Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
[linux-2.6.git] / drivers / net / wireless / libertas / cfg.c
1 /*
2  * Implement cfg80211 ("iw") support.
3  *
4  * Copyright (C) 2009 M&N Solutions GmbH, 61191 Rosbach, Germany
5  * Holger Schurig <hs4233@mail.mn-solutions.de>
6  *
7  */
8
9 #include <linux/sched.h>
10 #include <linux/wait.h>
11 #include <linux/slab.h>
12 #include <linux/ieee80211.h>
13 #include <net/cfg80211.h>
14 #include <asm/unaligned.h>
15
16 #include "decl.h"
17 #include "cfg.h"
18 #include "cmd.h"
19
20
21 #define CHAN2G(_channel, _freq, _flags) {        \
22         .band             = IEEE80211_BAND_2GHZ, \
23         .center_freq      = (_freq),             \
24         .hw_value         = (_channel),          \
25         .flags            = (_flags),            \
26         .max_antenna_gain = 0,                   \
27         .max_power        = 30,                  \
28 }
29
30 static struct ieee80211_channel lbs_2ghz_channels[] = {
31         CHAN2G(1,  2412, 0),
32         CHAN2G(2,  2417, 0),
33         CHAN2G(3,  2422, 0),
34         CHAN2G(4,  2427, 0),
35         CHAN2G(5,  2432, 0),
36         CHAN2G(6,  2437, 0),
37         CHAN2G(7,  2442, 0),
38         CHAN2G(8,  2447, 0),
39         CHAN2G(9,  2452, 0),
40         CHAN2G(10, 2457, 0),
41         CHAN2G(11, 2462, 0),
42         CHAN2G(12, 2467, 0),
43         CHAN2G(13, 2472, 0),
44         CHAN2G(14, 2484, 0),
45 };
46
47 #define RATETAB_ENT(_rate, _hw_value, _flags) { \
48         .bitrate  = (_rate),                    \
49         .hw_value = (_hw_value),                \
50         .flags    = (_flags),                   \
51 }
52
53
54 /* Table 6 in section 3.2.1.1 */
55 static struct ieee80211_rate lbs_rates[] = {
56         RATETAB_ENT(10,  0,  0),
57         RATETAB_ENT(20,  1,  0),
58         RATETAB_ENT(55,  2,  0),
59         RATETAB_ENT(110, 3,  0),
60         RATETAB_ENT(60,  9,  0),
61         RATETAB_ENT(90,  6,  0),
62         RATETAB_ENT(120, 7,  0),
63         RATETAB_ENT(180, 8,  0),
64         RATETAB_ENT(240, 9,  0),
65         RATETAB_ENT(360, 10, 0),
66         RATETAB_ENT(480, 11, 0),
67         RATETAB_ENT(540, 12, 0),
68 };
69
70 static struct ieee80211_supported_band lbs_band_2ghz = {
71         .channels = lbs_2ghz_channels,
72         .n_channels = ARRAY_SIZE(lbs_2ghz_channels),
73         .bitrates = lbs_rates,
74         .n_bitrates = ARRAY_SIZE(lbs_rates),
75 };
76
77
78 static const u32 cipher_suites[] = {
79         WLAN_CIPHER_SUITE_WEP40,
80         WLAN_CIPHER_SUITE_WEP104,
81         WLAN_CIPHER_SUITE_TKIP,
82         WLAN_CIPHER_SUITE_CCMP,
83 };
84
85 /* Time to stay on the channel */
86 #define LBS_DWELL_PASSIVE 100
87 #define LBS_DWELL_ACTIVE  40
88
89
90 /***************************************************************************
91  * Misc utility functions
92  *
93  * TLVs are Marvell specific. They are very similar to IEs, they have the
94  * same structure: type, length, data*. The only difference: for IEs, the
95  * type and length are u8, but for TLVs they're __le16.
96  */
97
98 /*
99  * Convert NL80211's auth_type to the one from Libertas, see chapter 5.9.1
100  * in the firmware spec
101  */
102 static u8 lbs_auth_to_authtype(enum nl80211_auth_type auth_type)
103 {
104         int ret = -ENOTSUPP;
105
106         switch (auth_type) {
107         case NL80211_AUTHTYPE_OPEN_SYSTEM:
108         case NL80211_AUTHTYPE_SHARED_KEY:
109                 ret = auth_type;
110                 break;
111         case NL80211_AUTHTYPE_AUTOMATIC:
112                 ret = NL80211_AUTHTYPE_OPEN_SYSTEM;
113                 break;
114         case NL80211_AUTHTYPE_NETWORK_EAP:
115                 ret = 0x80;
116                 break;
117         default:
118                 /* silence compiler */
119                 break;
120         }
121         return ret;
122 }
123
124
125 /*
126  * Various firmware commands need the list of supported rates, but with
127  * the hight-bit set for basic rates
128  */
129 static int lbs_add_rates(u8 *rates)
130 {
131         size_t i;
132
133         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
134                 u8 rate = lbs_rates[i].bitrate / 5;
135                 if (rate == 0x02 || rate == 0x04 ||
136                     rate == 0x0b || rate == 0x16)
137                         rate |= 0x80;
138                 rates[i] = rate;
139         }
140         return ARRAY_SIZE(lbs_rates);
141 }
142
143
144 /***************************************************************************
145  * TLV utility functions
146  *
147  * TLVs are Marvell specific. They are very similar to IEs, they have the
148  * same structure: type, length, data*. The only difference: for IEs, the
149  * type and length are u8, but for TLVs they're __le16.
150  */
151
152
153 /*
154  * Add ssid TLV
155  */
156 #define LBS_MAX_SSID_TLV_SIZE                   \
157         (sizeof(struct mrvl_ie_header)          \
158          + IEEE80211_MAX_SSID_LEN)
159
160 static int lbs_add_ssid_tlv(u8 *tlv, const u8 *ssid, int ssid_len)
161 {
162         struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
163
164         /*
165          * TLV-ID SSID  00 00
166          * length       06 00
167          * ssid         4d 4e 54 45 53 54
168          */
169         ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
170         ssid_tlv->header.len = cpu_to_le16(ssid_len);
171         memcpy(ssid_tlv->ssid, ssid, ssid_len);
172         return sizeof(ssid_tlv->header) + ssid_len;
173 }
174
175
176 /*
177  * Add channel list TLV (section 8.4.2)
178  *
179  * Actual channel data comes from priv->wdev->wiphy->channels.
180  */
181 #define LBS_MAX_CHANNEL_LIST_TLV_SIZE                                   \
182         (sizeof(struct mrvl_ie_header)                                  \
183          + (LBS_SCAN_BEFORE_NAP * sizeof(struct chanscanparamset)))
184
185 static int lbs_add_channel_list_tlv(struct lbs_private *priv, u8 *tlv,
186                                     int last_channel, int active_scan)
187 {
188         int chanscanparamsize = sizeof(struct chanscanparamset) *
189                 (last_channel - priv->scan_channel);
190
191         struct mrvl_ie_header *header = (void *) tlv;
192
193         /*
194          * TLV-ID CHANLIST  01 01
195          * length           0e 00
196          * channel          00 01 00 00 00 64 00
197          *   radio type     00
198          *   channel           01
199          *   scan type            00
200          *   min scan time           00 00
201          *   max scan time                 64 00
202          * channel 2        00 02 00 00 00 64 00
203          *
204          */
205
206         header->type = cpu_to_le16(TLV_TYPE_CHANLIST);
207         header->len  = cpu_to_le16(chanscanparamsize);
208         tlv += sizeof(struct mrvl_ie_header);
209
210         /* lbs_deb_scan("scan: channels %d to %d\n", priv->scan_channel,
211                      last_channel); */
212         memset(tlv, 0, chanscanparamsize);
213
214         while (priv->scan_channel < last_channel) {
215                 struct chanscanparamset *param = (void *) tlv;
216
217                 param->radiotype = CMD_SCAN_RADIO_TYPE_BG;
218                 param->channumber =
219                         priv->scan_req->channels[priv->scan_channel]->hw_value;
220                 if (active_scan) {
221                         param->maxscantime = cpu_to_le16(LBS_DWELL_ACTIVE);
222                 } else {
223                         param->chanscanmode.passivescan = 1;
224                         param->maxscantime = cpu_to_le16(LBS_DWELL_PASSIVE);
225                 }
226                 tlv += sizeof(struct chanscanparamset);
227                 priv->scan_channel++;
228         }
229         return sizeof(struct mrvl_ie_header) + chanscanparamsize;
230 }
231
232
233 /*
234  * Add rates TLV
235  *
236  * The rates are in lbs_bg_rates[], but for the 802.11b
237  * rates the high bit is set. We add this TLV only because
238  * there's a firmware which otherwise doesn't report all
239  * APs in range.
240  */
241 #define LBS_MAX_RATES_TLV_SIZE                  \
242         (sizeof(struct mrvl_ie_header)          \
243          + (ARRAY_SIZE(lbs_rates)))
244
245 /* Adds a TLV with all rates the hardware supports */
246 static int lbs_add_supported_rates_tlv(u8 *tlv)
247 {
248         size_t i;
249         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
250
251         /*
252          * TLV-ID RATES  01 00
253          * length        0e 00
254          * rates         82 84 8b 96 0c 12 18 24 30 48 60 6c
255          */
256         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
257         tlv += sizeof(rate_tlv->header);
258         i = lbs_add_rates(tlv);
259         tlv += i;
260         rate_tlv->header.len = cpu_to_le16(i);
261         return sizeof(rate_tlv->header) + i;
262 }
263
264 /* Add common rates from a TLV and return the new end of the TLV */
265 static u8 *
266 add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
267 {
268         int hw, ap, ap_max = ie[1];
269         u8 hw_rate;
270
271         /* Advance past IE header */
272         ie += 2;
273
274         lbs_deb_hex(LBS_DEB_ASSOC, "AP IE Rates", (u8 *) ie, ap_max);
275
276         for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
277                 hw_rate = lbs_rates[hw].bitrate / 5;
278                 for (ap = 0; ap < ap_max; ap++) {
279                         if (hw_rate == (ie[ap] & 0x7f)) {
280                                 *tlv++ = ie[ap];
281                                 *nrates = *nrates + 1;
282                         }
283                 }
284         }
285         return tlv;
286 }
287
288 /*
289  * Adds a TLV with all rates the hardware *and* BSS supports.
