drivers/net/wireless/rndis_wlan.c

   1 /*
   2  * Driver for RNDIS based wireless USB devices.
   3  *
   4  * Copyright (C) 2007 by Bjorge Dijkstra <bjd@jooz.net>
   5  * Copyright (C) 2008-2009 by Jussi Kivilinna <jussi.kivilinna@iki.fi>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  *
  20  *  Portions of this file are based on NDISwrapper project,
  21  *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
  22  *  http://ndiswrapper.sourceforge.net/
  23  */
  24
  25 // #define      DEBUG                   // error path messages, extra info
  26 // #define      VERBOSE                 // more; success messages
  27
  28 #include <linux/module.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/etherdevice.h>
  31 #include <linux/ethtool.h>
  32 #include <linux/workqueue.h>
  33 #include <linux/mutex.h>
  34 #include <linux/mii.h>
  35 #include <linux/usb.h>
  36 #include <linux/usb/cdc.h>
  37 #include <linux/ieee80211.h>
  38 #include <linux/if_arp.h>
  39 #include <linux/ctype.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/slab.h>
  42 #include <net/cfg80211.h>
  43 #include <linux/usb/usbnet.h>
  44 #include <linux/usb/rndis_host.h>
  45
  46
  47 /* NOTE: All these are settings for Broadcom chipset */
  48 static char modparam_country[4] = "EU";
  49 module_param_string(country, modparam_country, 4, 0444);
  50 MODULE_PARM_DESC(country, "Country code (ISO 3166-1 alpha-2), default: EU");
  51
  52 static int modparam_frameburst = 1;
  53 module_param_named(frameburst, modparam_frameburst, int, 0444);
  54 MODULE_PARM_DESC(frameburst, "enable frame bursting (default: on)");
  55
  56 static int modparam_afterburner = 0;
  57 module_param_named(afterburner, modparam_afterburner, int, 0444);
  58 MODULE_PARM_DESC(afterburner,
  59         "enable afterburner aka '125 High Speed Mode' (default: off)");
  60
  61 static int modparam_power_save = 0;
  62 module_param_named(power_save, modparam_power_save, int, 0444);
  63 MODULE_PARM_DESC(power_save,
  64         "set power save mode: 0=off, 1=on, 2=fast (default: off)");
  65
  66 static int modparam_power_output = 3;
  67 module_param_named(power_output, modparam_power_output, int, 0444);
  68 MODULE_PARM_DESC(power_output,
  69         "set power output: 0=25%, 1=50%, 2=75%, 3=100% (default: 100%)");
  70
  71 static int modparam_roamtrigger = -70;
  72 module_param_named(roamtrigger, modparam_roamtrigger, int, 0444);
  73 MODULE_PARM_DESC(roamtrigger,
  74         "set roaming dBm trigger: -80=optimize for distance, "
  75                                 "-60=bandwidth (default: -70)");
  76
  77 static int modparam_roamdelta = 1;
  78 module_param_named(roamdelta, modparam_roamdelta, int, 0444);
  79 MODULE_PARM_DESC(roamdelta,
  80         "set roaming tendency: 0=aggressive, 1=moderate, "
  81                                 "2=conservative (default: moderate)");
  82
  83 static int modparam_workaround_interval;
  84 module_param_named(workaround_interval, modparam_workaround_interval,
  85                                                         int, 0444);
  86 MODULE_PARM_DESC(workaround_interval,
  87         "set stall workaround interval in msecs (0=disabled) (default: 0)");
  88
  89 /* Typical noise/maximum signal level values taken from ndiswrapper iw_ndis.h */
  90 #define WL_NOISE        -96     /* typical noise level in dBm */
  91 #define WL_SIGMAX       -32     /* typical maximum signal level in dBm */
  92
  93
  94 /* Assume that Broadcom 4320 (only chipset at time of writing known to be
  95  * based on wireless rndis) has default txpower of 13dBm.
  96  * This value is from Linksys WUSB54GSC User Guide, Appendix F: Specifications.
  97  *  100% : 20 mW ~ 13dBm
  98  *   75% : 15 mW ~ 12dBm
  99  *   50% : 10 mW ~ 10dBm
 100  *   25% :  5 mW ~  7dBm
 101  */
 102 #define BCM4320_DEFAULT_TXPOWER_DBM_100 13
 103 #define BCM4320_DEFAULT_TXPOWER_DBM_75  12
 104 #define BCM4320_DEFAULT_TXPOWER_DBM_50  10
 105 #define BCM4320_DEFAULT_TXPOWER_DBM_25  7
 106
 107 /* Known device types */
 108 #define RNDIS_UNKNOWN   0
 109 #define RNDIS_BCM4320A  1
 110 #define RNDIS_BCM4320B  2
 111
 112
 113 /* NDIS data structures. Taken from wpa_supplicant driver_ndis.c
 114  * slightly modified for datatype endianess, etc
 115  */
 116 #define NDIS_802_11_LENGTH_SSID 32
 117 #define NDIS_802_11_LENGTH_RATES 8
 118 #define NDIS_802_11_LENGTH_RATES_EX 16
 119
 120 enum ndis_80211_net_type {
 121         NDIS_80211_TYPE_FREQ_HOP,
 122         NDIS_80211_TYPE_DIRECT_SEQ,
 123         NDIS_80211_TYPE_OFDM_A,
 124         NDIS_80211_TYPE_OFDM_G
 125 };
 126
 127 enum ndis_80211_net_infra {
 128         NDIS_80211_INFRA_ADHOC,
 129         NDIS_80211_INFRA_INFRA,
 130         NDIS_80211_INFRA_AUTO_UNKNOWN
 131 };
 132
 133 enum ndis_80211_auth_mode {
 134         NDIS_80211_AUTH_OPEN,
 135         NDIS_80211_AUTH_SHARED,
 136         NDIS_80211_AUTH_AUTO_SWITCH,
 137         NDIS_80211_AUTH_WPA,
 138         NDIS_80211_AUTH_WPA_PSK,
 139         NDIS_80211_AUTH_WPA_NONE,
 140         NDIS_80211_AUTH_WPA2,
 141         NDIS_80211_AUTH_WPA2_PSK
 142 };
 143
 144 enum ndis_80211_encr_status {
 145         NDIS_80211_ENCR_WEP_ENABLED,
 146         NDIS_80211_ENCR_DISABLED,
 147         NDIS_80211_ENCR_WEP_KEY_ABSENT,
 148         NDIS_80211_ENCR_NOT_SUPPORTED,
 149         NDIS_80211_ENCR_TKIP_ENABLED,
 150         NDIS_80211_ENCR_TKIP_KEY_ABSENT,
 151         NDIS_80211_ENCR_CCMP_ENABLED,
 152         NDIS_80211_ENCR_CCMP_KEY_ABSENT
 153 };
 154
 155 enum ndis_80211_priv_filter {
 156         NDIS_80211_PRIV_ACCEPT_ALL,
 157         NDIS_80211_PRIV_8021X_WEP
 158 };
 159
 160 enum ndis_80211_status_type {
 161         NDIS_80211_STATUSTYPE_AUTHENTICATION,
 162         NDIS_80211_STATUSTYPE_MEDIASTREAMMODE,
 163         NDIS_80211_STATUSTYPE_PMKID_CANDIDATELIST,
 164         NDIS_80211_STATUSTYPE_RADIOSTATE,
 165 };
 166
 167 enum ndis_80211_media_stream_mode {
 168         NDIS_80211_MEDIA_STREAM_OFF,
 169         NDIS_80211_MEDIA_STREAM_ON
 170 };
 171
 172 enum ndis_80211_radio_status {
 173         NDIS_80211_RADIO_STATUS_ON,
 174         NDIS_80211_RADIO_STATUS_HARDWARE_OFF,
 175         NDIS_80211_RADIO_STATUS_SOFTWARE_OFF,
 176 };
 177
 178 enum ndis_80211_addkey_bits {
 179         NDIS_80211_ADDKEY_8021X_AUTH = cpu_to_le32(1 << 28),
 180         NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ = cpu_to_le32(1 << 29),
 181         NDIS_80211_ADDKEY_PAIRWISE_KEY = cpu_to_le32(1 << 30),
 182         NDIS_80211_ADDKEY_TRANSMIT_KEY = cpu_to_le32(1 << 31)
 183 };
 184
 185 enum ndis_80211_addwep_bits {
 186         NDIS_80211_ADDWEP_PERCLIENT_KEY = cpu_to_le32(1 << 30),
 187         NDIS_80211_ADDWEP_TRANSMIT_KEY = cpu_to_le32(1 << 31)
 188 };
 189
 190 enum ndis_80211_power_mode {
 191         NDIS_80211_POWER_MODE_CAM,
 192         NDIS_80211_POWER_MODE_MAX_PSP,
 193         NDIS_80211_POWER_MODE_FAST_PSP,
 194 };
 195
 196 enum ndis_80211_pmkid_cand_list_flag_bits {
 197         NDIS_80211_PMKID_CAND_PREAUTH = cpu_to_le32(1 << 0)
 198 };
 199
 200 struct ndis_80211_auth_request {
 201         __le32 length;
 202         u8 bssid[ETH_ALEN];
 203         u8 padding[2];
 204         __le32 flags;
 205 } __packed;
 206
 207 struct ndis_80211_pmkid_candidate {
 208         u8 bssid[ETH_ALEN];
 209         u8 padding[2];
 210         __le32 flags;
 211 } __packed;
 212
 213 struct ndis_80211_pmkid_cand_list {
 214         __le32 version;
 215         __le32 num_candidates;
 216         struct ndis_80211_pmkid_candidate candidate_list[0];
 217 } __packed;
 218
 219 struct ndis_80211_status_indication {
 220         __le32 status_type;
 221         union {
 222                 __le32                                  media_stream_mode;
 223                 __le32                                  radio_status;
 224                 struct ndis_80211_auth_request          auth_request[0];
 225                 struct ndis_80211_pmkid_cand_list       cand_list;
 226         } u;
 227 } __packed;
 228
 229 struct ndis_80211_ssid {
 230         __le32 length;
 231         u8 essid[NDIS_802_11_LENGTH_SSID];
 232 } __packed;
 233
 234 struct ndis_80211_conf_freq_hop {
 235         __le32 length;
 236         __le32 hop_pattern;
 237         __le32 hop_set;
 238         __le32 dwell_time;
 239 } __packed;
 240
 241 struct ndis_80211_conf {
 242         __le32 length;
 243         __le32 beacon_period;
 244         __le32 atim_window;
 245         __le32 ds_config;
 246         struct ndis_80211_conf_freq_hop fh_config;
 247 } __packed;
 248
 249 struct ndis_80211_bssid_ex {
 250         __le32 length;
 251         u8 mac[ETH_ALEN];
 252         u8 padding[2];
 253         struct ndis_80211_ssid ssid;
 254         __le32 privacy;
 255         __le32 rssi;
 256         __le32 net_type;
 257         struct ndis_80211_conf config;
 258         __le32 net_infra;
 259         u8 rates[NDIS_802_11_LENGTH_RATES_EX];
 260         __le32 ie_length;
 261         u8 ies[0];
 262 } __packed;
 263
 264 struct ndis_80211_bssid_list_ex {
 265         __le32 num_items;
 266         struct ndis_80211_bssid_ex bssid[0];
 267 } __packed;
 268
 269 struct ndis_80211_fixed_ies {
 270         u8 timestamp[8];
 271         __le16 beacon_interval;
 272         __le16 capabilities;
 273 } __packed;
 274
 275 struct ndis_80211_wep_key {
 276         __le32 size;
 277         __le32 index;
 278         __le32 length;
 279         u8 material[32];
 280 } __packed;
 281
 282 struct ndis_80211_key {
 283         __le32 size;
 284         __le32 index;
 285         __le32 length;
 286         u8 bssid[ETH_ALEN];
 287         u8 padding[6];
 288         u8 rsc[8];
 289         u8 material[32];
 290 } __packed;
 291
 292 struct ndis_80211_remove_key {
 293         __le32 size;
 294         __le32 index;
 295         u8 bssid[ETH_ALEN];
 296         u8 padding[2];
 297 } __packed;
 298
 299 struct ndis_config_param {
 300         __le32 name_offs;
 301         __le32 name_length;
 302         __le32 type;
 303         __le32 value_offs;
 304         __le32 value_length;
 305 } __packed;
 306
 307 struct ndis_80211_assoc_info {
 308         __le32 length;
 309         __le16 req_ies;
 310         struct req_ie {
 311                 __le16 capa;
 312                 __le16 listen_interval;
 313                 u8 cur_ap_address[ETH_ALEN];
 314         } req_ie;
 315         __le32 req_ie_length;
 316         __le32 offset_req_ies;
 317         __le16 resp_ies;
 318         struct resp_ie {
 319                 __le16 capa;
 320                 __le16 status_code;
 321                 __le16 assoc_id;
 322         } resp_ie;
 323         __le32 resp_ie_length;
 324         __le32 offset_resp_ies;
 325 } __packed;
 326
 327 struct ndis_80211_auth_encr_pair {
 328         __le32 auth_mode;
 329         __le32 encr_mode;
 330 } __packed;
 331
 332 struct ndis_80211_capability {
 333         __le32 length;
 334         __le32 version;
 335         __le32 num_pmkids;
 336         __le32 num_auth_encr_pair;
 337         struct ndis_80211_auth_encr_pair auth_encr_pair[0];
 338 } __packed;
 339
 340 struct ndis_80211_bssid_info {
 341         u8 bssid[ETH_ALEN];
 342         u8 pmkid[16];
 343 } __packed;
 344
 345 struct ndis_80211_pmkid {
 346         __le32 length;
 347         __le32 bssid_info_count;
 348         struct ndis_80211_bssid_info bssid_info[0];
 349 } __packed;
 350
 351 /*
 352  *  private data
 353  */
 354 #define CAP_MODE_80211A         1
 355 #define CAP_MODE_80211B         2
 356 #define CAP_MODE_80211G         4
 357 #define CAP_MODE_MASK           7
 358
 359 #define WORK_LINK_UP            0
 360 #define WORK_LINK_DOWN          1
 361 #define WORK_SET_MULTICAST_LIST 2
 362
 363 #define RNDIS_WLAN_ALG_NONE     0
 364 #define RNDIS_WLAN_ALG_WEP      (1<<0)
 365 #define RNDIS_WLAN_ALG_TKIP     (1<<1)
 366 #define RNDIS_WLAN_ALG_CCMP     (1<<2)
 367
 368 #define RNDIS_WLAN_NUM_KEYS             4
 369 #define RNDIS_WLAN_KEY_MGMT_NONE        0
 370 #define RNDIS_WLAN_KEY_MGMT_802_1X      (1<<0)
 371 #define RNDIS_WLAN_KEY_MGMT_PSK         (1<<1)
 372
 373 #define COMMAND_BUFFER_SIZE     (CONTROL_BUFFER_SIZE + sizeof(struct rndis_set))
 374
 375 static const struct ieee80211_channel rndis_channels[] = {
 376         { .center_freq = 2412 },
 377         { .center_freq = 2417 },
 378         { .center_freq = 2422 },
 379         { .center_freq = 2427 },
 380         { .center_freq = 2432 },
 381         { .center_freq = 2437 },
 382         { .center_freq = 2442 },
 383         { .center_freq = 2447 },
 384         { .center_freq = 2452 },
 385         { .center_freq = 2457 },
 386         { .center_freq = 2462 },
 387         { .center_freq = 2467 },
 388         { .center_freq = 2472 },
 389         { .center_freq = 2484 },
 390 };
 391
 392 static const struct ieee80211_rate rndis_rates[] = {
 393         { .bitrate = 10 },
 394         { .bitrate = 20, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 395         { .bitrate = 55, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 396         { .bitrate = 110, .flags = IEEE80211_RATE_SHORT_PREAMBLE },
 397         { .bitrate = 60 },
 398         { .bitrate = 90 },
 399         { .bitrate = 120 },
 400         { .bitrate = 180 },
 401         { .bitrate = 240 },
 402         { .bitrate = 360 },
 403         { .bitrate = 480 },
 404         { .bitrate = 540 }
 405 };
 406
 407 static const u32 rndis_cipher_suites[] = {
 408         WLAN_CIPHER_SUITE_WEP40,
 409         WLAN_CIPHER_SUITE_WEP104,
 410         WLAN_CIPHER_SUITE_TKIP,
 411         WLAN_CIPHER_SUITE_CCMP,
 412 };
 413
 414 struct rndis_wlan_encr_key {
 415         int len;
 416         u32 cipher;
 417         u8 material[32];
 418         u8 bssid[ETH_ALEN];
 419         bool pairwise;
 420         bool tx_key;
 421 };
 422
 423 /* RNDIS device private data */
 424 struct rndis_wlan_private {
 425         struct usbnet *usbdev;
 426
 427         struct wireless_dev wdev;
 428
 429         struct cfg80211_scan_request *scan_request;
 430
 431         struct workqueue_struct *workqueue;
 432         struct delayed_work dev_poller_work;
 433         struct delayed_work scan_work;
 434         struct work_struct work;
 435         struct mutex command_lock;
 436         unsigned long work_pending;
 437         int last_qual;
 438         s32 cqm_rssi_thold;
 439         u32 cqm_rssi_hyst;
 440         int last_cqm_event_rssi;
 441
 442         struct ieee80211_supported_band band;
 443         struct ieee80211_channel channels[ARRAY_SIZE(rndis_channels)];
 444         struct ieee80211_rate rates[ARRAY_SIZE(rndis_rates)];
 445         u32 cipher_suites[ARRAY_SIZE(rndis_cipher_suites)];
 446
 447         int device_type;
 448         int caps;
 449         int multicast_size;
 450
 451         /* module parameters */
 452         char param_country[4];
 453         int  param_frameburst;
 454         int  param_afterburner;
 455         int  param_power_save;
 456         int  param_power_output;
 457         int  param_roamtrigger;
 458         int  param_roamdelta;
 459         u32  param_workaround_interval;
 460
 461         /* hardware state */
 462         bool radio_on;
 463         int power_mode;
 464         int infra_mode;
 465         bool connected;
 466         u8 bssid[ETH_ALEN];
 467         u32 current_command_oid;
 468
 469         /* encryption stuff */
 470         u8 encr_tx_key_index;
 471         struct rndis_wlan_encr_key encr_keys[RNDIS_WLAN_NUM_KEYS];
 472         int  wpa_version;
 473
 474         u8 command_buffer[COMMAND_BUFFER_SIZE];
 475 };
 476
 477 /*
 478  * cfg80211 ops
 479  */
