git.oblomov.eu Git - linux-2.6/blob - drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invokations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They  call copy_[to|from]_bap() and
  66 *                       cmd_access().   These functions operate on the
  67 *                       RIDs and buffers without validation.  The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 /*================================================================*/
 114 /* System Includes */
 115 #define WLAN_DBVAR      prism2_debug
 116
 117 #include <linux/version.h>
 118
 119 #include <linux/module.h>
 120 #include <linux/kernel.h>
 121 #include <linux/sched.h>
 122 #include <linux/types.h>
 123 #include <linux/slab.h>
 124 #include <linux/wireless.h>
 125 #include <linux/netdevice.h>
 126 #include <linux/timer.h>
 127 #include <asm/io.h>
 128 #include <linux/delay.h>
 129 #include <asm/byteorder.h>
 130 #include <asm/bitops.h>
 131 #include <linux/list.h>
 132 #include <linux/usb.h>
 133
 134 #include "wlan_compat.h"
 135
 136 #define SUBMIT_URB(u,f)  usb_submit_urb(u,f)
 137
 138 /*================================================================*/
 139 /* Project Includes */
 140
 141 #include "p80211types.h"
 142 #include "p80211hdr.h"
 143 #include "p80211mgmt.h"
 144 #include "p80211conv.h"
 145 #include "p80211msg.h"
 146 #include "p80211netdev.h"
 147 #include "p80211req.h"
 148 #include "p80211metadef.h"
 149 #include "p80211metastruct.h"
 150 #include "hfa384x.h"
 151 #include "prism2mgmt.h"
 152
 153 /*================================================================*/
 154 /* Local Constants */
 155
 156 enum cmd_mode
 157 {
 158   DOWAIT = 0,
 159   DOASYNC
 160 };
 161 typedef enum cmd_mode CMD_MODE;
 162
 163 #define THROTTLE_JIFFIES        (HZ/8)
 164
 165 /*================================================================*/
 166 /* Local Macros */
 167
 168 #define ROUNDUP64(a) (((a)+63)&~63)
 169
 170 /*================================================================*/
 171 /* Local Types */
 172
 173 /*================================================================*/
 174 /* Local Static Definitions */
 175 extern int prism2_debug;
 176
 177 /*================================================================*/
 178 /* Local Function Declarations */
 179
 180 #ifdef DEBUG_USB
 181 static void
 182 dbprint_urb(struct urb* urb);
 183 #endif
 184
 185 static void
 186 hfa384x_int_rxmonitor(
 187         wlandevice_t *wlandev,
 188         hfa384x_usb_rxfrm_t *rxfrm);
 189
 190 static void
 191 hfa384x_usb_defer(struct work_struct *data);
 192
 193 static int
 194 submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 195
 196 static int
 197 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 198
 199 /*---------------------------------------------------*/
 200 /* Callbacks */
 201 #ifdef URB_ONLY_CALLBACK
 202 static void
 203 hfa384x_usbout_callback(struct urb *urb);
 204 static void
 205 hfa384x_ctlxout_callback(struct urb *urb);
 206 static void
 207 hfa384x_usbin_callback(struct urb *urb);
 208 #else
 209 static void
 210 hfa384x_usbout_callback(struct urb *urb, struct pt_regs *regs);
 211 static void
 212 hfa384x_ctlxout_callback(struct urb *urb, struct pt_regs *regs);
 213 static void
 214 hfa384x_usbin_callback(struct urb *urb, struct pt_regs *regs);
 215 #endif
 216
 217 static void
 218 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 219
 220 static void
 221 hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 222
 223 static void
 224 hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 225
 226 static void
 227 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 228
 229 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 230                                int urb_status);
 231
 232 /*---------------------------------------------------*/
 233 /* Functions to support the prism2 usb command queue */
 234
 235 static void
 236 hfa384x_usbctlxq_run(hfa384x_t *hw);
 237
 238 static void
 239 hfa384x_usbctlx_reqtimerfn(unsigned long data);
 240
 241 static void
 242 hfa384x_usbctlx_resptimerfn(unsigned long data);
 243
 244 static void
 245 hfa384x_usb_throttlefn(unsigned long data);
 246
 247 static void
 248 hfa384x_usbctlx_completion_task(unsigned long data);
 249
 250 static void
 251 hfa384x_usbctlx_reaper_task(unsigned long data);
 252
 253 static int
 254 hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 255
 256 static void
 257 unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 258
 259 struct usbctlx_completor
 260 {
 261         int (*complete)(struct usbctlx_completor*);
 262 };
 263 typedef struct usbctlx_completor usbctlx_completor_t;
 264
 265 static int
 266 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 267                               hfa384x_usbctlx_t *ctlx,
 268                               usbctlx_completor_t *completor);
 269
 270 static int
 271 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 272
 273 static void
 274 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 275
 276 static void
 277 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 278
 279 static int
 280 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 281                    hfa384x_cmdresult_t *result);
 282
 283 static void
 284 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 285                        hfa384x_rridresult_t *result);
 286
 287 /*---------------------------------------------------*/
 288 /* Low level req/resp CTLX formatters and submitters */
 289 static int
 290 hfa384x_docmd(
 291         hfa384x_t *hw,
 292         CMD_MODE mode,
 293         hfa384x_metacmd_t *cmd,
 294         ctlx_cmdcb_t cmdcb,
 295         ctlx_usercb_t usercb,
 296         void    *usercb_data);
 297
 298 static int
 299 hfa384x_dorrid(
 300         hfa384x_t *hw,
 301         CMD_MODE mode,
 302         u16     rid,
 303         void    *riddata,
 304         unsigned int    riddatalen,
 305         ctlx_cmdcb_t cmdcb,
 306         ctlx_usercb_t usercb,
 307         void    *usercb_data);
 308
 309 static int
 310 hfa384x_dowrid(
 311         hfa384x_t *hw,
 312         CMD_MODE mode,
 313         u16     rid,
 314         void    *riddata,
 315         unsigned int    riddatalen,
 316         ctlx_cmdcb_t cmdcb,
 317         ctlx_usercb_t usercb,
 318         void    *usercb_data);
 319
 320 static int
 321 hfa384x_dormem(
 322         hfa384x_t *hw,
 323         CMD_MODE mode,
 324         u16     page,
 325         u16     offset,
 326         void    *data,
 327         unsigned int    len,
 328         ctlx_cmdcb_t cmdcb,
 329         ctlx_usercb_t usercb,
 330         void    *usercb_data);
 331
 332 static int
 333 hfa384x_dowmem(
 334         hfa384x_t *hw,
 335         CMD_MODE mode,
 336         u16     page,
 337         u16     offset,
 338         void    *data,
 339         unsigned int    len,
 340         ctlx_cmdcb_t cmdcb,
 341         ctlx_usercb_t usercb,
 342         void    *usercb_data);
 343
 344 static int
 345 hfa384x_isgood_pdrcode(u16 pdrcode);
 346
 347 /*================================================================*/
 348 /* Function Definitions */
 349 static inline const char* ctlxstr(CTLX_STATE s)
 350 {
 351         static const char* ctlx_str[] = {
 352                 "Initial state",
 353                 "Complete",
 354                 "Request failed",
 355                 "Request pending",
 356                 "Request packet submitted",
 357                 "Request packet completed",
 358                 "Response packet completed"
 359         };
 360
 361         return ctlx_str[s];
 362 };
 363
 364
 365 static inline hfa384x_usbctlx_t*
 366 get_active_ctlx(hfa384x_t *hw)
 367 {
 368         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 369 }
 370
 371
 372 #ifdef DEBUG_USB
 373 void
 374 dbprint_urb(struct urb* urb)
 375 {
 376         WLAN_LOG_DEBUG(3,"urb->pipe=0x%08x\n", urb->pipe);
 377         WLAN_LOG_DEBUG(3,"urb->status=0x%08x\n", urb->status);
 378         WLAN_LOG_DEBUG(3,"urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 379         WLAN_LOG_DEBUG(3,"urb->transfer_buffer=0x%08x\n", (unsigned int)urb->transfer_buffer);
 380         WLAN_LOG_DEBUG(3,"urb->transfer_buffer_length=0x%08x\n", urb->transfer_buffer_length);
 381         WLAN_LOG_DEBUG(3,"urb->actual_length=0x%08x\n", urb->actual_length);
 382         WLAN_LOG_DEBUG(3,"urb->bandwidth=0x%08x\n", urb->bandwidth);
 383         WLAN_LOG_DEBUG(3,"urb->setup_packet(ctl)=0x%08x\n", (unsigned int)urb->setup_packet);
 384         WLAN_LOG_DEBUG(3,"urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 385         WLAN_LOG_DEBUG(3,"urb->interval(irq)=0x%08x\n", urb->interval);
 386         WLAN_LOG_DEBUG(3,"urb->error_count(iso)=0x%08x\n", urb->error_count);
 387         WLAN_LOG_DEBUG(3,"urb->timeout=0x%08x\n", urb->timeout);
 388         WLAN_LOG_DEBUG(3,"urb->context=0x%08x\n", (unsigned int)urb->context);
 389         WLAN_LOG_DEBUG(3,"urb->complete=0x%08x\n", (unsigned int)urb->complete);
 390 }
 391 #endif
 392
 393
 394 /*----------------------------------------------------------------
 395 * submit_rx_urb
 396 *
 397 * Listen for input data on the BULK-IN pipe. If the pipe has
 398 * stalled then schedule it to be reset.
 399 *
 400 * Arguments:
 401 *       hw              device struct
 402 *       memflags        memory allocation flags
 403 *
 404 * Returns:
 405 *       error code from submission
 406 *
 407 * Call context:
 408 *       Any
 409 ----------------------------------------------------------------*/
 410 static int
 411 submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 412 {
 413         struct sk_buff *skb;
 414         int result;
 415
 416         DBFENTER;
 417
 418         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 419         if (skb == NULL) {
 420                 result = -ENOMEM;
 421                 goto done;
 422         }
 423
 424         /* Post the IN urb */
 425         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 426                       hw->endp_in,
 427                       skb->data, sizeof(hfa384x_usbin_t),
 428                       hfa384x_usbin_callback, hw->wlandev);
 429
 430         hw->rx_urb_skb = skb;
 431
 432         result = -ENOLINK;
 433         if ( !hw->wlandev->hwremoved && !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 434                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 435
 436                 /* Check whether we need to reset the RX pipe */
 437                 if (result == -EPIPE) {
 438                         WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
 439                                          hw->wlandev->netdev->name);
 440                         if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
 441                                 schedule_work(&hw->usb_work);
 442                 }
 443         }
 444
 445         /* Don't leak memory if anything should go wrong */
 446         if (result != 0) {
 447                 dev_kfree_skb(skb);
 448                 hw->rx_urb_skb = NULL;
 449         }
 450
 451  done:
 452
 453         DBFEXIT;
 454         return result;
 455 }
 456
 457 /*----------------------------------------------------------------
 458 * submit_tx_urb
 459 *
 460 * Prepares and submits the URB of transmitted data. If the
 461 * submission fails then it will schedule the output pipe to
 462 * be reset.
 463 *
 464 * Arguments:
 465 *       hw              device struct
 466 *       tx_urb          URB of data for tranmission
 467 *       memflags        memory allocation flags
 468 *
 469 * Returns:
 470 *       error code from submission
 471 *
 472 * Call context:
 473 *       Any
 474 ----------------------------------------------------------------*/
 475 static int
 476 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 477 {
 478         struct net_device *netdev = hw->wlandev->netdev;
 479         int result;
 480
 481         DBFENTER;
 482
 483         result = -ENOLINK;
 484         if ( netif_running(netdev) ) {
 485
 486                 if ( !hw->wlandev->hwremoved && !test_bit(WORK_TX_HALT, &hw->usb_flags) ) {
 487                         result = SUBMIT_URB(tx_urb, memflags);
 488
 489                         /* Test whether we need to reset the TX pipe */
 490                         if (result == -EPIPE) {
 491                                 WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
 492                                                  netdev->name);
 493                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 494                                 schedule_work(&hw->usb_work);
 495                         } else if (result == 0) {
 496                                 netif_stop_queue(netdev);
 497                         }
 498                 }
 499         }
 500
 501         DBFEXIT;
 502
 503         return result;
 504 }
 505
 506 /*----------------------------------------------------------------
 507 * hfa394x_usb_defer
 508 *
 509 * There are some things that the USB stack cannot do while
 510 * in interrupt context, so we arrange this function to run
 511 * in process context.