290  */
291 static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
292 {
293         struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
294         const u8 *rates_eid, *ext_rates_eid;
295         int n = 0;
296
297         rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
298         ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
299
300         /*
301          * 01 00                   TLV_TYPE_RATES
302          * 04 00                   len
303          * 82 84 8b 96             rates
304          */
305         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
306         tlv += sizeof(rate_tlv->header);
307
308         /* Add basic rates */
309         if (rates_eid) {
310                 tlv = add_ie_rates(tlv, rates_eid, &n);
311
312                 /* Add extended rates, if any */
313                 if (ext_rates_eid)
314                         tlv = add_ie_rates(tlv, ext_rates_eid, &n);
315         } else {
316                 lbs_deb_assoc("assoc: bss had no basic rate IE\n");
317                 /* Fallback: add basic 802.11b rates */
318                 *tlv++ = 0x82;
319                 *tlv++ = 0x84;
320                 *tlv++ = 0x8b;
321                 *tlv++ = 0x96;
322                 n = 4;
323         }
324
325         rate_tlv->header.len = cpu_to_le16(n);
326         return sizeof(rate_tlv->header) + n;
327 }
328
329
330 /*
331  * Add auth type TLV.
332  *
333  * This is only needed for newer firmware (V9 and up).
334  */
335 #define LBS_MAX_AUTH_TYPE_TLV_SIZE \
336         sizeof(struct mrvl_ie_auth_type)
337
338 static int lbs_add_auth_type_tlv(u8 *tlv, enum nl80211_auth_type auth_type)
339 {
340         struct mrvl_ie_auth_type *auth = (void *) tlv;
341
342         /*
343          * 1f 01  TLV_TYPE_AUTH_TYPE
344          * 01 00  len
345          * 01     auth type
346          */
347         auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
348         auth->header.len = cpu_to_le16(sizeof(*auth)-sizeof(auth->header));
349         auth->auth = cpu_to_le16(lbs_auth_to_authtype(auth_type));
350         return sizeof(*auth);
351 }
352
353
354 /*
355  * Add channel (phy ds) TLV
356  */
357 #define LBS_MAX_CHANNEL_TLV_SIZE \
358         sizeof(struct mrvl_ie_header)
359
360 static int lbs_add_channel_tlv(u8 *tlv, u8 channel)
361 {
362         struct mrvl_ie_ds_param_set *ds = (void *) tlv;
363
364         /*
365          * 03 00  TLV_TYPE_PHY_DS
366          * 01 00  len
367          * 06     channel
368          */
369         ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
370         ds->header.len = cpu_to_le16(sizeof(*ds)-sizeof(ds->header));
371         ds->channel = channel;
372         return sizeof(*ds);
373 }
374
375
376 /*
377  * Add (empty) CF param TLV of the form:
378  */
379 #define LBS_MAX_CF_PARAM_TLV_SIZE               \
380         sizeof(struct mrvl_ie_header)
381
382 static int lbs_add_cf_param_tlv(u8 *tlv)
383 {
384         struct mrvl_ie_cf_param_set *cf = (void *)tlv;
385
386         /*
387          * 04 00  TLV_TYPE_CF
388          * 06 00  len
389          * 00     cfpcnt
390          * 00     cfpperiod
391          * 00 00  cfpmaxduration
392          * 00 00  cfpdurationremaining
393          */
394         cf->header.type = cpu_to_le16(TLV_TYPE_CF);
395         cf->header.len = cpu_to_le16(sizeof(*cf)-sizeof(cf->header));
396         return sizeof(*cf);
397 }
398
399 /*
400  * Add WPA TLV
401  */
402 #define LBS_MAX_WPA_TLV_SIZE                    \
403         (sizeof(struct mrvl_ie_header)          \
404          + 128 /* TODO: I guessed the size */)
405
406 static int lbs_add_wpa_tlv(u8 *tlv, const u8 *ie, u8 ie_len)
407 {
408         size_t tlv_len;
409
410         /*
411          * We need just convert an IE to an TLV. IEs use u8 for the header,
412          *   u8      type
413          *   u8      len
414          *   u8[]    data
415          * but TLVs use __le16 instead:
416          *   __le16  type
417          *   __le16  len
418          *   u8[]    data
419          */
420         *tlv++ = *ie++;
421         *tlv++ = 0;
422         tlv_len = *tlv++ = *ie++;
423         *tlv++ = 0;
424         while (tlv_len--)
425                 *tlv++ = *ie++;
426         /* the TLV is two bytes larger than the IE */
427         return ie_len + 2;
428 }
429
430 /*
431  * Set Channel
432  */
433
434 static int lbs_cfg_set_channel(struct wiphy *wiphy,
435         struct net_device *netdev,
436         struct ieee80211_channel *channel,
437         enum nl80211_channel_type channel_type)
438 {
439         struct lbs_private *priv = wiphy_priv(wiphy);
440         int ret = -ENOTSUPP;
441
442         lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d",
443                            channel->center_freq, channel_type);
444
445         if (channel_type != NL80211_CHAN_NO_HT)
446                 goto out;
447
448         ret = lbs_set_channel(priv, channel->hw_value);
449
450  out:
451         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
452         return ret;
453 }
454
455
456
457 /*
458  * Scanning
459  */
460
461 /*
462  * When scanning, the firmware doesn't send a nul packet with the power-safe
463  * bit to the AP. So we cannot stay away from our current channel too long,
464  * otherwise we loose data. So take a "nap" while scanning every other
465  * while.
466  */
467 #define LBS_SCAN_BEFORE_NAP 4
468
469
470 /*
471  * When the firmware reports back a scan-result, it gives us an "u8 rssi",
472  * which isn't really an RSSI, as it becomes larger when moving away from
473  * the AP. Anyway, we need to convert that into mBm.
474  */
475 #define LBS_SCAN_RSSI_TO_MBM(rssi) \
476         ((-(int)rssi + 3)*100)
477
478 static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
479         struct cmd_header *resp)
480 {
481         struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
482         int bsssize;
483         const u8 *pos;
484         const u8 *tsfdesc;
485         int tsfsize;
486         int i;
487         int ret = -EILSEQ;
488
489         lbs_deb_enter(LBS_DEB_CFG80211);
490
491         bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
492
493         lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
494                         scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));
495
496         if (scanresp->nr_sets == 0) {
497                 ret = 0;
498                 goto done;
499         }
500
501         /*
502          * The general layout of the scan response is described in chapter
503          * 5.7.1. Basically we have a common part, then any number of BSS
504          * descriptor sections. Finally we have section with the same number
505          * of TSFs.
