1 // SPDX-License-Identifier: ISC
2 /*
3  * Copyright (c) 2014 Broadcom Corporation
4  */
5 
6 #include <linux/vmalloc.h>
7 #include <net/cfg80211.h>
8 #include <net/netlink.h>
9 
10 #include <brcmu_wifi.h>
11 #include "fwil_types.h"
12 #include "core.h"
13 #include "p2p.h"
14 #include "debug.h"
15 #include "cfg80211.h"
16 #include "vendor.h"
17 #include "fwil.h"
18 
19 static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
20 						 struct wireless_dev *wdev,
21 						 const void *data, int len)
22 {
23 	struct brcmf_cfg80211_vif *vif;
24 	struct brcmf_if *ifp;
25 	const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
26 	struct sk_buff *reply;
27 	unsigned int payload, ret_len;
28 	void *dcmd_buf = NULL, *wr_pointer;
29 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
30 	int ret;
31 
32 	if (len < sizeof(*cmdhdr)) {
33 		brcmf_err("vendor command too short: %d\n", len);
34 		return -EINVAL;
35 	}
36 
37 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
38 	ifp = vif->ifp;
39 
40 	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
41 
42 	if (cmdhdr->offset > len) {
43 		brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
44 		return -EINVAL;
45 	}
46 
47 	len -= cmdhdr->offset;
48 	ret_len = cmdhdr->len;
49 	if (ret_len > 0 || len > 0) {
50 		if (len > BRCMF_DCMD_MAXLEN) {
51 			brcmf_err("oversize input buffer %d\n", len);
52 			len = BRCMF_DCMD_MAXLEN;
53 		}
54 		if (ret_len > BRCMF_DCMD_MAXLEN) {
55 			brcmf_err("oversize return buffer %d\n", ret_len);
56 			ret_len = BRCMF_DCMD_MAXLEN;
57 		}
58 		payload = max_t(unsigned int, ret_len, len) + 1;
59 		dcmd_buf = vzalloc(payload);
60 		if (NULL == dcmd_buf)
61 			return -ENOMEM;
62 
63 		memcpy(dcmd_buf, (void *)cmdhdr + cmdhdr->offset, len);
64 		*(char *)(dcmd_buf + len)  = '\0';
65 	}
66 
67 	if (cmdhdr->set)
68 		ret = brcmf_fil_cmd_data_set(ifp, cmdhdr->cmd, dcmd_buf,
69 					     ret_len);
70 	else
71 		ret = brcmf_fil_cmd_data_get(ifp, cmdhdr->cmd, dcmd_buf,
72 					     ret_len);
73 	if (ret != 0)
74 		goto exit;
75 
76 	wr_pointer = dcmd_buf;
77 	while (ret_len > 0) {
78 		msglen = ret_len > maxmsglen ? maxmsglen : ret_len;
79 		ret_len -= msglen;
80 		payload = msglen + sizeof(msglen);
81 		reply = cfg80211_vendor_cmd_alloc_reply_skb(wiphy, payload);
82 		if (NULL == reply) {
83 			ret = -ENOMEM;
84 			break;
85 		}
86 
87 		if (nla_put(reply, BRCMF_NLATTR_DATA, msglen, wr_pointer) ||
88 		    nla_put_u16(reply, BRCMF_NLATTR_LEN, msglen)) {
89 			kfree_skb(reply);
90 			ret = -ENOBUFS;
91 			break;
92 		}
93 
94 		ret = cfg80211_vendor_cmd_reply(reply);
95 		if (ret)
96 			break;
97 
98 		wr_pointer += msglen;
99 	}
100 
101 exit:
102 	vfree(dcmd_buf);
103 
104 	return ret;
105 }
106 
107 const struct wiphy_vendor_command brcmf_vendor_cmds[] = {
108 	{
109 		{
110 			.vendor_id = BROADCOM_OUI,
111 			.subcmd = BRCMF_VNDR_CMDS_DCMD
112 		},
113 		.flags = WIPHY_VENDOR_CMD_NEED_WDEV |
114 			 WIPHY_VENDOR_CMD_NEED_NETDEV,
115 		.policy = VENDOR_CMD_RAW_DATA,
116 		.doit = brcmf_cfg80211_vndr_cmds_dcmd_handler
117 	},
118 };
119