mclist)
301{
302 struct p54_common *priv = dev->priv;
303
304 *total_flags &= FIF_PROMISC_IN_BSS |
305 FIF_OTHER_BSS;
306
307 priv->filter_flags = *total_flags;
308
309 if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS))
310 p54_setup_mac(priv);
311}
312
313static int p54_conf_tx(struct ieee80211_hw *dev, u16 queue,
314 const struct ieee80211_tx_queue_params *params)
315{
316 struct p54_common *priv = dev->priv;
317 int ret;
318
319 mutex_lock(&priv->conf_mutex);
718126a7 320 if (queue < dev->queues) {
0ac0d6ce
CL
321 P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
322 params->cw_min, params->cw_max, params->txop);
323 ret = p54_set_edcf(priv);
324 } else
325 ret = -EINVAL;
326 mutex_unlock(&priv->conf_mutex);
327 return ret;
328}
329
330static void p54_work(struct work_struct *work)
331{
332 struct p54_common *priv = container_of(work, struct p54_common,
333 work.work);
334
335 if (unlikely(priv->mode == NL80211_IFTYPE_UNSPECIFIED))
336 return ;
337
338 /*
339 * TODO: walk through tx_queue and do the following tasks
340 * 1. initiate bursts.
341 * 2. cancel stuck frames / reset the device if necessary.
342 */
343
344 p54_fetch_statistics(priv);
345}
346
347static int p54_get_stats(struct ieee80211_hw *dev,
348 struct ieee80211_low_level_stats *stats)
349{
350 struct p54_common *priv = dev->priv;
351
352 memcpy(stats, &priv->stats, sizeof(*stats));
353 return 0;
354}
355
356static int p54_get_tx_stats(struct ieee80211_hw *dev,
357 struct ieee80211_tx_queue_stats *stats)
358{
359 struct p54_common *priv = dev->priv;
360
361 memcpy(stats, &priv->tx_stats[P54_QUEUE_DATA],
362 sizeof(stats[0]) * dev->queues);
363 return 0;
364}
365
366static void p54_bss_info_changed(struct ieee80211_hw *dev,
367 struct ieee80211_vif *vif,
368 struct ieee80211_bss_conf *info,
369 u32 changed)
370{
371 struct p54_common *priv = dev->priv;
372
373 mutex_lock(&priv->conf_mutex);
374 if (changed & BSS_CHANGED_BSSID) {
375 memcpy(priv->bssid, info->bssid, ETH_ALEN);
376 p54_setup_mac(priv);
377 }
378
379 if (changed & BSS_CHANGED_BEACON) {
380 p54_scan(priv, P54_SCAN_EXIT, 0);
381 p54_setup_mac(priv);
382 p54_beacon_update(priv, vif);
383 p54_set_edcf(priv);
384 }
385
386 if (changed & (BSS_CHANGED_ERP_SLOT | BSS_CHANGED_BEACON)) {
387 priv->use_short_slot = info->use_short_slot;
388 p54_set_edcf(priv);
389 }
390 if (changed & BSS_CHANGED_BASIC_RATES) {
391 if (dev->conf.channel->band == IEEE80211_BAND_5GHZ)
392 priv->basic_rate_mask = (info->basic_rates << 4);
393 else
394 priv->basic_rate_mask = info->basic_rates;
395 p54_setup_mac(priv);
396 if (priv->fw_var >= 0x500)
397 p54_scan(priv, P54_SCAN_EXIT, 0);
398 }
399 if (changed & BSS_CHANGED_ASSOC) {
400 if (info->assoc) {
401 priv->aid = info->aid;
402 priv->wakeup_timer = info->beacon_int *
403 info->dtim_period * 5;
404 p54_setup_mac(priv);
e0f114e8
CL
405 } else {
406 priv->wakeup_timer = 500;
407 priv->aid = 0;
0ac0d6ce
CL
408 }
409 }
410
411 mutex_unlock(&priv->conf_mutex);
412}
413
414static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
415 struct ieee80211_vif *vif, struct ieee80211_sta *sta,