506          *
507          * cmd_ds_802_11_scan_rsp
508          *   cmd_header
509          *   pos_size
510          *   nr_sets
511          *   bssdesc 1
512          *     bssid
513          *     rssi
514          *     timestamp
515          *     intvl
516          *     capa
517          *     IEs
518          *   bssdesc 2
519          *   bssdesc n
520          *   MrvlIEtypes_TsfFimestamp_t
521          *     TSF for BSS 1
522          *     TSF for BSS 2
523          *     TSF for BSS n
524          */
525
526         pos = scanresp->bssdesc_and_tlvbuffer;
527
528         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_RSP", scanresp->bssdesc_and_tlvbuffer,
529                         scanresp->bssdescriptsize);
530
531         tsfdesc = pos + bsssize;
532         tsfsize = 4 + 8 * scanresp->nr_sets;
533         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TSF", (u8 *) tsfdesc, tsfsize);
534
535         /* Validity check: we expect a Marvell-Local TLV */
536         i = get_unaligned_le16(tsfdesc);
537         tsfdesc += 2;
538         if (i != TLV_TYPE_TSFTIMESTAMP) {
539                 lbs_deb_scan("scan response: invalid TSF Timestamp %d\n", i);
540                 goto done;
541         }
542
543         /*
544          * Validity check: the TLV holds TSF values with 8 bytes each, so
545          * the size in the TLV must match the nr_sets value
546          */
547         i = get_unaligned_le16(tsfdesc);
548         tsfdesc += 2;
549         if (i / 8 != scanresp->nr_sets) {
550                 lbs_deb_scan("scan response: invalid number of TSF timestamp "
551                              "sets (expected %d got %d)\n", scanresp->nr_sets,
552                              i / 8);
553                 goto done;
554         }
555
556         for (i = 0; i < scanresp->nr_sets; i++) {
557                 const u8 *bssid;
558                 const u8 *ie;
559                 int left;
560                 int ielen;
561                 int rssi;
562                 u16 intvl;
563                 u16 capa;
564                 int chan_no = -1;
565                 const u8 *ssid = NULL;
566                 u8 ssid_len = 0;
567                 DECLARE_SSID_BUF(ssid_buf);
568
569                 int len = get_unaligned_le16(pos);
570                 pos += 2;
571
572                 /* BSSID */
573                 bssid = pos;
574                 pos += ETH_ALEN;
575                 /* RSSI */
576                 rssi = *pos++;
577                 /* Packet time stamp */
578                 pos += 8;
579                 /* Beacon interval */
580                 intvl = get_unaligned_le16(pos);
581                 pos += 2;
582                 /* Capabilities */
583                 capa = get_unaligned_le16(pos);
584                 pos += 2;
585
586                 /* To find out the channel, we must parse the IEs */
587                 ie = pos;
588                 /*
589                  * 6+1+8+2+2: size of BSSID, RSSI, time stamp, beacon
590                  * interval, capabilities
591                  */
592                 ielen = left = len - (6 + 1 + 8 + 2 + 2);
593                 while (left >= 2) {
594                         u8 id, elen;
595                         id = *pos++;
596                         elen = *pos++;
597                         left -= 2;
598                         if (elen > left || elen == 0) {
599                                 lbs_deb_scan("scan response: invalid IE fmt\n");
600                                 goto done;
601                         }
602
603                         if (id == WLAN_EID_DS_PARAMS)
604                                 chan_no = *pos;
605                         if (id == WLAN_EID_SSID) {
606                                 ssid = pos;
607                                 ssid_len = elen;
608                         }
609                         left -= elen;
610                         pos += elen;
611                 }
612
613                 /* No channel, no luck */
614                 if (chan_no != -1) {
615                         struct wiphy *wiphy = priv->wdev->wiphy;
616                         int freq = ieee80211_channel_to_frequency(chan_no,
617                                                         IEEE80211_BAND_2GHZ);
618                         struct ieee80211_channel *channel =
619                                 ieee80211_get_channel(wiphy, freq);
620
621                         lbs_deb_scan("scan: %pM, capa %04x, chan %2d, %s, "
622                                      "%d dBm\n",
623                                      bssid, capa, chan_no,
624                                      print_ssid(ssid_buf, ssid, ssid_len),
625                                      LBS_SCAN_RSSI_TO_MBM(rssi)/100);
626
627                         if (channel &&
628                             !(channel->flags & IEEE80211_CHAN_DISABLED))
629                                 cfg80211_inform_bss(wiphy, channel,
630                                         bssid, le64_to_cpu(*(__le64 *)tsfdesc),
631                                         capa, intvl, ie, ielen,
632                                         LBS_SCAN_RSSI_TO_MBM(rssi),
633                                         GFP_KERNEL);
634                 } else
635                         lbs_deb_scan("scan response: missing BSS channel IE\n");
636
637                 tsfdesc += 8;
638         }
639         ret = 0;
640
641  done:
642         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
643         return ret;
644 }
645
646
647 /*
648  * Our scan command contains a TLV, consting of a SSID TLV, a channel list
649  * TLV and a rates TLV. Determine the maximum size of them:
650  */
651 #define LBS_SCAN_MAX_CMD_SIZE                   \
652         (sizeof(struct cmd_ds_802_11_scan)      \
653          + LBS_MAX_SSID_TLV_SIZE                \
654          + LBS_MAX_CHANNEL_LIST_TLV_SIZE        \
655          + LBS_MAX_RATES_TLV_SIZE)
656
657 /*
658  * Assumes priv->scan_req is initialized and valid
659  * Assumes priv->scan_channel is initialized
660  */
661 static void lbs_scan_worker(struct work_struct *work)
662 {
663         struct lbs_private *priv =
664                 container_of(work, struct lbs_private, scan_work.work);
665         struct cmd_ds_802_11_scan *scan_cmd;
666         u8 *tlv; /* pointer into our current, growing TLV storage area */
667         int last_channel;
668         int running, carrier;
669
670         lbs_deb_enter(LBS_DEB_SCAN);
671
672         scan_cmd = kzalloc(LBS_SCAN_MAX_CMD_SIZE, GFP_KERNEL);
673         if (scan_cmd == NULL)
674                 goto out_no_scan_cmd;
675
676         /* prepare fixed part of scan command */
677         scan_cmd->bsstype = CMD_BSS_TYPE_ANY;
678
679         /* stop network while we're away from our main channel */
680         running = !netif_queue_stopped(priv->dev);
681         carrier = netif_carrier_ok(priv->dev);
682         if (running)
683                 netif_stop_queue(priv->dev);
684         if (carrier)
685                 netif_carrier_off(priv->dev);
686
687         /* prepare fixed part of scan command */
688         tlv = scan_cmd->tlvbuffer;
689
690         /* add SSID TLV */
691         if (priv->scan_req->n_ssids)
692                 tlv += lbs_add_ssid_tlv(tlv,
693                                         priv->scan_req->ssids[0].ssid,
694                                         priv->scan_req->ssids[0].ssid_len);
695
696         /* add channel TLVs */
697         last_channel = priv->scan_channel + LBS_SCAN_BEFORE_NAP;
698         if (last_channel > priv->scan_req->n_channels)
699                 last_channel = priv->scan_req->n_channels;
700         tlv += lbs_add_channel_list_tlv(priv, tlv, last_channel,
701                 priv->scan_req->n_ssids);
702
703         /* add rates TLV */
704         tlv += lbs_add_supported_rates_tlv(tlv);
705
706         if (priv->scan_channel < priv->scan_req->n_channels) {
707                 cancel_delayed_work(&priv->scan_work);
708                 if (!priv->stopping)
709                         queue_delayed_work(priv->work_thread, &priv->scan_work,
710                                 msecs_to_jiffies(300));
711         }
712
713         /* This is the final data we are about to send */
714         scan_cmd->hdr.size = cpu_to_le16(tlv - (u8 *)scan_cmd);
715         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
716                     sizeof(*scan_cmd));
717         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
718                     tlv - scan_cmd->tlvbuffer);
719
720         __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
721                 le16_to_cpu(scan_cmd->hdr.size),
722                 lbs_ret_scan, 0);
723
724         if (priv->scan_channel >= priv->scan_req->n_channels) {
725                 /* Mark scan done */
726                 if (priv->internal_scan)
727                         kfree(priv->scan_req);
728                 else
729                         cfg80211_scan_done(priv->scan_req, false);
730
731                 priv->scan_req = NULL;
732                 priv->last_scan = jiffies;
733         }
734
735         /* Restart network */
736         if (carrier)
737                 netif_carrier_on(priv->dev);
738         if (running && !priv->tx_pending_len)
739                 netif_wake_queue(priv->dev);
740
741         kfree(scan_cmd);
742
743         /* Wake up anything waiting on scan completion */
744         if (priv->scan_req == NULL) {
745                 lbs_deb_scan("scan: waking up waiters\n");
746                 wake_up_all(&priv->scan_q);
747         }
748
749  out_no_scan_cmd:
750         lbs_deb_leave(LBS_DEB_SCAN);
751 }
752
753 static void _internal_start_scan(struct lbs_private *priv, bool internal,
754         struct cfg80211_scan_request *request)
755 {
756         lbs_deb_enter(LBS_DEB_CFG80211);
757
758         lbs_deb_scan("scan: ssids %d, channels %d, ie_len %zd\n",
759                 request->n_ssids, request->n_channels, request->ie_len);
760
761         priv->scan_channel = 0;
762         queue_delayed_work(priv->work_thread, &priv->scan_work,
763                 msecs_to_jiffies(50));
764
765         priv->scan_req = request;
766         priv->internal_scan = internal;
767
768         lbs_deb_leave(LBS_DEB_CFG80211);
769 }
770
771 static int lbs_cfg_scan(struct wiphy *wiphy,
772         struct net_device *dev,
773         struct cfg80211_scan_request *request)
774 {
775         struct lbs_private *priv = wiphy_priv(wiphy);
776         int ret = 0;
777
778         lbs_deb_enter(LBS_DEB_CFG80211);
779
780         if (priv->scan_req || delayed_work_pending(&priv->scan_work)) {
781                 /* old scan request not yet processed */
782                 ret = -EAGAIN;
783                 goto out;
784         }
785
786         _internal_start_scan(priv, false, request);
787
788         if (priv->surpriseremoved)
789                 ret = -EIO;
790
791  out:
792         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
793         return ret;
794 }
795
796
797
798
799 /*
800  * Events
801  */
802
803 void lbs_send_disconnect_notification(struct lbs_private *priv)
804 {
805         lbs_deb_enter(LBS_DEB_CFG80211);
806
807         cfg80211_disconnected(priv->dev,
808                 0,
809                 NULL, 0,
810                 GFP_KERNEL);
811
812         lbs_deb_leave(LBS_DEB_CFG80211);
813 }
814
815 void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
816 {
817         lbs_deb_enter(LBS_DEB_CFG80211);
818
819         cfg80211_michael_mic_failure(priv->dev,
820                 priv->assoc_bss,
821                 event == MACREG_INT_CODE_MIC_ERR_MULTICAST ?