 512 *
 513 * Arguments:
 514 *       hw      device structure
 515 *
 516 * Returns:
 517 *       nothing
 518 *
 519 * Call context:
 520 *       process (by design)
 521 ----------------------------------------------------------------*/
 522 static void
 523 hfa384x_usb_defer(struct work_struct *data)
 524 {
 525         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 526         struct net_device *netdev = hw->wlandev->netdev;
 527
 528         DBFENTER;
 529
 530         /* Don't bother trying to reset anything if the plug
 531          * has been pulled ...
 532          */
 533         if ( hw->wlandev->hwremoved ) {
 534                 DBFEXIT;
 535                 return;
 536         }
 537
 538         /* Reception has stopped: try to reset the input pipe */
 539         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 540                 int ret;
 541
 542                 usb_kill_urb(&hw->rx_urb);  /* Cannot be holding spinlock! */
 543
 544                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 545                 if (ret != 0) {
 546                         printk(KERN_ERR
 547                                "Failed to clear rx pipe for %s: err=%d\n",
 548                                netdev->name, ret);
 549                 } else {
 550                         printk(KERN_INFO "%s rx pipe reset complete.\n",
 551                                          netdev->name);
 552                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 553                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 554                 }
 555         }
 556
 557         /* Resume receiving data back from the device. */
 558         if ( test_bit(WORK_RX_RESUME, &hw->usb_flags) ) {
 559                 int ret;
 560
 561                 ret = submit_rx_urb(hw, GFP_KERNEL);
 562                 if (ret != 0) {
 563                         printk(KERN_ERR
 564                                "Failed to resume %s rx pipe.\n", netdev->name);
 565                 } else {
 566                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 567                 }
 568         }
 569
 570         /* Transmission has stopped: try to reset the output pipe */
 571         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 572                 int ret;
 573
 574                 usb_kill_urb(&hw->tx_urb);
 575                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 576                 if (ret != 0) {
 577                         printk(KERN_ERR
 578                                "Failed to clear tx pipe for %s: err=%d\n",
 579                                netdev->name, ret);
 580                 } else {
 581                         printk(KERN_INFO "%s tx pipe reset complete.\n",
 582                                          netdev->name);
 583                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 584                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 585
 586                         /* Stopping the BULK-OUT pipe also blocked
 587                          * us from sending any more CTLX URBs, so
 588                          * we need to re-run our queue ...
 589                          */
 590                         hfa384x_usbctlxq_run(hw);
 591                 }
 592         }
 593
 594         /* Resume transmitting. */
 595         if ( test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags) ) {
 596                 p80211netdev_wake_queue(hw->wlandev);
 597         }
 598
 599         DBFEXIT;
 600 }
 601
 602
 603 /*----------------------------------------------------------------
 604 * hfa384x_create
 605 *
 606 * Sets up the hfa384x_t data structure for use.  Note this
 607 * does _not_ intialize the actual hardware, just the data structures
 608 * we use to keep track of its state.
 609 *
 610 * Arguments:
 611 *       hw              device structure
 612 *       irq             device irq number
 613 *       iobase          i/o base address for register access
 614 *       membase         memory base address for register access
 615 *
 616 * Returns:
 617 *       nothing
 618 *
 619 * Side effects:
 620 *
 621 * Call context:
 622 *       process
 623 ----------------------------------------------------------------*/
 624 void
 625 hfa384x_create( hfa384x_t *hw, struct usb_device *usb)
 626 {
 627         DBFENTER;
 628
 629         memset(hw, 0, sizeof(hfa384x_t));
 630         hw->usb = usb;
 631
 632         /* set up the endpoints */
 633         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 634         hw->endp_out = usb_sndbulkpipe(usb, 2);
 635
 636         /* Set up the waitq */
 637         init_waitqueue_head(&hw->cmdq);
 638
 639         /* Initialize the command queue */
 640         spin_lock_init(&hw->ctlxq.lock);
 641         INIT_LIST_HEAD(&hw->ctlxq.pending);
 642         INIT_LIST_HEAD(&hw->ctlxq.active);
 643         INIT_LIST_HEAD(&hw->ctlxq.completing);
 644         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 645
 646         /* Initialize the authentication queue */
 647         skb_queue_head_init(&hw->authq);
 648
 649         tasklet_init(&hw->reaper_bh,
 650                      hfa384x_usbctlx_reaper_task,
 651                      (unsigned long)hw);
 652         tasklet_init(&hw->completion_bh,
 653                      hfa384x_usbctlx_completion_task,
 654                      (unsigned long)hw);
 655         INIT_WORK2(&hw->link_bh, prism2sta_processing_defer);
 656         INIT_WORK2(&hw->usb_work, hfa384x_usb_defer);
 657
 658         init_timer(&hw->throttle);
 659         hw->throttle.function = hfa384x_usb_throttlefn;
 660         hw->throttle.data = (unsigned long)hw;
 661
 662         init_timer(&hw->resptimer);
 663         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 664         hw->resptimer.data = (unsigned long)hw;
 665
 666         init_timer(&hw->reqtimer);
 667         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 668         hw->reqtimer.data = (unsigned long)hw;
 669
 670         usb_init_urb(&hw->rx_urb);
 671         usb_init_urb(&hw->tx_urb);
 672         usb_init_urb(&hw->ctlx_urb);
 673
 674         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 675         hw->state = HFA384x_STATE_INIT;
 676
 677         INIT_WORK2(&hw->commsqual_bh, prism2sta_commsqual_defer);
 678         init_timer(&hw->commsqual_timer);
 679         hw->commsqual_timer.data = (unsigned long) hw;
 680         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 681
 682         DBFEXIT;
 683 }
 684
 685
 686 /*----------------------------------------------------------------
 687 * hfa384x_destroy
 688 *
 689 * Partner to hfa384x_create().  This function cleans up the hw
 690 * structure so that it can be freed by the caller using a simple
 691 * kfree.  Currently, this function is just a placeholder.  If, at some
 692 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 693 * kfree, this is where it should be done.  Note that if this function
 694 * is called on a _running_ hw structure, the drvr_stop() function is
 695 * called.
 696 *
 697 * Arguments:
 698 *       hw              device structure
 699 *
 700 * Returns:
 701 *       nothing, this function is not allowed to fail.
 702 *
 703 * Side effects:
 704 *
 705 * Call context:
 706 *       process
 707 ----------------------------------------------------------------*/
 708 void
 709 hfa384x_destroy( hfa384x_t *hw)
 710 {
 711         struct sk_buff *skb;
 712
 713         DBFENTER;
 714
 715         if ( hw->state == HFA384x_STATE_RUNNING ) {
 716                 hfa384x_drvr_stop(hw);
 717         }
 718         hw->state = HFA384x_STATE_PREINIT;
 719
 720         if (hw->scanresults) {
 721                 kfree(hw->scanresults);
 722                 hw->scanresults = NULL;
 723         }
 724
 725         /* Now to clean out the auth queue */
 726         while ( (skb = skb_dequeue(&hw->authq)) ) {
 727                 dev_kfree_skb(skb);
 728         }
 729
 730         DBFEXIT;
 731 }
 732
 733
 734 /*----------------------------------------------------------------
 735  */
 736 static hfa384x_usbctlx_t* usbctlx_alloc(void)
 737 {
 738         hfa384x_usbctlx_t *ctlx;
 739
 740         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 741         if (ctlx != NULL)
 742         {
 743                 memset(ctlx, 0, sizeof(*ctlx));
 744                 init_completion(&ctlx->done);
 745         }
 746
 747         return ctlx;
 748 }
 749
 750
 751 /*----------------------------------------------------------------
 752  *
 753 ----------------------------------------------------------------*/
 754 static int
 755 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 756                    hfa384x_cmdresult_t *result)
 757 {
 758         DBFENTER;
 759
 760         result->status = hfa384x2host_16(cmdresp->status);
 761         result->resp0 = hfa384x2host_16(cmdresp->resp0);
 762         result->resp1 = hfa384x2host_16(cmdresp->resp1);
 763         result->resp2 = hfa384x2host_16(cmdresp->resp2);
 764
 765         WLAN_LOG_DEBUG(4, "cmdresult:status=0x%04x "
 766                           "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 767                         result->status,
 768                         result->resp0,
 769                         result->resp1,
 770                         result->resp2);
 771
 772         DBFEXIT;
 773         return (result->status & HFA384x_STATUS_RESULT);
 774 }
 775
 776 static void
 777 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 778                        hfa384x_rridresult_t *result)
 779 {
 780         DBFENTER;
 781
 782         result->rid = hfa384x2host_16(rridresp->rid);
 783         result->riddata = rridresp->data;
 784         result->riddata_len = ((hfa384x2host_16(rridresp->frmlen) - 1) * 2);
 785
 786         DBFEXIT;
 787 }
 788
 789
 790 /*----------------------------------------------------------------
 791 * Completor object:
 792 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 793 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 794 ----------------------------------------------------------------*/
 795 struct usbctlx_cmd_completor
 796 {
 797         usbctlx_completor_t     head;
 798
 799         const hfa384x_usb_cmdresp_t     *cmdresp;
 800         hfa384x_cmdresult_t     *result;
 801 };
 802 typedef struct usbctlx_cmd_completor usbctlx_cmd_completor_t;
 803
 804 static int usbctlx_cmd_completor_fn(usbctlx_completor_t *head)
 805 {
 806         usbctlx_cmd_completor_t *complete = (usbctlx_cmd_completor_t*)head;
 807         return usbctlx_get_status(complete->cmdresp, complete->result);
 808 }
 809
 810 static inline usbctlx_completor_t*
 811 init_cmd_completor(usbctlx_cmd_completor_t *completor,
 812                    const hfa384x_usb_cmdresp_t *cmdresp,
 813                    hfa384x_cmdresult_t *result)
 814 {
 815         completor->head.complete = usbctlx_cmd_completor_fn;
 816         completor->cmdresp = cmdresp;
 817         completor->result = result;
 818         return &(completor->head);
 819 }
 820
 821 /*----------------------------------------------------------------
 822 * Completor object:
 823 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 824 * when processing a CTLX that reads a RID.