 480 static int rndis_change_virtual_intf(struct wiphy *wiphy,
 481                                         struct net_device *dev,
 482                                         enum nl80211_iftype type,
 483                                         struct vif_params *params);
 484
 485 static int rndis_scan(struct wiphy *wiphy,
 486                         struct cfg80211_scan_request *request);
 487
 488 static int rndis_set_wiphy_params(struct wiphy *wiphy, u32 changed);
 489
 490 static int rndis_set_tx_power(struct wiphy *wiphy,
 491                               struct wireless_dev *wdev,
 492                               enum nl80211_tx_power_setting type,
 493                               int mbm);
 494 static int rndis_get_tx_power(struct wiphy *wiphy,
 495                               struct wireless_dev *wdev,
 496                               int *dbm);
 497
 498 static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
 499                                 struct cfg80211_connect_params *sme);
 500
 501 static int rndis_disconnect(struct wiphy *wiphy, struct net_device *dev,
 502                                 u16 reason_code);
 503
 504 static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 505                                         struct cfg80211_ibss_params *params);
 506
 507 static int rndis_leave_ibss(struct wiphy *wiphy, struct net_device *dev);
 508
 509 static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
 510                          u8 key_index, bool pairwise, const u8 *mac_addr,
 511                          struct key_params *params);
 512
 513 static int rndis_del_key(struct wiphy *wiphy, struct net_device *netdev,
 514                          u8 key_index, bool pairwise, const u8 *mac_addr);
 515
 516 static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
 517                                  u8 key_index, bool unicast, bool multicast);
 518
 519 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
 520                              const u8 *mac, struct station_info *sinfo);
 521
 522 static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
 523                                int idx, u8 *mac, struct station_info *sinfo);
 524
 525 static int rndis_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
 526                                 struct cfg80211_pmksa *pmksa);
 527
 528 static int rndis_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
 529                                 struct cfg80211_pmksa *pmksa);
 530
 531 static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev);
 532
 533 static int rndis_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
 534                                 bool enabled, int timeout);
 535
 536 static int rndis_set_cqm_rssi_config(struct wiphy *wiphy,
 537                                         struct net_device *dev,
 538                                         s32 rssi_thold, u32 rssi_hyst);
 539
 540 static const struct cfg80211_ops rndis_config_ops = {
 541         .change_virtual_intf = rndis_change_virtual_intf,
 542         .scan = rndis_scan,
 543         .set_wiphy_params = rndis_set_wiphy_params,
 544         .set_tx_power = rndis_set_tx_power,
 545         .get_tx_power = rndis_get_tx_power,
 546         .connect = rndis_connect,
 547         .disconnect = rndis_disconnect,
 548         .join_ibss = rndis_join_ibss,
 549         .leave_ibss = rndis_leave_ibss,
 550         .add_key = rndis_add_key,
 551         .del_key = rndis_del_key,
 552         .set_default_key = rndis_set_default_key,
 553         .get_station = rndis_get_station,
 554         .dump_station = rndis_dump_station,
 555         .set_pmksa = rndis_set_pmksa,
 556         .del_pmksa = rndis_del_pmksa,
 557         .flush_pmksa = rndis_flush_pmksa,
 558         .set_power_mgmt = rndis_set_power_mgmt,
 559         .set_cqm_rssi_config = rndis_set_cqm_rssi_config,
 560 };
 561
 562 static void *rndis_wiphy_privid = &rndis_wiphy_privid;
 563
 564
 565 static struct rndis_wlan_private *get_rndis_wlan_priv(struct usbnet *dev)
 566 {
 567         return (struct rndis_wlan_private *)dev->driver_priv;
 568 }
 569
 570 static u32 get_bcm4320_power_dbm(struct rndis_wlan_private *priv)
 571 {
 572         switch (priv->param_power_output) {
 573         default:
 574         case 3:
 575                 return BCM4320_DEFAULT_TXPOWER_DBM_100;
 576         case 2:
 577                 return BCM4320_DEFAULT_TXPOWER_DBM_75;
 578         case 1:
 579                 return BCM4320_DEFAULT_TXPOWER_DBM_50;
 580         case 0:
 581                 return BCM4320_DEFAULT_TXPOWER_DBM_25;
 582         }
 583 }
 584
 585 static bool is_wpa_key(struct rndis_wlan_private *priv, u8 idx)
 586 {
 587         int cipher = priv->encr_keys[idx].cipher;
 588
 589         return (cipher == WLAN_CIPHER_SUITE_CCMP ||
 590                 cipher == WLAN_CIPHER_SUITE_TKIP);
 591 }
 592
 593 static int rndis_cipher_to_alg(u32 cipher)
 594 {
 595         switch (cipher) {
 596         default:
 597                 return RNDIS_WLAN_ALG_NONE;
 598         case WLAN_CIPHER_SUITE_WEP40:
 599         case WLAN_CIPHER_SUITE_WEP104:
 600                 return RNDIS_WLAN_ALG_WEP;
 601         case WLAN_CIPHER_SUITE_TKIP:
 602                 return RNDIS_WLAN_ALG_TKIP;
 603         case WLAN_CIPHER_SUITE_CCMP:
 604                 return RNDIS_WLAN_ALG_CCMP;
 605         }
 606 }
 607
 608 static int rndis_akm_suite_to_key_mgmt(u32 akm_suite)
 609 {
 610         switch (akm_suite) {
 611         default:
 612                 return RNDIS_WLAN_KEY_MGMT_NONE;
 613         case WLAN_AKM_SUITE_8021X:
 614                 return RNDIS_WLAN_KEY_MGMT_802_1X;
 615         case WLAN_AKM_SUITE_PSK:
 616                 return RNDIS_WLAN_KEY_MGMT_PSK;
 617         }
 618 }
 619
 620 #ifdef DEBUG
 621 static const char *oid_to_string(u32 oid)
 622 {
 623         switch (oid) {
 624 #define OID_STR(oid) case oid: return(#oid)
 625                 /* from rndis_host.h */
 626                 OID_STR(RNDIS_OID_802_3_PERMANENT_ADDRESS);
 627                 OID_STR(RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE);
 628                 OID_STR(RNDIS_OID_GEN_CURRENT_PACKET_FILTER);
 629                 OID_STR(RNDIS_OID_GEN_PHYSICAL_MEDIUM);
 630
 631                 /* from rndis_wlan.c */
 632                 OID_STR(RNDIS_OID_GEN_LINK_SPEED);
 633                 OID_STR(RNDIS_OID_GEN_RNDIS_CONFIG_PARAMETER);
 634
 635                 OID_STR(RNDIS_OID_GEN_XMIT_OK);
 636                 OID_STR(RNDIS_OID_GEN_RCV_OK);
 637                 OID_STR(RNDIS_OID_GEN_XMIT_ERROR);
 638                 OID_STR(RNDIS_OID_GEN_RCV_ERROR);
 639                 OID_STR(RNDIS_OID_GEN_RCV_NO_BUFFER);
 640
 641                 OID_STR(RNDIS_OID_802_3_CURRENT_ADDRESS);
 642                 OID_STR(RNDIS_OID_802_3_MULTICAST_LIST);
 643                 OID_STR(RNDIS_OID_802_3_MAXIMUM_LIST_SIZE);
 644
 645                 OID_STR(RNDIS_OID_802_11_BSSID);
 646                 OID_STR(RNDIS_OID_802_11_SSID);
 647                 OID_STR(RNDIS_OID_802_11_INFRASTRUCTURE_MODE);
 648                 OID_STR(RNDIS_OID_802_11_ADD_WEP);
 649                 OID_STR(RNDIS_OID_802_11_REMOVE_WEP);
 650                 OID_STR(RNDIS_OID_802_11_DISASSOCIATE);
 651                 OID_STR(RNDIS_OID_802_11_AUTHENTICATION_MODE);
 652                 OID_STR(RNDIS_OID_802_11_PRIVACY_FILTER);
 653                 OID_STR(RNDIS_OID_802_11_BSSID_LIST_SCAN);
 654                 OID_STR(RNDIS_OID_802_11_ENCRYPTION_STATUS);
 655                 OID_STR(RNDIS_OID_802_11_ADD_KEY);
 656                 OID_STR(RNDIS_OID_802_11_REMOVE_KEY);
 657                 OID_STR(RNDIS_OID_802_11_ASSOCIATION_INFORMATION);
 658                 OID_STR(RNDIS_OID_802_11_CAPABILITY);
 659                 OID_STR(RNDIS_OID_802_11_PMKID);
 660                 OID_STR(RNDIS_OID_802_11_NETWORK_TYPES_SUPPORTED);
 661                 OID_STR(RNDIS_OID_802_11_NETWORK_TYPE_IN_USE);
 662                 OID_STR(RNDIS_OID_802_11_TX_POWER_LEVEL);
 663                 OID_STR(RNDIS_OID_802_11_RSSI);
 664                 OID_STR(RNDIS_OID_802_11_RSSI_TRIGGER);
 665                 OID_STR(RNDIS_OID_802_11_FRAGMENTATION_THRESHOLD);
 666                 OID_STR(RNDIS_OID_802_11_RTS_THRESHOLD);
 667                 OID_STR(RNDIS_OID_802_11_SUPPORTED_RATES);
 668                 OID_STR(RNDIS_OID_802_11_CONFIGURATION);
 669                 OID_STR(RNDIS_OID_802_11_POWER_MODE);
 670                 OID_STR(RNDIS_OID_802_11_BSSID_LIST);
 671 #undef OID_STR
 672         }
 673
 674         return "?";
 675 }
 676 #else
 677 static const char *oid_to_string(u32 oid)
 678 {
 679         return "?";
 680 }
 681 #endif
 682
 683 /* translate error code */
 684 static int rndis_error_status(__le32 rndis_status)
 685 {
 686         int ret = -EINVAL;
 687         switch (le32_to_cpu(rndis_status)) {
 688         case RNDIS_STATUS_SUCCESS:
 689                 ret = 0;
 690                 break;
 691         case RNDIS_STATUS_FAILURE:
 692         case RNDIS_STATUS_INVALID_DATA:
 693                 ret = -EINVAL;
 694                 break;
 695         case RNDIS_STATUS_NOT_SUPPORTED:
 696                 ret = -EOPNOTSUPP;
 697                 break;
 698         case RNDIS_STATUS_ADAPTER_NOT_READY:
 699         case RNDIS_STATUS_ADAPTER_NOT_OPEN:
 700                 ret = -EBUSY;
 701                 break;
 702         }
 703         return ret;
 704 }
 705
 706 static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)
 707 {
 708         struct rndis_wlan_private *priv = get_rndis_wlan_priv(dev);
 709         union {
 710                 void                    *buf;
 711                 struct rndis_msg_hdr    *header;
 712                 struct rndis_query      *get;
 713                 struct rndis_query_c    *get_c;
 714         } u;
 715         int ret;
 716         size_t buflen, resplen, respoffs, copylen;
 717
 718         buflen = *len + sizeof(*u.get);
 719         if (buflen < CONTROL_BUFFER_SIZE)
 720                 buflen = CONTROL_BUFFER_SIZE;
 721
 722         if (buflen > COMMAND_BUFFER_SIZE) {
 723                 u.buf = kmalloc(buflen, GFP_KERNEL);
 724                 if (!u.buf)
 725                         return -ENOMEM;
 726         } else {
 727                 u.buf = priv->command_buffer;
 728         }
 729
 730         mutex_lock(&priv->command_lock);
 731
 732         memset(u.get, 0, sizeof *u.get);
 733         u.get->msg_type = cpu_to_le32(RNDIS_MSG_QUERY);
 734         u.get->msg_len = cpu_to_le32(sizeof *u.get);
 735         u.get->oid = cpu_to_le32(oid);
 736
 737         priv->current_command_oid = oid;
 738         ret = rndis_command(dev, u.header, buflen);
 739         priv->current_command_oid = 0;
 740         if (ret < 0)
 741                 netdev_dbg(dev->net, "%s(%s): rndis_command() failed, %d (%08x)\n",
 742                            __func__, oid_to_string(oid), ret,
 743                            le32_to_cpu(u.get_c->status));
 744
 745         if (ret == 0) {
 746                 resplen = le32_to_cpu(u.get_c->len);
 747                 respoffs = le32_to_cpu(u.get_c->offset) + 8;
 748
 749                 if (respoffs > buflen) {
 750                         /* Device returned data offset outside buffer, error. */
 751                         netdev_dbg(dev->net,
 752                                    "%s(%s): received invalid data offset: %zu > %zu\n",
 753                                    __func__, oid_to_string(oid), respoffs, buflen);
 754
 755                         ret = -EINVAL;
 756                         goto exit_unlock;
 757                 }
 758
 759                 copylen = min(resplen, buflen - respoffs);
 760
 761                 if (copylen > *len)
 762                         copylen = *len;
 763
 764                 memcpy(data, u.buf + respoffs, copylen);
 765
 766                 *len = resplen;
 767
 768                 ret = rndis_error_status(u.get_c->status);
 769                 if (ret < 0)
 770                         netdev_dbg(dev->net, "%s(%s): device returned error,  0x%08x (%d)\n",
 771                                    __func__, oid_to_string(oid),
 772                                    le32_to_cpu(u.get_c->status), ret);
 773         }
 774
 775 exit_unlock:
 776         mutex_unlock(&priv->command_lock);
 777
 778         if (u.buf != priv->command_buffer)
 779                 kfree(u.buf);
 780         return ret;
 781 }
 782
 783 static int rndis_set_oid(struct usbnet *dev, u32 oid, const void *data,
 784                          int len)
 785 {
 786         struct rndis_wlan_private *priv = get_rndis_wlan_priv(dev);
 787         union {
 788                 void                    *buf;
 789                 struct rndis_msg_hdr    *header;
 790                 struct rndis_set        *set;
 791                 struct rndis_set_c      *set_c;
 792         } u;
 793         int ret, buflen;
 794
 795         buflen = len + sizeof(*u.set);
 796         if (buflen < CONTROL_BUFFER_SIZE)
 797                 buflen = CONTROL_BUFFER_SIZE;
 798
 799         if (buflen > COMMAND_BUFFER_SIZE) {
 800                 u.buf = kmalloc(buflen, GFP_KERNEL);
 801                 if (!u.buf)
 802                         return -ENOMEM;
 803         } else {
 804                 u.buf = priv->command_buffer;
 805         }
 806
 807         mutex_lock(&priv->command_lock);
 808
 809         memset(u.set, 0, sizeof *u.set);
 810         u.set->msg_type = cpu_to_le32(RNDIS_MSG_SET);
 811         u.set->msg_len = cpu_to_le32(sizeof(*u.set) + len);
 812         u.set->oid = cpu_to_le32(oid);
 813         u.set->len = cpu_to_le32(len);
 814         u.set->offset = cpu_to_le32(sizeof(*u.set) - 8);
 815         u.set->handle = cpu_to_le32(0);
 816         memcpy(u.buf + sizeof(*u.set), data, len);
 817
 818         priv->current_command_oid = oid;
 819         ret = rndis_command(dev, u.header, buflen);
 820         priv->current_command_oid = 0;
 821         if (ret < 0)
 822                 netdev_dbg(dev->net, "%s(%s): rndis_command() failed, %d (%08x)\n",
 823                            __func__, oid_to_string(oid), ret,
 824                            le32_to_cpu(u.set_c->status));
 825
 826         if (ret == 0) {
 827                 ret = rndis_error_status(u.set_c->status);
 828
 829                 if (ret < 0)
 830                         netdev_dbg(dev->net, "%s(%s): device returned error, 0x%08x (%d)\n",
 831                                    __func__, oid_to_string(oid),
 832                                    le32_to_cpu(u.set_c->status), ret);
 833         }
 834
 835         mutex_unlock(&priv->command_lock);
 836
 837         if (u.buf != priv->command_buffer)
 838                 kfree(u.buf);
 839         return ret;
 840 }
 841
 842 static int rndis_reset(struct usbnet *usbdev)
 843 {
 844         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
 845         struct rndis_reset *reset;
 846         int ret;
 847
 848         mutex_lock(&priv->command_lock);
 849
 850         reset = (void *)priv->command_buffer;
 851         memset(reset, 0, sizeof(*reset));
 852         reset->msg_type = cpu_to_le32(RNDIS_MSG_RESET);
 853         reset->msg_len = cpu_to_le32(sizeof(*reset));
 854         priv->current_command_oid = 0;
 855         ret = rndis_command(usbdev, (void *)reset, CONTROL_BUFFER_SIZE);
 856
 857         mutex_unlock(&priv->command_lock);
 858
 859         if (ret < 0)
 860                 return ret;
 861         return 0;
 862 }
 863
 864 /*
 865  * Specs say that we can only set config parameters only soon after device
 866  * initialization.