822                         NL80211_KEYTYPE_GROUP :
823                         NL80211_KEYTYPE_PAIRWISE,
824                 -1,
825                 NULL,
826                 GFP_KERNEL);
827
828         lbs_deb_leave(LBS_DEB_CFG80211);
829 }
830
831
832
833
834 /*
835  * Connect/disconnect
836  */
837
838
839 /*
840  * This removes all WEP keys
841  */
842 static int lbs_remove_wep_keys(struct lbs_private *priv)
843 {
844         struct cmd_ds_802_11_set_wep cmd;
845         int ret;
846
847         lbs_deb_enter(LBS_DEB_CFG80211);
848
849         memset(&cmd, 0, sizeof(cmd));
850         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
851         cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
852         cmd.action = cpu_to_le16(CMD_ACT_REMOVE);
853
854         ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
855
856         lbs_deb_leave(LBS_DEB_CFG80211);
857         return ret;
858 }
859
860 /*
861  * Set WEP keys
862  */
863 static int lbs_set_wep_keys(struct lbs_private *priv)
864 {
865         struct cmd_ds_802_11_set_wep cmd;
866         int i;
867         int ret;
868
869         lbs_deb_enter(LBS_DEB_CFG80211);
870
871         /*
872          * command         13 00
873          * size            50 00
874          * sequence        xx xx
875          * result          00 00
876          * action          02 00     ACT_ADD
877          * transmit key    00 00
878          * type for key 1  01        WEP40
879          * type for key 2  00
880          * type for key 3  00
881          * type for key 4  00
882          * key 1           39 39 39 39 39 00 00 00
883          *                 00 00 00 00 00 00 00 00
884          * key 2           00 00 00 00 00 00 00 00
885          *                 00 00 00 00 00 00 00 00
886          * key 3           00 00 00 00 00 00 00 00
887          *                 00 00 00 00 00 00 00 00
888          * key 4           00 00 00 00 00 00 00 00
889          */
890         if (priv->wep_key_len[0] || priv->wep_key_len[1] ||
891             priv->wep_key_len[2] || priv->wep_key_len[3]) {
892                 /* Only set wep keys if we have at least one of them */
893                 memset(&cmd, 0, sizeof(cmd));
894                 cmd.hdr.size = cpu_to_le16(sizeof(cmd));
895                 cmd.keyindex = cpu_to_le16(priv->wep_tx_key);
896                 cmd.action = cpu_to_le16(CMD_ACT_ADD);
897
898                 for (i = 0; i < 4; i++) {
899                         switch (priv->wep_key_len[i]) {
900                         case WLAN_KEY_LEN_WEP40:
901                                 cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
902                                 break;
903                         case WLAN_KEY_LEN_WEP104:
904                                 cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
905                                 break;
906                         default:
907                                 cmd.keytype[i] = 0;
908                                 break;
909                         }
910                         memcpy(cmd.keymaterial[i], priv->wep_key[i],
911                                priv->wep_key_len[i]);
912                 }
913
914                 ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
915         } else {
916                 /* Otherwise remove all wep keys */
917                 ret = lbs_remove_wep_keys(priv);
918         }
919
920         lbs_deb_leave(LBS_DEB_CFG80211);
921         return ret;
922 }
923
924
925 /*
926  * Enable/Disable RSN status
927  */
928 static int lbs_enable_rsn(struct lbs_private *priv, int enable)
929 {
930         struct cmd_ds_802_11_enable_rsn cmd;
931         int ret;
932
933         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", enable);
934
935         /*
936          * cmd       2f 00
937          * size      0c 00
938          * sequence  xx xx
939          * result    00 00
940          * action    01 00    ACT_SET
941          * enable    01 00
942          */
943         memset(&cmd, 0, sizeof(cmd));
944         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
945         cmd.action = cpu_to_le16(CMD_ACT_SET);
946         cmd.enable = cpu_to_le16(enable);
947
948         ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
949
950         lbs_deb_leave(LBS_DEB_CFG80211);
951         return ret;
952 }
953
954
955 /*
956  * Set WPA/WPA key material
957  */
958
959 /*
960  * like "struct cmd_ds_802_11_key_material", but with cmd_header. Once we
961  * get rid of WEXT, this should go into host.h
962  */
963
964 struct cmd_key_material {
965         struct cmd_header hdr;
966
967         __le16 action;
968         struct MrvlIEtype_keyParamSet param;
969 } __packed;
970
971 static int lbs_set_key_material(struct lbs_private *priv,
972                                 int key_type,
973                                 int key_info,
974                                 u8 *key, u16 key_len)
975 {
976         struct cmd_key_material cmd;
977         int ret;
978
979         lbs_deb_enter(LBS_DEB_CFG80211);
980
981         /*
982          * Example for WPA (TKIP):
983          *
984          * cmd       5e 00
985          * size      34 00
986          * sequence  xx xx
987          * result    00 00
988          * action    01 00
989          * TLV type  00 01    key param
990          * length    00 26
991          * key type  01 00    TKIP
992          * key info  06 00    UNICAST | ENABLED
993          * key len   20 00
994          * key       32 bytes
995          */
996         memset(&cmd, 0, sizeof(cmd));
997         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
998         cmd.action = cpu_to_le16(CMD_ACT_SET);
999         cmd.param.type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
1000         cmd.param.length = cpu_to_le16(sizeof(cmd.param) - 4);
1001         cmd.param.keytypeid = cpu_to_le16(key_type);
1002         cmd.param.keyinfo = cpu_to_le16(key_info);
1003         cmd.param.keylen = cpu_to_le16(key_len);
1004         if (key && key_len)
1005                 memcpy(cmd.param.key, key, key_len);
1006
1007         ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
1008
1009         lbs_deb_leave(LBS_DEB_CFG80211);
1010         return ret;
1011 }
1012
1013
1014 /*
1015  * Sets the auth type (open, shared, etc) in the firmware. That
1016  * we use CMD_802_11_AUTHENTICATE is misleading, this firmware
1017  * command doesn't send an authentication frame at all, it just
1018  * stores the auth_type.
1019  */
1020 static int lbs_set_authtype(struct lbs_private *priv,
1021                             struct cfg80211_connect_params *sme)
1022 {
1023         struct cmd_ds_802_11_authenticate cmd;
1024         int ret;
1025
1026         lbs_deb_enter_args(LBS_DEB_CFG80211, "%d", sme->auth_type);
1027
1028         /*
1029          * cmd        11 00
1030          * size       19 00
1031          * sequence   xx xx
1032          * result     00 00
1033          * BSS id     00 13 19 80 da 30
1034          * auth type  00
1035          * reserved   00 00 00 00 00 00 00 00 00 00
1036          */
1037         memset(&cmd, 0, sizeof(cmd));
1038         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1039         if (sme->bssid)
1040                 memcpy(cmd.bssid, sme->bssid, ETH_ALEN);
1041         /* convert auth_type */
1042         ret = lbs_auth_to_authtype(sme->auth_type);
1043         if (ret < 0)
1044                 goto done;
1045
1046         cmd.authtype = ret;
1047         ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
1048
1049  done:
1050         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1051         return ret;
1052 }
1053
1054
1055 /*
1056  * Create association request
1057  */
1058 #define LBS_ASSOC_MAX_CMD_SIZE                     \
1059         (sizeof(struct cmd_ds_802_11_associate)    \
1060          - 512 /* cmd_ds_802_11_associate.iebuf */ \
1061          + LBS_MAX_SSID_TLV_SIZE                   \
1062          + LBS_MAX_CHANNEL_TLV_SIZE                \
1063          + LBS_MAX_CF_PARAM_TLV_SIZE               \
1064          + LBS_MAX_AUTH_TYPE_TLV_SIZE              \
1065          + LBS_MAX_WPA_TLV_SIZE)
1066
1067 static int lbs_associate(struct lbs_private *priv,
1068                 struct cfg80211_bss *bss,
1069                 struct cfg80211_connect_params *sme)
1070 {
1071         struct cmd_ds_802_11_associate_response *resp;
1072         struct cmd_ds_802_11_associate *cmd = kzalloc(LBS_ASSOC_MAX_CMD_SIZE,
1073                                                       GFP_KERNEL);
1074         const u8 *ssid_eid;
1075         size_t len, resp_ie_len;
1076         int status;
1077         int ret;
1078         u8 *pos = &(cmd->iebuf[0]);
1079         u8 *tmp;
1080
1081         lbs_deb_enter(LBS_DEB_CFG80211);
1082
1083         if (!cmd) {
1084                 ret = -ENOMEM;
1085                 goto done;
1086         }
1087
1088         /*
1089          * cmd              50 00
1090          * length           34 00
1091          * sequence         xx xx
1092          * result           00 00
1093          * BSS id           00 13 19 80 da 30
1094          * capabilities     11 00
1095          * listen interval  0a 00
1096          * beacon interval  00 00
1097          * DTIM period      00
1098          * TLVs             xx   (up to 512 bytes)
1099          */
1100         cmd->hdr.command = cpu_to_le16(CMD_802_11_ASSOCIATE);
1101
1102         /* Fill in static fields */
1103         memcpy(cmd->bssid, bss->bssid, ETH_ALEN);
1104         cmd->listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
1105         cmd->capability = cpu_to_le16(bss->capability);
1106
1107         /* add SSID TLV */
1108         ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
1109         if (ssid_eid)
1110                 pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
1111         else
1112                 lbs_deb_assoc("no SSID\n");
1113
1114         /* add DS param TLV */
1115         if (bss->channel)
1116                 pos += lbs_add_channel_tlv(pos, bss->channel->hw_value);
1117         else
1118                 lbs_deb_assoc("no channel\n");
1119
1120         /* add (empty) CF param TLV */
1121         pos += lbs_add_cf_param_tlv(pos);
1122
1123         /* add rates TLV */
1124         tmp = pos + 4; /* skip Marvell IE header */
1125         pos += lbs_add_common_rates_tlv(pos, bss);
1126         lbs_deb_hex(LBS_DEB_ASSOC, "Common Rates", tmp, pos - tmp);
1127
1128         /* add auth type TLV */
1129         if (MRVL_FW_MAJOR_REV(priv->fwrelease) >= 9)
1130                 pos += lbs_add_auth_type_tlv(pos, sme->auth_type);
1131
1132         /* add WPA/WPA2 TLV */
1133         if (sme->ie && sme->ie_len)
1134                 pos += lbs_add_wpa_tlv(pos, sme->ie, sme->ie_len);
1135
1136         len = (sizeof(*cmd) - sizeof(cmd->iebuf)) +
1137                 (u16)(pos - (u8 *) &cmd->iebuf);
1138         cmd->hdr.size = cpu_to_le16(len);
1139
1140         lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_CMD", (u8 *) cmd,
1141                         le16_to_cpu(cmd->hdr.size));
1142
1143         /* store for later use */
1144         memcpy(priv->assoc_bss, bss->bssid, ETH_ALEN);
1145
1146         ret = lbs_cmd_with_response(priv, CMD_802_11_ASSOCIATE, cmd);
1147         if (ret)
1148                 goto done;
1149
1150         /* generate connect message to cfg80211 */
1151
1152         resp = (void *) cmd; /* recast for easier field access */
1153         status = le16_to_cpu(resp->statuscode);
1154
1155         /* Older FW versions map the IEEE 802.11 Status Code in the association
1156          * response to the following values returned in resp->statuscode:
1157          *
1158          *    IEEE Status Code                Marvell Status Code
1159          *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
1160          *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
1161          *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
1162          *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
1163          *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
1164          *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
1165          *
1166          * Other response codes:
1167          *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
1168          *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
1169          *                                    association response from the AP)
1170          */
1171         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
1172                 switch (status) {
1173                 case 0:
1174                         break;
1175                 case 1:
1176                         lbs_deb_assoc("invalid association parameters\n");
1177                         status = WLAN_STATUS_CAPS_UNSUPPORTED;
1178                         break;
1179                 case 2:
1180                         lbs_deb_assoc("timer expired while waiting for AP\n");
1181                         status = WLAN_STATUS_AUTH_TIMEOUT;
1182                         break;
1183                 case 3:
1184                         lbs_deb_assoc("association refused by AP\n");
1185                         status = WLAN_STATUS_ASSOC_DENIED_UNSPEC;
1186                         break;
1187                 case 4:
1188                         lbs_deb_assoc("authentication refused by AP\n");
1189                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1190                         break;
1191                 default:
1192                         lbs_deb_assoc("association failure %d\n", status);
1193                         /* v5 OLPC firmware does return the AP status code if
1194                          * it's not one of the values above.  Let that through.