 825 ----------------------------------------------------------------*/
 826 struct usbctlx_rrid_completor
 827 {
 828         usbctlx_completor_t     head;
 829
 830         const hfa384x_usb_rridresp_t    *rridresp;
 831         void                    *riddata;
 832         unsigned int                    riddatalen;
 833 };
 834 typedef struct usbctlx_rrid_completor usbctlx_rrid_completor_t;
 835
 836 static int usbctlx_rrid_completor_fn(usbctlx_completor_t *head)
 837 {
 838         usbctlx_rrid_completor_t *complete = (usbctlx_rrid_completor_t*)head;
 839         hfa384x_rridresult_t rridresult;
 840
 841         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 842
 843         /* Validate the length, note body len calculation in bytes */
 844         if ( rridresult.riddata_len != complete->riddatalen ) {
 845                 WLAN_LOG_WARNING(
 846                         "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 847                         rridresult.rid,
 848                         complete->riddatalen,
 849                         rridresult.riddata_len);
 850                 return -ENODATA;
 851         }
 852
 853         memcpy(complete->riddata,
 854                rridresult.riddata,
 855                complete->riddatalen);
 856         return 0;
 857 }
 858
 859 static inline usbctlx_completor_t*
 860 init_rrid_completor(usbctlx_rrid_completor_t *completor,
 861                     const hfa384x_usb_rridresp_t *rridresp,
 862                     void *riddata,
 863                     unsigned int riddatalen)
 864 {
 865         completor->head.complete = usbctlx_rrid_completor_fn;
 866         completor->rridresp = rridresp;
 867         completor->riddata = riddata;
 868         completor->riddatalen = riddatalen;
 869         return &(completor->head);
 870 }
 871
 872 /*----------------------------------------------------------------
 873 * Completor object:
 874 * Interprets the results of a synchronous RID-write
 875 ----------------------------------------------------------------*/
 876 typedef usbctlx_cmd_completor_t usbctlx_wrid_completor_t;
 877 #define init_wrid_completor  init_cmd_completor
 878
 879 /*----------------------------------------------------------------
 880 * Completor object:
 881 * Interprets the results of a synchronous memory-write
 882 ----------------------------------------------------------------*/
 883 typedef usbctlx_cmd_completor_t usbctlx_wmem_completor_t;
 884 #define init_wmem_completor  init_cmd_completor
 885
 886 /*----------------------------------------------------------------
 887 * Completor object:
 888 * Interprets the results of a synchronous memory-read
 889 ----------------------------------------------------------------*/
 890 struct usbctlx_rmem_completor
 891 {
 892         usbctlx_completor_t           head;
 893
 894         const hfa384x_usb_rmemresp_t  *rmemresp;
 895         void                          *data;
 896         unsigned int                          len;
 897 };
 898 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
 899
 900 static int usbctlx_rmem_completor_fn(usbctlx_completor_t *head)
 901 {
 902         usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t*)head;
 903
 904         WLAN_LOG_DEBUG(4,"rmemresp:len=%d\n", complete->rmemresp->frmlen);
 905         memcpy(complete->data, complete->rmemresp->data, complete->len);
 906         return 0;
 907 }
 908
 909 static inline usbctlx_completor_t*
 910 init_rmem_completor(usbctlx_rmem_completor_t *completor,
 911                     hfa384x_usb_rmemresp_t *rmemresp,
 912                     void *data,
 913                     unsigned int len)
 914 {
 915         completor->head.complete = usbctlx_rmem_completor_fn;
 916         completor->rmemresp = rmemresp;
 917         completor->data = data;
 918         completor->len = len;
 919         return &(completor->head);
 920 }
 921
 922 /*----------------------------------------------------------------
 923 * hfa384x_cb_status
 924 *
 925 * Ctlx_complete handler for async CMD type control exchanges.
 926 * mark the hw struct as such.
 927 *
 928 * Note: If the handling is changed here, it should probably be
 929 *       changed in docmd as well.
 930 *
 931 * Arguments:
 932 *       hw              hw struct
 933 *       ctlx            completed CTLX
 934 *
 935 * Returns:
 936 *       nothing
 937 *
 938 * Side effects:
 939 *
 940 * Call context:
 941 *       interrupt
 942 ----------------------------------------------------------------*/
 943 static void
 944 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 945 {
 946         DBFENTER;
 947
 948         if ( ctlx->usercb != NULL ) {
 949                 hfa384x_cmdresult_t cmdresult;
 950
 951                 if (ctlx->state != CTLX_COMPLETE) {
 952                         memset(&cmdresult, 0, sizeof(cmdresult));
 953                         cmdresult.status = HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 954                 } else {
 955                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 956                 }
 957
 958                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 959         }
 960
 961         DBFEXIT;
 962 }
 963
 964
 965 /*----------------------------------------------------------------
 966 * hfa384x_cb_rrid
 967 *
 968 * CTLX completion handler for async RRID type control exchanges.
 969 *
 970 * Note: If the handling is changed here, it should probably be
 971 *       changed in dorrid as well.
 972 *
 973 * Arguments:
 974 *       hw              hw struct
 975 *       ctlx            completed CTLX
 976 *
 977 * Returns:
 978 *       nothing
 979 *
 980 * Side effects:
 981 *
 982 * Call context:
 983 *       interrupt
 984 ----------------------------------------------------------------*/
 985 static void
 986 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 987 {
 988         DBFENTER;
 989
 990         if ( ctlx->usercb != NULL ) {
 991                 hfa384x_rridresult_t rridresult;
 992
 993                 if (ctlx->state != CTLX_COMPLETE) {
 994                         memset(&rridresult, 0, sizeof(rridresult));
 995                         rridresult.rid = hfa384x2host_16(ctlx->outbuf.rridreq.rid);
 996                 } else {
 997                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp, &rridresult);
 998                 }
 999
1000                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
1001         }
1002
1003         DBFEXIT;
1004 }
1005
1006 static inline int
1007 hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
1008 {
1009         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
1010 }
1011
1012 static inline int
1013 hfa384x_docmd_async(hfa384x_t *hw,
1014                     hfa384x_metacmd_t *cmd,
1015                     ctlx_cmdcb_t cmdcb,
1016                     ctlx_usercb_t usercb,
1017                     void *usercb_data)
1018 {
1019         return hfa384x_docmd(hw, DOASYNC, cmd,
1020                                 cmdcb, usercb, usercb_data);
1021 }
1022
1023 static inline int
1024 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1025 {
1026         return hfa384x_dorrid(hw, DOWAIT,
1027                               rid, riddata, riddatalen,
1028                               NULL, NULL, NULL);
1029 }
1030
1031 static inline int
1032 hfa384x_dorrid_async(hfa384x_t *hw,
1033                      u16 rid, void *riddata, unsigned int riddatalen,
1034                      ctlx_cmdcb_t cmdcb,
1035                      ctlx_usercb_t usercb,
1036                      void *usercb_data)
1037 {
1038         return hfa384x_dorrid(hw, DOASYNC,
1039                               rid, riddata, riddatalen,
1040                               cmdcb, usercb, usercb_data);
1041 }
1042
1043 static inline int
1044 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1045 {
1046         return hfa384x_dowrid(hw, DOWAIT,
1047                               rid, riddata, riddatalen,
1048                               NULL, NULL, NULL);
1049 }
1050
1051 static inline int
1052 hfa384x_dowrid_async(hfa384x_t *hw,
1053                      u16 rid, void *riddata, unsigned int riddatalen,
1054                      ctlx_cmdcb_t cmdcb,
1055                      ctlx_usercb_t usercb,
1056                      void *usercb_data)
1057 {
1058         return hfa384x_dowrid(hw, DOASYNC,
1059                               rid, riddata, riddatalen,
1060                               cmdcb, usercb, usercb_data);
1061 }
1062
1063 static inline int
1064 hfa384x_dormem_wait(hfa384x_t *hw,
1065                     u16 page, u16 offset, void *data, unsigned int len)
1066 {
1067         return hfa384x_dormem(hw, DOWAIT,
1068                               page, offset, data, len,
1069                               NULL, NULL, NULL);
1070 }
1071
1072 static inline int
1073 hfa384x_dormem_async(hfa384x_t *hw,
1074                      u16 page, u16 offset, void *data, unsigned int len,
1075                      ctlx_cmdcb_t cmdcb,
1076                      ctlx_usercb_t usercb,
1077                      void *usercb_data)
1078 {
1079         return hfa384x_dormem(hw, DOASYNC,
1080                               page, offset, data, len,
1081                               cmdcb, usercb, usercb_data);
1082 }
1083
1084 static inline int
1085 hfa384x_dowmem_wait(
1086         hfa384x_t *hw,
1087         u16  page,
1088         u16  offset,
1089         void    *data,
1090         unsigned int    len)
1091 {
1092         return hfa384x_dowmem(hw, DOWAIT,
1093                                   page, offset, data, len,
1094                                   NULL, NULL, NULL);
1095 }
1096
1097 static inline int
1098 hfa384x_dowmem_async(
1099         hfa384x_t *hw,
1100         u16  page,
1101         u16  offset,
1102         void    *data,
1103         unsigned int    len,
1104         ctlx_cmdcb_t cmdcb,
1105         ctlx_usercb_t usercb,
1106         void    *usercb_data)
1107 {
1108         return hfa384x_dowmem(hw, DOASYNC,
1109                                   page, offset, data, len,
1110                                   cmdcb, usercb, usercb_data);
1111 }
1112
1113 /*----------------------------------------------------------------
1114 * hfa384x_cmd_initialize
1115 *
1116 * Issues the initialize command and sets the hw->state based
1117 * on the result.
1118 *
1119 * Arguments:
1120 *       hw              device structure
1121 *
1122 * Returns:
1123 *       0               success
1124 *       >0              f/w reported error - f/w status code
1125 *       <0              driver reported error
1126 *
1127 * Side effects:
1128 *
1129 * Call context:
1130 *       process
1131 ----------------------------------------------------------------*/
1132 int
1133 hfa384x_cmd_initialize(hfa384x_t *hw)
1134 {
1135         int     result = 0;
1136         int     i;
1137         hfa384x_metacmd_t cmd;
1138
1139         DBFENTER;
1140
1141
1142         cmd.cmd = HFA384x_CMDCODE_INIT;
1143         cmd.parm0 = 0;
1144         cmd.parm1 = 0;
1145         cmd.parm2 = 0;
1146
1147         result = hfa384x_docmd_wait(hw, &cmd);
1148
1149
1150         WLAN_LOG_DEBUG(3,"cmdresp.init: "
1151                 "status=0x%04x, resp0=0x%04x, "
1152                 "resp1=0x%04x, resp2=0x%04x\n",
1153                 cmd.result.status,
1154                 cmd.result.resp0,
1155                 cmd.result.resp1,
1156                 cmd.result.resp2);
1157         if ( result == 0 ) {
1158                 for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
1159                         hw->port_enabled[i] = 0;
1160                 }
1161         }
1162
1163         hw->link_status = HFA384x_LINK_NOTCONNECTED;
1164
1165         DBFEXIT;
1166         return result;
1167 }
1168
1169
1170 /*----------------------------------------------------------------
1171 * hfa384x_cmd_disable
1172 *
1173 * Issues the disable command to stop communications on one of
1174 * the MACs 'ports'.
1175 *
1176 * Arguments:
1177 *       hw              device structure
1178 *       macport         MAC port number (host order)
1179 *
1180 * Returns:
1181 *       0               success
1182 *       >0              f/w reported failure - f/w status code
1183 *       <0              driver reported error (timeout|bad arg)
1184 *
1185 * Side effects:
1186 *
1187 * Call context:
1188 *       process
1189 ----------------------------------------------------------------*/
1190 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1191 {
1192         int     result = 0;
1193         hfa384x_metacmd_t cmd;
1194
1195         DBFENTER;
1196
1197         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1198                   HFA384x_CMD_MACPORT_SET(macport);
1199         cmd.parm0 = 0;
1200         cmd.parm1 = 0;
1201         cmd.parm2 = 0;
1202
1203         result = hfa384x_docmd_wait(hw, &cmd);
1204
1205         DBFEXIT;
1206         return result;
1207 }
1208
1209
1210 /*----------------------------------------------------------------
1211 * hfa384x_cmd_enable
1212 *
1213 * Issues the enable command to enable communications on one of
1214 * the MACs 'ports'.
1215 *
1216 * Arguments:
1217 *       hw              device structure
1218 *       macport         MAC port number
1219 *
1220 * Returns:
1221 *       0               success
1222 *       >0              f/w reported failure - f/w status code
1223 *       <0              driver reported error (timeout|bad arg)
1224 *
1225 * Side effects:
1226 *
1227 * Call context:
1228 *       process
1229 ----------------------------------------------------------------*/
1230 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1231 {
1232         int     result = 0;
1233         hfa384x_metacmd_t cmd;
1234
1235         DBFENTER;
1236
1237         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1238                   HFA384x_CMD_MACPORT_SET(macport);
1239         cmd.parm0 = 0;
1240         cmd.parm1 = 0;
1241         cmd.parm2 = 0;
1242
1243         result = hfa384x_docmd_wait(hw, &cmd);
1244
1245         DBFEXIT;
1246         return result;
1247 }
1248
1249
1250 /*----------------------------------------------------------------
1251 * hfa384x_cmd_notify
1252 *
1253 * Sends an info frame to the firmware to alter the behavior
1254 * of the f/w asynch processes.  Can only be called when the MAC
1255 * is in the enabled state.
1256 *
1257 * Arguments:
1258 *       hw              device structure
1259 *       reclaim         [0|1] indicates whether the given FID will
1260 *                       be handed back (via Alloc event) for reuse.
1261 *                       (host order)
1262 *       fid             FID of buffer containing the frame that was
1263 *                       previously copied to MAC memory via the bap.