416 struct ieee80211_key_conf *key)
417{
418 struct p54_common *priv = dev->priv;
419 int slot, ret = 0;
420 u8 algo = 0;
421 u8 *addr = NULL;
422
423 if (modparam_nohwcrypt)
424 return -EOPNOTSUPP;
425
426 mutex_lock(&priv->conf_mutex);
427 if (cmd == SET_KEY) {
428 switch (key->alg) {
429 case ALG_TKIP:
430 if (!(priv->privacy_caps & (BR_DESC_PRIV_CAP_MICHAEL |
431 BR_DESC_PRIV_CAP_TKIP))) {
432 ret = -EOPNOTSUPP;
433 goto out_unlock;
434 }
435 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
436 algo = P54_CRYPTO_TKIPMICHAEL;
437 break;
438 case ALG_WEP:
439 if (!(priv->privacy_caps & BR_DESC_PRIV_CAP_WEP)) {
440 ret = -EOPNOTSUPP;
441 goto out_unlock;
442 }
443 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
444 algo = P54_CRYPTO_WEP;
445 break;
446 case ALG_CCMP:
447 if (!(priv->privacy_caps & BR_DESC_PRIV_CAP_AESCCMP)) {
448 ret = -EOPNOTSUPP;
449 goto out_unlock;
450 }
451 key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
452 algo = P54_CRYPTO_AESCCMP;
453 break;
454 default:
455 ret = -EOPNOTSUPP;
456 goto out_unlock;
457 }
458 slot = bitmap_find_free_region(priv->used_rxkeys,
459 priv->rx_keycache_size, 0);
460
461 if (slot < 0) {
462 /*
463 * The device supports the choosen algorithm, but the
464 * firmware does not provide enough key slots to store
465 * all of them.
466 * But encryption offload for outgoing frames is always
467 * possible, so we just pretend that the upload was
468 * successful and do the decryption in software.
469 */
470
471 /* mark the key as invalid. */
472 key->hw_key_idx = 0xff;
473 goto out_unlock;
474 }
475 } else {
476 slot = key->hw_key_idx;
477
478 if (slot == 0xff) {
479 /* This key was not uploaded into the rx key cache. */
480
481 goto out_unlock;
482 }
483
484 bitmap_release_region(priv->used_rxkeys, slot, 0);
485 algo = 0;
486 }
487
488 if (sta)
489 addr = sta->addr;
490
491 ret = p54_upload_key(priv, algo, slot, key->keyidx,
492 key->keylen, addr, key->key);
493 if (ret) {
494 bitmap_release_region(priv->used_rxkeys, slot, 0);
495 ret = -EOPNOTSUPP;
496 goto out_unlock;
497 }
498
499 key->hw_key_idx = slot;
500
501out_unlock:
502 mutex_unlock(&priv->conf_mutex);
503 return ret;
504}
505
506static const struct ieee80211_ops p54_ops = {
507 .tx = p54_tx_80211,
508 .start = p54_start,
509 .stop = p54_stop,
510 .add_interface = p54_add_interface,
511 .remove_interface = p54_remove_interface,
512 .set_tim = p54_set_tim,
513 .sta_notify = p54_sta_notify,
514 .set_key = p54_set_key,
515 .config = p54_config,
516 .bss_info_changed = p54_bss_info_changed,
517 .configure_filter = p54_configure_filter,
518 .conf_tx = p54_conf_tx,
519 .get_stats = p54_get_stats,
520 .get_tx_stats = p54_get_tx_stats
521};
522
523struct ieee80211_hw *p54_init_common(size_t priv_data_len)
524{
525 struct ieee80211_hw *dev;
526 struct p54_common *priv;
527
528 dev = ieee80211_alloc_hw(priv_data_len, &p54_ops);
529 if (!dev)
530 return NULL;
531
532 priv = dev->priv;
533 priv->hw = dev;
534 priv->mode = NL80211_IFTYPE_UNSPECIFIED;
535 priv->basic_rate_mask = 0x15f;
536 spin_lock_init(&priv->tx_stats_lock);