1195                          */
1196                         break;
1197                 }
1198         }
1199
1200         lbs_deb_assoc("status %d, statuscode 0x%04x, capability 0x%04x, "
1201                       "aid 0x%04x\n", status, le16_to_cpu(resp->statuscode),
1202                       le16_to_cpu(resp->capability), le16_to_cpu(resp->aid));
1203
1204         resp_ie_len = le16_to_cpu(resp->hdr.size)
1205                 - sizeof(resp->hdr)
1206                 - 6;
1207         cfg80211_connect_result(priv->dev,
1208                                 priv->assoc_bss,
1209                                 sme->ie, sme->ie_len,
1210                                 resp->iebuf, resp_ie_len,
1211                                 status,
1212                                 GFP_KERNEL);
1213
1214         if (status == 0) {
1215                 /* TODO: get rid of priv->connect_status */
1216                 priv->connect_status = LBS_CONNECTED;
1217                 netif_carrier_on(priv->dev);
1218                 if (!priv->tx_pending_len)
1219                         netif_tx_wake_all_queues(priv->dev);
1220         }
1221
1222 done:
1223         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1224         return ret;
1225 }
1226
1227 static struct cfg80211_scan_request *
1228 _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
1229 {
1230         struct cfg80211_scan_request *creq = NULL;
1231         int i, n_channels = 0;
1232         enum ieee80211_band band;
1233
1234         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1235                 if (wiphy->bands[band])
1236                         n_channels += wiphy->bands[band]->n_channels;
1237         }
1238
1239         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
1240                        n_channels * sizeof(void *),
1241                        GFP_ATOMIC);
1242         if (!creq)
1243                 return NULL;
1244
1245         /* SSIDs come after channels */
1246         creq->ssids = (void *)&creq->channels[n_channels];
1247         creq->n_channels = n_channels;
1248         creq->n_ssids = 1;
1249
1250         /* Scan all available channels */
1251         i = 0;
1252         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1253                 int j;
1254
1255                 if (!wiphy->bands[band])
1256                         continue;
1257
1258                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
1259                         /* ignore disabled channels */
1260                         if (wiphy->bands[band]->channels[j].flags &
1261                                                 IEEE80211_CHAN_DISABLED)
1262                                 continue;
1263
1264                         creq->channels[i] = &wiphy->bands[band]->channels[j];
1265                         i++;
1266                 }
1267         }
1268         if (i) {
1269                 /* Set real number of channels specified in creq->channels[] */
1270                 creq->n_channels = i;
1271
1272                 /* Scan for the SSID we're going to connect to */
1273                 memcpy(creq->ssids[0].ssid, sme->ssid, sme->ssid_len);
1274                 creq->ssids[0].ssid_len = sme->ssid_len;
1275         } else {
1276                 /* No channels found... */
1277                 kfree(creq);
1278                 creq = NULL;
1279         }
1280
1281         return creq;
1282 }
1283
1284 static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
1285                            struct cfg80211_connect_params *sme)
1286 {
1287         struct lbs_private *priv = wiphy_priv(wiphy);
1288         struct cfg80211_bss *bss = NULL;
1289         int ret = 0;
1290         u8 preamble = RADIO_PREAMBLE_SHORT;
1291
1292         lbs_deb_enter(LBS_DEB_CFG80211);
1293
1294         if (!sme->bssid) {
1295                 /* Run a scan if one isn't in-progress already and if the last
1296                  * scan was done more than 2 seconds ago.
1297                  */
1298                 if (priv->scan_req == NULL &&
1299                     time_after(jiffies, priv->last_scan + (2 * HZ))) {
1300                         struct cfg80211_scan_request *creq;
1301
1302                         creq = _new_connect_scan_req(wiphy, sme);
1303                         if (!creq) {
1304                                 ret = -EINVAL;
1305                                 goto done;
1306                         }
1307
1308                         lbs_deb_assoc("assoc: scanning for compatible AP\n");
1309                         _internal_start_scan(priv, true, creq);
1310                 }
1311
1312                 /* Wait for any in-progress scan to complete */
1313                 lbs_deb_assoc("assoc: waiting for scan to complete\n");
1314                 wait_event_interruptible_timeout(priv->scan_q,
1315                                                  (priv->scan_req == NULL),
1316                                                  (15 * HZ));
1317                 lbs_deb_assoc("assoc: scanning competed\n");
1318         }
1319
1320         /* Find the BSS we want using available scan results */
1321         bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
1322                 sme->ssid, sme->ssid_len,
1323                 WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
1324         if (!bss) {
1325                 lbs_pr_err("assoc: bss %pM not in scan results\n",
1326                            sme->bssid);
1327                 ret = -ENOENT;
1328                 goto done;
1329         }
1330         lbs_deb_assoc("trying %pM\n", bss->bssid);
1331         lbs_deb_assoc("cipher 0x%x, key index %d, key len %d\n",
1332                       sme->crypto.cipher_group,
1333                       sme->key_idx, sme->key_len);
1334
1335         /* As this is a new connection, clear locally stored WEP keys */
1336         priv->wep_tx_key = 0;
1337         memset(priv->wep_key, 0, sizeof(priv->wep_key));
1338         memset(priv->wep_key_len, 0, sizeof(priv->wep_key_len));
1339
1340         /* set/remove WEP keys */
1341         switch (sme->crypto.cipher_group) {
1342         case WLAN_CIPHER_SUITE_WEP40:
1343         case WLAN_CIPHER_SUITE_WEP104:
1344                 /* Store provided WEP keys in priv-> */
1345                 priv->wep_tx_key = sme->key_idx;
1346                 priv->wep_key_len[sme->key_idx] = sme->key_len;
1347                 memcpy(priv->wep_key[sme->key_idx], sme->key, sme->key_len);
1348                 /* Set WEP keys and WEP mode */
1349                 lbs_set_wep_keys(priv);
1350                 priv->mac_control |= CMD_ACT_MAC_WEP_ENABLE;
1351                 lbs_set_mac_control(priv);
1352                 /* No RSN mode for WEP */
1353                 lbs_enable_rsn(priv, 0);
1354                 break;
1355         case 0: /* there's no WLAN_CIPHER_SUITE_NONE definition */
1356                 /*
1357                  * If we don't have no WEP, no WPA and no WPA2,
1358                  * we remove all keys like in the WPA/WPA2 setup,
1359                  * we just don't set RSN.