1264 *                       (host order)
1265 *
1266 * Returns:
1267 *       0               success
1268 *       >0              f/w reported failure - f/w status code
1269 *       <0              driver reported error (timeout|bad arg)
1270 *
1271 * Side effects:
1272 *       hw->resp0 will contain the FID being used by async notify
1273 *       process.  If reclaim==0, resp0 will be the same as the fid
1274 *       argument.  If reclaim==1, resp0 will be the different.
1275 *
1276 * Call context:
1277 *       process
1278 ----------------------------------------------------------------*/
1279 int hfa384x_cmd_notify(hfa384x_t *hw, u16 reclaim, u16 fid,
1280                        void *buf, u16 len)
1281 {
1282 #if 0
1283         int     result = 0;
1284         u16     cmd;
1285         DBFENTER;
1286         cmd =   HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_NOTIFY) |
1287                 HFA384x_CMD_RECL_SET(reclaim);
1288         result = hfa384x_docmd_wait(hw, cmd);
1289
1290         DBFEXIT;
1291         return result;
1292 #endif
1293 return 0;
1294 }
1295
1296
1297 #if 0
1298 /*----------------------------------------------------------------
1299 * hfa384x_cmd_inquiry
1300 *
1301 * Requests an info frame from the firmware.  The info frame will
1302 * be delivered asynchronously via the Info event.
1303 *
1304 * Arguments:
1305 *       hw              device structure
1306 *       fid             FID of the info frame requested. (host order)
1307 *
1308 * Returns:
1309 *       0               success
1310 *       >0              f/w reported failure - f/w status code
1311 *       <0              driver reported error (timeout|bad arg)
1312 *
1313 * Side effects:
1314 *
1315 * Call context:
1316 *       process
1317 ----------------------------------------------------------------*/
1318 int hfa384x_cmd_inquiry(hfa384x_t *hw, u16 fid)
1319 {
1320         int     result = 0;
1321         hfa384x_metacmd_t cmd;
1322
1323         DBFENTER;
1324
1325         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_INQ);
1326         cmd.parm0 = 0;
1327         cmd.parm1 = 0;
1328         cmd.parm2 = 0;
1329
1330         result = hfa384x_docmd_wait(hw, &cmd);
1331
1332         DBFEXIT;
1333         return result;
1334 }
1335 #endif
1336
1337
1338 /*----------------------------------------------------------------
1339 * hfa384x_cmd_monitor
1340 *
1341 * Enables the 'monitor mode' of the MAC.  Here's the description of
1342 * monitor mode that I've received thus far:
1343 *
1344 *  "The "monitor mode" of operation is that the MAC passes all
1345 *  frames for which the PLCP checks are correct. All received
1346 *  MPDUs are passed to the host with MAC Port = 7, with a
1347 *  receive status of good, FCS error, or undecryptable. Passing
1348 *  certain MPDUs is a violation of the 802.11 standard, but useful
1349 *  for a debugging tool."  Normal communication is not possible
1350 *  while monitor mode is enabled.
1351 *
1352 * Arguments:
1353 *       hw              device structure
1354 *       enable          a code (0x0b|0x0f) that enables/disables
1355 *                       monitor mode. (host order)
1356 *
1357 * Returns:
1358 *       0               success
1359 *       >0              f/w reported failure - f/w status code
1360 *       <0              driver reported error (timeout|bad arg)
1361 *
1362 * Side effects:
1363 *
1364 * Call context:
1365 *       process
1366 ----------------------------------------------------------------*/
1367 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1368 {
1369         int     result = 0;
1370         hfa384x_metacmd_t cmd;
1371
1372         DBFENTER;
1373
1374         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1375                 HFA384x_CMD_AINFO_SET(enable);
1376         cmd.parm0 = 0;
1377         cmd.parm1 = 0;
1378         cmd.parm2 = 0;
1379
1380         result = hfa384x_docmd_wait(hw, &cmd);
1381
1382         DBFEXIT;
1383         return result;
1384 }
1385
1386
1387 /*----------------------------------------------------------------
1388 * hfa384x_cmd_download
1389 *
1390 * Sets the controls for the MAC controller code/data download
1391 * process.  The arguments set the mode and address associated
1392 * with a download.  Note that the aux registers should be enabled
1393 * prior to setting one of the download enable modes.
1394 *
1395 * Arguments:
1396 *       hw              device structure
1397 *       mode            0 - Disable programming and begin code exec
1398 *                       1 - Enable volatile mem programming
1399 *                       2 - Enable non-volatile mem programming
1400 *                       3 - Program non-volatile section from NV download
1401 *                           buffer.
1402 *                       (host order)
1403 *       lowaddr
1404 *       highaddr        For mode 1, sets the high & low order bits of
1405 *                       the "destination address".  This address will be
1406 *                       the execution start address when download is
1407 *                       subsequently disabled.
1408 *                       For mode 2, sets the high & low order bits of
1409 *                       the destination in NV ram.
1410 *                       For modes 0 & 3, should be zero. (host order)
1411 *                       NOTE: these are CMD format.
1412 *       codelen         Length of the data to write in mode 2,
1413 *                       zero otherwise. (host order)
1414 *
1415 * Returns:
1416 *       0               success
1417 *       >0              f/w reported failure - f/w status code
1418 *       <0              driver reported error (timeout|bad arg)
1419 *
1420 * Side effects:
1421 *
1422 * Call context:
1423 *       process
1424 ----------------------------------------------------------------*/
1425 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1426                                 u16 highaddr, u16 codelen)
1427 {
1428         int     result = 0;
1429         hfa384x_metacmd_t cmd;
1430
1431         DBFENTER;
1432         WLAN_LOG_DEBUG(5,
1433                 "mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1434                 mode, lowaddr, highaddr, codelen);
1435
1436         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1437                    HFA384x_CMD_PROGMODE_SET(mode));
1438
1439         cmd.parm0 = lowaddr;
1440         cmd.parm1 = highaddr;
1441         cmd.parm2 = codelen;
1442
1443         result = hfa384x_docmd_wait(hw, &cmd);
1444
1445         DBFEXIT;
1446         return result;
1447 }
1448
1449
1450 /*----------------------------------------------------------------
1451 * hfa384x_copy_from_aux
1452 *
1453 * Copies a collection of bytes from the controller memory.  The
1454 * Auxiliary port MUST be enabled prior to calling this function.
1455 * We _might_ be in a download state.
1456 *
1457 * Arguments:
1458 *       hw              device structure
1459 *       cardaddr        address in hfa384x data space to read
1460 *       auxctl          address space select
1461 *       buf             ptr to destination host buffer
1462 *       len             length of data to transfer (in bytes)
1463 *
1464 * Returns:
1465 *       nothing
1466 *
1467 * Side effects:
1468 *       buf contains the data copied
1469 *
1470 * Call context:
1471 *       process
1472 *       interrupt
1473 ----------------------------------------------------------------*/
1474 void
1475 hfa384x_copy_from_aux(
1476         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1477 {
1478         DBFENTER;
1479         WLAN_LOG_ERROR("not used in USB.\n");
1480         DBFEXIT;
1481 }
1482
1483
1484 /*----------------------------------------------------------------
1485 * hfa384x_copy_to_aux
1486 *
1487 * Copies a collection of bytes to the controller memory.  The
1488 * Auxiliary port MUST be enabled prior to calling this function.
1489 * We _might_ be in a download state.
1490 *
1491 * Arguments:
1492 *       hw              device structure
1493 *       cardaddr        address in hfa384x data space to read
1494 *       auxctl          address space select
1495 *       buf             ptr to destination host buffer
1496 *       len             length of data to transfer (in bytes)
1497 *
1498 * Returns:
1499 *       nothing
1500 *
1501 * Side effects:
1502 *       Controller memory now contains a copy of buf
1503 *
1504 * Call context:
1505 *       process
1506 *       interrupt
1507 ----------------------------------------------------------------*/
1508 void
1509 hfa384x_copy_to_aux(
1510         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1511 {
1512         DBFENTER;
1513         WLAN_LOG_ERROR("not used in USB.\n");
1514         DBFEXIT;
1515 }
1516
1517
1518 /*----------------------------------------------------------------
1519 * hfa384x_corereset
1520 *
1521 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1522 * structure is in its "created" state.  That is, it is initialized
1523 * with proper values.  Note that if a reset is done after the
1524 * device has been active for awhile, the caller might have to clean
1525 * up some leftover cruft in the hw structure.
1526 *
1527 * Arguments:
1528 *       hw              device structure
1529 *       holdtime        how long (in ms) to hold the reset
1530 *       settletime      how long (in ms) to wait after releasing
1531 *                       the reset
1532 *
1533 * Returns:
1534 *       nothing
1535 *
1536 * Side effects:
1537 *
1538 * Call context:
1539 *       process
1540 ----------------------------------------------------------------*/
1541 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1542 {
1543         int                     result = 0;
1544
1545         DBFENTER;
1546
1547         result=usb_reset_device(hw->usb);
1548         if(result<0) {
1549                 WLAN_LOG_ERROR("usb_reset_device() failed, result=%d.\n",result);
1550         }
1551
1552         DBFEXIT;
1553         return result;
1554 }
1555
1556
1557 /*----------------------------------------------------------------
1558 * hfa384x_usbctlx_complete_sync
1559 *
1560 * Waits for a synchronous CTLX object to complete,
1561 * and then handles the response.
1562 *
1563 * Arguments:
1564 *       hw              device structure
1565 *       ctlx            CTLX ptr
1566 *       completor       functor object to decide what to
1567 *                       do with the CTLX's result.
1568 *
1569 * Returns:
1570 *       0               Success
1571 *       -ERESTARTSYS    Interrupted by a signal
1572 *       -EIO            CTLX failed
1573 *       -ENODEV         Adapter was unplugged
1574 *       ???             Result from completor
1575 *
1576 * Side effects:
1577 *
1578 * Call context:
1579 *       process
1580 ----------------------------------------------------------------*/
1581 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1582                                          hfa384x_usbctlx_t *ctlx,
1583                                          usbctlx_completor_t *completor)
1584 {
1585         unsigned long flags;
1586         int result;
1587
1588         DBFENTER;
1589
1590         result = wait_for_completion_interruptible(&ctlx->done);
1591
1592         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1593
1594         /*
1595          * We can only handle the CTLX if the USB disconnect
1596          * function has not run yet ...
1597          */
1598         cleanup:
1599         if ( hw->wlandev->hwremoved )
1600         {
1601                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1602                 result = -ENODEV;
1603         }
1604         else if ( result != 0 )
1605         {
1606                 int runqueue = 0;
1607
1608                 /*
1609                  * We were probably interrupted, so delete
1610                  * this CTLX asynchronously, kill the timers
1611                  * and the URB, and then start the next
1612                  * pending CTLX.
1613                  *
1614                  * NOTE: We can only delete the timers and
1615                  *       the URB if this CTLX is active.
1616                  */
1617                 if (ctlx == get_active_ctlx(hw))
1618                 {
1619                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1620
1621                         del_singleshot_timer_sync(&hw->reqtimer);
1622                         del_singleshot_timer_sync(&hw->resptimer);
1623                         hw->req_timer_done = 1;
1624                         hw->resp_timer_done = 1;
1625                         usb_kill_urb(&hw->ctlx_urb);
1626
1627                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1628
1629                         runqueue = 1;
1630
1631                         /*
1632                          * This scenario is so unlikely that I'm
1633                          * happy with a grubby "goto" solution ...
1634                          */
1635                         if ( hw->wlandev->hwremoved )
1636                                 goto cleanup;
1637                 }
1638
1639                 /*
1640                  * The completion task will send this CTLX
1641                  * to the reaper the next time it runs. We
1642                  * are no longer in a hurry.
1643                  */
1644                 ctlx->reapable = 1;
1645                 ctlx->state = CTLX_REQ_FAILED;
1646                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1647
1648                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1649
1650                 if (runqueue)
1651                         hfa384x_usbctlxq_run(hw);
1652         } else {
1653                 if (ctlx->state == CTLX_COMPLETE) {
1654                         result = completor->complete(completor);
1655                 } else {
1656                         WLAN_LOG_WARNING("CTLX[%d] error: state(%s)\n",
1657                                          hfa384x2host_16(ctlx->outbuf.type),
1658                                          ctlxstr(ctlx->state));
1659                         result = -EIO;
1660                 }
1661
1662                 list_del(&ctlx->list);
1663                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1664                 kfree(ctlx);
1665         }
1666
1667         DBFEXIT;
1668         return result;
1669 }
1670
1671 /*----------------------------------------------------------------
1672 * hfa384x_docmd
1673 *
1674 * Constructs a command CTLX and submits it.