 867  *   value_type: 0 = u32, 2 = unicode string
 868  */
 869 static int rndis_set_config_parameter(struct usbnet *dev, char *param,
 870                                                 int value_type, void *value)
 871 {
 872         struct ndis_config_param *infobuf;
 873         int value_len, info_len, param_len, ret, i;
 874         __le16 *unibuf;
 875         __le32 *dst_value;
 876
 877         if (value_type == 0)
 878                 value_len = sizeof(__le32);
 879         else if (value_type == 2)
 880                 value_len = strlen(value) * sizeof(__le16);
 881         else
 882                 return -EINVAL;
 883
 884         param_len = strlen(param) * sizeof(__le16);
 885         info_len = sizeof(*infobuf) + param_len + value_len;
 886
 887 #ifdef DEBUG
 888         info_len += 12;
 889 #endif
 890         infobuf = kmalloc(info_len, GFP_KERNEL);
 891         if (!infobuf)
 892                 return -ENOMEM;
 893
 894 #ifdef DEBUG
 895         info_len -= 12;
 896         /* extra 12 bytes are for padding (debug output) */
 897         memset(infobuf, 0xCC, info_len + 12);
 898 #endif
 899
 900         if (value_type == 2)
 901                 netdev_dbg(dev->net, "setting config parameter: %s, value: %s\n",
 902                            param, (u8 *)value);
 903         else
 904                 netdev_dbg(dev->net, "setting config parameter: %s, value: %d\n",
 905                            param, *(u32 *)value);
 906
 907         infobuf->name_offs = cpu_to_le32(sizeof(*infobuf));
 908         infobuf->name_length = cpu_to_le32(param_len);
 909         infobuf->type = cpu_to_le32(value_type);
 910         infobuf->value_offs = cpu_to_le32(sizeof(*infobuf) + param_len);
 911         infobuf->value_length = cpu_to_le32(value_len);
 912
 913         /* simple string to unicode string conversion */
 914         unibuf = (void *)infobuf + sizeof(*infobuf);
 915         for (i = 0; i < param_len / sizeof(__le16); i++)
 916                 unibuf[i] = cpu_to_le16(param[i]);
 917
 918         if (value_type == 2) {
 919                 unibuf = (void *)infobuf + sizeof(*infobuf) + param_len;
 920                 for (i = 0; i < value_len / sizeof(__le16); i++)
 921                         unibuf[i] = cpu_to_le16(((u8 *)value)[i]);
 922         } else {
 923                 dst_value = (void *)infobuf + sizeof(*infobuf) + param_len;
 924                 *dst_value = cpu_to_le32(*(u32 *)value);
 925         }
 926
 927 #ifdef DEBUG
 928         netdev_dbg(dev->net, "info buffer (len: %d)\n", info_len);
 929         for (i = 0; i < info_len; i += 12) {
 930                 u32 *tmp = (u32 *)((u8 *)infobuf + i);
 931                 netdev_dbg(dev->net, "%08X:%08X:%08X\n",
 932                            cpu_to_be32(tmp[0]),
 933                            cpu_to_be32(tmp[1]),
 934                            cpu_to_be32(tmp[2]));
 935         }
 936 #endif
 937
 938         ret = rndis_set_oid(dev, RNDIS_OID_GEN_RNDIS_CONFIG_PARAMETER,
 939                                                         infobuf, info_len);
 940         if (ret != 0)
 941                 netdev_dbg(dev->net, "setting rndis config parameter failed, %d\n",
 942                            ret);
 943
 944         kfree(infobuf);
 945         return ret;
 946 }
 947
 948 static int rndis_set_config_parameter_str(struct usbnet *dev,
 949                                                 char *param, char *value)
 950 {
 951         return rndis_set_config_parameter(dev, param, 2, value);
 952 }
 953
 954 /*
 955  * data conversion functions
 956  */
 957 static int level_to_qual(int level)
 958 {
 959         int qual = 100 * (level - WL_NOISE) / (WL_SIGMAX - WL_NOISE);
 960         return qual >= 0 ? (qual <= 100 ? qual : 100) : 0;
 961 }
 962
 963 /*
 964  * common functions
 965  */
 966 static int set_infra_mode(struct usbnet *usbdev, int mode);
 967 static void restore_keys(struct usbnet *usbdev);
 968 static int rndis_check_bssid_list(struct usbnet *usbdev, u8 *match_bssid,
 969                                         bool *matched);
 970
 971 static int rndis_start_bssid_list_scan(struct usbnet *usbdev)
 972 {
 973         __le32 tmp;
 974
 975         /* Note: RNDIS_OID_802_11_BSSID_LIST_SCAN clears internal BSS list. */
 976         tmp = cpu_to_le32(1);
 977         return rndis_set_oid(usbdev, RNDIS_OID_802_11_BSSID_LIST_SCAN, &tmp,
 978                                                         sizeof(tmp));
 979 }
 980
 981 static int set_essid(struct usbnet *usbdev, struct ndis_80211_ssid *ssid)
 982 {
 983         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
 984         int ret;
 985
 986         ret = rndis_set_oid(usbdev, RNDIS_OID_802_11_SSID,
 987                             ssid, sizeof(*ssid));
 988         if (ret < 0) {
 989                 netdev_warn(usbdev->net, "setting SSID failed (%08X)\n", ret);
 990                 return ret;
 991         }
 992         if (ret == 0) {
 993                 priv->radio_on = true;
 994                 netdev_dbg(usbdev->net, "%s(): radio_on = true\n", __func__);
 995         }
 996
 997         return ret;
 998 }
 999
1000 static int set_bssid(struct usbnet *usbdev, const u8 *bssid)
1001 {
1002         int ret;
1003
1004         ret = rndis_set_oid(usbdev, RNDIS_OID_802_11_BSSID,
1005                             bssid, ETH_ALEN);
1006         if (ret < 0) {
1007                 netdev_warn(usbdev->net, "setting BSSID[%pM] failed (%08X)\n",
1008                             bssid, ret);
1009                 return ret;
1010         }
1011
1012         return ret;
1013 }
1014
1015 static int clear_bssid(struct usbnet *usbdev)
1016 {
1017         static const u8 broadcast_mac[ETH_ALEN] = {
1018                 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
1019         };
1020
1021         return set_bssid(usbdev, broadcast_mac);
1022 }
1023
1024 static int get_bssid(struct usbnet *usbdev, u8 bssid[ETH_ALEN])
1025 {
1026         int ret, len;
1027
1028         len = ETH_ALEN;
1029         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_BSSID,
1030                               bssid, &len);
1031
1032         if (ret != 0)
1033                 eth_zero_addr(bssid);
1034
1035         return ret;
1036 }
1037
1038 static int get_association_info(struct usbnet *usbdev,
1039                         struct ndis_80211_assoc_info *info, int len)
1040 {
1041         return rndis_query_oid(usbdev,
1042                         RNDIS_OID_802_11_ASSOCIATION_INFORMATION,
1043                         info, &len);
1044 }
1045
1046 static bool is_associated(struct usbnet *usbdev)
1047 {
1048         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1049         u8 bssid[ETH_ALEN];
1050         int ret;
1051
1052         if (!priv->radio_on)
1053                 return false;
1054
1055         ret = get_bssid(usbdev, bssid);
1056
1057         return (ret == 0 && !is_zero_ether_addr(bssid));
1058 }
1059
1060 static int disassociate(struct usbnet *usbdev, bool reset_ssid)
1061 {
1062         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1063         struct ndis_80211_ssid ssid;
1064         int i, ret = 0;
1065
1066         if (priv->radio_on) {
1067                 ret = rndis_set_oid(usbdev,
1068                                 RNDIS_OID_802_11_DISASSOCIATE,
1069                                 NULL, 0);
1070                 if (ret == 0) {
1071                         priv->radio_on = false;
1072                         netdev_dbg(usbdev->net, "%s(): radio_on = false\n",
1073                                    __func__);
1074
1075                         if (reset_ssid)
1076                                 msleep(100);
1077                 }
1078         }
1079
1080         /* disassociate causes radio to be turned off; if reset_ssid
1081          * is given, set random ssid to enable radio */
1082         if (reset_ssid) {
1083                 /* Set device to infrastructure mode so we don't get ad-hoc
1084                  * 'media connect' indications with the random ssid.
1085                  */
1086                 set_infra_mode(usbdev, NDIS_80211_INFRA_INFRA);
1087
1088                 ssid.length = cpu_to_le32(sizeof(ssid.essid));
1089                 get_random_bytes(&ssid.essid[2], sizeof(ssid.essid)-2);
1090                 ssid.essid[0] = 0x1;
1091                 ssid.essid[1] = 0xff;
1092                 for (i = 2; i < sizeof(ssid.essid); i++)
1093                         ssid.essid[i] = 0x1 + (ssid.essid[i] * 0xfe / 0xff);
1094                 ret = set_essid(usbdev, &ssid);
1095         }
1096         return ret;
1097 }
1098
1099 static int set_auth_mode(struct usbnet *usbdev, u32 wpa_version,
1100                                 enum nl80211_auth_type auth_type, int keymgmt)
1101 {
1102         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1103         __le32 tmp;
1104         int auth_mode, ret;
1105
1106         netdev_dbg(usbdev->net, "%s(): wpa_version=0x%x authalg=0x%x keymgmt=0x%x\n",
1107                    __func__, wpa_version, auth_type, keymgmt);
1108
1109         if (wpa_version & NL80211_WPA_VERSION_2) {
1110                 if (keymgmt & RNDIS_WLAN_KEY_MGMT_802_1X)
1111                         auth_mode = NDIS_80211_AUTH_WPA2;
1112                 else
1113                         auth_mode = NDIS_80211_AUTH_WPA2_PSK;
1114         } else if (wpa_version & NL80211_WPA_VERSION_1) {
1115                 if (keymgmt & RNDIS_WLAN_KEY_MGMT_802_1X)
1116                         auth_mode = NDIS_80211_AUTH_WPA;
1117                 else if (keymgmt & RNDIS_WLAN_KEY_MGMT_PSK)
1118                         auth_mode = NDIS_80211_AUTH_WPA_PSK;
1119                 else
1120                         auth_mode = NDIS_80211_AUTH_WPA_NONE;
1121         } else if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
1122                 auth_mode = NDIS_80211_AUTH_SHARED;
1123         else if (auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM)
1124                 auth_mode = NDIS_80211_AUTH_OPEN;
1125         else if (auth_type == NL80211_AUTHTYPE_AUTOMATIC)
1126                 auth_mode = NDIS_80211_AUTH_AUTO_SWITCH;
1127         else
1128                 return -ENOTSUPP;
1129
1130         tmp = cpu_to_le32(auth_mode);
1131         ret = rndis_set_oid(usbdev,
1132                             RNDIS_OID_802_11_AUTHENTICATION_MODE,
1133                             &tmp, sizeof(tmp));
1134         if (ret != 0) {
1135                 netdev_warn(usbdev->net, "setting auth mode failed (%08X)\n",
1136                             ret);
1137                 return ret;
1138         }
1139
1140         priv->wpa_version = wpa_version;
1141
1142         return 0;
1143 }
1144
1145 static int set_priv_filter(struct usbnet *usbdev)
1146 {
1147         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1148         __le32 tmp;
1149
1150         netdev_dbg(usbdev->net, "%s(): wpa_version=0x%x\n",
1151                    __func__, priv->wpa_version);
1152
1153         if (priv->wpa_version & NL80211_WPA_VERSION_2 ||
1154             priv->wpa_version & NL80211_WPA_VERSION_1)
1155                 tmp = cpu_to_le32(NDIS_80211_PRIV_8021X_WEP);
1156         else
1157                 tmp = cpu_to_le32(NDIS_80211_PRIV_ACCEPT_ALL);
1158
1159         return rndis_set_oid(usbdev,
1160                              RNDIS_OID_802_11_PRIVACY_FILTER, &tmp,
1161                              sizeof(tmp));
1162 }
1163
1164 static int set_encr_mode(struct usbnet *usbdev, int pairwise, int groupwise)
1165 {
1166         __le32 tmp;
1167         int encr_mode, ret;
1168
1169         netdev_dbg(usbdev->net, "%s(): cipher_pair=0x%x cipher_group=0x%x\n",
1170                    __func__, pairwise, groupwise);
1171
1172         if (pairwise & RNDIS_WLAN_ALG_CCMP)
1173                 encr_mode = NDIS_80211_ENCR_CCMP_ENABLED;
1174         else if (pairwise & RNDIS_WLAN_ALG_TKIP)
1175                 encr_mode = NDIS_80211_ENCR_TKIP_ENABLED;
1176         else if (pairwise & RNDIS_WLAN_ALG_WEP)
1177                 encr_mode = NDIS_80211_ENCR_WEP_ENABLED;
1178         else if (groupwise & RNDIS_WLAN_ALG_CCMP)
1179                 encr_mode = NDIS_80211_ENCR_CCMP_ENABLED;
1180         else if (groupwise & RNDIS_WLAN_ALG_TKIP)
1181                 encr_mode = NDIS_80211_ENCR_TKIP_ENABLED;
1182         else
1183                 encr_mode = NDIS_80211_ENCR_DISABLED;
1184
1185         tmp = cpu_to_le32(encr_mode);
1186         ret = rndis_set_oid(usbdev,
1187                         RNDIS_OID_802_11_ENCRYPTION_STATUS, &tmp,
1188                         sizeof(tmp));
1189         if (ret != 0) {
1190                 netdev_warn(usbdev->net, "setting encr mode failed (%08X)\n",
1191                             ret);
1192                 return ret;
1193         }
1194
1195         return 0;
1196 }
1197
1198 static int set_infra_mode(struct usbnet *usbdev, int mode)
1199 {
1200         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1201         __le32 tmp;
1202         int ret;
1203
1204         netdev_dbg(usbdev->net, "%s(): infra_mode=0x%x\n",
1205                    __func__, priv->infra_mode);
1206
1207         tmp = cpu_to_le32(mode);
1208         ret = rndis_set_oid(usbdev,
1209                             RNDIS_OID_802_11_INFRASTRUCTURE_MODE,
1210                             &tmp, sizeof(tmp));
1211         if (ret != 0) {
1212                 netdev_warn(usbdev->net, "setting infra mode failed (%08X)\n",
1213                             ret);
1214                 return ret;
1215         }
1216
1217         /* NDIS drivers clear keys when infrastructure mode is
1218          * changed. But Linux tools assume otherwise. So set the
1219          * keys */
1220         restore_keys(usbdev);
1221
1222         priv->infra_mode = mode;
1223         return 0;
1224 }
1225
1226 static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
1227 {
1228         __le32 tmp;
1229
1230         netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
1231
1232         if (rts_threshold == -1 || rts_threshold > 2347)
1233                 rts_threshold = 2347;
1234
1235         tmp = cpu_to_le32(rts_threshold);
1236         return rndis_set_oid(usbdev,
1237                              RNDIS_OID_802_11_RTS_THRESHOLD,
1238                              &tmp, sizeof(tmp));
1239 }
1240
1241 static int set_frag_threshold(struct usbnet *usbdev, u32 frag_threshold)
1242 {
1243         __le32 tmp;
1244
1245         netdev_dbg(usbdev->net, "%s(): %i\n", __func__, frag_threshold);
1246
1247         if (frag_threshold < 256 || frag_threshold > 2346)
1248                 frag_threshold = 2346;
1249
1250         tmp = cpu_to_le32(frag_threshold);
1251         return rndis_set_oid(usbdev,
1252                         RNDIS_OID_802_11_FRAGMENTATION_THRESHOLD,
1253                         &tmp, sizeof(tmp));
1254 }
1255
1256 static void set_default_iw_params(struct usbnet *usbdev)
1257 {
1258         set_infra_mode(usbdev, NDIS_80211_INFRA_INFRA);
1259         set_auth_mode(usbdev, 0, NL80211_AUTHTYPE_OPEN_SYSTEM,
1260                                                 RNDIS_WLAN_KEY_MGMT_NONE);
1261         set_priv_filter(usbdev);
1262         set_encr_mode(usbdev, RNDIS_WLAN_ALG_NONE, RNDIS_WLAN_ALG_NONE);
1263 }
1264
1265 static int deauthenticate(struct usbnet *usbdev)
1266 {
1267         int ret;
1268
1269         ret = disassociate(usbdev, true);
1270         set_default_iw_params(usbdev);
1271         return ret;
1272 }
1273
1274 static int set_channel(struct usbnet *usbdev, int channel)
1275 {
1276         struct ndis_80211_conf config;
1277         unsigned int dsconfig;
1278         int len, ret;
1279
1280         netdev_dbg(usbdev->net, "%s(%d)\n", __func__, channel);
1281
1282         /* this OID is valid only when not associated */
1283         if (is_associated(usbdev))
1284                 return 0;
1285
1286         dsconfig = 1000 *
1287                 ieee80211_channel_to_frequency(channel, NL80211_BAND_2GHZ);
1288
1289         len = sizeof(config);
1290         ret = rndis_query_oid(usbdev,
1291                         RNDIS_OID_802_11_CONFIGURATION,
1292                         &config, &len);
1293         if (ret < 0) {
1294                 netdev_dbg(usbdev->net, "%s(): querying configuration failed\n",
1295                            __func__);
1296                 return ret;
1297         }
1298
1299         config.ds_config = cpu_to_le32(dsconfig);
1300         ret = rndis_set_oid(usbdev,
1301                         RNDIS_OID_802_11_CONFIGURATION,
1302                         &config, sizeof(config));
1303
1304         netdev_dbg(usbdev->net, "%s(): %d -> %d\n", __func__, channel, ret);
1305
1306         return ret;
1307 }
1308
1309 static struct ieee80211_channel *get_current_channel(struct usbnet *usbdev,
1310                                                      u32 *beacon_period)
1311 {
1312         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1313         struct ieee80211_channel *channel;
1314         struct ndis_80211_conf config;
1315         int len, ret;
1316
1317         /* Get channel and beacon interval */
1318         len = sizeof(config);
1319         ret = rndis_query_oid(usbdev,
1320                         RNDIS_OID_802_11_CONFIGURATION,
1321                         &config, &len);
1322         netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_CONFIGURATION -> %d\n",
1323                                 __func__, ret);
1324         if (ret < 0)
1325                 return NULL;
1326
1327         channel = ieee80211_get_channel(priv->wdev.wiphy,
1328                                 KHZ_TO_MHZ(le32_to_cpu(config.ds_config)));
1329         if (!channel)
1330                 return NULL;
1331
1332         if (beacon_period)
1333                 *beacon_period = le32_to_cpu(config.beacon_period);
1334         return channel;
1335 }
1336
1337 /* index must be 0 - N, as per NDIS  */
1338 static int add_wep_key(struct usbnet *usbdev, const u8 *key, int key_len,
1339                                                                 u8 index)
1340 {
1341         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1342         struct ndis_80211_wep_key ndis_key;
1343         u32 cipher;
1344         int ret;
1345
1346         netdev_dbg(usbdev->net, "%s(idx: %d, len: %d)\n",
1347                    __func__, index, key_len);
1348
1349         if (index >= RNDIS_WLAN_NUM_KEYS)
1350                 return -EINVAL;
1351
1352         if (key_len == 5)
1353                 cipher = WLAN_CIPHER_SUITE_WEP40;
1354         else if (key_len == 13)
1355                 cipher = WLAN_CIPHER_SUITE_WEP104;
1356         else
1357                 return -EINVAL;
1358
1359         memset(&ndis_key, 0, sizeof(ndis_key));
1360
1361         ndis_key.size = cpu_to_le32(sizeof(ndis_key));
1362         ndis_key.length = cpu_to_le32(key_len);
1363         ndis_key.index = cpu_to_le32(index);
1364         memcpy(&ndis_key.material, key, key_len);
1365
1366         if (index == priv->encr_tx_key_index) {
1367                 ndis_key.index |= NDIS_80211_ADDWEP_TRANSMIT_KEY;
1368                 ret = set_encr_mode(usbdev, RNDIS_WLAN_ALG_WEP,
1369                                                         RNDIS_WLAN_ALG_NONE);
1370                 if (ret)
1371                         netdev_warn(usbdev->net, "encryption couldn't be enabled (%08X)\n",
1372                                     ret);
1373         }
1374
1375         ret = rndis_set_oid(usbdev,
1376                         RNDIS_OID_802_11_ADD_WEP, &ndis_key,
1377                         sizeof(ndis_key));
1378         if (ret != 0) {
1379                 netdev_warn(usbdev->net, "adding encryption key %d failed (%08X)\n",
1380                             index + 1, ret);
1381                 return ret;
1382         }
1383
1384         priv->encr_keys[index].len = key_len;
1385         priv->encr_keys[index].cipher = cipher;
1386         memcpy(&priv->encr_keys[index].material, key, key_len);
1387         eth_broadcast_addr(priv->encr_keys[index].bssid);
1388
1389         return 0;
1390 }
1391
1392 static int add_wpa_key(struct usbnet *usbdev, const u8 *key, int key_len,
1393                         u8 index, const u8 *addr, const u8 *rx_seq,
1394                         int seq_len, u32 cipher, __le32 flags)
1395 {
1396         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1397         struct ndis_80211_key ndis_key;
1398         bool is_addr_ok;
1399         int ret;
1400
1401         if (index >= RNDIS_WLAN_NUM_KEYS) {