537 skb_queue_head_init(&priv->tx_queue);
538 skb_queue_head_init(&priv->tx_pending);
539 dev->flags = IEEE80211_HW_RX_INCLUDES_FCS |
540 IEEE80211_HW_SIGNAL_DBM |
e0f114e8
CL
541 IEEE80211_HW_SUPPORTS_PS |
542 IEEE80211_HW_PS_NULLFUNC_STACK |
543 IEEE80211_HW_BEACON_FILTER |
0ac0d6ce
CL
544 IEEE80211_HW_NOISE_DBM;
545
546 dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
547 BIT(NL80211_IFTYPE_ADHOC) |
548 BIT(NL80211_IFTYPE_AP) |
549 BIT(NL80211_IFTYPE_MESH_POINT);
550
551 dev->channel_change_time = 1000; /* TODO: find actual value */
46df10ae 552 priv->beacon_req_id = cpu_to_le32(0);
0ac0d6ce
CL
553 priv->tx_stats[P54_QUEUE_BEACON].limit = 1;
554 priv->tx_stats[P54_QUEUE_FWSCAN].limit = 1;
555 priv->tx_stats[P54_QUEUE_MGMT].limit = 3;
556 priv->tx_stats[P54_QUEUE_CAB].limit = 3;
557 priv->tx_stats[P54_QUEUE_DATA].limit = 5;
558 dev->queues = 1;
559 priv->noise = -94;
560 /*
561 * We support at most 8 tries no matter which rate they're at,
562 * we cannot support max_rates * max_rate_tries as we set it
563 * here, but setting it correctly to 4/2 or so would limit us
564 * artificially if the RC algorithm wants just two rates, so
565 * let's say 4/7, we'll redistribute it at TX time, see the
566 * comments there.
567 */
568 dev->max_rates = 4;
569 dev->max_rate_tries = 7;
570 dev->extra_tx_headroom = sizeof(struct p54_hdr) + 4 +
571 sizeof(struct p54_tx_data);
572
573 mutex_init(&priv->conf_mutex);
574 mutex_init(&priv->eeprom_mutex);
575 init_completion(&priv->eeprom_comp);
46df10ae 576 init_completion(&priv->beacon_comp);
0ac0d6ce
CL
577 INIT_DELAYED_WORK(&priv->work, p54_work);
578
579 return dev;
580}
581EXPORT_SYMBOL_GPL(p54_init_common);
582
583int p54_register_common(struct ieee80211_hw *dev, struct device *pdev)
584{
585 struct p54_common *priv = dev->priv;
586 int err;
587
588 err = ieee80211_register_hw(dev);
589 if (err) {
590 dev_err(pdev, "Cannot register device (%d).\n", err);
591 return err;
592 }
593
594#ifdef CONFIG_P54_LEDS
595 err = p54_init_leds(priv);
596 if (err)
597 return err;
598#endif /* CONFIG_P54_LEDS */
599
600 dev_info(pdev, "is registered as '%s'\n", wiphy_name(dev->wiphy));
601 return 0;
602}
603EXPORT_SYMBOL_GPL(p54_register_common);
604
605void p54_free_common(struct ieee80211_hw *dev)
606{
607 struct p54_common *priv = dev->priv;
1a9b6679
CL
608 unsigned int i;
609
610 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
611 kfree(priv->band_table[i]);
0ac0d6ce
CL
612
613 kfree(priv->iq_autocal);
614 kfree(priv->output_limit);
615 kfree(priv->curve_data);
616 kfree(priv->used_rxkeys);
617 priv->iq_autocal = NULL;
618 priv->output_limit = NULL;
619 priv->curve_data = NULL;
620 priv->used_rxkeys = NULL;
621 ieee80211_free_hw(dev);
622}
623EXPORT_SYMBOL_GPL(p54_free_common);
624
625void p54_unregister_common(struct ieee80211_hw *dev)
626{
627 struct p54_common *priv = dev->priv;
628
629#ifdef CONFIG_P54_LEDS
630 p54_unregister_leds(priv);
631#endif /* CONFIG_P54_LEDS */
632
633 ieee80211_unregister_hw(dev);
634 mutex_destroy(&priv->conf_mutex);
635 mutex_destroy(&priv->eeprom_mutex);
636}
637EXPORT_SYMBOL_GPL(p54_unregister_common);