1675 *
1676 * NOTE: Any changes to the 'post-submit' code in this function
1677 *       need to be carried over to hfa384x_cbcmd() since the handling
1678 *       is virtually identical.
1679 *
1680 * Arguments:
1681 *       hw              device structure
1682 *       mode            DOWAIT or DOASYNC
1683 *       cmd             cmd structure.  Includes all arguments and result
1684 *                       data points.  All in host order. in host order
1685 *       cmdcb           command-specific callback
1686 *       usercb          user callback for async calls, NULL for DOWAIT calls
1687 *       usercb_data     user supplied data pointer for async calls, NULL
1688 *                       for DOASYNC calls
1689 *
1690 * Returns:
1691 *       0               success
1692 *       -EIO            CTLX failure
1693 *       -ERESTARTSYS    Awakened on signal
1694 *       >0              command indicated error, Status and Resp0-2 are
1695 *                       in hw structure.
1696 *
1697 * Side effects:
1698 *
1699 *
1700 * Call context:
1701 *       process
1702 ----------------------------------------------------------------*/
1703 static int
1704 hfa384x_docmd(
1705         hfa384x_t *hw,
1706         CMD_MODE mode,
1707         hfa384x_metacmd_t *cmd,
1708         ctlx_cmdcb_t    cmdcb,
1709         ctlx_usercb_t   usercb,
1710         void    *usercb_data)
1711 {
1712         int                     result;
1713         hfa384x_usbctlx_t       *ctlx;
1714
1715         DBFENTER;
1716         ctlx = usbctlx_alloc();
1717         if ( ctlx == NULL ) {
1718                 result = -ENOMEM;
1719                 goto done;
1720         }
1721
1722         /* Initialize the command */
1723         ctlx->outbuf.cmdreq.type =      host2hfa384x_16(HFA384x_USB_CMDREQ);
1724         ctlx->outbuf.cmdreq.cmd =       host2hfa384x_16(cmd->cmd);
1725         ctlx->outbuf.cmdreq.parm0 =     host2hfa384x_16(cmd->parm0);
1726         ctlx->outbuf.cmdreq.parm1 =     host2hfa384x_16(cmd->parm1);
1727         ctlx->outbuf.cmdreq.parm2 =     host2hfa384x_16(cmd->parm2);
1728
1729         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1730
1731         WLAN_LOG_DEBUG(4, "cmdreq: cmd=0x%04x "
1732                 "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1733                 cmd->cmd,
1734                 cmd->parm0,
1735                 cmd->parm1,
1736                 cmd->parm2);
1737
1738         ctlx->reapable = mode;
1739         ctlx->cmdcb = cmdcb;
1740         ctlx->usercb = usercb;
1741         ctlx->usercb_data = usercb_data;
1742
1743         result = hfa384x_usbctlx_submit(hw, ctlx);
1744         if (result != 0) {
1745                 kfree(ctlx);
1746         } else if (mode == DOWAIT) {
1747                 usbctlx_cmd_completor_t completor;
1748
1749                 result = hfa384x_usbctlx_complete_sync(
1750                              hw, ctlx, init_cmd_completor(&completor,
1751                                                           &ctlx->inbuf.cmdresp,
1752                                                           &cmd->result) );
1753         }
1754
1755 done:
1756         DBFEXIT;
1757         return result;
1758 }
1759
1760
1761 /*----------------------------------------------------------------
1762 * hfa384x_dorrid
1763 *
1764 * Constructs a read rid CTLX and issues it.
1765 *
1766 * NOTE: Any changes to the 'post-submit' code in this function
1767 *       need to be carried over to hfa384x_cbrrid() since the handling
1768 *       is virtually identical.
1769 *
1770 * Arguments:
1771 *       hw              device structure
1772 *       mode            DOWAIT or DOASYNC
1773 *       rid             Read RID number (host order)
1774 *       riddata         Caller supplied buffer that MAC formatted RID.data
1775 *                       record will be written to for DOWAIT calls. Should
1776 *                       be NULL for DOASYNC calls.
1777 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1778 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1779 *       usercb          user callback for async calls, NULL for DOWAIT calls
1780 *       usercb_data     user supplied data pointer for async calls, NULL
1781 *                       for DOWAIT calls
1782 *
1783 * Returns:
1784 *       0               success
1785 *       -EIO            CTLX failure
1786 *       -ERESTARTSYS    Awakened on signal
1787 *       -ENODATA        riddatalen != macdatalen
1788 *       >0              command indicated error, Status and Resp0-2 are
1789 *                       in hw structure.
1790 *
1791 * Side effects:
1792 *
1793 * Call context:
1794 *       interrupt (DOASYNC)
1795 *       process (DOWAIT or DOASYNC)
1796 ----------------------------------------------------------------*/
1797 static int
1798 hfa384x_dorrid(
1799         hfa384x_t *hw,
1800         CMD_MODE mode,
1801         u16     rid,
1802         void    *riddata,
1803         unsigned int    riddatalen,
1804         ctlx_cmdcb_t cmdcb,
1805         ctlx_usercb_t usercb,
1806         void    *usercb_data)
1807 {
1808         int                     result;
1809         hfa384x_usbctlx_t       *ctlx;
1810
1811         DBFENTER;
1812         ctlx = usbctlx_alloc();
1813         if ( ctlx == NULL ) {
1814                 result = -ENOMEM;
1815                 goto done;
1816         }
1817
1818         /* Initialize the command */
1819         ctlx->outbuf.rridreq.type =   host2hfa384x_16(HFA384x_USB_RRIDREQ);
1820         ctlx->outbuf.rridreq.frmlen =
1821                 host2hfa384x_16(sizeof(ctlx->outbuf.rridreq.rid));
1822         ctlx->outbuf.rridreq.rid =    host2hfa384x_16(rid);
1823
1824         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1825
1826         ctlx->reapable = mode;
1827         ctlx->cmdcb = cmdcb;
1828         ctlx->usercb = usercb;
1829         ctlx->usercb_data = usercb_data;
1830
1831         /* Submit the CTLX */
1832         result = hfa384x_usbctlx_submit(hw, ctlx);
1833         if (result != 0) {
1834                 kfree(ctlx);
1835         } else if (mode == DOWAIT) {
1836                 usbctlx_rrid_completor_t completor;
1837
1838                 result = hfa384x_usbctlx_complete_sync(
1839                            hw, ctlx, init_rrid_completor(&completor,
1840                                                          &ctlx->inbuf.rridresp,
1841                                                          riddata,
1842                                                          riddatalen) );
1843         }
1844
1845 done:
1846         DBFEXIT;
1847         return result;
1848 }
1849
1850
1851 /*----------------------------------------------------------------
1852 * hfa384x_dowrid
1853 *
1854 * Constructs a write rid CTLX and issues it.
1855 *
1856 * NOTE: Any changes to the 'post-submit' code in this function
1857 *       need to be carried over to hfa384x_cbwrid() since the handling
1858 *       is virtually identical.
1859 *
1860 * Arguments:
1861 *       hw              device structure
1862 *       CMD_MODE        DOWAIT or DOASYNC
1863 *       rid             RID code
1864 *       riddata         Data portion of RID formatted for MAC
1865 *       riddatalen      Length of the data portion in bytes
1866 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1867 *       usercb          user callback for async calls, NULL for DOWAIT calls
1868 *       usercb_data     user supplied data pointer for async calls
1869 *
1870 * Returns:
1871 *       0               success
1872 *       -ETIMEDOUT      timed out waiting for register ready or
1873 *                       command completion
1874 *       >0              command indicated error, Status and Resp0-2 are
1875 *                       in hw structure.
1876 *
1877 * Side effects:
1878 *
1879 * Call context:
1880 *       interrupt (DOASYNC)
1881 *       process (DOWAIT or DOASYNC)
1882 ----------------------------------------------------------------*/
1883 static int
1884 hfa384x_dowrid(
1885         hfa384x_t *hw,
1886         CMD_MODE mode,
1887         u16     rid,
1888         void    *riddata,
1889         unsigned int    riddatalen,
1890         ctlx_cmdcb_t cmdcb,
1891         ctlx_usercb_t usercb,
1892         void    *usercb_data)
1893 {
1894         int                     result;
1895         hfa384x_usbctlx_t       *ctlx;
1896
1897         DBFENTER;
1898         ctlx = usbctlx_alloc();
1899         if ( ctlx == NULL ) {
1900                 result = -ENOMEM;
1901                 goto done;
1902         }
1903
1904         /* Initialize the command */
1905         ctlx->outbuf.wridreq.type =   host2hfa384x_16(HFA384x_USB_WRIDREQ);
1906         ctlx->outbuf.wridreq.frmlen = host2hfa384x_16(
1907                                         (sizeof(ctlx->outbuf.wridreq.rid) +
1908                                         riddatalen + 1) / 2);
1909         ctlx->outbuf.wridreq.rid =    host2hfa384x_16(rid);
1910         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1911
1912         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1913                            sizeof(ctlx->outbuf.wridreq.frmlen) +
1914                            sizeof(ctlx->outbuf.wridreq.rid) +
1915                            riddatalen;
1916
1917         ctlx->reapable = mode;
1918         ctlx->cmdcb = cmdcb;
1919         ctlx->usercb = usercb;
1920         ctlx->usercb_data = usercb_data;
1921
1922         /* Submit the CTLX */
1923         result = hfa384x_usbctlx_submit(hw, ctlx);
1924         if (result != 0) {
1925                 kfree(ctlx);
1926         } else if (mode == DOWAIT) {
1927                 usbctlx_wrid_completor_t completor;
1928                 hfa384x_cmdresult_t wridresult;
1929
1930                 result = hfa384x_usbctlx_complete_sync(
1931                                hw,
1932                                ctlx,
1933                                init_wrid_completor(&completor,
1934                                                    &ctlx->inbuf.wridresp,
1935                                                    &wridresult) );
1936         }
1937
1938 done:
1939         DBFEXIT;
1940         return result;
1941 }
1942
1943 /*----------------------------------------------------------------
1944 * hfa384x_dormem
1945 *
1946 * Constructs a readmem CTLX and issues it.
1947 *
1948 * NOTE: Any changes to the 'post-submit' code in this function
1949 *       need to be carried over to hfa384x_cbrmem() since the handling
1950 *       is virtually identical.
1951 *
1952 * Arguments:
1953 *       hw              device structure
1954 *       mode            DOWAIT or DOASYNC
1955 *       page            MAC address space page (CMD format)
1956 *       offset          MAC address space offset
1957 *       data            Ptr to data buffer to receive read
1958 *       len             Length of the data to read (max == 2048)
1959 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1960 *       usercb          user callback for async calls, NULL for DOWAIT calls
1961 *       usercb_data     user supplied data pointer for async calls
1962 *
1963 * Returns:
1964 *       0               success
1965 *       -ETIMEDOUT      timed out waiting for register ready or
1966 *                       command completion
1967 *       >0              command indicated error, Status and Resp0-2 are
1968 *                       in hw structure.
