drivers/wlan/third_party/broadcom/brcmfmac/vendor.c

/*
 * Copyright (c) 2014 Broadcom Corporation
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include "vendor.h"

#include <limits.h>

#include "brcmu_wifi.h"
#include "cfg80211.h"
#include "core.h"
#include "debug.h"
#include "fwil.h"
#include "fwil_types.h"
#include "linuxisms.h"
#include "netbuf.h"
#include "p2p.h"

static zx_status_t brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy* wiphy,
                                                         struct wireless_dev* wdev,
                                                         const void* data, int len) {
    struct brcmf_cfg80211_vif* vif;
    struct brcmf_if* ifp;
    const struct brcmf_vndr_dcmd_hdr* cmdhdr = data;
    struct brcmf_netbuf* reply;
    zx_status_t ret;
    int payload, ret_len;
    void* dcmd_buf = NULL;
    void* wr_pointer;
    uint16_t msglen;
    uint16_t maxmsglen = PAGE_SIZE - 0x100;

    if (len < (int)sizeof(*cmdhdr)) {
        brcmf_err("vendor command too short: %d\n", len);
        return ZX_ERR_INVALID_ARGS;
    }

    vif = containerof(wdev, struct brcmf_cfg80211_vif, wdev);
    ifp = vif->ifp;

    brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);

    if ((int)cmdhdr->offset > len) {
        brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
        return ZX_ERR_INVALID_ARGS;
    }

    len -= cmdhdr->offset;
    ret_len = cmdhdr->len;
    if (ret_len > 0 || len > 0) {
        if (len > BRCMF_DCMD_MAXLEN) {
            brcmf_err("oversize input buffer %d\n", len);
            len = BRCMF_DCMD_MAXLEN;
        }
        if (ret_len > BRCMF_DCMD_MAXLEN) {
            brcmf_err("oversize return buffer %d\n", ret_len);
            ret_len = BRCMF_DCMD_MAXLEN;
        }
        payload = max(ret_len, len) + 1;
        dcmd_buf = calloc(1, payload);
        if (NULL == dcmd_buf) {
            return ZX_ERR_NO_MEMORY;
        }

        memcpy(dcmd_buf, (void*)cmdhdr + cmdhdr->offset, len);
        *(char*)(dcmd_buf + len) = '\0';
    }

    if (cmdhdr->set) {
        ret = brcmf_fil_cmd_data_set(ifp, cmdhdr->cmd, dcmd_buf, ret_len);
    } else {
        ret = brcmf_fil_cmd_data_get(ifp, cmdhdr->cmd, dcmd_buf, ret_len);
    }
    if (ret != ZX_OK) {
        goto exit;
    }

    wr_pointer = dcmd_buf;
    while (ret_len > 0) {
        msglen = ret_len > maxmsglen ? maxmsglen : ret_len;
        ret_len -= msglen;
        payload = msglen + sizeof(msglen);
        reply = cfg80211_vendor_cmd_alloc_reply_netbuf(wiphy, payload);
        if (NULL == reply) {
            ret = ZX_ERR_NO_MEMORY;
            break;
        }

        if (nla_put(reply, BRCMF_NLATTR_DATA, msglen, wr_pointer) ||
                nla_put_u16(reply, BRCMF_NLATTR_LEN, msglen)) {
            brcmf_netbuf_free(reply);
            ret = ZX_ERR_NO_RESOURCES;
            break;
        }

        ret = cfg80211_vendor_cmd_reply(reply);
        if (ret != ZX_OK) {
            break;
        }

        wr_pointer += msglen;
    }

exit:
    free(dcmd_buf);

    return ret;
}

const struct wiphy_vendor_command brcmf_vendor_cmds[] = {
    {   {.vendor_id = BROADCOM_OUI, .subcmd = BRCMF_VNDR_CMDS_DCMD},
        .flags = WIPHY_VENDOR_CMD_NEED_WDEV | WIPHY_VENDOR_CMD_NEED_NETDEV,
        .doit = brcmf_cfg80211_vndr_cmds_dcmd_handler
    },
};