1360                  *
1361                  * Therefore: fall-through
1362                  */
1363         case WLAN_CIPHER_SUITE_TKIP:
1364         case WLAN_CIPHER_SUITE_CCMP:
1365                 /* Remove WEP keys and WEP mode */
1366                 lbs_remove_wep_keys(priv);
1367                 priv->mac_control &= ~CMD_ACT_MAC_WEP_ENABLE;
1368                 lbs_set_mac_control(priv);
1369
1370                 /* clear the WPA/WPA2 keys */
1371                 lbs_set_key_material(priv,
1372                         KEY_TYPE_ID_WEP, /* doesn't matter */
1373                         KEY_INFO_WPA_UNICAST,
1374                         NULL, 0);
1375                 lbs_set_key_material(priv,
1376                         KEY_TYPE_ID_WEP, /* doesn't matter */
1377                         KEY_INFO_WPA_MCAST,
1378                         NULL, 0);
1379                 /* RSN mode for WPA/WPA2 */
1380                 lbs_enable_rsn(priv, sme->crypto.cipher_group != 0);
1381                 break;
1382         default:
1383                 lbs_pr_err("unsupported cipher group 0x%x\n",
1384                            sme->crypto.cipher_group);
1385                 ret = -ENOTSUPP;
1386                 goto done;
1387         }
1388
1389         lbs_set_authtype(priv, sme);
1390         lbs_set_radio(priv, preamble, 1);
1391
1392         /* Do the actual association */
1393         ret = lbs_associate(priv, bss, sme);
1394
1395  done:
1396         if (bss)
1397                 cfg80211_put_bss(bss);
1398         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1399         return ret;
1400 }
1401
1402 static int lbs_cfg_disconnect(struct wiphy *wiphy, struct net_device *dev,
1403         u16 reason_code)
1404 {
1405         struct lbs_private *priv = wiphy_priv(wiphy);
1406         struct cmd_ds_802_11_deauthenticate cmd;
1407
1408         lbs_deb_enter_args(LBS_DEB_CFG80211, "reason_code %d", reason_code);
1409
1410         /* store for lbs_cfg_ret_disconnect() */
1411         priv->disassoc_reason = reason_code;
1412
1413         memset(&cmd, 0, sizeof(cmd));
1414         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1415         /* Mildly ugly to use a locally store my own BSSID ... */
1416         memcpy(cmd.macaddr, &priv->assoc_bss, ETH_ALEN);
1417         cmd.reasoncode = cpu_to_le16(reason_code);
1418
1419         if (lbs_cmd_with_response(priv, CMD_802_11_DEAUTHENTICATE, &cmd))
1420                 return -EFAULT;
1421
1422         cfg80211_disconnected(priv->dev,
1423                         priv->disassoc_reason,
1424                         NULL, 0,
1425                         GFP_KERNEL);
1426         priv->connect_status = LBS_DISCONNECTED;
1427
1428         return 0;
1429 }
1430
1431
1432 static int lbs_cfg_set_default_key(struct wiphy *wiphy,
1433                                    struct net_device *netdev,
1434                                    u8 key_index, bool unicast,
1435                                    bool multicast)
1436 {
1437         struct lbs_private *priv = wiphy_priv(wiphy);
1438
1439         lbs_deb_enter(LBS_DEB_CFG80211);
1440
1441         if (key_index != priv->wep_tx_key) {
1442                 lbs_deb_assoc("set_default_key: to %d\n", key_index);
1443                 priv->wep_tx_key = key_index;
1444                 lbs_set_wep_keys(priv);
1445         }
1446
1447         return 0;
1448 }
1449
1450
1451 static int lbs_cfg_add_key(struct wiphy *wiphy, struct net_device *netdev,
1452                            u8 idx, bool pairwise, const u8 *mac_addr,
1453                            struct key_params *params)
1454 {
1455         struct lbs_private *priv = wiphy_priv(wiphy);
1456         u16 key_info;
1457         u16 key_type;
1458         int ret = 0;
1459
1460         lbs_deb_enter(LBS_DEB_CFG80211);
1461
1462         lbs_deb_assoc("add_key: cipher 0x%x, mac_addr %pM\n",
1463                       params->cipher, mac_addr);
1464         lbs_deb_assoc("add_key: key index %d, key len %d\n",
1465                       idx, params->key_len);
1466         if (params->key_len)
1467                 lbs_deb_hex(LBS_DEB_CFG80211, "KEY",
1468                             params->key, params->key_len);
1469
1470         lbs_deb_assoc("add_key: seq len %d\n", params->seq_len);
1471         if (params->seq_len)
1472                 lbs_deb_hex(LBS_DEB_CFG80211, "SEQ",
1473                             params->seq, params->seq_len);
1474
1475         switch (params->cipher) {
1476         case WLAN_CIPHER_SUITE_WEP40:
1477         case WLAN_CIPHER_SUITE_WEP104:
1478                 /* actually compare if something has changed ... */
1479                 if ((priv->wep_key_len[idx] != params->key_len) ||
1480                         memcmp(priv->wep_key[idx],
1481                                params->key, params->key_len) != 0) {
1482                         priv->wep_key_len[idx] = params->key_len;
1483                         memcpy(priv->wep_key[idx],
1484                                params->key, params->key_len);
1485                         lbs_set_wep_keys(priv);
1486                 }
1487                 break;
1488         case WLAN_CIPHER_SUITE_TKIP:
1489         case WLAN_CIPHER_SUITE_CCMP:
1490                 key_info = KEY_INFO_WPA_ENABLED | ((idx == 0)
1491                                                    ? KEY_INFO_WPA_UNICAST
1492                                                    : KEY_INFO_WPA_MCAST);
1493                 key_type = (params->cipher == WLAN_CIPHER_SUITE_TKIP)
1494                         ? KEY_TYPE_ID_TKIP
1495                         : KEY_TYPE_ID_AES;
1496                 lbs_set_key_material(priv,
1497                                      key_type,
1498                                      key_info,
1499                                      params->key, params->key_len);
1500                 break;
1501         default:
1502                 lbs_pr_err("unhandled cipher 0x%x\n", params->cipher);
1503                 ret = -ENOTSUPP;
1504                 break;
1505         }
1506
1507         return ret;
1508 }
1509
1510
1511 static int lbs_cfg_del_key(struct wiphy *wiphy, struct net_device *netdev,
1512                            u8 key_index, bool pairwise, const u8 *mac_addr)
1513 {
1514
1515         lbs_deb_enter(LBS_DEB_CFG80211);
1516
1517         lbs_deb_assoc("del_key: key_idx %d, mac_addr %pM\n",
1518                       key_index, mac_addr);
1519
1520 #ifdef TODO
1521         struct lbs_private *priv = wiphy_priv(wiphy);
1522         /*
1523          * I think can keep this a NO-OP, because:
1524
1525          * - we clear all keys whenever we do lbs_cfg_connect() anyway
1526          * - neither "iw" nor "wpa_supplicant" won't call this during
1527          *   an ongoing connection
1528          * - TODO: but I have to check if this is still true when
1529          *   I set the AP to periodic re-keying
1530          * - we've not kzallec() something when we've added a key at
1531          *   lbs_cfg_connect() or lbs_cfg_add_key().
1532          *
1533          * This causes lbs_cfg_del_key() only called at disconnect time,
1534          * where we'd just waste time deleting a key that is not going
1535          * to be used anyway.
1536          */
1537         if (key_index < 3 && priv->wep_key_len[key_index]) {
1538                 priv->wep_key_len[key_index] = 0;
1539                 lbs_set_wep_keys(priv);
1540         }
1541 #endif
1542
1543         return 0;
1544 }
1545
1546
1547 /*
1548  * Get station
1549  */
1550
1551 static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
1552                               u8 *mac, struct station_info *sinfo)
1553 {
1554         struct lbs_private *priv = wiphy_priv(wiphy);
1555         s8 signal, noise;
1556         int ret;
1557         size_t i;
1558
1559         lbs_deb_enter(LBS_DEB_CFG80211);
1560
1561         sinfo->filled |= STATION_INFO_TX_BYTES |
1562                          STATION_INFO_TX_PACKETS |
1563                          STATION_INFO_RX_BYTES |
1564                          STATION_INFO_RX_PACKETS;
1565         sinfo->tx_bytes = priv->dev->stats.tx_bytes;
1566         sinfo->tx_packets = priv->dev->stats.tx_packets;
1567         sinfo->rx_bytes = priv->dev->stats.rx_bytes;
1568         sinfo->rx_packets = priv->dev->stats.rx_packets;
1569
1570         /* Get current RSSI */
1571         ret = lbs_get_rssi(priv, &signal, &noise);
1572         if (ret == 0) {
1573                 sinfo->signal = signal;
1574                 sinfo->filled |= STATION_INFO_SIGNAL;
1575         }
1576
1577         /* Convert priv->cur_rate from hw_value to NL80211 value */
1578         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
1579                 if (priv->cur_rate == lbs_rates[i].hw_value) {
1580                         sinfo->txrate.legacy = lbs_rates[i].bitrate;
1581                         sinfo->filled |= STATION_INFO_TX_BITRATE;
1582                         break;
1583                 }
1584         }
1585
1586         return 0;
1587 }
1588
1589
1590
1591
1592 /*
1593  * "Site survey", here just current channel and noise level
1594  */
1595
1596 static int lbs_get_survey(struct wiphy *wiphy, struct net_device *dev,
1597         int idx, struct survey_info *survey)
1598 {
1599         struct lbs_private *priv = wiphy_priv(wiphy);
1600         s8 signal, noise;
1601         int ret;
1602
1603         if (idx != 0)
1604                 ret = -ENOENT;
1605
1606         lbs_deb_enter(LBS_DEB_CFG80211);
1607
1608         survey->channel = ieee80211_get_channel(wiphy,
1609                 ieee80211_channel_to_frequency(priv->channel,
1610                                                IEEE80211_BAND_2GHZ));
1611
1612         ret = lbs_get_rssi(priv, &signal, &noise);
1613         if (ret == 0) {
1614                 survey->filled = SURVEY_INFO_NOISE_DBM;
1615                 survey->noise = noise;
1616         }
1617
1618         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1619         return ret;
1620 }
1621
1622
1623
1624
1625 /*
1626  * Change interface
1627  */
1628
1629 static int lbs_change_intf(struct wiphy *wiphy, struct net_device *dev,
1630         enum nl80211_iftype type, u32 *flags,
1631                struct vif_params *params)
1632 {
1633         struct lbs_private *priv = wiphy_priv(wiphy);
1634         int ret = 0;
1635
1636         lbs_deb_enter(LBS_DEB_CFG80211);
1637
1638         switch (type) {
1639         case NL80211_IFTYPE_MONITOR:
1640                 ret = lbs_set_monitor_mode(priv, 1);
1641                 break;
1642         case NL80211_IFTYPE_STATION:
1643                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1644                         ret = lbs_set_monitor_mode(priv, 0);
1645                 if (!ret)
1646                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 1);
1647                 break;
1648         case NL80211_IFTYPE_ADHOC:
1649                 if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR)
1650                         ret = lbs_set_monitor_mode(priv, 0);
1651                 if (!ret)
1652                         ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, 2);
1653                 break;
1654         default:
1655                 ret = -ENOTSUPP;
1656         }
1657
1658         if (!ret)
1659                 priv->wdev->iftype = type;
1660
1661         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1662         return ret;
1663 }
1664
1665
1666
1667 /*
1668  * IBSS (Ad-Hoc)
1669  */
1670
1671 /*
1672  * The firmware needs the following bits masked out of the beacon-derived
1673  * capability field when associating/joining to a BSS:
1674  *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
1675  */
1676 #define CAPINFO_MASK (~(0xda00))
1677
1678
1679 static void lbs_join_post(struct lbs_private *priv,
1680                           struct cfg80211_ibss_params *params,
1681                           u8 *bssid, u16 capability)
1682 {
1683         u8 fake_ie[2 + IEEE80211_MAX_SSID_LEN + /* ssid */
1684                    2 + 4 +                      /* basic rates */
1685                    2 + 1 +                      /* DS parameter */
1686                    2 + 2 +                      /* atim */
1687                    2 + 8];                      /* extended rates */
1688         u8 *fake = fake_ie;
1689
1690         lbs_deb_enter(LBS_DEB_CFG80211);
1691
1692         /*
1693          * For cfg80211_inform_bss, we'll need a fake IE, as we can't get
1694          * the real IE from the firmware. So we fabricate a fake IE based on
1695          * what the firmware actually sends (sniffed with wireshark).