1969 *
1970 * Side effects:
1971 *
1972 * Call context:
1973 *       interrupt (DOASYNC)
1974 *       process (DOWAIT or DOASYNC)
1975 ----------------------------------------------------------------*/
1976 static int
1977 hfa384x_dormem(
1978         hfa384x_t *hw,
1979         CMD_MODE mode,
1980         u16     page,
1981         u16     offset,
1982         void    *data,
1983         unsigned int    len,
1984         ctlx_cmdcb_t cmdcb,
1985         ctlx_usercb_t usercb,
1986         void    *usercb_data)
1987 {
1988         int                     result;
1989         hfa384x_usbctlx_t       *ctlx;
1990
1991         DBFENTER;
1992         ctlx = usbctlx_alloc();
1993         if ( ctlx == NULL ) {
1994                 result = -ENOMEM;
1995                 goto done;
1996         }
1997
1998         /* Initialize the command */
1999         ctlx->outbuf.rmemreq.type =    host2hfa384x_16(HFA384x_USB_RMEMREQ);
2000         ctlx->outbuf.rmemreq.frmlen =  host2hfa384x_16(
2001                                         sizeof(ctlx->outbuf.rmemreq.offset) +
2002                                         sizeof(ctlx->outbuf.rmemreq.page) +
2003                                         len);
2004         ctlx->outbuf.rmemreq.offset =   host2hfa384x_16(offset);
2005         ctlx->outbuf.rmemreq.page =     host2hfa384x_16(page);
2006
2007         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
2008
2009         WLAN_LOG_DEBUG(4,
2010                 "type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
2011                 ctlx->outbuf.rmemreq.type,
2012                 ctlx->outbuf.rmemreq.frmlen,
2013                 ctlx->outbuf.rmemreq.offset,
2014                 ctlx->outbuf.rmemreq.page);
2015
2016         WLAN_LOG_DEBUG(4,"pktsize=%zd\n",
2017                 ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
2018
2019         ctlx->reapable = mode;
2020         ctlx->cmdcb = cmdcb;
2021         ctlx->usercb = usercb;
2022         ctlx->usercb_data = usercb_data;
2023
2024         result = hfa384x_usbctlx_submit(hw, ctlx);
2025         if (result != 0) {
2026                 kfree(ctlx);
2027         } else if ( mode == DOWAIT ) {
2028                 usbctlx_rmem_completor_t completor;
2029
2030                 result = hfa384x_usbctlx_complete_sync(
2031                            hw, ctlx, init_rmem_completor(&completor,
2032                                                          &ctlx->inbuf.rmemresp,
2033                                                          data,
2034                                                          len) );
2035         }
2036
2037 done:
2038         DBFEXIT;
2039         return result;
2040 }
2041
2042
2043
2044 /*----------------------------------------------------------------
2045 * hfa384x_dowmem
2046 *
2047 * Constructs a writemem CTLX and issues it.
2048 *
2049 * NOTE: Any changes to the 'post-submit' code in this function
2050 *       need to be carried over to hfa384x_cbwmem() since the handling
2051 *       is virtually identical.
2052 *
2053 * Arguments:
2054 *       hw              device structure
2055 *       mode            DOWAIT or DOASYNC
2056 *       page            MAC address space page (CMD format)
2057 *       offset          MAC address space offset
2058 *       data            Ptr to data buffer containing write data
2059 *       len             Length of the data to read (max == 2048)
2060 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
2061 *       usercb          user callback for async calls, NULL for DOWAIT calls
2062 *       usercb_data     user supplied data pointer for async calls.
2063 *
2064 * Returns:
2065 *       0               success
2066 *       -ETIMEDOUT      timed out waiting for register ready or
2067 *                       command completion
2068 *       >0              command indicated error, Status and Resp0-2 are
2069 *                       in hw structure.
2070 *
2071 * Side effects:
2072 *
2073 * Call context:
2074 *       interrupt (DOWAIT)
2075 *       process (DOWAIT or DOASYNC)
2076 ----------------------------------------------------------------*/
2077 static int
2078 hfa384x_dowmem(
2079         hfa384x_t *hw,
2080         CMD_MODE mode,
2081         u16     page,
2082         u16     offset,
2083         void    *data,
2084         unsigned int    len,
2085         ctlx_cmdcb_t cmdcb,
2086         ctlx_usercb_t usercb,
2087         void    *usercb_data)
2088 {
2089         int                     result;
2090         hfa384x_usbctlx_t       *ctlx;
2091
2092         DBFENTER;
2093         WLAN_LOG_DEBUG(5, "page=0x%04x offset=0x%04x len=%d\n",
2094                 page,offset,len);
2095
2096         ctlx = usbctlx_alloc();
2097         if ( ctlx == NULL ) {
2098                 result = -ENOMEM;
2099                 goto done;
2100         }
2101
2102         /* Initialize the command */
2103         ctlx->outbuf.wmemreq.type =   host2hfa384x_16(HFA384x_USB_WMEMREQ);
2104         ctlx->outbuf.wmemreq.frmlen = host2hfa384x_16(
2105                                         sizeof(ctlx->outbuf.wmemreq.offset) +
2106                                         sizeof(ctlx->outbuf.wmemreq.page) +
2107                                         len);
2108         ctlx->outbuf.wmemreq.offset = host2hfa384x_16(offset);
2109         ctlx->outbuf.wmemreq.page =   host2hfa384x_16(page);
2110         memcpy(ctlx->outbuf.wmemreq.data, data, len);
2111
2112         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
2113                            sizeof(ctlx->outbuf.wmemreq.frmlen) +
2114                            sizeof(ctlx->outbuf.wmemreq.offset) +
2115                            sizeof(ctlx->outbuf.wmemreq.page) +
2116                            len;
2117
2118         ctlx->reapable = mode;
2119         ctlx->cmdcb = cmdcb;
2120         ctlx->usercb = usercb;
2121         ctlx->usercb_data = usercb_data;
2122
2123         result = hfa384x_usbctlx_submit(hw, ctlx);
2124         if (result != 0) {
2125                 kfree(ctlx);
2126         } else if ( mode == DOWAIT ) {
2127                 usbctlx_wmem_completor_t completor;
2128                 hfa384x_cmdresult_t wmemresult;
2129
2130                 result = hfa384x_usbctlx_complete_sync(
2131                                hw,
2132                                ctlx,
2133                                init_wmem_completor(&completor,
2134                                                    &ctlx->inbuf.wmemresp,
2135                                                    &wmemresult) );
2136         }
2137
2138 done:
2139         DBFEXIT;
2140         return result;
2141 }
2142
2143
2144 /*----------------------------------------------------------------
2145 * hfa384x_drvr_commtallies
2146 *
2147 * Send a commtallies inquiry to the MAC.  Note that this is an async
2148 * call that will result in an info frame arriving sometime later.
2149 *
2150 * Arguments:
2151 *       hw              device structure
2152 *
2153 * Returns:
2154 *       zero            success.
2155 *
2156 * Side effects:
2157 *
2158 * Call context:
2159 *       process
2160 ----------------------------------------------------------------*/
2161 int hfa384x_drvr_commtallies( hfa384x_t *hw )
2162 {
2163         hfa384x_metacmd_t cmd;
2164
2165         DBFENTER;
2166
2167         cmd.cmd = HFA384x_CMDCODE_INQ;
2168         cmd.parm0 = HFA384x_IT_COMMTALLIES;
2169         cmd.parm1 = 0;
2170         cmd.parm2 = 0;
2171
2172         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
2173
2174         DBFEXIT;
2175         return 0;
2176 }
2177
2178
2179 /*----------------------------------------------------------------
2180 * hfa384x_drvr_disable
2181 *
2182 * Issues the disable command to stop communications on one of
2183 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2184 * APs may also disable macports 1-6.  Only ports that have been
2185 * previously enabled may be disabled.
2186 *
2187 * Arguments:
2188 *       hw              device structure
2189 *       macport         MAC port number (host order)
2190 *
2191 * Returns:
2192 *       0               success
2193 *       >0              f/w reported failure - f/w status code
2194 *       <0              driver reported error (timeout|bad arg)
2195 *
2196 * Side effects:
2197 *
2198 * Call context:
2199 *       process
2200 ----------------------------------------------------------------*/
2201 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
2202 {
2203         int     result = 0;
2204
2205         DBFENTER;
2206         if ((!hw->isap && macport != 0) ||
2207             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2208             !(hw->port_enabled[macport]) ){
2209                 result = -EINVAL;
2210         } else {
2211                 result = hfa384x_cmd_disable(hw, macport);
2212                 if ( result == 0 ) {
2213                         hw->port_enabled[macport] = 0;
2214                 }
2215         }
2216         DBFEXIT;
2217         return result;
2218 }
2219
2220
2221 /*----------------------------------------------------------------
2222 * hfa384x_drvr_enable
2223 *
2224 * Issues the enable command to enable communications on one of
2225 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2226 * APs may also enable macports 1-6.  Only ports that are currently
2227 * disabled may be enabled.
2228 *
2229 * Arguments:
2230 *       hw              device structure
2231 *       macport         MAC port number
2232 *
2233 * Returns:
2234 *       0               success
2235 *       >0              f/w reported failure - f/w status code
2236 *       <0              driver reported error (timeout|bad arg)
2237 *
2238 * Side effects:
2239 *
2240 * Call context:
2241 *       process
2242 ----------------------------------------------------------------*/
2243 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
2244 {
2245         int     result = 0;
2246
2247         DBFENTER;
2248         if ((!hw->isap && macport != 0) ||
2249             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2250             (hw->port_enabled[macport]) ){
2251                 result = -EINVAL;
2252         } else {
2253                 result = hfa384x_cmd_enable(hw, macport);
2254                 if ( result == 0 ) {
2255                         hw->port_enabled[macport] = 1;
2256                 }
2257         }
2258         DBFEXIT;
2259         return result;
2260 }
2261
2262
2263 /*----------------------------------------------------------------
2264 * hfa384x_drvr_flashdl_enable
2265 *
2266 * Begins the flash download state.  Checks to see that we're not
2267 * already in a download state and that a port isn't enabled.
2268 * Sets the download state and retrieves the flash download
2269 * buffer location, buffer size, and timeout length.
2270 *
2271 * Arguments:
2272 *       hw              device structure
2273 *
2274 * Returns:
2275 *       0               success
2276 *       >0              f/w reported error - f/w status code
2277 *       <0              driver reported error
2278 *
2279 * Side effects:
2280 *
2281 * Call context:
2282 *       process
2283 ----------------------------------------------------------------*/
2284 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
2285 {
2286         int             result = 0;
2287         int             i;
2288
2289         DBFENTER;
2290         /* Check that a port isn't active */
2291         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2292                 if ( hw->port_enabled[i] ) {
2293                         WLAN_LOG_DEBUG(1,"called when port enabled.\n");
2294                         return -EINVAL;
2295                 }
2296         }
2297
2298         /* Check that we're not already in a download state */
2299         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2300                 return -EINVAL;
2301         }
2302
2303         /* Retrieve the buffer loc&size and timeout */
2304         if ( (result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
2305                                 &(hw->bufinfo), sizeof(hw->bufinfo))) ) {
2306                 return result;
2307         }
2308         hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
2309         hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
2310         hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
2311         if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
2312                                 &(hw->dltimeout))) ) {
2313                 return result;
2314         }
2315         hw->dltimeout = hfa384x2host_16(hw->dltimeout);
2316
2317         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2318
2319         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
2320         DBFEXIT;
2321         return result;
2322 }
2323
2324
2325 /*----------------------------------------------------------------
2326 * hfa384x_drvr_flashdl_disable
2327 *
2328 * Ends the flash download state.  Note that this will cause the MAC
2329 * firmware to restart.
2330 *
2331 * Arguments:
2332 *       hw              device structure
2333 *
2334 * Returns:
2335 *       0               success
2336 *       >0              f/w reported error - f/w status code
2337 *       <0              driver reported error
2338 *
2339 * Side effects:
2340 *
2341 * Call context:
2342 *       process
2343 ----------------------------------------------------------------*/
2344 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
2345 {
2346         DBFENTER;
2347         /* Check that we're already in the download state */
2348         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2349                 return -EINVAL;
2350         }
2351
2352         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2353
2354         /* There isn't much we can do at this point, so I don't */
2355         /*  bother  w/ the return value */
2356         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2357         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2358
2359         DBFEXIT;
2360         return 0;
2361 }
2362
2363
2364 /*----------------------------------------------------------------
2365 * hfa384x_drvr_flashdl_write
2366 *
2367 * Performs a FLASH download of a chunk of data. First checks to see
2368 * that we're in the FLASH download state, then sets the download
2369 * mode, uses the aux functions to 1) copy the data to the flash
2370 * buffer, 2) sets the download 'write flash' mode, 3) readback and
2371 * compare.  Lather rinse, repeat as many times an necessary to get
2372 * all the given data into flash.
2373 * When all data has been written using this function (possibly
2374 * repeatedly), call drvr_flashdl_disable() to end the download state
2375 * and restart the MAC.
2376 *
2377 * Arguments:
2378 *       hw              device structure
2379 *       daddr           Card address to write to. (host order)
2380 *       buf             Ptr to data to write.