1402                 netdev_dbg(usbdev->net, "%s(): index out of range (%i)\n",
1403                            __func__, index);
1404                 return -EINVAL;
1405         }
1406         if (key_len > sizeof(ndis_key.material) || key_len < 0) {
1407                 netdev_dbg(usbdev->net, "%s(): key length out of range (%i)\n",
1408                            __func__, key_len);
1409                 return -EINVAL;
1410         }
1411         if (flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ) {
1412                 if (!rx_seq || seq_len <= 0) {
1413                         netdev_dbg(usbdev->net, "%s(): recv seq flag without buffer\n",
1414                                    __func__);
1415                         return -EINVAL;
1416                 }
1417                 if (rx_seq && seq_len > sizeof(ndis_key.rsc)) {
1418                         netdev_dbg(usbdev->net, "%s(): too big recv seq buffer\n", __func__);
1419                         return -EINVAL;
1420                 }
1421         }
1422
1423         is_addr_ok = addr && !is_zero_ether_addr(addr) &&
1424                                         !is_broadcast_ether_addr(addr);
1425         if ((flags & NDIS_80211_ADDKEY_PAIRWISE_KEY) && !is_addr_ok) {
1426                 netdev_dbg(usbdev->net, "%s(): pairwise but bssid invalid (%pM)\n",
1427                            __func__, addr);
1428                 return -EINVAL;
1429         }
1430
1431         netdev_dbg(usbdev->net, "%s(%i): flags:%i%i%i\n",
1432                    __func__, index,
1433                    !!(flags & NDIS_80211_ADDKEY_TRANSMIT_KEY),
1434                    !!(flags & NDIS_80211_ADDKEY_PAIRWISE_KEY),
1435                    !!(flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ));
1436
1437         memset(&ndis_key, 0, sizeof(ndis_key));
1438
1439         ndis_key.size = cpu_to_le32(sizeof(ndis_key) -
1440                                 sizeof(ndis_key.material) + key_len);
1441         ndis_key.length = cpu_to_le32(key_len);
1442         ndis_key.index = cpu_to_le32(index) | flags;
1443
1444         if (cipher == WLAN_CIPHER_SUITE_TKIP && key_len == 32) {
1445                 /* wpa_supplicant gives us the Michael MIC RX/TX keys in
1446                  * different order than NDIS spec, so swap the order here. */
1447                 memcpy(ndis_key.material, key, 16);
1448                 memcpy(ndis_key.material + 16, key + 24, 8);
1449                 memcpy(ndis_key.material + 24, key + 16, 8);
1450         } else
1451                 memcpy(ndis_key.material, key, key_len);
1452
1453         if (flags & NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ)
1454                 memcpy(ndis_key.rsc, rx_seq, seq_len);
1455
1456         if (flags & NDIS_80211_ADDKEY_PAIRWISE_KEY) {
1457                 /* pairwise key */
1458                 memcpy(ndis_key.bssid, addr, ETH_ALEN);
1459         } else {
1460                 /* group key */
1461                 if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
1462                         eth_broadcast_addr(ndis_key.bssid);
1463                 else
1464                         get_bssid(usbdev, ndis_key.bssid);
1465         }
1466
1467         ret = rndis_set_oid(usbdev,
1468                         RNDIS_OID_802_11_ADD_KEY, &ndis_key,
1469                         le32_to_cpu(ndis_key.size));
1470         netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_ADD_KEY -> %08X\n",
1471                    __func__, ret);
1472         if (ret != 0)
1473                 return ret;
1474
1475         memset(&priv->encr_keys[index], 0, sizeof(priv->encr_keys[index]));
1476         priv->encr_keys[index].len = key_len;
1477         priv->encr_keys[index].cipher = cipher;
1478         memcpy(&priv->encr_keys[index].material, key, key_len);
1479         if (flags & NDIS_80211_ADDKEY_PAIRWISE_KEY)
1480                 memcpy(&priv->encr_keys[index].bssid, ndis_key.bssid, ETH_ALEN);
1481         else
1482                 eth_broadcast_addr(priv->encr_keys[index].bssid);
1483
1484         if (flags & NDIS_80211_ADDKEY_TRANSMIT_KEY)
1485                 priv->encr_tx_key_index = index;
1486
1487         return 0;
1488 }
1489
1490 static int restore_key(struct usbnet *usbdev, u8 key_idx)
1491 {
1492         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1493         struct rndis_wlan_encr_key key;
1494
1495         if (is_wpa_key(priv, key_idx))
1496                 return 0;
1497
1498         key = priv->encr_keys[key_idx];
1499
1500         netdev_dbg(usbdev->net, "%s(): %i:%i\n", __func__, key_idx, key.len);
1501
1502         if (key.len == 0)
1503                 return 0;
1504
1505         return add_wep_key(usbdev, key.material, key.len, key_idx);
1506 }
1507
1508 static void restore_keys(struct usbnet *usbdev)
1509 {
1510         int i;
1511
1512         for (i = 0; i < 4; i++)
1513                 restore_key(usbdev, i);
1514 }
1515
1516 static void clear_key(struct rndis_wlan_private *priv, u8 idx)
1517 {
1518         memset(&priv->encr_keys[idx], 0, sizeof(priv->encr_keys[idx]));
1519 }
1520
1521 /* remove_key is for both wep and wpa */
1522 static int remove_key(struct usbnet *usbdev, u8 index, const u8 *bssid)
1523 {
1524         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1525         struct ndis_80211_remove_key remove_key;
1526         __le32 keyindex;
1527         bool is_wpa;
1528         int ret;
1529
1530         if (index >= RNDIS_WLAN_NUM_KEYS)
1531                 return -ENOENT;
1532
1533         if (priv->encr_keys[index].len == 0)
1534                 return 0;
1535
1536         is_wpa = is_wpa_key(priv, index);
1537
1538         netdev_dbg(usbdev->net, "%s(): %i:%s:%i\n",
1539                    __func__, index, is_wpa ? "wpa" : "wep",
1540                    priv->encr_keys[index].len);
1541
1542         clear_key(priv, index);
1543
1544         if (is_wpa) {
1545                 remove_key.size = cpu_to_le32(sizeof(remove_key));
1546                 remove_key.index = cpu_to_le32(index);
1547                 if (bssid) {
1548                         /* pairwise key */
1549                         if (!is_broadcast_ether_addr(bssid))
1550                                 remove_key.index |=
1551                                         NDIS_80211_ADDKEY_PAIRWISE_KEY;
1552                         memcpy(remove_key.bssid, bssid,
1553                                         sizeof(remove_key.bssid));
1554                 } else
1555                         memset(remove_key.bssid, 0xff,
1556                                                 sizeof(remove_key.bssid));
1557
1558                 ret = rndis_set_oid(usbdev,
1559                                 RNDIS_OID_802_11_REMOVE_KEY,
1560                                 &remove_key, sizeof(remove_key));
1561                 if (ret != 0)
1562                         return ret;
1563         } else {
1564                 keyindex = cpu_to_le32(index);
1565                 ret = rndis_set_oid(usbdev,
1566                                 RNDIS_OID_802_11_REMOVE_WEP,
1567                                 &keyindex, sizeof(keyindex));
1568                 if (ret != 0) {
1569                         netdev_warn(usbdev->net,
1570                                     "removing encryption key %d failed (%08X)\n",
1571                                     index, ret);
1572                         return ret;
1573                 }
1574         }
1575
1576         /* if it is transmit key, disable encryption */
1577         if (index == priv->encr_tx_key_index)
1578                 set_encr_mode(usbdev, RNDIS_WLAN_ALG_NONE, RNDIS_WLAN_ALG_NONE);
1579
1580         return 0;
1581 }
1582
1583 static void set_multicast_list(struct usbnet *usbdev)
1584 {
1585         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1586         struct netdev_hw_addr *ha;
1587         __le32 filter, basefilter;
1588         int ret;
1589         char *mc_addrs = NULL;
1590         int mc_count;
1591
1592         basefilter = filter = cpu_to_le32(RNDIS_PACKET_TYPE_DIRECTED |
1593                                           RNDIS_PACKET_TYPE_BROADCAST);
1594
1595         if (usbdev->net->flags & IFF_PROMISC) {
1596                 filter |= cpu_to_le32(RNDIS_PACKET_TYPE_PROMISCUOUS |
1597                                       RNDIS_PACKET_TYPE_ALL_LOCAL);
1598         } else if (usbdev->net->flags & IFF_ALLMULTI) {
1599                 filter |= cpu_to_le32(RNDIS_PACKET_TYPE_ALL_MULTICAST);
1600         }
1601
1602         if (filter != basefilter)
1603                 goto set_filter;
1604
1605         /*
1606          * mc_list should be accessed holding the lock, so copy addresses to
1607          * local buffer first.
1608          */
1609         netif_addr_lock_bh(usbdev->net);
1610         mc_count = netdev_mc_count(usbdev->net);
1611         if (mc_count > priv->multicast_size) {
1612                 filter |= cpu_to_le32(RNDIS_PACKET_TYPE_ALL_MULTICAST);
1613         } else if (mc_count) {
1614                 int i = 0;
1615
1616                 mc_addrs = kmalloc_array(mc_count, ETH_ALEN, GFP_ATOMIC);
1617                 if (!mc_addrs) {
1618                         netif_addr_unlock_bh(usbdev->net);
1619                         return;
1620                 }
1621
1622                 netdev_for_each_mc_addr(ha, usbdev->net)
1623                         memcpy(mc_addrs + i++ * ETH_ALEN,
1624                                ha->addr, ETH_ALEN);
1625         }
1626         netif_addr_unlock_bh(usbdev->net);
1627
1628         if (filter != basefilter)
1629                 goto set_filter;
1630
1631         if (mc_count) {
1632                 ret = rndis_set_oid(usbdev,
1633                                 RNDIS_OID_802_3_MULTICAST_LIST,
1634                                 mc_addrs, mc_count * ETH_ALEN);
1635                 kfree(mc_addrs);
1636                 if (ret == 0)
1637                         filter |= cpu_to_le32(RNDIS_PACKET_TYPE_MULTICAST);
1638                 else
1639                         filter |= cpu_to_le32(RNDIS_PACKET_TYPE_ALL_MULTICAST);
1640
1641                 netdev_dbg(usbdev->net, "RNDIS_OID_802_3_MULTICAST_LIST(%d, max: %d) -> %d\n",
1642                            mc_count, priv->multicast_size, ret);
1643         }
1644
1645 set_filter:
1646         ret = rndis_set_oid(usbdev, RNDIS_OID_GEN_CURRENT_PACKET_FILTER, &filter,
1647                                                         sizeof(filter));
1648         if (ret < 0) {
1649                 netdev_warn(usbdev->net, "couldn't set packet filter: %08x\n",
1650                             le32_to_cpu(filter));
1651         }
1652
1653         netdev_dbg(usbdev->net, "RNDIS_OID_GEN_CURRENT_PACKET_FILTER(%08x) -> %d\n",
1654                    le32_to_cpu(filter), ret);
1655 }
1656
1657 #ifdef DEBUG
1658 static void debug_print_pmkids(struct usbnet *usbdev,
1659                                 struct ndis_80211_pmkid *pmkids,
1660                                 const char *func_str)
1661 {
1662         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1663         int i, len, count, max_pmkids, entry_len;
1664
1665         max_pmkids = priv->wdev.wiphy->max_num_pmkids;
1666         len = le32_to_cpu(pmkids->length);
1667         count = le32_to_cpu(pmkids->bssid_info_count);
1668
1669         entry_len = (count > 0) ? (len - sizeof(*pmkids)) / count : -1;
1670
1671         netdev_dbg(usbdev->net, "%s(): %d PMKIDs (data len: %d, entry len: "
1672                                 "%d)\n", func_str, count, len, entry_len);
1673
1674         if (count > max_pmkids)
1675                 count = max_pmkids;
1676
1677         for (i = 0; i < count; i++) {
1678                 u32 *tmp = (u32 *)pmkids->bssid_info[i].pmkid;
1679
1680                 netdev_dbg(usbdev->net, "%s():  bssid: %pM, "
1681                                 "pmkid: %08X:%08X:%08X:%08X\n",
1682                                 func_str, pmkids->bssid_info[i].bssid,
1683                                 cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
1684                                 cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
1685         }
1686 }
1687 #else
1688 static void debug_print_pmkids(struct usbnet *usbdev,
1689                                 struct ndis_80211_pmkid *pmkids,
1690                                 const char *func_str)
1691 {
1692         return;
1693 }
1694 #endif
1695
1696 static struct ndis_80211_pmkid *get_device_pmkids(struct usbnet *usbdev)
1697 {
1698         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1699         struct ndis_80211_pmkid *pmkids;
1700         int len, ret, max_pmkids;
1701
1702         max_pmkids = priv->wdev.wiphy->max_num_pmkids;
1703         len = sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]);
1704
1705         pmkids = kzalloc(len, GFP_KERNEL);
1706         if (!pmkids)
1707                 return ERR_PTR(-ENOMEM);
1708
1709         pmkids->length = cpu_to_le32(len);
1710         pmkids->bssid_info_count = cpu_to_le32(max_pmkids);
1711
1712         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_PMKID,
1713                         pmkids, &len);
1714         if (ret < 0) {
1715                 netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_PMKID(%d, %d)"
1716                                 " -> %d\n", __func__, len, max_pmkids, ret);
1717
1718                 kfree(pmkids);
1719                 return ERR_PTR(ret);
1720         }
1721
1722         if (le32_to_cpu(pmkids->bssid_info_count) > max_pmkids)
1723                 pmkids->bssid_info_count = cpu_to_le32(max_pmkids);
1724
1725         debug_print_pmkids(usbdev, pmkids, __func__);
1726
1727         return pmkids;
1728 }
1729
1730 static int set_device_pmkids(struct usbnet *usbdev,
1731                                 struct ndis_80211_pmkid *pmkids)
1732 {
1733         int ret, len, num_pmkids;
1734
1735         num_pmkids = le32_to_cpu(pmkids->bssid_info_count);
1736         len = sizeof(*pmkids) + num_pmkids * sizeof(pmkids->bssid_info[0]);
1737         pmkids->length = cpu_to_le32(len);
1738
1739         debug_print_pmkids(usbdev, pmkids, __func__);
1740
1741         ret = rndis_set_oid(usbdev, RNDIS_OID_802_11_PMKID, pmkids,
1742                             le32_to_cpu(pmkids->length));
1743         if (ret < 0) {
1744                 netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_PMKID(%d, %d) -> %d"
1745                                 "\n", __func__, len, num_pmkids, ret);
1746         }
1747
1748         kfree(pmkids);
1749         return ret;
1750 }
1751
1752 static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev,
1753                                                 struct ndis_80211_pmkid *pmkids,
1754                                                 struct cfg80211_pmksa *pmksa,
1755                                                 int max_pmkids)
1756 {
1757         int i, newlen, err;
1758         unsigned int count;
1759
1760         count = le32_to_cpu(pmkids->bssid_info_count);
1761
1762         if (count > max_pmkids)
1763                 count = max_pmkids;
1764
1765         for (i = 0; i < count; i++)
1766                 if (ether_addr_equal(pmkids->bssid_info[i].bssid,
1767                                      pmksa->bssid))
1768                         break;
1769
1770         /* pmkid not found */
1771         if (i == count) {
1772                 netdev_dbg(usbdev->net, "%s(): bssid not found (%pM)\n",
1773                                         __func__, pmksa->bssid);
1774                 err = -ENOENT;
1775                 goto error;
1776         }
1777
1778         for (; i + 1 < count; i++)
1779                 pmkids->bssid_info[i] = pmkids->bssid_info[i + 1];
1780
1781         count--;
1782         newlen = sizeof(*pmkids) + count * sizeof(pmkids->bssid_info[0]);
1783
1784         pmkids->length = cpu_to_le32(newlen);
1785         pmkids->bssid_info_count = cpu_to_le32(count);
1786
1787         return pmkids;
1788 error:
1789         kfree(pmkids);
1790         return ERR_PTR(err);
1791 }
1792
1793 static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
1794                                                 struct ndis_80211_pmkid *pmkids,
1795                                                 struct cfg80211_pmksa *pmksa,
1796                                                 int max_pmkids)
1797 {
1798         struct ndis_80211_pmkid *new_pmkids;
1799         int i, err, newlen;
1800         unsigned int count;
1801
1802         count = le32_to_cpu(pmkids->bssid_info_count);
1803
1804         if (count > max_pmkids)
1805                 count = max_pmkids;
1806
1807         /* update with new pmkid */
1808         for (i = 0; i < count; i++) {
1809                 if (!ether_addr_equal(pmkids->bssid_info[i].bssid,
1810                                       pmksa->bssid))
1811                         continue;
1812
1813                 memcpy(pmkids->bssid_info[i].pmkid, pmksa->pmkid,
1814                                                                 WLAN_PMKID_LEN);
1815
1816                 return pmkids;
1817         }
1818
1819         /* out of space, return error */
1820         if (i == max_pmkids) {
1821                 netdev_dbg(usbdev->net, "%s(): out of space\n", __func__);
1822                 err = -ENOSPC;
1823                 goto error;
1824         }
1825
1826         /* add new pmkid */
1827         newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
1828
1829         new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
1830         if (!new_pmkids) {
1831                 err = -ENOMEM;
1832                 goto error;
1833         }
1834         pmkids = new_pmkids;
1835
1836         pmkids->length = cpu_to_le32(newlen);
1837         pmkids->bssid_info_count = cpu_to_le32(count + 1);
1838
1839         memcpy(pmkids->bssid_info[count].bssid, pmksa->bssid, ETH_ALEN);
1840         memcpy(pmkids->bssid_info[count].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
1841
1842         return pmkids;
1843 error:
1844         kfree(pmkids);
1845         return ERR_PTR(err);
1846 }
1847
1848 /*
1849  * cfg80211 ops
1850  */
1851 static int rndis_change_virtual_intf(struct wiphy *wiphy,
1852                                         struct net_device *dev,
1853                                         enum nl80211_iftype type,
1854                                         struct vif_params *params)
1855 {
1856         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
1857         struct usbnet *usbdev = priv->usbdev;
1858         int mode;
1859
1860         switch (type) {
1861         case NL80211_IFTYPE_ADHOC:
1862                 mode = NDIS_80211_INFRA_ADHOC;
1863                 break;
1864         case NL80211_IFTYPE_STATION:
1865                 mode = NDIS_80211_INFRA_INFRA;
1866                 break;
1867         default:
1868                 return -EINVAL;
1869         }
1870
1871         priv->wdev.iftype = type;
1872
1873         return set_infra_mode(usbdev, mode);
1874 }
1875
1876 static int rndis_set_wiphy_params(struct wiphy *wiphy, u32 changed)
1877 {
1878         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
1879         struct usbnet *usbdev = priv->usbdev;
1880         int err;
1881
1882         if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
1883                 err = set_frag_threshold(usbdev, wiphy->frag_threshold);
1884                 if (err < 0)
1885                         return err;
1886         }
1887
1888         if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
1889                 err = set_rts_threshold(usbdev, wiphy->rts_threshold);
1890                 if (err < 0)
1891                         return err;
1892         }
1893
1894         return 0;
1895 }
1896
1897 static int rndis_set_tx_power(struct wiphy *wiphy,
1898                               struct wireless_dev *wdev,
1899                               enum nl80211_tx_power_setting type,
1900                               int mbm)
1901 {
1902         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
1903         struct usbnet *usbdev = priv->usbdev;
1904
1905         netdev_dbg(usbdev->net, "%s(): type:0x%x mbm:%i\n",
1906                    __func__, type, mbm);
1907
1908         if (mbm < 0 || (mbm % 100))
1909                 return -ENOTSUPP;
1910
1911         /* Device doesn't support changing txpower after initialization, only
1912          * turn off/on radio. Support 'auto' mode and setting same dBm that is
1913          * currently used.