1696          */
1697         /* Fake SSID IE */
1698         *fake++ = WLAN_EID_SSID;
1699         *fake++ = params->ssid_len;
1700         memcpy(fake, params->ssid, params->ssid_len);
1701         fake += params->ssid_len;
1702         /* Fake supported basic rates IE */
1703         *fake++ = WLAN_EID_SUPP_RATES;
1704         *fake++ = 4;
1705         *fake++ = 0x82;
1706         *fake++ = 0x84;
1707         *fake++ = 0x8b;
1708         *fake++ = 0x96;
1709         /* Fake DS channel IE */
1710         *fake++ = WLAN_EID_DS_PARAMS;
1711         *fake++ = 1;
1712         *fake++ = params->channel->hw_value;
1713         /* Fake IBSS params IE */
1714         *fake++ = WLAN_EID_IBSS_PARAMS;
1715         *fake++ = 2;
1716         *fake++ = 0; /* ATIM=0 */
1717         *fake++ = 0;
1718         /* Fake extended rates IE, TODO: don't add this for 802.11b only,
1719          * but I don't know how this could be checked */
1720         *fake++ = WLAN_EID_EXT_SUPP_RATES;
1721         *fake++ = 8;
1722         *fake++ = 0x0c;
1723         *fake++ = 0x12;
1724         *fake++ = 0x18;
1725         *fake++ = 0x24;
1726         *fake++ = 0x30;
1727         *fake++ = 0x48;
1728         *fake++ = 0x60;
1729         *fake++ = 0x6c;
1730         lbs_deb_hex(LBS_DEB_CFG80211, "IE", fake_ie, fake - fake_ie);
1731
1732         cfg80211_inform_bss(priv->wdev->wiphy,
1733                             params->channel,
1734                             bssid,
1735                             0,
1736                             capability,
1737                             params->beacon_interval,
1738                             fake_ie, fake - fake_ie,
1739                             0, GFP_KERNEL);
1740
1741         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
1742         priv->wdev->ssid_len = params->ssid_len;
1743
1744         cfg80211_ibss_joined(priv->dev, bssid, GFP_KERNEL);
1745
1746         /* TODO: consider doing this at MACREG_INT_CODE_LINK_SENSED time */
1747         priv->connect_status = LBS_CONNECTED;
1748         netif_carrier_on(priv->dev);
1749         if (!priv->tx_pending_len)
1750                 netif_wake_queue(priv->dev);
1751
1752         lbs_deb_leave(LBS_DEB_CFG80211);
1753 }
1754
1755 static int lbs_ibss_join_existing(struct lbs_private *priv,
1756         struct cfg80211_ibss_params *params,
1757         struct cfg80211_bss *bss)
1758 {
1759         const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
1760         struct cmd_ds_802_11_ad_hoc_join cmd;
1761         u8 preamble = RADIO_PREAMBLE_SHORT;
1762         int ret = 0;
1763
1764         lbs_deb_enter(LBS_DEB_CFG80211);
1765
1766         /* TODO: set preamble based on scan result */
1767         ret = lbs_set_radio(priv, preamble, 1);
1768         if (ret)
1769                 goto out;
1770
1771         /*
1772          * Example CMD_802_11_AD_HOC_JOIN command:
1773          *
1774          * command         2c 00         CMD_802_11_AD_HOC_JOIN
1775          * size            65 00
1776          * sequence        xx xx
1777          * result          00 00
1778          * bssid           02 27 27 97 2f 96
1779          * ssid            49 42 53 53 00 00 00 00
1780          *                 00 00 00 00 00 00 00 00
1781          *                 00 00 00 00 00 00 00 00
1782          *                 00 00 00 00 00 00 00 00
1783          * type            02            CMD_BSS_TYPE_IBSS
1784          * beacon period   64 00
1785          * dtim period     00
1786          * timestamp       00 00 00 00 00 00 00 00
1787          * localtime       00 00 00 00 00 00 00 00
1788          * IE DS           03
1789          * IE DS len       01
1790          * IE DS channel   01
1791          * reserveed       00 00 00 00
1792          * IE IBSS         06
1793          * IE IBSS len     02
1794          * IE IBSS atim    00 00
1795          * reserved        00 00 00 00
1796          * capability      02 00
1797          * rates           82 84 8b 96 0c 12 18 24 30 48 60 6c 00
1798          * fail timeout    ff 00
1799          * probe delay     00 00
1800          */
1801         memset(&cmd, 0, sizeof(cmd));
1802         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1803
1804         memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN);
1805         memcpy(cmd.bss.ssid, params->ssid, params->ssid_len);
1806         cmd.bss.type = CMD_BSS_TYPE_IBSS;
1807         cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval);
1808         cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS;
1809         cmd.bss.ds.header.len = 1;
1810         cmd.bss.ds.channel = params->channel->hw_value;
1811         cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1812         cmd.bss.ibss.header.len = 2;
1813         cmd.bss.ibss.atimwindow = 0;
1814         cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
1815
1816         /* set rates to the intersection of our rates and the rates in the
1817            bss */
1818         if (!rates_eid) {
1819                 lbs_add_rates(cmd.bss.rates);
1820         } else {
1821                 int hw, i;
1822                 u8 rates_max = rates_eid[1];
1823                 u8 *rates = cmd.bss.rates;
1824                 for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
1825                         u8 hw_rate = lbs_rates[hw].bitrate / 5;
1826                         for (i = 0; i < rates_max; i++) {
1827                                 if (hw_rate == (rates_eid[i+2] & 0x7f)) {
1828                                         u8 rate = rates_eid[i+2];
1829                                         if (rate == 0x02 || rate == 0x04 ||
1830                                             rate == 0x0b || rate == 0x16)
1831                                                 rate |= 0x80;
1832                                         *rates++ = rate;
1833                                 }
1834                         }
1835                 }
1836         }
1837
1838         /* Only v8 and below support setting this */
1839         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
1840                 cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT);
1841                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1842         }
1843         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
1844         if (ret)
1845                 goto out;
1846
1847         /*
1848          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1849          *
1850          * response        2c 80
1851          * size            09 00
1852          * sequence        xx xx
1853          * result          00 00
1854          * reserved        00
1855          */
1856         lbs_join_post(priv, params, bss->bssid, bss->capability);
1857
1858  out:
1859         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1860         return ret;
1861 }
1862
1863
1864
1865 static int lbs_ibss_start_new(struct lbs_private *priv,
1866         struct cfg80211_ibss_params *params)
1867 {
1868         struct cmd_ds_802_11_ad_hoc_start cmd;
1869         struct cmd_ds_802_11_ad_hoc_result *resp =
1870                 (struct cmd_ds_802_11_ad_hoc_result *) &cmd;
1871         u8 preamble = RADIO_PREAMBLE_SHORT;
1872         int ret = 0;
1873         u16 capability;
1874
1875         lbs_deb_enter(LBS_DEB_CFG80211);
1876
1877         ret = lbs_set_radio(priv, preamble, 1);
1878         if (ret)
1879                 goto out;
1880
1881         /*
1882          * Example CMD_802_11_AD_HOC_START command:
1883          *
1884          * command         2b 00         CMD_802_11_AD_HOC_START
1885          * size            b1 00
1886          * sequence        xx xx
1887          * result          00 00
1888          * ssid            54 45 53 54 00 00 00 00
1889          *                 00 00 00 00 00 00 00 00
1890          *                 00 00 00 00 00 00 00 00
1891          *                 00 00 00 00 00 00 00 00
1892          * bss type        02
1893          * beacon period   64 00
1894          * dtim period     00
1895          * IE IBSS         06
1896          * IE IBSS len     02
1897          * IE IBSS atim    00 00
1898          * reserved        00 00 00 00
1899          * IE DS           03
1900          * IE DS len       01
1901          * IE DS channel   01
1902          * reserved        00 00 00 00
1903          * probe delay     00 00
1904          * capability      02 00
1905          * rates           82 84 8b 96   (basic rates with have bit 7 set)
1906          *                 0c 12 18 24 30 48 60 6c
1907          * padding         100 bytes
1908          */
1909         memset(&cmd, 0, sizeof(cmd));
1910         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1911         memcpy(cmd.ssid, params->ssid, params->ssid_len);
1912         cmd.bsstype = CMD_BSS_TYPE_IBSS;
1913         cmd.beaconperiod = cpu_to_le16(params->beacon_interval);
1914         cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
1915         cmd.ibss.header.len = 2;
1916         cmd.ibss.atimwindow = 0;