2381 *       len             Length of data (host order).
2382 *
2383 * Returns:
2384 *       0               success
2385 *       >0              f/w reported error - f/w status code
2386 *       <0              driver reported error
2387 *
2388 * Side effects:
2389 *
2390 * Call context:
2391 *       process
2392 ----------------------------------------------------------------*/
2393 int
2394 hfa384x_drvr_flashdl_write(
2395         hfa384x_t       *hw,
2396         u32             daddr,
2397         void            *buf,
2398         u32             len)
2399 {
2400         int             result = 0;
2401         u32             dlbufaddr;
2402         int             nburns;
2403         u32             burnlen;
2404         u32             burndaddr;
2405         u16             burnlo;
2406         u16             burnhi;
2407         int             nwrites;
2408         u8              *writebuf;
2409         u16             writepage;
2410         u16             writeoffset;
2411         u32             writelen;
2412         int             i;
2413         int             j;
2414
2415         DBFENTER;
2416         WLAN_LOG_DEBUG(5,"daddr=0x%08x len=%d\n", daddr, len);
2417
2418         /* Check that we're in the flash download state */
2419         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2420                 return -EINVAL;
2421         }
2422
2423         WLAN_LOG_INFO("Download %d bytes to flash @0x%06x\n", len, daddr);
2424
2425         /* Convert to flat address for arithmetic */
2426         /* NOTE: dlbuffer RID stores the address in AUX format */
2427         dlbufaddr = HFA384x_ADDR_AUX_MKFLAT(
2428                         hw->bufinfo.page, hw->bufinfo.offset);
2429         WLAN_LOG_DEBUG(5,
2430                 "dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2431                 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2432
2433 #if 0
2434 WLAN_LOG_WARNING("dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
2435 #endif
2436         /* Calculations to determine how many fills of the dlbuffer to do
2437          * and how many USB wmemreq's to do for each fill.  At this point
2438          * in time, the dlbuffer size and the wmemreq size are the same.
2439          * Therefore, nwrites should always be 1.  The extra complexity
2440          * here is a hedge against future changes.
2441          */
2442
2443         /* Figure out how many times to do the flash programming */
2444         nburns = len / hw->bufinfo.len;
2445         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2446
2447         /* For each flash program cycle, how many USB wmemreq's are needed? */
2448         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2449         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2450
2451         /* For each burn */
2452         for ( i = 0; i < nburns; i++) {
2453                 /* Get the dest address and len */
2454                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2455                                 hw->bufinfo.len :
2456                                 (len - (hw->bufinfo.len * i));
2457                 burndaddr = daddr + (hw->bufinfo.len * i);
2458                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2459                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2460
2461                 WLAN_LOG_INFO("Writing %d bytes to flash @0x%06x\n",
2462                         burnlen, burndaddr);
2463
2464                 /* Set the download mode */
2465                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2466                                 burnlo, burnhi, burnlen);
2467                 if ( result ) {
2468                         WLAN_LOG_ERROR("download(NV,lo=%x,hi=%x,len=%x) "
2469                                 "cmd failed, result=%d. Aborting d/l\n",
2470                                 burnlo, burnhi, burnlen, result);
2471                         goto exit_proc;
2472                 }
2473
2474                 /* copy the data to the flash download buffer */
2475                 for ( j=0; j < nwrites; j++) {
2476                         writebuf = buf +
2477                                 (i*hw->bufinfo.len) +
2478                                 (j*HFA384x_USB_RWMEM_MAXLEN);
2479
2480                         writepage = HFA384x_ADDR_CMD_MKPAGE(
2481                                         dlbufaddr +
2482                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2483                         writeoffset = HFA384x_ADDR_CMD_MKOFF(
2484                                         dlbufaddr +
2485                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2486
2487                         writelen = burnlen-(j*HFA384x_USB_RWMEM_MAXLEN);
2488                         writelen = writelen  > HFA384x_USB_RWMEM_MAXLEN ?
2489                                         HFA384x_USB_RWMEM_MAXLEN :
2490                                         writelen;
2491
2492                         result = hfa384x_dowmem_wait( hw,
2493                                         writepage,
2494                                         writeoffset,
2495                                         writebuf,
2496                                         writelen );
2497 #if 0
2498
2499 Comment out for debugging, assume the write was successful.
2500                         if (result) {
2501                                 WLAN_LOG_ERROR(
2502                                         "Write to dl buffer failed, "
2503                                         "result=0x%04x. Aborting.\n",
2504                                         result);
2505                                 goto exit_proc;
2506                         }
2507 #endif
2508
2509                 }
2510
2511                 /* set the download 'write flash' mode */
2512                 result = hfa384x_cmd_download(hw,
2513                                 HFA384x_PROGMODE_NVWRITE,
2514                                 0,0,0);
2515                 if ( result ) {
2516                         WLAN_LOG_ERROR(
2517                                 "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2518                                 "cmd failed, result=%d. Aborting d/l\n",
2519                                 burnlo, burnhi, burnlen, result);
2520                         goto exit_proc;
2521                 }
2522
2523                 /* TODO: We really should do a readback and compare. */
2524         }
2525
2526 exit_proc:
2527
2528         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2529         /*  actually disable programming mode.  Remember, that will cause the */
2530         /*  the firmware to effectively reset itself. */
2531
2532         DBFEXIT;
2533         return result;
2534 }
2535
2536
2537 /*----------------------------------------------------------------
2538 * hfa384x_drvr_getconfig
2539 *
2540 * Performs the sequence necessary to read a config/info item.
2541 *
2542 * Arguments:
2543 *       hw              device structure
2544 *       rid             config/info record id (host order)
2545 *       buf             host side record buffer.  Upon return it will
2546 *                       contain the body portion of the record (minus the
2547 *                       RID and len).
2548 *       len             buffer length (in bytes, should match record length)
2549 *
2550 * Returns:
2551 *       0               success
2552 *       >0              f/w reported error - f/w status code
2553 *       <0              driver reported error
2554 *       -ENODATA        length mismatch between argument and retrieved
2555 *                       record.
2556 *
2557 * Side effects:
2558 *
2559 * Call context:
2560 *       process
2561 ----------------------------------------------------------------*/
2562 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2563 {
2564         int                     result;
2565         DBFENTER;
2566
2567         result = hfa384x_dorrid_wait(hw, rid, buf, len);
2568
2569         DBFEXIT;
2570         return result;
2571 }
2572
2573 /*----------------------------------------------------------------
2574  * hfa384x_drvr_getconfig_async
2575  *
2576  * Performs the sequence necessary to perform an async read of
2577  * of a config/info item.
2578  *
2579  * Arguments:
2580  *       hw              device structure
2581  *       rid             config/info record id (host order)
2582  *       buf             host side record buffer.  Upon return it will
2583  *                       contain the body portion of the record (minus the
2584  *                       RID and len).
2585  *       len             buffer length (in bytes, should match record length)
2586  *       cbfn            caller supplied callback, called when the command
2587  *                       is done (successful or not).
2588  *       cbfndata        pointer to some caller supplied data that will be
2589  *                       passed in as an argument to the cbfn.
2590  *
2591  * Returns:
2592  *       nothing         the cbfn gets a status argument identifying if
2593  *                       any errors occur.
2594  * Side effects:
2595  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2596  *
2597  * Call context:
2598  *       Any
2599  ----------------------------------------------------------------*/
2600 int
2601 hfa384x_drvr_getconfig_async(
2602          hfa384x_t               *hw,
2603          u16                  rid,
2604          ctlx_usercb_t           usercb,
2605          void                    *usercb_data)
2606 {
2607          return hfa384x_dorrid_async(hw, rid, NULL, 0,
2608                                      hfa384x_cb_rrid, usercb, usercb_data);
2609 }
2610
2611 /*----------------------------------------------------------------
2612  * hfa384x_drvr_setconfig_async
2613  *
2614  * Performs the sequence necessary to write a config/info item.
2615  *
2616  * Arguments:
2617  *       hw              device structure
2618  *       rid             config/info record id (in host order)
2619  *       buf             host side record buffer
2620  *       len             buffer length (in bytes)
2621  *       usercb          completion callback
2622  *       usercb_data     completion callback argument
2623  *
2624  * Returns:
2625  *       0               success
2626  *       >0              f/w reported error - f/w status code
2627  *       <0              driver reported error
2628  *
2629  * Side effects:
2630  *
2631  * Call context:
2632  *       process
2633  ----------------------------------------------------------------*/
2634 int
2635 hfa384x_drvr_setconfig_async(
2636          hfa384x_t       *hw,
2637          u16          rid,
2638          void            *buf,
2639          u16          len,
2640          ctlx_usercb_t   usercb,
2641          void            *usercb_data)
2642 {
2643         return hfa384x_dowrid_async(hw, rid, buf, len,
2644                                     hfa384x_cb_status, usercb, usercb_data);
2645 }
2646
2647 /*----------------------------------------------------------------
2648 * hfa384x_drvr_handover
2649 *
2650 * Sends a handover notification to the MAC.
2651 *
2652 * Arguments:
2653 *       hw              device structure
2654 *       addr            address of station that's left
2655 *
2656 * Returns:
2657 *       zero            success.
2658 *       -ERESTARTSYS    received signal while waiting for semaphore.
2659 *       -EIO            failed to write to bap, or failed in cmd.
2660 *
2661 * Side effects:
2662 *
2663 * Call context:
2664 *       process
2665 ----------------------------------------------------------------*/
2666 int hfa384x_drvr_handover( hfa384x_t *hw, u8 *addr)
2667 {
2668         DBFENTER;
2669         WLAN_LOG_ERROR("Not currently supported in USB!\n");
2670         DBFEXIT;
2671         return -EIO;
2672 }
2673
2674 /*----------------------------------------------------------------
2675 * hfa384x_drvr_low_level
2676 *
2677 * Write test commands to the card.  Some test commands don't make
2678 * sense without prior set-up.  For example, continous TX isn't very
2679 * useful until you set the channel.  That functionality should be
2680 *
2681 * Side effects:
2682 *
2683 * Call context:
2684 *      process thread
2685 * -----------------------------------------------------------------*/
2686 int hfa384x_drvr_low_level(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
2687 {
2688         int             result;
2689         DBFENTER;
2690
2691         /* Do i need a host2hfa... conversion ? */
2692
2693         result = hfa384x_docmd_wait(hw, cmd);
2694
2695         DBFEXIT;
2696         return result;
2697 }
2698
2699 /*----------------------------------------------------------------
2700 * hfa384x_drvr_mmi_read
2701 *
2702 * Read mmi registers.  mmi is intersil-speak for the baseband
2703 * processor registers.
2704 *
2705 * Arguments:
2706 *       hw              device structure
2707 *       register        The test register to be accessed (must be even #).
2708 *
2709 * Returns:
2710 *       0               success
2711 *       >0              f/w reported error - f/w status code
2712 *       <0              driver reported error
2713 *
2714 * Side effects:
2715 *
2716 * Call context:
2717 *       process
2718 ----------------------------------------------------------------*/
2719 int hfa384x_drvr_mmi_read(hfa384x_t *hw, u32 addr, u32 *resp)
2720 {
2721 #if 0
2722         int             result = 0;
2723         u16  cmd_code = (u16) 0x30;
2724         u16 param = (u16) addr;
2725         DBFENTER;
2726
2727         /* Do i need a host2hfa... conversion ? */
2728         result = hfa384x_docmd_wait(hw, cmd_code);
2729
2730         DBFEXIT;
2731         return result;
2732 #endif
2733 return 0;
2734 }
2735
2736 /*----------------------------------------------------------------
2737 * hfa384x_drvr_mmi_write
2738 *
2739 * Read mmi registers.  mmi is intersil-speak for the baseband
2740 * processor registers.
2741 *
2742 * Arguments:
2743 *       hw              device structure
2744 *       addr            The test register to be accessed (must be even #).
2745 *       data            The data value to write to the register.
