[PATCH] drivers/net/wireless/libertas/fw.c: fix use-before-check
[linux-2.6/libata-dev.git] / drivers / net / wireless / libertas / fw.c
blob5c63c9b1659c1e45e1054bb01fd0969a82dfa563
1 /**
2 * This file contains the initialization for FW and HW
3 */
4 #include <linux/module.h>
5 #include <linux/moduleparam.h>
7 #include <linux/vmalloc.h>
8 #include <linux/firmware.h>
9 #include <linux/version.h>
11 #include "host.h"
12 #include "sbi.h"
13 #include "defs.h"
14 #include "decl.h"
15 #include "dev.h"
16 #include "fw.h"
17 #include "wext.h"
18 #include "if_usb.h"
20 char *libertas_fw_name = NULL;
21 module_param_named(fw_name, libertas_fw_name, charp, 0644);
23 unsigned int libertas_debug = 0;
24 module_param(libertas_debug, int, 0);
26 /**
27 * @brief This function checks the validity of Boot2/FW image.
29 * @param data pointer to image
30 * len image length
31 * @return 0 or -1
33 static int check_fwfile_format(u8 *data, u32 totlen)
35 u8 bincmd, exit;
36 u32 blksize, offset, len;
37 int ret;
39 ret = 1;
40 exit = len = 0;
42 do {
43 bincmd = *data;
44 blksize = *(u32*)(data + offsetof(struct fwheader, datalength));
45 switch (bincmd) {
46 case FW_HAS_DATA_TO_RECV:
47 offset = sizeof(struct fwheader) + blksize;
48 data += offset;
49 len += offset;
50 if (len >= totlen)
51 exit = 1;
52 break;
53 case FW_HAS_LAST_BLOCK:
54 exit = 1;
55 ret = 0;
56 break;
57 default:
58 exit = 1;
59 break;
61 } while (!exit);
63 if (ret)
64 lbs_pr_err("bin file format check FAIL...\n");
65 else
66 lbs_pr_debug(1, "bin file format check PASS...\n");
68 return ret;
71 /**
72 * @brief This function downloads firmware image, gets
73 * HW spec from firmware and set basic parameters to
74 * firmware.
76 * @param priv A pointer to wlan_private structure
77 * @return 0 or -1
79 static int wlan_setup_station_hw(wlan_private * priv)
81 int ret = -1;
82 wlan_adapter *adapter = priv->adapter;
84 ENTER();
86 if ((ret = request_firmware(&priv->firmware, libertas_fw_name,
87 priv->hotplug_device)) < 0) {
88 lbs_pr_err("request_firmware() failed, error code = %#x\n",
89 ret);
90 lbs_pr_err("%s not found in /lib/firmware\n", libertas_fw_name);
91 goto done;
94 if(check_fwfile_format(priv->firmware->data, priv->firmware->size)) {
95 release_firmware(priv->firmware);
96 goto done;
99 ret = libertas_sbi_prog_firmware(priv);
101 release_firmware(priv->firmware);
103 if (ret) {
104 lbs_pr_debug(1, "Bootloader in invalid state!\n");
105 ret = -1;
106 goto done;
110 * Read MAC address from HW
112 memset(adapter->current_addr, 0xff, ETH_ALEN);
114 ret = libertas_prepare_and_send_command(priv, cmd_get_hw_spec,
115 0, cmd_option_waitforrsp, 0, NULL);
117 if (ret) {
118 ret = -1;
119 goto done;
122 libertas_set_mac_packet_filter(priv);
124 /* Get the supported Data rates */
125 ret = libertas_prepare_and_send_command(priv, cmd_802_11_data_rate,
126 cmd_act_get_tx_rate,
127 cmd_option_waitforrsp, 0, NULL);
129 if (ret) {
130 ret = -1;
131 goto done;
134 ret = 0;
135 done:
136 LEAVE();
138 return (ret);
141 static int wlan_allocate_adapter(wlan_private * priv)
143 u32 ulbufsize;
144 wlan_adapter *adapter = priv->adapter;
146 struct bss_descriptor *ptempscantable;
148 /* Allocate buffer to store the BSSID list */
149 ulbufsize = sizeof(struct bss_descriptor) * MRVDRV_MAX_BSSID_LIST;
150 if (!(ptempscantable = kmalloc(ulbufsize, GFP_KERNEL))) {
151 libertas_free_adapter(priv);
152 return -1;
155 adapter->scantable = ptempscantable;
156 memset(adapter->scantable, 0, ulbufsize);
158 /* Allocate the command buffers */
159 libertas_allocate_cmd_buffer(priv);
161 memset(&adapter->libertas_ps_confirm_sleep, 0, sizeof(struct PS_CMD_ConfirmSleep));
162 adapter->libertas_ps_confirm_sleep.seqnum = cpu_to_le16(++adapter->seqnum);
163 adapter->libertas_ps_confirm_sleep.command =
164 cpu_to_le16(cmd_802_11_ps_mode);
165 adapter->libertas_ps_confirm_sleep.size =
166 cpu_to_le16(sizeof(struct PS_CMD_ConfirmSleep));
167 adapter->libertas_ps_confirm_sleep.result = 0;
168 adapter->libertas_ps_confirm_sleep.action =
169 cpu_to_le16(cmd_subcmd_sleep_confirmed);
171 return 0;
174 static void wlan_init_adapter(wlan_private * priv)
176 wlan_adapter *adapter = priv->adapter;
177 int i;
179 adapter->scanprobes = 0;
181 adapter->bcn_avg_factor = DEFAULT_BCN_AVG_FACTOR;
182 adapter->data_avg_factor = DEFAULT_DATA_AVG_FACTOR;
184 /* ATIM params */
185 adapter->atimwindow = 0;
187 adapter->connect_status = libertas_disconnected;
188 memset(adapter->current_addr, 0xff, ETH_ALEN);
190 /* scan type */
191 adapter->scantype = cmd_scan_type_active;
193 /* scan mode */
194 adapter->scanmode = cmd_bss_type_any;
196 /* 802.11 specific */
197 adapter->secinfo.wep_enabled = 0;
198 for (i = 0; i < sizeof(adapter->wep_keys) / sizeof(adapter->wep_keys[0]);
199 i++)
200 memset(&adapter->wep_keys[i], 0, sizeof(struct WLAN_802_11_KEY));
201 adapter->wep_tx_keyidx = 0;
202 adapter->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
203 adapter->mode = IW_MODE_INFRA;
205 adapter->assoc_req = NULL;
207 adapter->numinscantable = 0;
208 adapter->pattemptedbssdesc = NULL;
209 mutex_init(&adapter->lock);
211 adapter->prescan = 1;
213 memset(&adapter->curbssparams, 0, sizeof(adapter->curbssparams));
215 /* PnP and power profile */
216 adapter->surpriseremoved = 0;
218 adapter->currentpacketfilter =
219 cmd_act_mac_rx_on | cmd_act_mac_tx_on;
221 adapter->radioon = RADIO_ON;
222 adapter->txantenna = RF_ANTENNA_2;
223 adapter->rxantenna = RF_ANTENNA_AUTO;
225 adapter->is_datarate_auto = 1;
226 adapter->beaconperiod = MRVDRV_BEACON_INTERVAL;
228 // set default value of capinfo.