1917         cmd.ds.header.id = WLAN_EID_DS_PARAMS;
1918         cmd.ds.header.len = 1;
1919         cmd.ds.channel = params->channel->hw_value;
1920         /* Only v8 and below support setting probe delay */
1921         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8)
1922                 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME);
1923         /* TODO: mix in WLAN_CAPABILITY_PRIVACY */
1924         capability = WLAN_CAPABILITY_IBSS;
1925         cmd.capability = cpu_to_le16(capability);
1926         lbs_add_rates(cmd.rates);
1927
1928
1929         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
1930         if (ret)
1931                 goto out;
1932
1933         /*
1934          * This is a sample response to CMD_802_11_AD_HOC_JOIN:
1935          *
1936          * response        2b 80
1937          * size            14 00
1938          * sequence        xx xx
1939          * result          00 00
1940          * reserved        00
1941          * bssid           02 2b 7b 0f 86 0e
1942          */
1943         lbs_join_post(priv, params, resp->bssid, capability);
1944
1945  out:
1946         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1947         return ret;
1948 }
1949
1950
1951 static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
1952                 struct cfg80211_ibss_params *params)
1953 {
1954         struct lbs_private *priv = wiphy_priv(wiphy);
1955         int ret = 0;
1956         struct cfg80211_bss *bss;
1957         DECLARE_SSID_BUF(ssid_buf);
1958
1959         lbs_deb_enter(LBS_DEB_CFG80211);
1960
1961         if (!params->channel) {
1962                 ret = -ENOTSUPP;
1963                 goto out;
1964         }
1965
1966         ret = lbs_set_channel(priv, params->channel->hw_value);
1967         if (ret)
1968                 goto out;
1969
1970         /* Search if someone is beaconing. This assumes that the
1971          * bss list is populated already */
1972         bss = cfg80211_get_bss(wiphy, params->channel, params->bssid,
1973                 params->ssid, params->ssid_len,
1974                 WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
1975
1976         if (bss) {
1977                 ret = lbs_ibss_join_existing(priv, params, bss);
1978                 cfg80211_put_bss(bss);
1979         } else
1980                 ret = lbs_ibss_start_new(priv, params);
1981
1982
1983  out:
1984         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
1985         return ret;
1986 }
1987
1988
1989 static int lbs_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
1990 {
1991         struct lbs_private *priv = wiphy_priv(wiphy);
1992         struct cmd_ds_802_11_ad_hoc_stop cmd;
1993         int ret = 0;
1994
1995         lbs_deb_enter(LBS_DEB_CFG80211);
1996
1997         memset(&cmd, 0, sizeof(cmd));
1998         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
1999         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_STOP, &cmd);
2000
2001         /* TODO: consider doing this at MACREG_INT_CODE_ADHOC_BCN_LOST time */
2002         lbs_mac_event_disconnected(priv);
2003
2004         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2005         return ret;
2006 }
2007
2008
2009
2010
2011 /*
2012  * Initialization
2013  */
2014
2015 static struct cfg80211_ops lbs_cfg80211_ops = {
2016         .set_channel = lbs_cfg_set_channel,
2017         .scan = lbs_cfg_scan,
2018         .connect = lbs_cfg_connect,
2019         .disconnect = lbs_cfg_disconnect,
2020         .add_key = lbs_cfg_add_key,
2021         .del_key = lbs_cfg_del_key,
2022         .set_default_key = lbs_cfg_set_default_key,
2023         .get_station = lbs_cfg_get_station,
2024         .dump_survey = lbs_get_survey,
2025         .change_virtual_intf = lbs_change_intf,
2026         .join_ibss = lbs_join_ibss,
2027         .leave_ibss = lbs_leave_ibss,
2028 };
2029
2030
2031 /*
2032  * At this time lbs_private *priv doesn't even exist, so we just allocate
2033  * memory and don't initialize the wiphy further. This is postponed until we
2034  * can talk to the firmware and happens at registration time in
2035  * lbs_cfg_wiphy_register().
2036  */
2037 struct wireless_dev *lbs_cfg_alloc(struct device *dev)
2038 {
2039         int ret = 0;
2040         struct wireless_dev *wdev;
2041
2042         lbs_deb_enter(LBS_DEB_CFG80211);
2043
2044         wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
2045         if (!wdev) {
2046                 dev_err(dev, "cannot allocate wireless device\n");
2047                 return ERR_PTR(-ENOMEM);
2048         }
2049
2050         wdev->wiphy = wiphy_new(&lbs_cfg80211_ops, sizeof(struct lbs_private));
2051         if (!wdev->wiphy) {
2052                 dev_err(dev, "cannot allocate wiphy\n");
2053                 ret = -ENOMEM;
2054                 goto err_wiphy_new;
2055         }
2056
2057         lbs_deb_leave(LBS_DEB_CFG80211);
2058         return wdev;
2059
2060  err_wiphy_new:
2061         kfree(wdev);
2062         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2063         return ERR_PTR(ret);
2064 }
2065
2066
2067 static void lbs_cfg_set_regulatory_hint(struct lbs_private *priv)
2068 {
2069         struct region_code_mapping {
2070                 const char *cn;
2071                 int code;
2072         };
2073
2074         /* Section 5.17.2 */
2075         static const struct region_code_mapping regmap[] = {
2076                 {"US ", 0x10}, /* US FCC */
2077                 {"CA ", 0x20}, /* Canada */
2078                 {"EU ", 0x30}, /* ETSI   */
2079                 {"ES ", 0x31}, /* Spain  */
2080                 {"FR ", 0x32}, /* France */
2081                 {"JP ", 0x40}, /* Japan  */
2082         };
2083         size_t i;
2084
2085         lbs_deb_enter(LBS_DEB_CFG80211);
2086
2087         for (i = 0; i < ARRAY_SIZE(regmap); i++)
2088                 if (regmap[i].code == priv->regioncode) {
2089                         regulatory_hint(priv->wdev->wiphy, regmap[i].cn);
2090                         break;
2091                 }
2092
2093         lbs_deb_leave(LBS_DEB_CFG80211);
2094 }
2095
2096
2097 /*
2098  * This function get's called after lbs_setup_firmware() determined the
2099  * firmware capabities. So we can setup the wiphy according to our
2100  * hardware/firmware.
2101  */
2102 int lbs_cfg_register(struct lbs_private *priv)
2103 {
2104         struct wireless_dev *wdev = priv->wdev;
2105         int ret;
2106
2107         lbs_deb_enter(LBS_DEB_CFG80211);
2108
2109         wdev->wiphy->max_scan_ssids = 1;
2110         wdev->wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
2111
2112         wdev->wiphy->interface_modes =
2113                         BIT(NL80211_IFTYPE_STATION) |
2114                         BIT(NL80211_IFTYPE_ADHOC);
2115         if (lbs_rtap_supported(priv))
2116                 wdev->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
2117
2118         wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
2119
2120         /*
2121          * We could check priv->fwcapinfo && FW_CAPINFO_WPA, but I have
2122          * never seen a firmware without WPA
2123          */
2124         wdev->wiphy->cipher_suites = cipher_suites;
2125         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
2126         wdev->wiphy->reg_notifier = lbs_reg_notifier;
2127
2128         ret = wiphy_register(wdev->wiphy);
2129         if (ret < 0)
2130                 lbs_pr_err("cannot register wiphy device\n");
2131
2132         priv->wiphy_registered = true;
2133
2134         ret = register_netdev(priv->dev);
2135         if (ret)
2136                 lbs_pr_err("cannot register network device\n");
2137
2138         INIT_DELAYED_WORK(&priv->scan_work, lbs_scan_worker);
2139
2140         lbs_cfg_set_regulatory_hint(priv);
2141
2142         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
2143         return ret;
2144 }
2145
2146 int lbs_reg_notifier(struct wiphy *wiphy,
2147                 struct regulatory_request *request)
2148 {
2149         struct lbs_private *priv = wiphy_priv(wiphy);
2150         int ret;
2151
2152         lbs_deb_enter_args(LBS_DEB_CFG80211, "cfg80211 regulatory domain "
2153                         "callback for domain %c%c\n", request->alpha2[0],
2154                         request->alpha2[1]);
2155
2156         ret = lbs_set_11d_domain_info(priv, request, wiphy->bands);
2157
2158         lbs_deb_leave(LBS_DEB_CFG80211);
2159         return ret;
2160 }
2161
2162 void lbs_scan_deinit(struct lbs_private *priv)
2163 {
2164         lbs_deb_enter(LBS_DEB_CFG80211);
2165         cancel_delayed_work_sync(&priv->scan_work);
2166 }
2167
2168
2169 void lbs_cfg_free(struct lbs_private *priv)
2170 {
2171         struct wireless_dev *wdev = priv->wdev;
2172
2173         lbs_deb_enter(LBS_DEB_CFG80211);
2174
2175         if (!wdev)
2176                 return;
2177
2178         if (priv->wiphy_registered)
2179                 wiphy_unregister(wdev->wiphy);
2180
2181         if (wdev->wiphy)
2182                 wiphy_free(wdev->wiphy);
2183
2184         kfree(wdev);
2185 }