kernel/drivers/net/wireless/brcm80211/brcmfmac/vendor.c

   1 /*
   2  * Copyright (c) 2014 Broadcom Corporation
   3  *
   4  * Permission to use, copy, modify, and/or distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  11  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  13  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  14  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <linux/vmalloc.h>
  18 #include <net/cfg80211.h>
  19 #include <net/netlink.h>
  20
  21 #include <brcmu_wifi.h>
  22 #include "fwil_types.h"
  23 #include "core.h"
  24 #include "p2p.h"
  25 #include "debug.h"
  26 #include "cfg80211.h"
  27 #include "vendor.h"
  28 #include "fwil.h"
  29
  30 static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
  31                                                  struct wireless_dev *wdev,
  32                                                  const void *data, int len)
  33 {
  34         struct brcmf_cfg80211_vif *vif;
  35         struct brcmf_if *ifp;
  36         const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
  37         struct sk_buff *reply;
  38         int ret, payload, ret_len;
  39         void *dcmd_buf = NULL, *wr_pointer;
  40         u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
  41
  42         if (len < sizeof(*cmdhdr)) {
  43                 brcmf_err("vendor command too short: %d\n", len);
  44                 return -EINVAL;
  45         }
  46
  47         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
  48         ifp = vif->ifp;
  49
  50         brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
  51
  52         if (cmdhdr->offset > len) {
  53                 brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
  54                 return -EINVAL;
  55         }
  56
  57         len -= cmdhdr->offset;
  58         ret_len = cmdhdr->len;
  59         if (ret_len > 0 || len > 0) {
  60                 if (len > BRCMF_DCMD_MAXLEN) {
  61                         brcmf_err("oversize input buffer %d\n", len);
  62                         len = BRCMF_DCMD_MAXLEN;
  63                 }
  64                 if (ret_len > BRCMF_DCMD_MAXLEN) {
  65                         brcmf_err("oversize return buffer %d\n", ret_len);
  66                         ret_len = BRCMF_DCMD_MAXLEN;
  67                 }
  68                 payload = max(ret_len, len) + 1;
  69                 dcmd_buf = vzalloc(payload);
  70                 if (NULL == dcmd_buf)
  71                         return -ENOMEM;
  72
  73                 memcpy(dcmd_buf, (void *)cmdhdr + cmdhdr->offset, len);
  74                 *(char *)(dcmd_buf + len)  = '\0';
  75         }
  76
  77         if (cmdhdr->set)
  78                 ret = brcmf_fil_cmd_data_set(ifp, cmdhdr->cmd, dcmd_buf,
  79                                              ret_len);
  80         else
  81                 ret = brcmf_fil_cmd_data_get(ifp, cmdhdr->cmd, dcmd_buf,
  82                                              ret_len);
  83         if (ret != 0)
  84                 goto exit;
  85
  86         wr_pointer = dcmd_buf;
  87         while (ret_len > 0) {
  88                 msglen = ret_len > maxmsglen ? maxmsglen : ret_len;
  89                 ret_len -= msglen;
  90                 payload = msglen + sizeof(msglen);
  91                 reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
  92                 if (NULL == reply) {
  93                         ret = -ENOMEM;
  94                         break;
  95                 }
  96
  97                 if (nla_put(reply, BRCMF_NLATTR_DATA, msglen, wr_pointer) ||
  98                     nla_put_u16(reply, BRCMF_NLATTR_LEN, msglen)) {
  99                         kfree_skb(reply);
 100                         ret = -ENOBUFS;
 101                         break;
 102                 }
 103
 104                 ret = cfg80211_vendor_cmd_reply(reply);
 105                 if (ret)
 106                         break;
 107
 108                 wr_pointer += msglen;
 109         }
 110
 111 exit:
 112         vfree(dcmd_buf);
 113
 114         return ret;
 115 }
 116
 117 const struct wiphy_vendor_command brcmf_vendor_cmds[] = {
 118         {
 119                 {
 120                         .vendor_id = BROADCOM_OUI,
 121                         .subcmd = BRCMF_VNDR_CMDS_DCMD
 122                 },
 123                 .flags = WIPHY_VENDOR_CMD_NEED_WDEV |
 124                          WIPHY_VENDOR_CMD_NEED_NETDEV,
 125                 .doit = brcmf_cfg80211_vndr_cmds_dcmd_handler
 126         },
 127 };