1914          */
1915         if (type == NL80211_TX_POWER_AUTOMATIC ||
1916             MBM_TO_DBM(mbm) == get_bcm4320_power_dbm(priv)) {
1917                 if (!priv->radio_on)
1918                         disassociate(usbdev, true); /* turn on radio */
1919
1920                 return 0;
1921         }
1922
1923         return -ENOTSUPP;
1924 }
1925
1926 static int rndis_get_tx_power(struct wiphy *wiphy,
1927                               struct wireless_dev *wdev,
1928                               int *dbm)
1929 {
1930         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
1931         struct usbnet *usbdev = priv->usbdev;
1932
1933         *dbm = get_bcm4320_power_dbm(priv);
1934
1935         netdev_dbg(usbdev->net, "%s(): dbm:%i\n", __func__, *dbm);
1936
1937         return 0;
1938 }
1939
1940 #define SCAN_DELAY_JIFFIES (6 * HZ)
1941 static int rndis_scan(struct wiphy *wiphy,
1942                         struct cfg80211_scan_request *request)
1943 {
1944         struct net_device *dev = request->wdev->netdev;
1945         struct usbnet *usbdev = netdev_priv(dev);
1946         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1947         int ret;
1948         int delay = SCAN_DELAY_JIFFIES;
1949
1950         netdev_dbg(usbdev->net, "cfg80211.scan\n");
1951
1952         /* Get current bssid list from device before new scan, as new scan
1953          * clears internal bssid list.
1954          */
1955         rndis_check_bssid_list(usbdev, NULL, NULL);
1956
1957         if (priv->scan_request && priv->scan_request != request)
1958                 return -EBUSY;
1959
1960         priv->scan_request = request;
1961
1962         ret = rndis_start_bssid_list_scan(usbdev);
1963         if (ret == 0) {
1964                 if (priv->device_type == RNDIS_BCM4320A)
1965                         delay = HZ;
1966
1967                 /* Wait before retrieving scan results from device */
1968                 queue_delayed_work(priv->workqueue, &priv->scan_work, delay);
1969         }
1970
1971         return ret;
1972 }
1973
1974 static bool rndis_bss_info_update(struct usbnet *usbdev,
1975                                   struct ndis_80211_bssid_ex *bssid)
1976 {
1977         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
1978         struct ieee80211_channel *channel;
1979         struct cfg80211_bss *bss;
1980         s32 signal;
1981         u64 timestamp;
1982         u16 capability;
1983         u16 beacon_interval;
1984         struct ndis_80211_fixed_ies *fixed;
1985         int ie_len, bssid_len;
1986         u8 *ie;
1987
1988         netdev_dbg(usbdev->net, " found bssid: '%.32s' [%pM], len: %d\n",
1989                    bssid->ssid.essid, bssid->mac, le32_to_cpu(bssid->length));
1990
1991         /* parse bssid structure */
1992         bssid_len = le32_to_cpu(bssid->length);
1993
1994         if (bssid_len < sizeof(struct ndis_80211_bssid_ex) +
1995                         sizeof(struct ndis_80211_fixed_ies))
1996                 return NULL;
1997
1998         fixed = (struct ndis_80211_fixed_ies *)bssid->ies;
1999
2000         ie = (void *)(bssid->ies + sizeof(struct ndis_80211_fixed_ies));
2001         ie_len = min(bssid_len - (int)sizeof(*bssid),
2002                                         (int)le32_to_cpu(bssid->ie_length));
2003         ie_len -= sizeof(struct ndis_80211_fixed_ies);
2004         if (ie_len < 0)
2005                 return NULL;
2006
2007         /* extract data for cfg80211_inform_bss */
2008         channel = ieee80211_get_channel(priv->wdev.wiphy,
2009                         KHZ_TO_MHZ(le32_to_cpu(bssid->config.ds_config)));
2010         if (!channel)
2011                 return NULL;
2012
2013         signal = level_to_qual(le32_to_cpu(bssid->rssi));
2014         timestamp = le64_to_cpu(*(__le64 *)fixed->timestamp);
2015         capability = le16_to_cpu(fixed->capabilities);
2016         beacon_interval = le16_to_cpu(fixed->beacon_interval);
2017
2018         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel,
2019                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid->mac,
2020                                   timestamp, capability, beacon_interval,
2021                                   ie, ie_len, signal, GFP_KERNEL);
2022         cfg80211_put_bss(priv->wdev.wiphy, bss);
2023
2024         return (bss != NULL);
2025 }
2026
2027 static struct ndis_80211_bssid_ex *next_bssid_list_item(
2028                                         struct ndis_80211_bssid_ex *bssid,
2029                                         int *bssid_len, void *buf, int len)
2030 {
2031         void *buf_end, *bssid_end;
2032
2033         buf_end = (char *)buf + len;
2034         bssid_end = (char *)bssid + *bssid_len;
2035
2036         if ((int)(buf_end - bssid_end) < sizeof(bssid->length)) {
2037                 *bssid_len = 0;
2038                 return NULL;
2039         } else {
2040                 bssid = (void *)((char *)bssid + *bssid_len);
2041                 *bssid_len = le32_to_cpu(bssid->length);
2042                 return bssid;
2043         }
2044 }
2045
2046 static bool check_bssid_list_item(struct ndis_80211_bssid_ex *bssid,
2047                                   int bssid_len, void *buf, int len)
2048 {
2049         void *buf_end, *bssid_end;
2050
2051         if (!bssid || bssid_len <= 0 || bssid_len > len)
2052                 return false;
2053
2054         buf_end = (char *)buf + len;
2055         bssid_end = (char *)bssid + bssid_len;
2056
2057         return (int)(buf_end - bssid_end) >= 0 && (int)(bssid_end - buf) >= 0;
2058 }
2059
2060 static int rndis_check_bssid_list(struct usbnet *usbdev, u8 *match_bssid,
2061                                         bool *matched)
2062 {
2063         void *buf = NULL;
2064         struct ndis_80211_bssid_list_ex *bssid_list;
2065         struct ndis_80211_bssid_ex *bssid;
2066         int ret = -EINVAL, len, count, bssid_len, real_count, new_len;
2067
2068         netdev_dbg(usbdev->net, "%s()\n", __func__);
2069
2070         len = CONTROL_BUFFER_SIZE;
2071 resize_buf:
2072         buf = kzalloc(len, GFP_KERNEL);
2073         if (!buf) {
2074                 ret = -ENOMEM;
2075                 goto out;
2076         }
2077
2078         /* BSSID-list might have got bigger last time we checked, keep
2079          * resizing until it won't get any bigger.
2080          */
2081         new_len = len;
2082         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_BSSID_LIST,
2083                               buf, &new_len);
2084         if (ret != 0 || new_len < sizeof(struct ndis_80211_bssid_list_ex))
2085                 goto out;
2086
2087         if (new_len > len) {
2088                 len = new_len;
2089                 kfree(buf);
2090                 goto resize_buf;
2091         }
2092
2093         len = new_len;
2094
2095         bssid_list = buf;
2096         count = le32_to_cpu(bssid_list->num_items);
2097         real_count = 0;
2098         netdev_dbg(usbdev->net, "%s(): buflen: %d\n", __func__, len);
2099
2100         bssid_len = 0;
2101         bssid = next_bssid_list_item(bssid_list->bssid, &bssid_len, buf, len);
2102
2103         /* Device returns incorrect 'num_items'. Workaround by ignoring the
2104          * received 'num_items' and walking through full bssid buffer instead.
2105          */
2106         while (check_bssid_list_item(bssid, bssid_len, buf, len)) {
2107                 if (rndis_bss_info_update(usbdev, bssid) && match_bssid &&
2108                     matched) {
2109                         if (ether_addr_equal(bssid->mac, match_bssid))
2110                                 *matched = true;
2111                 }
2112
2113                 real_count++;
2114                 bssid = next_bssid_list_item(bssid, &bssid_len, buf, len);
2115         }
2116
2117         netdev_dbg(usbdev->net, "%s(): num_items from device: %d, really found:"
2118                                 " %d\n", __func__, count, real_count);
2119
2120 out:
2121         kfree(buf);
2122         return ret;
2123 }
2124
2125 static void rndis_get_scan_results(struct work_struct *work)
2126 {
2127         struct rndis_wlan_private *priv =
2128                 container_of(work, struct rndis_wlan_private, scan_work.work);
2129         struct usbnet *usbdev = priv->usbdev;
2130         struct cfg80211_scan_info info = {};
2131         int ret;
2132
2133         netdev_dbg(usbdev->net, "get_scan_results\n");
2134
2135         if (!priv->scan_request)
2136                 return;
2137
2138         ret = rndis_check_bssid_list(usbdev, NULL, NULL);
2139
2140         info.aborted = ret < 0;
2141         cfg80211_scan_done(priv->scan_request, &info);
2142
2143         priv->scan_request = NULL;
2144 }
2145
2146 static int rndis_connect(struct wiphy *wiphy, struct net_device *dev,
2147                                         struct cfg80211_connect_params *sme)
2148 {
2149         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2150         struct usbnet *usbdev = priv->usbdev;
2151         struct ieee80211_channel *channel = sme->channel;
2152         struct ndis_80211_ssid ssid;
2153         int pairwise = RNDIS_WLAN_ALG_NONE;
2154         int groupwise = RNDIS_WLAN_ALG_NONE;
2155         int keymgmt = RNDIS_WLAN_KEY_MGMT_NONE;
2156         int length, i, ret, chan = -1;
2157
2158         if (channel)
2159                 chan = ieee80211_frequency_to_channel(channel->center_freq);
2160
2161         groupwise = rndis_cipher_to_alg(sme->crypto.cipher_group);
2162         for (i = 0; i < sme->crypto.n_ciphers_pairwise; i++)
2163                 pairwise |=
2164                         rndis_cipher_to_alg(sme->crypto.ciphers_pairwise[i]);
2165
2166         if (sme->crypto.n_ciphers_pairwise > 0 &&
2167                         pairwise == RNDIS_WLAN_ALG_NONE) {
2168                 netdev_err(usbdev->net, "Unsupported pairwise cipher\n");
2169                 return -ENOTSUPP;
2170         }
2171
2172         for (i = 0; i < sme->crypto.n_akm_suites; i++)
2173                 keymgmt |=
2174                         rndis_akm_suite_to_key_mgmt(sme->crypto.akm_suites[i]);
2175
2176         if (sme->crypto.n_akm_suites > 0 &&
2177                         keymgmt == RNDIS_WLAN_KEY_MGMT_NONE) {
2178                 netdev_err(usbdev->net, "Invalid keymgmt\n");
2179                 return -ENOTSUPP;
2180         }
2181
2182         netdev_dbg(usbdev->net, "cfg80211.connect('%.32s':[%pM]:%d:[%d,0x%x:0x%x]:[0x%x:0x%x]:0x%x)\n",
2183                    sme->ssid, sme->bssid, chan,
2184                    sme->privacy, sme->crypto.wpa_versions, sme->auth_type,
2185                    groupwise, pairwise, keymgmt);
2186
2187         if (is_associated(usbdev))
2188                 disassociate(usbdev, false);
2189
2190         ret = set_infra_mode(usbdev, NDIS_80211_INFRA_INFRA);
2191         if (ret < 0) {
2192                 netdev_dbg(usbdev->net, "connect: set_infra_mode failed, %d\n",
2193                            ret);
2194                 goto err_turn_radio_on;
2195         }
2196
2197         ret = set_auth_mode(usbdev, sme->crypto.wpa_versions, sme->auth_type,
2198                                                                 keymgmt);
2199         if (ret < 0) {
2200                 netdev_dbg(usbdev->net, "connect: set_auth_mode failed, %d\n",
2201                            ret);
2202                 goto err_turn_radio_on;
2203         }
2204
2205         set_priv_filter(usbdev);
2206
2207         ret = set_encr_mode(usbdev, pairwise, groupwise);
2208         if (ret < 0) {
2209                 netdev_dbg(usbdev->net, "connect: set_encr_mode failed, %d\n",
2210                            ret);
2211                 goto err_turn_radio_on;
2212         }
2213
2214         if (channel) {
2215                 ret = set_channel(usbdev, chan);
2216                 if (ret < 0) {
2217                         netdev_dbg(usbdev->net, "connect: set_channel failed, %d\n",
2218                                    ret);
2219                         goto err_turn_radio_on;
2220                 }
2221         }
2222
2223         if (sme->key && ((groupwise | pairwise) & RNDIS_WLAN_ALG_WEP)) {
2224                 priv->encr_tx_key_index = sme->key_idx;
2225                 ret = add_wep_key(usbdev, sme->key, sme->key_len, sme->key_idx);
2226                 if (ret < 0) {
2227                         netdev_dbg(usbdev->net, "connect: add_wep_key failed, %d (%d, %d)\n",
2228                                    ret, sme->key_len, sme->key_idx);
2229                         goto err_turn_radio_on;
2230                 }
2231         }
2232
2233         if (sme->bssid && !is_zero_ether_addr(sme->bssid) &&
2234                                 !is_broadcast_ether_addr(sme->bssid)) {
2235                 ret = set_bssid(usbdev, sme->bssid);
2236                 if (ret < 0) {
2237                         netdev_dbg(usbdev->net, "connect: set_bssid failed, %d\n",
2238                                    ret);
2239                         goto err_turn_radio_on;
2240                 }
2241         } else
2242                 clear_bssid(usbdev);
2243
2244         length = sme->ssid_len;
2245         if (length > NDIS_802_11_LENGTH_SSID)
2246                 length = NDIS_802_11_LENGTH_SSID;
2247
2248         memset(&ssid, 0, sizeof(ssid));
2249         ssid.length = cpu_to_le32(length);
2250         memcpy(ssid.essid, sme->ssid, length);
2251
2252         /* Pause and purge rx queue, so we don't pass packets before
2253          * 'media connect'-indication.
2254          */
2255         usbnet_pause_rx(usbdev);
2256         usbnet_purge_paused_rxq(usbdev);
2257
2258         ret = set_essid(usbdev, &ssid);
2259         if (ret < 0)
2260                 netdev_dbg(usbdev->net, "connect: set_essid failed, %d\n", ret);
2261         return ret;
2262
2263 err_turn_radio_on:
2264         disassociate(usbdev, true);
2265
2266         return ret;
2267 }
2268
2269 static int rndis_disconnect(struct wiphy *wiphy, struct net_device *dev,
2270                                                                 u16 reason_code)
2271 {
2272         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2273         struct usbnet *usbdev = priv->usbdev;
2274
2275         netdev_dbg(usbdev->net, "cfg80211.disconnect(%d)\n", reason_code);
2276
2277         priv->connected = false;
2278         eth_zero_addr(priv->bssid);
2279
2280         return deauthenticate(usbdev);
2281 }
2282
2283 static int rndis_join_ibss(struct wiphy *wiphy, struct net_device *dev,
2284                                         struct cfg80211_ibss_params *params)
2285 {
2286         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2287         struct usbnet *usbdev = priv->usbdev;
2288         struct ieee80211_channel *channel = params->chandef.chan;
2289         struct ndis_80211_ssid ssid;
2290         enum nl80211_auth_type auth_type;
2291         int ret, alg, length, chan = -1;
2292
2293         if (channel)
2294                 chan = ieee80211_frequency_to_channel(channel->center_freq);
2295
2296         /* TODO: How to handle ad-hoc encryption?
2297          * connect() has *key, join_ibss() doesn't. RNDIS requires key to be
2298          * pre-shared for encryption (open/shared/wpa), is key set before
2299          * join_ibss? Which auth_type to use (not in params)? What about WPA?