229 #define SHORT_PREAMBLE_ALLOWED 1
230 memset(&adapter->capinfo, 0, sizeof(adapter->capinfo));
231 adapter->capinfo.shortpreamble = SHORT_PREAMBLE_ALLOWED;
233 adapter->adhocchannel = DEFAULT_AD_HOC_CHANNEL;
235 adapter->psmode = wlan802_11powermodecam;
236 adapter->multipledtim = MRVDRV_DEFAULT_MULTIPLE_DTIM;
238 adapter->listeninterval = MRVDRV_DEFAULT_LISTEN_INTERVAL;
240 adapter->psstate = PS_STATE_FULL_POWER;
241 adapter->needtowakeup = 0;
242 adapter->locallisteninterval = 0; /* default value in firmware will be used */
244 adapter->datarate = 0; // Initially indicate the rate as auto
246 adapter->adhoc_grate_enabled = 0;
248 adapter->intcounter = 0;
250 adapter->currenttxskb = NULL;
251 adapter->pkttxctrl = 0;
253 memset(&adapter->tx_queue_ps, 0, NR_TX_QUEUE*sizeof(struct sk_buff*));
254 adapter->tx_queue_idx = 0;
255 spin_lock_init(&adapter->txqueue_lock);
257 return;
260 static void command_timer_fn(unsigned long data);
262 int libertas_init_fw(wlan_private * priv)
264 int ret = -1;
265 wlan_adapter *adapter = priv->adapter;
267 ENTER();
269 /* Allocate adapter structure */
270 if ((ret = wlan_allocate_adapter(priv)) != 0)
271 goto done;
273 /* init adapter structure */
274 wlan_init_adapter(priv);
276 /* init timer etc. */
277 setup_timer(&adapter->command_timer, command_timer_fn,
278 (unsigned long)priv);
280 /* download fimrware etc. */
281 if ((ret = wlan_setup_station_hw(priv)) != 0) {
282 del_timer_sync(&adapter->command_timer);
283 goto done;
286 /* init 802.11d */
287 libertas_init_11d(priv);
289 ret = 0;
290 done:
291 LEAVE();
292 return ret;
295 void libertas_free_adapter(wlan_private * priv)
297 wlan_adapter *adapter = priv->adapter;
299 if (!adapter) {
300 lbs_pr_debug(1, "Why double free adapter?:)\n");
301 return;
304 lbs_pr_debug(1, "Free command buffer\n");
305 libertas_free_cmd_buffer(priv);
307 lbs_pr_debug(1, "Free commandTimer\n");
308 del_timer(&adapter->command_timer);
310 lbs_pr_debug(1, "Free scantable\n");
311 if (adapter->scantable) {
312 kfree(adapter->scantable);
313 adapter->scantable = NULL;
316 lbs_pr_debug(1, "Free adapter\n");
318 /* Free the adapter object itself */
319 kfree(adapter);
320 priv->adapter = NULL;
324 * This function handles the timeout of command sending.
325 * It will re-send the same command again.
327 static void command_timer_fn(unsigned long data)
329 wlan_private *priv = (wlan_private *)data;
330 wlan_adapter *adapter = priv->adapter;
331 struct cmd_ctrl_node *ptempnode;
332 struct cmd_ds_command *cmd;
333 unsigned long flags;
335 ptempnode = adapter->cur_cmd;
336 if (ptempnode == NULL) {
337 lbs_pr_debug(1, "PTempnode Empty\n");
338 return;
341 cmd = (struct cmd_ds_command *)ptempnode->bufvirtualaddr;
342 if (!cmd) {
343 lbs_pr_debug(1, "cmd is NULL\n");
344 return;
347 lbs_pr_info("command_timer_fn fired (%x)\n", cmd->command);
349 if (!adapter->fw_ready)
350 return;
352 spin_lock_irqsave(&adapter->driver_lock, flags);
353 adapter->cur_cmd = NULL;
354 spin_unlock_irqrestore(&adapter->driver_lock, flags);
356 lbs_pr_debug(1, "Re-sending same command as it timeout...!\n");
357 libertas_queue_cmd(adapter, ptempnode, 0);
359 wake_up_interruptible(&priv->mainthread.waitq);
361 return;