2300          */
2301         if (params->privacy) {
2302                 auth_type = NL80211_AUTHTYPE_SHARED_KEY;
2303                 alg = RNDIS_WLAN_ALG_WEP;
2304         } else {
2305                 auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2306                 alg = RNDIS_WLAN_ALG_NONE;
2307         }
2308
2309         netdev_dbg(usbdev->net, "cfg80211.join_ibss('%.32s':[%pM]:%d:%d)\n",
2310                    params->ssid, params->bssid, chan, params->privacy);
2311
2312         if (is_associated(usbdev))
2313                 disassociate(usbdev, false);
2314
2315         ret = set_infra_mode(usbdev, NDIS_80211_INFRA_ADHOC);
2316         if (ret < 0) {
2317                 netdev_dbg(usbdev->net, "join_ibss: set_infra_mode failed, %d\n",
2318                            ret);
2319                 goto err_turn_radio_on;
2320         }
2321
2322         ret = set_auth_mode(usbdev, 0, auth_type, RNDIS_WLAN_KEY_MGMT_NONE);
2323         if (ret < 0) {
2324                 netdev_dbg(usbdev->net, "join_ibss: set_auth_mode failed, %d\n",
2325                            ret);
2326                 goto err_turn_radio_on;
2327         }
2328
2329         set_priv_filter(usbdev);
2330
2331         ret = set_encr_mode(usbdev, alg, RNDIS_WLAN_ALG_NONE);
2332         if (ret < 0) {
2333                 netdev_dbg(usbdev->net, "join_ibss: set_encr_mode failed, %d\n",
2334                            ret);
2335                 goto err_turn_radio_on;
2336         }
2337
2338         if (channel) {
2339                 ret = set_channel(usbdev, chan);
2340                 if (ret < 0) {
2341                         netdev_dbg(usbdev->net, "join_ibss: set_channel failed, %d\n",
2342                                    ret);
2343                         goto err_turn_radio_on;
2344                 }
2345         }
2346
2347         if (params->bssid && !is_zero_ether_addr(params->bssid) &&
2348                                 !is_broadcast_ether_addr(params->bssid)) {
2349                 ret = set_bssid(usbdev, params->bssid);
2350                 if (ret < 0) {
2351                         netdev_dbg(usbdev->net, "join_ibss: set_bssid failed, %d\n",
2352                                    ret);
2353                         goto err_turn_radio_on;
2354                 }
2355         } else
2356                 clear_bssid(usbdev);
2357
2358         length = params->ssid_len;
2359         if (length > NDIS_802_11_LENGTH_SSID)
2360                 length = NDIS_802_11_LENGTH_SSID;
2361
2362         memset(&ssid, 0, sizeof(ssid));
2363         ssid.length = cpu_to_le32(length);
2364         memcpy(ssid.essid, params->ssid, length);
2365
2366         /* Don't need to pause rx queue for ad-hoc. */
2367         usbnet_purge_paused_rxq(usbdev);
2368         usbnet_resume_rx(usbdev);
2369
2370         ret = set_essid(usbdev, &ssid);
2371         if (ret < 0)
2372                 netdev_dbg(usbdev->net, "join_ibss: set_essid failed, %d\n",
2373                            ret);
2374         return ret;
2375
2376 err_turn_radio_on:
2377         disassociate(usbdev, true);
2378
2379         return ret;
2380 }
2381
2382 static int rndis_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
2383 {
2384         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2385         struct usbnet *usbdev = priv->usbdev;
2386
2387         netdev_dbg(usbdev->net, "cfg80211.leave_ibss()\n");
2388
2389         priv->connected = false;
2390         eth_zero_addr(priv->bssid);
2391
2392         return deauthenticate(usbdev);
2393 }
2394
2395 static int rndis_add_key(struct wiphy *wiphy, struct net_device *netdev,
2396                          u8 key_index, bool pairwise, const u8 *mac_addr,
2397                          struct key_params *params)
2398 {
2399         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2400         struct usbnet *usbdev = priv->usbdev;
2401         __le32 flags;
2402
2403         netdev_dbg(usbdev->net, "%s(%i, %pM, %08x)\n",
2404                    __func__, key_index, mac_addr, params->cipher);
2405
2406         switch (params->cipher) {
2407         case WLAN_CIPHER_SUITE_WEP40:
2408         case WLAN_CIPHER_SUITE_WEP104:
2409                 return add_wep_key(usbdev, params->key, params->key_len,
2410                                                                 key_index);
2411         case WLAN_CIPHER_SUITE_TKIP:
2412         case WLAN_CIPHER_SUITE_CCMP:
2413                 flags = 0;
2414
2415                 if (params->seq && params->seq_len > 0)
2416                         flags |= NDIS_80211_ADDKEY_SET_INIT_RECV_SEQ;
2417                 if (mac_addr)
2418                         flags |= NDIS_80211_ADDKEY_PAIRWISE_KEY |
2419                                         NDIS_80211_ADDKEY_TRANSMIT_KEY;
2420
2421                 return add_wpa_key(usbdev, params->key, params->key_len,
2422                                 key_index, mac_addr, params->seq,
2423                                 params->seq_len, params->cipher, flags);
2424         default:
2425                 netdev_dbg(usbdev->net, "%s(): unsupported cipher %08x\n",
2426                            __func__, params->cipher);
2427                 return -ENOTSUPP;
2428         }
2429 }
2430
2431 static int rndis_del_key(struct wiphy *wiphy, struct net_device *netdev,
2432                          u8 key_index, bool pairwise, const u8 *mac_addr)
2433 {
2434         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2435         struct usbnet *usbdev = priv->usbdev;
2436
2437         netdev_dbg(usbdev->net, "%s(%i, %pM)\n", __func__, key_index, mac_addr);
2438
2439         return remove_key(usbdev, key_index, mac_addr);
2440 }
2441
2442 static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
2443                                  u8 key_index, bool unicast, bool multicast)
2444 {
2445         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2446         struct usbnet *usbdev = priv->usbdev;
2447         struct rndis_wlan_encr_key key;
2448
2449         netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);
2450
2451         if (key_index >= RNDIS_WLAN_NUM_KEYS)
2452                 return -ENOENT;
2453
2454         priv->encr_tx_key_index = key_index;
2455
2456         if (is_wpa_key(priv, key_index))
2457                 return 0;
2458
2459         key = priv->encr_keys[key_index];
2460
2461         return add_wep_key(usbdev, key.material, key.len, key_index);
2462 }
2463
2464 static void rndis_fill_station_info(struct usbnet *usbdev,
2465                                                 struct station_info *sinfo)
2466 {
2467         __le32 linkspeed, rssi;
2468         int ret, len;
2469
2470         memset(sinfo, 0, sizeof(*sinfo));
2471
2472         len = sizeof(linkspeed);
2473         ret = rndis_query_oid(usbdev, RNDIS_OID_GEN_LINK_SPEED, &linkspeed, &len);
2474         if (ret == 0) {
2475                 sinfo->txrate.legacy = le32_to_cpu(linkspeed) / 1000;
2476                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
2477         }
2478
2479         len = sizeof(rssi);
2480         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_RSSI,
2481                               &rssi, &len);
2482         if (ret == 0) {
2483                 sinfo->signal = level_to_qual(le32_to_cpu(rssi));
2484                 sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
2485         }
2486 }
2487
2488 static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
2489                              const u8 *mac, struct station_info *sinfo)
2490 {
2491         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2492         struct usbnet *usbdev = priv->usbdev;
2493
2494         if (!ether_addr_equal(priv->bssid, mac))
2495                 return -ENOENT;
2496
2497         rndis_fill_station_info(usbdev, sinfo);
2498
2499         return 0;
2500 }
2501
2502 static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
2503                                int idx, u8 *mac, struct station_info *sinfo)
2504 {
2505         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2506         struct usbnet *usbdev = priv->usbdev;
2507
2508         if (idx != 0)
2509                 return -ENOENT;
2510
2511         memcpy(mac, priv->bssid, ETH_ALEN);
2512
2513         rndis_fill_station_info(usbdev, sinfo);
2514
2515         return 0;
2516 }
2517
2518 static int rndis_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
2519                                 struct cfg80211_pmksa *pmksa)
2520 {
2521         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2522         struct usbnet *usbdev = priv->usbdev;
2523         struct ndis_80211_pmkid *pmkids;
2524         u32 *tmp = (u32 *)pmksa->pmkid;
2525
2526         netdev_dbg(usbdev->net, "%s(%pM, %08X:%08X:%08X:%08X)\n", __func__,
2527                         pmksa->bssid,
2528                         cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
2529                         cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
2530
2531         pmkids = get_device_pmkids(usbdev);
2532         if (IS_ERR(pmkids)) {
2533                 /* couldn't read PMKID cache from device */
2534                 return PTR_ERR(pmkids);
2535         }
2536
2537         pmkids = update_pmkid(usbdev, pmkids, pmksa, wiphy->max_num_pmkids);
2538         if (IS_ERR(pmkids)) {
2539                 /* not found, list full, etc */
2540                 return PTR_ERR(pmkids);
2541         }
2542
2543         return set_device_pmkids(usbdev, pmkids);
2544 }
2545
2546 static int rndis_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
2547                                 struct cfg80211_pmksa *pmksa)
2548 {
2549         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2550         struct usbnet *usbdev = priv->usbdev;
2551         struct ndis_80211_pmkid *pmkids;
2552         u32 *tmp = (u32 *)pmksa->pmkid;
2553
2554         netdev_dbg(usbdev->net, "%s(%pM, %08X:%08X:%08X:%08X)\n", __func__,
2555                         pmksa->bssid,
2556                         cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
2557                         cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
2558
2559         pmkids = get_device_pmkids(usbdev);
2560         if (IS_ERR(pmkids)) {
2561                 /* Couldn't read PMKID cache from device */
2562                 return PTR_ERR(pmkids);
2563         }
2564
2565         pmkids = remove_pmkid(usbdev, pmkids, pmksa, wiphy->max_num_pmkids);
2566         if (IS_ERR(pmkids)) {
2567                 /* not found, etc */
2568                 return PTR_ERR(pmkids);
2569         }
2570
2571         return set_device_pmkids(usbdev, pmkids);
2572 }
2573
2574 static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
2575 {
2576         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2577         struct usbnet *usbdev = priv->usbdev;
2578         struct ndis_80211_pmkid pmkid;
2579
2580         netdev_dbg(usbdev->net, "%s()\n", __func__);
2581
2582         memset(&pmkid, 0, sizeof(pmkid));
2583
2584         pmkid.length = cpu_to_le32(sizeof(pmkid));
2585         pmkid.bssid_info_count = cpu_to_le32(0);
2586
2587         return rndis_set_oid(usbdev, RNDIS_OID_802_11_PMKID,
2588                              &pmkid, sizeof(pmkid));
2589 }
2590
2591 static int rndis_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
2592                                 bool enabled, int timeout)
2593 {
2594         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2595         struct usbnet *usbdev = priv->usbdev;
2596         int power_mode;
2597         __le32 mode;
2598         int ret;
2599
2600         if (priv->device_type != RNDIS_BCM4320B)
2601                 return -ENOTSUPP;
2602
2603         netdev_dbg(usbdev->net, "%s(): %s, %d\n", __func__,
2604                                 enabled ? "enabled" : "disabled",
2605                                 timeout);
2606
2607         if (enabled)
2608                 power_mode = NDIS_80211_POWER_MODE_FAST_PSP;
2609         else
2610                 power_mode = NDIS_80211_POWER_MODE_CAM;
2611
2612         if (power_mode == priv->power_mode)
2613                 return 0;
2614
2615         priv->power_mode = power_mode;
2616
2617         mode = cpu_to_le32(power_mode);
2618         ret = rndis_set_oid(usbdev, RNDIS_OID_802_11_POWER_MODE,
2619                             &mode, sizeof(mode));
2620
2621         netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_POWER_MODE -> %d\n",
2622                                 __func__, ret);
2623
2624         return ret;
2625 }
2626
2627 static int rndis_set_cqm_rssi_config(struct wiphy *wiphy,
2628                                         struct net_device *dev,
2629                                         s32 rssi_thold, u32 rssi_hyst)
2630 {
2631         struct rndis_wlan_private *priv = wiphy_priv(wiphy);
2632
2633         priv->cqm_rssi_thold = rssi_thold;
2634         priv->cqm_rssi_hyst = rssi_hyst;
2635         priv->last_cqm_event_rssi = 0;
2636
2637         return 0;
2638 }
2639
2640 static void rndis_wlan_craft_connected_bss(struct usbnet *usbdev, u8 *bssid,
2641                                            struct ndis_80211_assoc_info *info)
2642 {
2643         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
2644         struct ieee80211_channel *channel;
2645         struct ndis_80211_ssid ssid;
2646         struct cfg80211_bss *bss;
2647         s32 signal;
2648         u64 timestamp;
2649         u16 capability;
2650         u32 beacon_period = 0;
2651         __le32 rssi;
2652         u8 ie_buf[34];
2653         int len, ret, ie_len;
2654
2655         /* Get signal quality, in case of error use rssi=0 and ignore error. */
2656         len = sizeof(rssi);
2657         rssi = 0;
2658         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_RSSI,
2659                               &rssi, &len);
2660         signal = level_to_qual(le32_to_cpu(rssi));
2661
2662         netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_RSSI -> %d, "
2663                    "rssi:%d, qual: %d\n", __func__, ret, le32_to_cpu(rssi),
2664                    level_to_qual(le32_to_cpu(rssi)));
2665
2666         /* Get AP capabilities */
2667         if (info) {
2668                 capability = le16_to_cpu(info->resp_ie.capa);
2669         } else {
2670                 /* Set atleast ESS/IBSS capability */
2671                 capability = (priv->infra_mode == NDIS_80211_INFRA_INFRA) ?
2672                                 WLAN_CAPABILITY_ESS : WLAN_CAPABILITY_IBSS;
2673         }
2674
2675         /* Get channel and beacon interval */
2676         channel = get_current_channel(usbdev, &beacon_period);
2677         if (!channel) {
2678                 netdev_warn(usbdev->net, "%s(): could not get channel.\n",
2679                                         __func__);
2680                 return;
2681         }
2682
2683         /* Get SSID, in case of error, use zero length SSID and ignore error. */
2684         len = sizeof(ssid);
2685         memset(&ssid, 0, sizeof(ssid));
2686         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_SSID,
2687                               &ssid, &len);
2688         netdev_dbg(usbdev->net, "%s(): RNDIS_OID_802_11_SSID -> %d, len: %d, ssid: "
2689                                 "'%.32s'\n", __func__, ret,
2690                                 le32_to_cpu(ssid.length), ssid.essid);
2691
2692         if (le32_to_cpu(ssid.length) > 32)
2693                 ssid.length = cpu_to_le32(32);
2694
2695         ie_buf[0] = WLAN_EID_SSID;
2696         ie_buf[1] = le32_to_cpu(ssid.length);
2697         memcpy(&ie_buf[2], ssid.essid, le32_to_cpu(ssid.length));
2698
2699         ie_len = le32_to_cpu(ssid.length) + 2;
2700
2701         /* no tsf */
2702         timestamp = 0;
2703
2704         netdev_dbg(usbdev->net, "%s(): channel:%d(freq), bssid:[%pM], tsf:%d, "
2705                 "capa:%x, beacon int:%d, resp_ie(len:%d, essid:'%.32s'), "
2706                 "signal:%d\n", __func__, (channel ? channel->center_freq : -1),
2707                 bssid, (u32)timestamp, capability, beacon_period, ie_len,
2708                 ssid.essid, signal);
2709
2710         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel,
2711                                   CFG80211_BSS_FTYPE_UNKNOWN, bssid,
2712                                   timestamp, capability, beacon_period,
2713                                   ie_buf, ie_len, signal, GFP_KERNEL);
2714         cfg80211_put_bss(priv->wdev.wiphy, bss);
2715 }
2716
2717 /*
2718  * workers, indication handlers, device poller
2719  */
2720 static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
2721 {
2722         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
2723         struct ndis_80211_assoc_info *info = NULL;
2724         u8 bssid[ETH_ALEN];
2725         unsigned int resp_ie_len, req_ie_len;
2726         unsigned int offset;
2727         u8 *req_ie, *resp_ie;
2728         int ret;
2729         bool roamed = false;
2730         bool match_bss;
2731
2732         if (priv->infra_mode == NDIS_80211_INFRA_INFRA && priv->connected) {
2733                 /* received media connect indication while connected, either
2734                  * device reassociated with same AP or roamed to new. */
2735                 roamed = true;
2736         }
2737
2738         req_ie_len = 0;
2739         resp_ie_len = 0;
2740         req_ie = NULL;
2741         resp_ie = NULL;
2742
2743         if (priv->infra_mode == NDIS_80211_INFRA_INFRA) {
2744                 info = kzalloc(CONTROL_BUFFER_SIZE, GFP_KERNEL);
2745                 if (!info) {
2746                         /* No memory? Try resume work later */
2747                         set_bit(WORK_LINK_UP, &priv->work_pending);
2748                         queue_work(priv->workqueue, &priv->work);
2749                         return;
2750                 }
2751
2752                 /* Get association info IEs from device. */
2753                 ret = get_association_info(usbdev, info, CONTROL_BUFFER_SIZE);
2754                 if (!ret) {
2755                         req_ie_len = le32_to_cpu(info->req_ie_length);
2756                         if (req_ie_len > CONTROL_BUFFER_SIZE)
2757                                 req_ie_len = CONTROL_BUFFER_SIZE;
2758                         if (req_ie_len != 0) {
2759                                 offset = le32_to_cpu(info->offset_req_ies);
2760
2761                                 if (offset > CONTROL_BUFFER_SIZE)
2762                                         offset = CONTROL_BUFFER_SIZE;
2763
2764                                 req_ie = (u8 *)info + offset;
2765
2766                                 if (offset + req_ie_len > CONTROL_BUFFER_SIZE)
2767                                         req_ie_len =
2768                                                 CONTROL_BUFFER_SIZE - offset;
2769                         }
2770
2771                         resp_ie_len = le32_to_cpu(info->resp_ie_length);
2772                         if (resp_ie_len > CONTROL_BUFFER_SIZE)
2773                                 resp_ie_len = CONTROL_BUFFER_SIZE;
2774                         if (resp_ie_len != 0) {
2775                                 offset = le32_to_cpu(info->offset_resp_ies);
2776
2777                                 if (offset > CONTROL_BUFFER_SIZE)
2778                                         offset = CONTROL_BUFFER_SIZE;
2779
2780                                 resp_ie = (u8 *)info + offset;
2781
2782                                 if (offset + resp_ie_len > CONTROL_BUFFER_SIZE)
2783                                         resp_ie_len =
2784                                                 CONTROL_BUFFER_SIZE - offset;
2785                         }
2786                 } else {
2787                         /* Since rndis_wlan_craft_connected_bss() might use info
2788                          * later and expects info to contain valid data if
2789                          * non-null, free info and set NULL here.
2790                          */
2791                         kfree(info);
2792                         info = NULL;
2793                 }
2794         } else if (WARN_ON(priv->infra_mode != NDIS_80211_INFRA_ADHOC))
2795                 return;
2796
2797         ret = get_bssid(usbdev, bssid);
2798         if (ret < 0)
2799                 memset(bssid, 0, sizeof(bssid));
2800
2801         netdev_dbg(usbdev->net, "link up work: [%pM]%s\n",
2802                    bssid, roamed ? " roamed" : "");
2803
2804         /* Internal bss list in device should contain at least the currently
2805          * connected bss and we can get it to cfg80211 with
2806          * rndis_check_bssid_list().
2807          *
2808          * NDIS spec says: "If the device is associated, but the associated
2809          *  BSSID is not in its BSSID scan list, then the driver must add an
2810          *  entry for the BSSID at the end of the data that it returns in
2811          *  response to query of RNDIS_OID_802_11_BSSID_LIST."
2812          *
2813          * NOTE: Seems to be true for BCM4320b variant, but not BCM4320a.
2814          */
2815         match_bss = false;
2816         rndis_check_bssid_list(usbdev, bssid, &match_bss);
2817
2818         if (!is_zero_ether_addr(bssid) && !match_bss) {
2819                 /* Couldn't get bss from device, we need to manually craft bss
2820                  * for cfg80211.
2821                  */
2822                 rndis_wlan_craft_connected_bss(usbdev, bssid, info);
2823         }
2824
2825         if (priv->infra_mode == NDIS_80211_INFRA_INFRA) {
2826                 if (!roamed) {
2827                         cfg80211_connect_result(usbdev->net, bssid, req_ie,
2828                                                 req_ie_len, resp_ie,
2829                                                 resp_ie_len, 0, GFP_KERNEL);
2830                 } else {
2831                         struct cfg80211_roam_info roam_info = {
2832                                 .channel = get_current_channel(usbdev, NULL),
2833                                 .bssid = bssid,
2834                                 .req_ie = req_ie,
2835                                 .req_ie_len = req_ie_len,
2836                                 .resp_ie = resp_ie,
2837                                 .resp_ie_len = resp_ie_len,
2838                         };
2839
2840                         cfg80211_roamed(usbdev->net, &roam_info, GFP_KERNEL);
2841                 }
2842         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
2843                 cfg80211_ibss_joined(usbdev->net, bssid,
2844                                      get_current_channel(usbdev, NULL),
2845                                      GFP_KERNEL);
2846
2847         kfree(info);
2848
2849         priv->connected = true;
2850         memcpy(priv->bssid, bssid, ETH_ALEN);
2851
2852         usbnet_resume_rx(usbdev);
2853         netif_carrier_on(usbdev->net);
2854 }
2855
2856 static void rndis_wlan_do_link_down_work(struct usbnet *usbdev)
2857 {
2858         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
2859
2860         if (priv->connected) {
2861                 priv->connected = false;
2862                 eth_zero_addr(priv->bssid);
2863
2864                 deauthenticate(usbdev);
2865
2866                 cfg80211_disconnected(usbdev->net, 0, NULL, 0, true, GFP_KERNEL);
2867         }
2868
2869         netif_carrier_off(usbdev->net);
2870 }
2871
2872 static void rndis_wlan_worker(struct work_struct *work)
2873 {
2874         struct rndis_wlan_private *priv =
2875                 container_of(work, struct rndis_wlan_private, work);
2876         struct usbnet *usbdev = priv->usbdev;
2877
2878         if (test_and_clear_bit(WORK_LINK_UP, &priv->work_pending))
2879                 rndis_wlan_do_link_up_work(usbdev);
2880
2881         if (test_and_clear_bit(WORK_LINK_DOWN, &priv->work_pending))
2882                 rndis_wlan_do_link_down_work(usbdev);
2883
2884         if (test_and_clear_bit(WORK_SET_MULTICAST_LIST, &priv->work_pending))
2885                 set_multicast_list(usbdev);
2886 }
2887
2888 static void rndis_wlan_set_multicast_list(struct net_device *dev)
2889 {
2890         struct usbnet *usbdev = netdev_priv(dev);
2891         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
2892
2893         if (test_bit(WORK_SET_MULTICAST_LIST, &priv->work_pending))
2894                 return;
2895
2896         set_bit(WORK_SET_MULTICAST_LIST, &priv->work_pending);
2897         queue_work(priv->workqueue, &priv->work);
2898 }
2899
2900 static void rndis_wlan_auth_indication(struct usbnet *usbdev,
2901                                 struct ndis_80211_status_indication *indication,
2902                                 int len)
2903 {
2904         u8 *buf;
2905         const char *type;
2906         int flags, buflen, key_id;
2907         bool pairwise_error, group_error;
2908         struct ndis_80211_auth_request *auth_req;
2909         enum nl80211_key_type key_type;
2910
2911         /* must have at least one array entry */
2912         if (len < offsetof(struct ndis_80211_status_indication, u) +
2913                                 sizeof(struct ndis_80211_auth_request)) {
2914                 netdev_info(usbdev->net, "authentication indication: too short message (%i)\n",
2915                             len);
2916                 return;
2917         }
2918
2919         buf = (void *)&indication->u.auth_request[0];
2920         buflen = len - offsetof(struct ndis_80211_status_indication, u);
2921
2922         while (buflen >= sizeof(*auth_req)) {
2923                 auth_req = (void *)buf;
2924                 if (buflen < le32_to_cpu(auth_req->length))
2925                         return;
2926                 type = "unknown";
2927                 flags = le32_to_cpu(auth_req->flags);
2928                 pairwise_error = false;
2929                 group_error = false;
2930
2931                 if (flags & 0x1)
2932                         type = "reauth request";
2933                 if (flags & 0x2)
2934                         type = "key update request";
2935                 if (flags & 0x6) {
2936                         pairwise_error = true;
2937                         type = "pairwise_error";
2938                 }
2939                 if (flags & 0xe) {
2940                         group_error = true;
2941                         type = "group_error";
2942                 }
2943
2944                 netdev_info(usbdev->net, "authentication indication: %s (0x%08x)\n",
2945                             type, le32_to_cpu(auth_req->flags));
2946
2947                 if (pairwise_error) {
2948                         key_type = NL80211_KEYTYPE_PAIRWISE;
2949                         key_id = -1;
2950
2951                         cfg80211_michael_mic_failure(usbdev->net,
2952                                                         auth_req->bssid,
2953                                                         key_type, key_id, NULL,
2954                                                         GFP_KERNEL);
2955                 }
2956
2957                 if (group_error) {
2958                         key_type = NL80211_KEYTYPE_GROUP;
2959                         key_id = -1;
2960
2961                         cfg80211_michael_mic_failure(usbdev->net,
2962                                                         auth_req->bssid,
2963                                                         key_type, key_id, NULL,
2964                                                         GFP_KERNEL);
2965                 }
2966
2967                 buflen -= le32_to_cpu(auth_req->length);
2968                 buf += le32_to_cpu(auth_req->length);
2969         }
2970 }
2971
2972 static void rndis_wlan_pmkid_cand_list_indication(struct usbnet *usbdev,
2973                                 struct ndis_80211_status_indication *indication,
2974                                 int len)
2975 {
2976         struct ndis_80211_pmkid_cand_list *cand_list;
2977         int list_len, expected_len, i;
2978
2979         if (len < offsetof(struct ndis_80211_status_indication, u) +
2980                                 sizeof(struct ndis_80211_pmkid_cand_list)) {
2981                 netdev_info(usbdev->net, "pmkid candidate list indication: too short message (%i)\n",
2982                             len);
2983                 return;
2984         }
2985
2986         list_len = le32_to_cpu(indication->u.cand_list.num_candidates) *
2987                         sizeof(struct ndis_80211_pmkid_candidate);
2988         expected_len = sizeof(struct ndis_80211_pmkid_cand_list) + list_len +
2989                         offsetof(struct ndis_80211_status_indication, u);
2990
2991         if (len < expected_len) {
2992                 netdev_info(usbdev->net, "pmkid candidate list indication: list larger than buffer (%i < %i)\n",
2993                             len, expected_len);
2994                 return;
2995         }
2996
2997         cand_list = &indication->u.cand_list;
2998
2999         netdev_info(usbdev->net, "pmkid candidate list indication: version %i, candidates %i\n",
3000                     le32_to_cpu(cand_list->version),
3001                     le32_to_cpu(cand_list->num_candidates));
3002
3003         if (le32_to_cpu(cand_list->version) != 1)
3004                 return;
3005
3006         for (i = 0; i < le32_to_cpu(cand_list->num_candidates); i++) {
3007                 struct ndis_80211_pmkid_candidate *cand =
3008                                                 &cand_list->candidate_list[i];
3009                 bool preauth = !!(cand->flags & NDIS_80211_PMKID_CAND_PREAUTH);
3010
3011                 netdev_dbg(usbdev->net, "cand[%i]: flags: 0x%08x, preauth: %d, bssid: %pM\n",
3012                            i, le32_to_cpu(cand->flags), preauth, cand->bssid);
3013
3014                 cfg80211_pmksa_candidate_notify(usbdev->net, i, cand->bssid,
3015                                                 preauth, GFP_ATOMIC);
3016         }
3017 }
3018
3019 static void rndis_wlan_media_specific_indication(struct usbnet *usbdev,
3020                         struct rndis_indicate *msg, int buflen)
3021 {
3022         struct ndis_80211_status_indication *indication;
3023         unsigned int len, offset;
3024
3025         offset = offsetof(struct rndis_indicate, status) +
3026                         le32_to_cpu(msg->offset);
3027         len = le32_to_cpu(msg->length);
3028
3029         if (len < 8) {
3030                 netdev_info(usbdev->net, "media specific indication, ignore too short message (%i < 8)\n",
3031                             len);
3032                 return;
3033         }
3034
3035         if (len > buflen || offset > buflen || offset + len > buflen) {
3036                 netdev_info(usbdev->net, "media specific indication, too large to fit to buffer (%i > %i)\n",
3037                             offset + len, buflen);
3038                 return;
3039         }
3040
3041         indication = (void *)((u8 *)msg + offset);
3042
3043         switch (le32_to_cpu(indication->status_type)) {
3044         case NDIS_80211_STATUSTYPE_RADIOSTATE:
3045                 netdev_info(usbdev->net, "radio state indication: %i\n",
3046                             le32_to_cpu(indication->u.radio_status));
3047                 return;
3048
3049         case NDIS_80211_STATUSTYPE_MEDIASTREAMMODE:
3050                 netdev_info(usbdev->net, "media stream mode indication: %i\n",
3051                             le32_to_cpu(indication->u.media_stream_mode));
3052                 return;
3053
3054         case NDIS_80211_STATUSTYPE_AUTHENTICATION:
3055                 rndis_wlan_auth_indication(usbdev, indication, len);
3056                 return;
3057
3058         case NDIS_80211_STATUSTYPE_PMKID_CANDIDATELIST:
3059                 rndis_wlan_pmkid_cand_list_indication(usbdev, indication, len);
3060                 return;
3061
3062         default:
3063                 netdev_info(usbdev->net, "media specific indication: unknown status type 0x%08x\n",
3064                             le32_to_cpu(indication->status_type));
3065         }
3066 }
3067
3068 static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
3069 {
3070         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3071         struct rndis_indicate *msg = ind;
3072
3073         switch (le32_to_cpu(msg->status)) {
3074         case RNDIS_STATUS_MEDIA_CONNECT:
3075                 if (priv->current_command_oid == RNDIS_OID_802_11_ADD_KEY) {
3076                         /* RNDIS_OID_802_11_ADD_KEY causes sometimes extra
3077                          * "media connect" indications which confuses driver
3078                          * and userspace to think that device is
3079                          * roaming/reassociating when it isn't.
3080                          */
3081                         netdev_dbg(usbdev->net, "ignored RNDIS_OID_802_11_ADD_KEY triggered 'media connect'\n");
3082                         return;
3083                 }
3084
3085                 usbnet_pause_rx(usbdev);
3086
3087                 netdev_info(usbdev->net, "media connect\n");
3088
3089                 /* queue work to avoid recursive calls into rndis_command */
3090                 set_bit(WORK_LINK_UP, &priv->work_pending);
3091                 queue_work(priv->workqueue, &priv->work);
3092                 break;
3093
3094         case RNDIS_STATUS_MEDIA_DISCONNECT:
3095                 netdev_info(usbdev->net, "media disconnect\n");
3096
3097                 /* queue work to avoid recursive calls into rndis_command */
3098                 set_bit(WORK_LINK_DOWN, &priv->work_pending);
3099                 queue_work(priv->workqueue, &priv->work);
3100                 break;
3101
3102         case RNDIS_STATUS_MEDIA_SPECIFIC_INDICATION:
3103                 rndis_wlan_media_specific_indication(usbdev, msg, buflen);
3104                 break;
3105
3106         default:
3107                 netdev_info(usbdev->net, "indication: 0x%08x\n",
3108                             le32_to_cpu(msg->status));
3109                 break;
3110         }
3111 }
3112
3113 static int rndis_wlan_get_caps(struct usbnet *usbdev, struct wiphy *wiphy)
3114 {
3115         struct {
3116                 __le32  num_items;
3117                 __le32  items[8];
3118         } networks_supported;
3119         struct ndis_80211_capability *caps;
3120         u8 caps_buf[sizeof(*caps) + sizeof(caps->auth_encr_pair) * 16];
3121         int len, retval, i, n;
3122         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3123
3124         /* determine supported modes */
3125         len = sizeof(networks_supported);
3126         retval = rndis_query_oid(usbdev,
3127                                  RNDIS_OID_802_11_NETWORK_TYPES_SUPPORTED,
3128                                  &networks_supported, &len);
3129         if (retval >= 0) {
3130                 n = le32_to_cpu(networks_supported.num_items);
3131                 if (n > 8)
3132                         n = 8;
3133                 for (i = 0; i < n; i++) {
3134                         switch (le32_to_cpu(networks_supported.items[i])) {
3135                         case NDIS_80211_TYPE_FREQ_HOP:
3136                         case NDIS_80211_TYPE_DIRECT_SEQ:
3137                                 priv->caps |= CAP_MODE_80211B;
3138                                 break;
3139                         case NDIS_80211_TYPE_OFDM_A:
3140                                 priv->caps |= CAP_MODE_80211A;
3141                                 break;
3142                         case NDIS_80211_TYPE_OFDM_G:
3143                                 priv->caps |= CAP_MODE_80211G;
3144                                 break;
3145                         }
3146                 }
3147         }
3148
3149         /* get device 802.11 capabilities, number of PMKIDs */
3150         caps = (struct ndis_80211_capability *)caps_buf;
3151         len = sizeof(caps_buf);
3152         retval = rndis_query_oid(usbdev,
3153                                  RNDIS_OID_802_11_CAPABILITY,
3154                                  caps, &len);
3155         if (retval >= 0) {
3156                 netdev_dbg(usbdev->net, "RNDIS_OID_802_11_CAPABILITY -> len %d, "
3157                                 "ver %d, pmkids %d, auth-encr-pairs %d\n",
3158                                 le32_to_cpu(caps->length),
3159                                 le32_to_cpu(caps->version),
3160                                 le32_to_cpu(caps->num_pmkids),
3161                                 le32_to_cpu(caps->num_auth_encr_pair));
3162                 wiphy->max_num_pmkids = le32_to_cpu(caps->num_pmkids);
3163         } else
3164                 wiphy->max_num_pmkids = 0;
3165
3166         return retval;
3167 }
3168
3169 static void rndis_do_cqm(struct usbnet *usbdev, s32 rssi)
3170 {
3171         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3172         enum nl80211_cqm_rssi_threshold_event event;
3173         int thold, hyst, last_event;
3174
3175         if (priv->cqm_rssi_thold >= 0 || rssi >= 0)
3176                 return;
3177         if (priv->infra_mode != NDIS_80211_INFRA_INFRA)
3178                 return;
3179
3180         last_event = priv->last_cqm_event_rssi;
3181         thold = priv->cqm_rssi_thold;
3182         hyst = priv->cqm_rssi_hyst;
3183
3184         if (rssi < thold && (last_event == 0 || rssi < last_event - hyst))
3185                 event = NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW;
3186         else if (rssi > thold && (last_event == 0 || rssi > last_event + hyst))
3187                 event = NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
3188         else
3189                 return;
3190
3191         priv->last_cqm_event_rssi = rssi;
3192         cfg80211_cqm_rssi_notify(usbdev->net, event, rssi, GFP_KERNEL);
3193 }
3194
3195 #define DEVICE_POLLER_JIFFIES (HZ)
3196 static void rndis_device_poller(struct work_struct *work)
3197 {
3198         struct rndis_wlan_private *priv =
3199                 container_of(work, struct rndis_wlan_private,
3200                                                         dev_poller_work.work);
3201         struct usbnet *usbdev = priv->usbdev;
3202         __le32 rssi, tmp;
3203         int len, ret, j;
3204         int update_jiffies = DEVICE_POLLER_JIFFIES;
3205         void *buf;
3206
3207         /* Only check/do workaround when connected. Calling is_associated()
3208          * also polls device with rndis_command() and catches for media link
3209          * indications.
3210          */
3211         if (!is_associated(usbdev)) {
3212                 /* Workaround bad scanning in BCM4320a devices with active
3213                  * background scanning when not associated.
3214                  */
3215                 if (priv->device_type == RNDIS_BCM4320A && priv->radio_on &&
3216                     !priv->scan_request) {
3217                         /* Get previous scan results */
3218                         rndis_check_bssid_list(usbdev, NULL, NULL);
3219
3220                         /* Initiate new scan */
3221                         rndis_start_bssid_list_scan(usbdev);
3222                 }
3223
3224                 goto end;
3225         }
3226
3227         len = sizeof(rssi);
3228         ret = rndis_query_oid(usbdev, RNDIS_OID_802_11_RSSI,
3229                               &rssi, &len);
3230         if (ret == 0) {
3231                 priv->last_qual = level_to_qual(le32_to_cpu(rssi));
3232                 rndis_do_cqm(usbdev, le32_to_cpu(rssi));
3233         }
3234
3235         netdev_dbg(usbdev->net, "dev-poller: RNDIS_OID_802_11_RSSI -> %d, rssi:%d, qual: %d\n",
3236                    ret, le32_to_cpu(rssi), level_to_qual(le32_to_cpu(rssi)));
3237
3238         /* Workaround transfer stalls on poor quality links.
3239          * TODO: find right way to fix these stalls (as stalls do not happen
3240          * with ndiswrapper/windows driver). */
3241         if (priv->param_workaround_interval > 0 && priv->last_qual <= 25) {
3242                 /* Decrease stats worker interval to catch stalls.
3243                  * faster. Faster than 400-500ms causes packet loss,
3244                  * Slower doesn't catch stalls fast enough.
3245                  */
3246                 j = msecs_to_jiffies(priv->param_workaround_interval);
3247                 if (j > DEVICE_POLLER_JIFFIES)
3248                         j = DEVICE_POLLER_JIFFIES;
3249                 else if (j <= 0)
3250                         j = 1;
3251                 update_jiffies = j;
3252
3253                 /* Send scan OID. Use of both OIDs is required to get device
3254                  * working.
3255                  */
3256                 tmp = cpu_to_le32(1);
3257                 rndis_set_oid(usbdev,
3258                               RNDIS_OID_802_11_BSSID_LIST_SCAN,
3259                               &tmp, sizeof(tmp));
3260
3261                 len = CONTROL_BUFFER_SIZE;
3262                 buf = kmalloc(len, GFP_KERNEL);
3263                 if (!buf)
3264                         goto end;
3265
3266                 rndis_query_oid(usbdev,
3267                                 RNDIS_OID_802_11_BSSID_LIST,
3268                                 buf, &len);
3269                 kfree(buf);
3270         }
3271
3272 end:
3273         if (update_jiffies >= HZ)
3274                 update_jiffies = round_jiffies_relative(update_jiffies);
3275         else {
3276                 j = round_jiffies_relative(update_jiffies);
3277                 if (abs(j - update_jiffies) <= 10)
3278                         update_jiffies = j;
3279         }
3280
3281         queue_delayed_work(priv->workqueue, &priv->dev_poller_work,
3282                                                                 update_jiffies);
3283 }
3284
3285 /*
3286  * driver/device initialization
3287  */
3288 static void rndis_copy_module_params(struct usbnet *usbdev, int device_type)
3289 {
3290         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3291
3292         priv->device_type = device_type;
3293
3294         priv->param_country[0] = modparam_country[0];
3295         priv->param_country[1] = modparam_country[1];
3296         priv->param_country[2] = 0;
3297         priv->param_frameburst   = modparam_frameburst;
3298         priv->param_afterburner  = modparam_afterburner;
3299         priv->param_power_save   = modparam_power_save;
3300         priv->param_power_output = modparam_power_output;
3301         priv->param_roamtrigger  = modparam_roamtrigger;
3302         priv->param_roamdelta    = modparam_roamdelta;
3303
3304         priv->param_country[0] = toupper(priv->param_country[0]);
3305         priv->param_country[1] = toupper(priv->param_country[1]);
3306         /* doesn't support EU as country code, use FI instead */
3307         if (!strcmp(priv->param_country, "EU"))
3308                 strcpy(priv->param_country, "FI");
3309
3310         if (priv->param_power_save < 0)
3311                 priv->param_power_save = 0;
3312         else if (priv->param_power_save > 2)
3313                 priv->param_power_save = 2;
3314
3315         if (priv->param_power_output < 0)
3316                 priv->param_power_output = 0;
3317         else if (priv->param_power_output > 3)
3318                 priv->param_power_output = 3;
3319
3320         if (priv->param_roamtrigger < -80)
3321                 priv->param_roamtrigger = -80;
3322         else if (priv->param_roamtrigger > -60)
3323                 priv->param_roamtrigger = -60;
3324
3325         if (priv->param_roamdelta < 0)
3326                 priv->param_roamdelta = 0;
3327         else if (priv->param_roamdelta > 2)
3328                 priv->param_roamdelta = 2;
3329
3330         if (modparam_workaround_interval < 0)
3331                 priv->param_workaround_interval = 500;
3332         else
3333                 priv->param_workaround_interval = modparam_workaround_interval;
3334 }
3335
3336 static int unknown_early_init(struct usbnet *usbdev)
3337 {
3338         /* copy module parameters for unknown so that iwconfig reports txpower
3339          * and workaround parameter is copied to private structure correctly.
3340          */
3341         rndis_copy_module_params(usbdev, RNDIS_UNKNOWN);
3342
3343         /* This is unknown device, so do not try set configuration parameters.
3344          */
3345
3346         return 0;
3347 }
3348
3349 static int bcm4320a_early_init(struct usbnet *usbdev)
3350 {
3351         /* copy module parameters for bcm4320a so that iwconfig reports txpower
3352          * and workaround parameter is copied to private structure correctly.
3353          */
3354         rndis_copy_module_params(usbdev, RNDIS_BCM4320A);
3355
3356         /* bcm4320a doesn't handle configuration parameters well. Try
3357          * set any and you get partially zeroed mac and broken device.
3358          */
3359
3360         return 0;
3361 }
3362
3363 static int bcm4320b_early_init(struct usbnet *usbdev)
3364 {
3365         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3366         char buf[8];
3367
3368         rndis_copy_module_params(usbdev, RNDIS_BCM4320B);
3369
3370         /* Early initialization settings, setting these won't have effect
3371          * if called after generic_rndis_bind().
3372          */
3373
3374         rndis_set_config_parameter_str(usbdev, "Country", priv->param_country);
3375         rndis_set_config_parameter_str(usbdev, "FrameBursting",
3376                                         priv->param_frameburst ? "1" : "0");
3377         rndis_set_config_parameter_str(usbdev, "Afterburner",
3378                                         priv->param_afterburner ? "1" : "0");
3379         sprintf(buf, "%d", priv->param_power_save);
3380         rndis_set_config_parameter_str(usbdev, "PowerSaveMode", buf);
3381         sprintf(buf, "%d", priv->param_power_output);
3382         rndis_set_config_parameter_str(usbdev, "PwrOut", buf);
3383         sprintf(buf, "%d", priv->param_roamtrigger);
3384         rndis_set_config_parameter_str(usbdev, "RoamTrigger", buf);
3385         sprintf(buf, "%d", priv->param_roamdelta);
3386         rndis_set_config_parameter_str(usbdev, "RoamDelta", buf);
3387
3388         return 0;
3389 }
3390
3391 /* same as rndis_netdev_ops but with local multicast handler */
3392 static const struct net_device_ops rndis_wlan_netdev_ops = {
3393         .ndo_open               = usbnet_open,
3394         .ndo_stop               = usbnet_stop,
3395         .ndo_start_xmit         = usbnet_start_xmit,
3396         .ndo_tx_timeout         = usbnet_tx_timeout,
3397         .ndo_get_stats64        = usbnet_get_stats64,
3398         .ndo_set_mac_address    = eth_mac_addr,
3399         .ndo_validate_addr      = eth_validate_addr,
3400         .ndo_set_rx_mode        = rndis_wlan_set_multicast_list,
3401 };
3402
3403 static int rndis_wlan_bind(struct usbnet *usbdev, struct usb_interface *intf)
3404 {
3405         struct wiphy *wiphy;
3406         struct rndis_wlan_private *priv;
3407         int retval, len;
3408         __le32 tmp;
3409
3410         /* allocate wiphy and rndis private data
3411          * NOTE: We only support a single virtual interface, so wiphy
3412          * and wireless_dev are somewhat synonymous for this device.
3413          */
3414         wiphy = wiphy_new(&rndis_config_ops, sizeof(struct rndis_wlan_private));
3415         if (!wiphy)
3416                 return -ENOMEM;
3417
3418         priv = wiphy_priv(wiphy);
3419         usbdev->net->ieee80211_ptr = &priv->wdev;
3420         priv->wdev.wiphy = wiphy;
3421         priv->wdev.iftype = NL80211_IFTYPE_STATION;
3422
3423         /* These have to be initialized before calling generic_rndis_bind().
3424          * Otherwise we'll be in big trouble in rndis_wlan_early_init().
3425          */
3426         usbdev->driver_priv = priv;
3427         priv->usbdev = usbdev;
3428
3429         mutex_init(&priv->command_lock);
3430
3431         /* because rndis_command() sleeps we need to use workqueue */
3432         priv->workqueue = create_singlethread_workqueue("rndis_wlan");
3433         if (!priv->workqueue) {
3434                 wiphy_free(wiphy);
3435                 return -ENOMEM;
3436         }
3437         INIT_WORK(&priv->work, rndis_wlan_worker);
3438         INIT_DELAYED_WORK(&priv->dev_poller_work, rndis_device_poller);
3439         INIT_DELAYED_WORK(&priv->scan_work, rndis_get_scan_results);
3440
3441         /* try bind rndis_host */
3442         retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
3443         if (retval < 0)
3444                 goto fail;
3445
3446         /* generic_rndis_bind set packet filter to multicast_all+
3447          * promisc mode which doesn't work well for our devices (device
3448          * picks up rssi to closest station instead of to access point).
3449          *
3450          * rndis_host wants to avoid all OID as much as possible
3451          * so do promisc/multicast handling in rndis_wlan.
3452          */
3453         usbdev->net->netdev_ops = &rndis_wlan_netdev_ops;
3454
3455         tmp = cpu_to_le32(RNDIS_PACKET_TYPE_DIRECTED | RNDIS_PACKET_TYPE_BROADCAST);
3456         retval = rndis_set_oid(usbdev,
3457                                RNDIS_OID_GEN_CURRENT_PACKET_FILTER,
3458                                &tmp, sizeof(tmp));
3459
3460         len = sizeof(tmp);
3461         retval = rndis_query_oid(usbdev,
3462                                  RNDIS_OID_802_3_MAXIMUM_LIST_SIZE,
3463                                  &tmp, &len);
3464         priv->multicast_size = le32_to_cpu(tmp);
3465         if (retval < 0 || priv->multicast_size < 0)
3466                 priv->multicast_size = 0;
3467         if (priv->multicast_size > 0)
3468                 usbdev->net->flags |= IFF_MULTICAST;
3469         else
3470                 usbdev->net->flags &= ~IFF_MULTICAST;
3471
3472         /* fill-out wiphy structure and register w/ cfg80211 */
3473         memcpy(wiphy->perm_addr, usbdev->net->dev_addr, ETH_ALEN);
3474         wiphy->privid = rndis_wiphy_privid;
3475         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION)
3476                                         | BIT(NL80211_IFTYPE_ADHOC);
3477         wiphy->max_scan_ssids = 1;
3478
3479         /* TODO: fill-out band/encr information based on priv->caps */
3480         rndis_wlan_get_caps(usbdev, wiphy);
3481
3482         memcpy(priv->channels, rndis_channels, sizeof(rndis_channels));
3483         memcpy(priv->rates, rndis_rates, sizeof(rndis_rates));
3484         priv->band.channels = priv->channels;
3485         priv->band.n_channels = ARRAY_SIZE(rndis_channels);
3486         priv->band.bitrates = priv->rates;
3487         priv->band.n_bitrates = ARRAY_SIZE(rndis_rates);
3488         wiphy->bands[NL80211_BAND_2GHZ] = &priv->band;
3489         wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
3490
3491         memcpy(priv->cipher_suites, rndis_cipher_suites,
3492                                                 sizeof(rndis_cipher_suites));
3493         wiphy->cipher_suites = priv->cipher_suites;
3494         wiphy->n_cipher_suites = ARRAY_SIZE(rndis_cipher_suites);
3495
3496         set_wiphy_dev(wiphy, &usbdev->udev->dev);
3497
3498         if (wiphy_register(wiphy)) {
3499                 retval = -ENODEV;
3500                 goto fail;
3501         }
3502
3503         set_default_iw_params(usbdev);
3504
3505         priv->power_mode = -1;
3506
3507         /* set default rts/frag */
3508         rndis_set_wiphy_params(wiphy,
3509                         WIPHY_PARAM_FRAG_THRESHOLD | WIPHY_PARAM_RTS_THRESHOLD);
3510
3511         /* turn radio off on init */
3512         priv->radio_on = false;
3513         disassociate(usbdev, false);
3514         netif_carrier_off(usbdev->net);
3515
3516         return 0;
3517
3518 fail:
3519         cancel_delayed_work_sync(&priv->dev_poller_work);
3520         cancel_delayed_work_sync(&priv->scan_work);
3521         cancel_work_sync(&priv->work);
3522         flush_workqueue(priv->workqueue);
3523         destroy_workqueue(priv->workqueue);
3524
3525         wiphy_free(wiphy);
3526         return retval;
3527 }
3528
3529 static void rndis_wlan_unbind(struct usbnet *usbdev, struct usb_interface *intf)
3530 {
3531         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3532
3533         /* turn radio off */
3534         disassociate(usbdev, false);
3535
3536         cancel_delayed_work_sync(&priv->dev_poller_work);
3537         cancel_delayed_work_sync(&priv->scan_work);
3538         cancel_work_sync(&priv->work);
3539         flush_workqueue(priv->workqueue);
3540         destroy_workqueue(priv->workqueue);
3541
3542         rndis_unbind(usbdev, intf);
3543
3544         wiphy_unregister(priv->wdev.wiphy);
3545         wiphy_free(priv->wdev.wiphy);
3546 }
3547
3548 static int rndis_wlan_reset(struct usbnet *usbdev)
3549 {
3550         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3551         int retval;
3552
3553         netdev_dbg(usbdev->net, "%s()\n", __func__);
3554
3555         retval = rndis_reset(usbdev);
3556         if (retval)
3557                 netdev_warn(usbdev->net, "rndis_reset failed: %d\n", retval);
3558
3559         /* rndis_reset cleared multicast list, so restore here.
3560            (set_multicast_list() also turns on current packet filter) */
3561         set_multicast_list(usbdev);
3562
3563         queue_delayed_work(priv->workqueue, &priv->dev_poller_work,
3564                 round_jiffies_relative(DEVICE_POLLER_JIFFIES));
3565
3566         return deauthenticate(usbdev);
3567 }
3568
3569 static int rndis_wlan_stop(struct usbnet *usbdev)
3570 {
3571         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
3572         int retval;
3573         __le32 filter;
3574
3575         netdev_dbg(usbdev->net, "%s()\n", __func__);
3576
3577         retval = disassociate(usbdev, false);
3578
3579         priv->work_pending = 0;
3580         cancel_delayed_work_sync(&priv->dev_poller_work);
3581         cancel_delayed_work_sync(&priv->scan_work);
3582         cancel_work_sync(&priv->work);
3583         flush_workqueue(priv->workqueue);
3584
3585         if (priv->scan_request) {
3586                 struct cfg80211_scan_info info = {
3587                         .aborted = true,
3588                 };
3589
3590                 cfg80211_scan_done(priv->scan_request, &info);
3591                 priv->scan_request = NULL;
3592         }
3593
3594         /* Set current packet filter zero to block receiving data packets from
3595            device. */
3596         filter = 0;
3597         rndis_set_oid(usbdev, RNDIS_OID_GEN_CURRENT_PACKET_FILTER, &filter,
3598                                                                 sizeof(filter));
3599
3600         return retval;
3601 }
3602
3603 static const struct driver_info bcm4320b_info = {
3604         .description =  "Wireless RNDIS device, BCM4320b based",
3605         .flags =        FLAG_WLAN | FLAG_FRAMING_RN | FLAG_NO_SETINT |
3606                                 FLAG_AVOID_UNLINK_URBS,
3607         .bind =         rndis_wlan_bind,
3608         .unbind =       rndis_wlan_unbind,
3609         .status =       rndis_status,
3610         .rx_fixup =     rndis_rx_fixup,
3611         .tx_fixup =     rndis_tx_fixup,
3612         .reset =        rndis_wlan_reset,
3613         .stop =         rndis_wlan_stop,
3614         .early_init =   bcm4320b_early_init,
3615         .indication =   rndis_wlan_indication,
3616 };
3617
3618 static const struct driver_info bcm4320a_info = {
3619         .description =  "Wireless RNDIS device, BCM4320a based",
3620         .flags =        FLAG_WLAN | FLAG_FRAMING_RN | FLAG_NO_SETINT |
3621                                 FLAG_AVOID_UNLINK_URBS,
3622         .bind =         rndis_wlan_bind,
3623         .unbind =       rndis_wlan_unbind,
3624         .status =       rndis_status,
3625         .rx_fixup =     rndis_rx_fixup,
3626         .tx_fixup =     rndis_tx_fixup,
3627         .reset =        rndis_wlan_reset,
3628         .stop =         rndis_wlan_stop,
3629         .early_init =   bcm4320a_early_init,
3630         .indication =   rndis_wlan_indication,
3631 };
3632
3633 static const struct driver_info rndis_wlan_info = {
3634         .description =  "Wireless RNDIS device",
3635         .flags =        FLAG_WLAN | FLAG_FRAMING_RN | FLAG_NO_SETINT |
3636                                 FLAG_AVOID_UNLINK_URBS,
3637         .bind =         rndis_wlan_bind,
3638         .unbind =       rndis_wlan_unbind,
3639         .status =       rndis_status,
3640         .rx_fixup =     rndis_rx_fixup,
3641         .tx_fixup =     rndis_tx_fixup,
3642         .reset =        rndis_wlan_reset,
3643         .stop =         rndis_wlan_stop,
3644         .early_init =   unknown_early_init,
3645         .indication =   rndis_wlan_indication,
3646 };
3647
3648 /*-------------------------------------------------------------------------*/
3649
3650 static const struct usb_device_id products [] = {
3651 #define RNDIS_MASTER_INTERFACE \
3652         .bInterfaceClass        = USB_CLASS_COMM, \
3653         .bInterfaceSubClass     = 2 /* ACM */, \
3654         .bInterfaceProtocol     = 0x0ff
3655
3656 /* INF driver for these devices have DriverVer >= 4.xx.xx.xx and many custom
3657  * parameters available. Chipset marked as 'BCM4320SKFBG' in NDISwrapper-wiki.
3658  */
3659 {
3660         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3661                           | USB_DEVICE_ID_MATCH_DEVICE,
3662         .idVendor               = 0x0411,
3663         .idProduct              = 0x00bc,       /* Buffalo WLI-U2-KG125S */
3664         RNDIS_MASTER_INTERFACE,
3665         .driver_info            = (unsigned long) &bcm4320b_info,
3666 }, {
3667         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3668                           | USB_DEVICE_ID_MATCH_DEVICE,
3669         .idVendor               = 0x0baf,
3670         .idProduct              = 0x011b,       /* U.S. Robotics USR5421 */
3671         RNDIS_MASTER_INTERFACE,
3672         .driver_info            = (unsigned long) &bcm4320b_info,
3673 }, {
3674         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3675                           | USB_DEVICE_ID_MATCH_DEVICE,
3676         .idVendor               = 0x050d,
3677         .idProduct              = 0x011b,       /* Belkin F5D7051 */
3678         RNDIS_MASTER_INTERFACE,
3679         .driver_info            = (unsigned long) &bcm4320b_info,
3680 }, {
3681         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3682                           | USB_DEVICE_ID_MATCH_DEVICE,
3683         .idVendor               = 0x1799,       /* Belkin has two vendor ids */
3684         .idProduct              = 0x011b,       /* Belkin F5D7051 */
3685         RNDIS_MASTER_INTERFACE,
3686         .driver_info            = (unsigned long) &bcm4320b_info,
3687 }, {
3688         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3689                           | USB_DEVICE_ID_MATCH_DEVICE,
3690         .idVendor               = 0x13b1,
3691         .idProduct              = 0x0014,       /* Linksys WUSB54GSv2 */
3692         RNDIS_MASTER_INTERFACE,
3693         .driver_info            = (unsigned long) &bcm4320b_info,
3694 }, {
3695         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3696                           | USB_DEVICE_ID_MATCH_DEVICE,
3697         .idVendor               = 0x13b1,
3698         .idProduct              = 0x0026,       /* Linksys WUSB54GSC */
3699         RNDIS_MASTER_INTERFACE,
3700         .driver_info            = (unsigned long) &bcm4320b_info,
3701 }, {
3702         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3703                           | USB_DEVICE_ID_MATCH_DEVICE,
3704         .idVendor               = 0x0b05,
3705         .idProduct              = 0x1717,       /* Asus WL169gE */
3706         RNDIS_MASTER_INTERFACE,
3707         .driver_info            = (unsigned long) &bcm4320b_info,
3708 }, {
3709         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3710                           | USB_DEVICE_ID_MATCH_DEVICE,
3711         .idVendor               = 0x0a5c,
3712         .idProduct              = 0xd11b,       /* Eminent EM4045 */
3713         RNDIS_MASTER_INTERFACE,
3714         .driver_info            = (unsigned long) &bcm4320b_info,
3715 }, {
3716         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3717                           | USB_DEVICE_ID_MATCH_DEVICE,
3718         .idVendor               = 0x1690,
3719         .idProduct              = 0x0715,       /* BT Voyager 1055 */
3720         RNDIS_MASTER_INTERFACE,
3721         .driver_info            = (unsigned long) &bcm4320b_info,
3722 },
3723 /* These devices have DriverVer < 4.xx.xx.xx and do not have any custom
3724  * parameters available, hardware probably contain older firmware version with
3725  * no way of updating. Chipset marked as 'BCM4320????' in NDISwrapper-wiki.
3726  */
3727 {
3728         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3729                           | USB_DEVICE_ID_MATCH_DEVICE,
3730         .idVendor               = 0x13b1,
3731         .idProduct              = 0x000e,       /* Linksys WUSB54GSv1 */
3732         RNDIS_MASTER_INTERFACE,
3733         .driver_info            = (unsigned long) &bcm4320a_info,
3734 }, {
3735         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3736                           | USB_DEVICE_ID_MATCH_DEVICE,
3737         .idVendor               = 0x0baf,
3738         .idProduct              = 0x0111,       /* U.S. Robotics USR5420 */
3739         RNDIS_MASTER_INTERFACE,
3740         .driver_info            = (unsigned long) &bcm4320a_info,
3741 }, {
3742         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
3743                           | USB_DEVICE_ID_MATCH_DEVICE,
3744         .idVendor               = 0x0411,
3745         .idProduct              = 0x004b,       /* BUFFALO WLI-USB-G54 */
3746         RNDIS_MASTER_INTERFACE,
3747         .driver_info            = (unsigned long) &bcm4320a_info,
3748 },
3749 /* Generic Wireless RNDIS devices that we don't have exact
3750  * idVendor/idProduct/chip yet.
3751  */
3752 {
3753         /* RNDIS is MSFT's un-official variant of CDC ACM */
3754         USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
3755         .driver_info = (unsigned long) &rndis_wlan_info,
3756 }, {
3757         /* "ActiveSync" is an undocumented variant of RNDIS, used in WM5 */
3758         USB_INTERFACE_INFO(USB_CLASS_MISC, 1, 1),
3759         .driver_info = (unsigned long) &rndis_wlan_info,
3760 },
3761         { },            // END
3762 };
3763 MODULE_DEVICE_TABLE(usb, products);
3764
3765 static struct usb_driver rndis_wlan_driver = {
3766         .name =         "rndis_wlan",
3767         .id_table =     products,
3768         .probe =        usbnet_probe,
3769         .disconnect =   usbnet_disconnect,
3770         .suspend =      usbnet_suspend,
3771         .resume =       usbnet_resume,
3772         .disable_hub_initiated_lpm = 1,
3773 };
3774
3775 module_usb_driver(rndis_wlan_driver);
3776
3777 MODULE_AUTHOR("Bjorge Dijkstra");
3778 MODULE_AUTHOR("Jussi Kivilinna");
3779 MODULE_DESCRIPTION("Driver for RNDIS based USB Wireless adapters");
3780 MODULE_LICENSE("GPL");
3781