2746 *
2747 * Returns:
2748 *       0               success
2749 *       >0              f/w reported error - f/w status code
2750 *       <0              driver reported error
2751 *
2752 * Side effects:
2753 *
2754 * Call context:
2755 *       process
2756 ----------------------------------------------------------------*/
2757
2758 int
2759 hfa384x_drvr_mmi_write(hfa384x_t *hw, u32 addr, u32 data)
2760 {
2761 #if 0
2762         int             result = 0;
2763         u16  cmd_code = (u16) 0x31;
2764         u16 param0 = (u16) addr;
2765         u16 param1 = (u16) data;
2766         DBFENTER;
2767
2768         WLAN_LOG_DEBUG(1,"mmi write : addr = 0x%08lx\n", addr);
2769         WLAN_LOG_DEBUG(1,"mmi write : data = 0x%08lx\n", data);
2770
2771         /* Do i need a host2hfa... conversion ? */
2772         result = hfa384x_docmd_wait(hw, cmd_code);
2773
2774         DBFEXIT;
2775         return result;
2776 #endif
2777 return 0;
2778 }
2779
2780
2781 /*----------------------------------------------------------------
2782 * hfa384x_drvr_ramdl_disable
2783 *
2784 * Ends the ram download state.
2785 *
2786 * Arguments:
2787 *       hw              device structure
2788 *
2789 * Returns:
2790 *       0               success
2791 *       >0              f/w reported error - f/w status code
2792 *       <0              driver reported error
2793 *
2794 * Side effects:
2795 *
2796 * Call context:
2797 *       process
2798 ----------------------------------------------------------------*/
2799 int
2800 hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2801 {
2802         DBFENTER;
2803         /* Check that we're already in the download state */
2804         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2805                 return -EINVAL;
2806         }
2807
2808         WLAN_LOG_DEBUG(3,"ramdl_disable()\n");
2809
2810         /* There isn't much we can do at this point, so I don't */
2811         /*  bother  w/ the return value */
2812         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2813         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2814
2815         DBFEXIT;
2816         return 0;
2817 }
2818
2819
2820 /*----------------------------------------------------------------
2821 * hfa384x_drvr_ramdl_enable
2822 *
2823 * Begins the ram download state.  Checks to see that we're not
2824 * already in a download state and that a port isn't enabled.
2825 * Sets the download state and calls cmd_download with the
2826 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2827 *
2828 * Arguments:
2829 *       hw              device structure
2830 *       exeaddr         the card execution address that will be
2831 *                       jumped to when ramdl_disable() is called
2832 *                       (host order).
2833 *
2834 * Returns:
2835 *       0               success
2836 *       >0              f/w reported error - f/w status code
2837 *       <0              driver reported error
2838 *
2839 * Side effects:
2840 *
2841 * Call context:
2842 *       process
2843 ----------------------------------------------------------------*/
2844 int
2845 hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2846 {
2847         int             result = 0;
2848         u16             lowaddr;
2849         u16             hiaddr;
2850         int             i;
2851         DBFENTER;
2852         /* Check that a port isn't active */
2853         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2854                 if ( hw->port_enabled[i] ) {
2855                         WLAN_LOG_ERROR(
2856                                 "Can't download with a macport enabled.\n");
2857                         return -EINVAL;
2858                 }
2859         }
2860
2861         /* Check that we're not already in a download state */
2862         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2863                 WLAN_LOG_ERROR(
2864                         "Download state not disabled.\n");
2865                 return -EINVAL;
2866         }
2867
2868         WLAN_LOG_DEBUG(3,"ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2869
2870         /* Call the download(1,addr) function */
2871         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2872         hiaddr =  HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2873
2874         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2875                         lowaddr, hiaddr, 0);
2876
2877         if ( result == 0) {
2878                 /* Set the download state */
2879                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2880         } else {
2881                 WLAN_LOG_DEBUG(1,
2882                         "cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2883                         lowaddr,
2884                         hiaddr,
2885                         result);
2886         }
2887
2888         DBFEXIT;
2889         return result;
2890 }
2891
2892
2893 /*----------------------------------------------------------------
2894 * hfa384x_drvr_ramdl_write
2895 *
2896 * Performs a RAM download of a chunk of data. First checks to see
2897 * that we're in the RAM download state, then uses the [read|write]mem USB
2898 * commands to 1) copy the data, 2) readback and compare.  The download
2899 * state is unaffected.  When all data has been written using
2900 * this function, call drvr_ramdl_disable() to end the download state
2901 * and restart the MAC.
2902 *
2903 * Arguments:
2904 *       hw              device structure
2905 *       daddr           Card address to write to. (host order)
2906 *       buf             Ptr to data to write.
2907 *       len             Length of data (host order).
2908 *
2909 * Returns:
2910 *       0               success
2911 *       >0              f/w reported error - f/w status code
2912 *       <0              driver reported error
2913 *
2914 * Side effects:
2915 *
2916 * Call context:
2917 *       process
2918 ----------------------------------------------------------------*/
2919 int
2920 hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void* buf, u32 len)
2921 {
2922         int             result = 0;
2923         int             nwrites;
2924         u8              *data = buf;
2925         int             i;
2926         u32             curraddr;
2927         u16             currpage;
2928         u16             curroffset;
2929         u16             currlen;
2930         DBFENTER;
2931         /* Check that we're in the ram download state */
2932         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2933                 return -EINVAL;
2934         }
2935
2936         WLAN_LOG_INFO("Writing %d bytes to ram @0x%06x\n", len, daddr);
2937
2938         /* How many dowmem calls?  */
2939         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2940         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2941
2942         /* Do blocking wmem's */
2943         for(i=0; i < nwrites; i++) {
2944                 /* make address args */
2945                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2946                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2947                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2948                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2949                 if ( currlen > HFA384x_USB_RWMEM_MAXLEN) {
2950                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2951                 }
2952
2953                 /* Do blocking ctlx */
2954                 result = hfa384x_dowmem_wait( hw,
2955                                 currpage,
2956                                 curroffset,
2957                                 data + (i*HFA384x_USB_RWMEM_MAXLEN),
2958                                 currlen );
2959
2960                 if (result) break;
2961
2962                 /* TODO: We really should have a readback. */
2963         }
2964
2965         DBFEXIT;
2966         return result;
2967 }
2968
2969
2970 /*----------------------------------------------------------------
2971 * hfa384x_drvr_readpda
2972 *
2973 * Performs the sequence to read the PDA space.  Note there is no
2974 * drvr_writepda() function.  Writing a PDA is
2975 * generally implemented by a calling component via calls to
2976 * cmd_download and writing to the flash download buffer via the
2977 * aux regs.
2978 *
2979 * Arguments:
2980 *       hw              device structure
2981 *       buf             buffer to store PDA in
2982 *       len             buffer length
2983 *
2984 * Returns:
2985 *       0               success
2986 *       >0              f/w reported error - f/w status code
2987 *       <0              driver reported error
2988 *       -ETIMEOUT       timout waiting for the cmd regs to become
2989 *                       available, or waiting for the control reg
2990 *                       to indicate the Aux port is enabled.
2991 *       -ENODATA        the buffer does NOT contain a valid PDA.
2992 *                       Either the card PDA is bad, or the auxdata
2993 *                       reads are giving us garbage.
2994
2995 *
2996 * Side effects:
2997 *
2998 * Call context:
2999 *       process or non-card interrupt.
3000 ----------------------------------------------------------------*/
3001 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
3002 {
3003         int             result = 0;
3004         u16             *pda = buf;
3005         int             pdaok = 0;
3006         int             morepdrs = 1;
3007         int             currpdr = 0;    /* word offset of the current pdr */
3008         size_t          i;
3009         u16             pdrlen;         /* pdr length in bytes, host order */
3010         u16             pdrcode;        /* pdr code, host order */
3011         u16             currpage;
3012         u16             curroffset;
3013         struct pdaloc {
3014                 u32     cardaddr;
3015                 u16     auxctl;
3016         } pdaloc[] =
3017         {
3018                 { HFA3842_PDA_BASE,             0},
3019                 { HFA3841_PDA_BASE,             0},
3020                 { HFA3841_PDA_BOGUS_BASE,       0}
3021         };
3022
3023         DBFENTER;
3024
3025         /* Read the pda from each known address.  */
3026         for ( i = 0; i < ARRAY_SIZE(pdaloc); i++) {
3027                 /* Make address */
3028                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
3029                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
3030
3031                 result = hfa384x_dormem_wait(hw,
3032                         currpage,
3033                         curroffset,
3034                         buf,
3035                         len);           /* units of bytes */
3036
3037                 if (result) {
3038                         WLAN_LOG_WARNING(
3039                                           "Read from index %zd failed, continuing\n",
3040                                 i );
3041                         continue;
3042                 }
3043
3044                 /* Test for garbage */
3045                 pdaok = 1;      /* initially assume good */
3046                 morepdrs = 1;
3047                 while ( pdaok && morepdrs ) {
3048                         pdrlen = hfa384x2host_16(pda[currpdr]) * 2;
3049                         pdrcode = hfa384x2host_16(pda[currpdr+1]);
3050                         /* Test the record length */
3051                         if ( pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
3052                                 WLAN_LOG_ERROR("pdrlen invalid=%d\n",
3053                                         pdrlen);
3054                                 pdaok = 0;
3055                                 break;
3056                         }
3057                         /* Test the code */
3058                         if ( !hfa384x_isgood_pdrcode(pdrcode) ) {
3059                                 WLAN_LOG_ERROR("pdrcode invalid=%d\n",
3060                                         pdrcode);
3061                                 pdaok = 0;
3062                                 break;
3063                         }
3064                         /* Test for completion */
3065                         if ( pdrcode == HFA384x_PDR_END_OF_PDA) {
3066                                 morepdrs = 0;
3067                         }
3068
3069                         /* Move to the next pdr (if necessary) */
3070                         if ( morepdrs ) {
3071                                 /* note the access to pda[], need words here */
3072                                 currpdr += hfa384x2host_16(pda[currpdr]) + 1;
3073                         }
3074                 }
3075                 if ( pdaok ) {
3076                         WLAN_LOG_INFO(
3077                                 "PDA Read from 0x%08x in %s space.\n",
3078                                 pdaloc[i].cardaddr,
3079                                 pdaloc[i].auxctl == 0 ? "EXTDS" :
3080                                 pdaloc[i].auxctl == 1 ? "NV" :
3081                                 pdaloc[i].auxctl == 2 ? "PHY" :
3082                                 pdaloc[i].auxctl == 3 ? "ICSRAM" :
3083                                 "<bogus auxctl>");
3084                         break;
3085                 }
3086         }
3087         result = pdaok ? 0 : -ENODATA;
3088
3089         if ( result ) {
3090                 WLAN_LOG_DEBUG(3,"Failure: pda is not okay\n");
3091         }
3092
3093         DBFEXIT;
3094         return result;
3095 }
3096
3097
3098 /*----------------------------------------------------------------
3099 * hfa384x_drvr_setconfig
3100 *
3101 * Performs the sequence necessary to write a config/info item.
3102 *
3103 * Arguments:
3104 *       hw              device structure
3105 *       rid             config/info record id (in host order)
3106 *       buf             host side record buffer
3107 *       len             buffer length (in bytes)
3108 *
3109 * Returns:
3110 *       0               success
3111 *       >0              f/w reported error - f/w status code
3112 *       <0              driver reported error
3113 *
3114 * Side effects:
3115 *
3116 * Call context:
3117 *       process
3118 ----------------------------------------------------------------*/
3119 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
3120 {
3121         return hfa384x_dowrid_wait(hw, rid, buf, len);
3122 }
3123
3124 /*----------------------------------------------------------------
3125 * hfa384x_drvr_start
3126 *
3127 * Issues the MAC initialize command, sets up some data structures,
3128 * and enables the interrupts.  After this function completes, the
3129 * low-level stuff should be ready for any/all commands.
3130 *
3131 * Arguments:
3132 *       hw              device structure
3133 * Returns:
3134 *       0               success
3135 *       >0              f/w reported error - f/w status code
3136 *       <0              driver reported error
3137 *
3138 * Side effects:
3139 *
3140 * Call context:
3141 *       process
3142 ----------------------------------------------------------------*/
3143 int hfa384x_drvr_start(hfa384x_t *hw)
3144 {
3145         int             result;
3146         DBFENTER;
3147
3148         might_sleep();
3149
3150         if (usb_clear_halt(hw->usb, hw->endp_in)) {
3151                 WLAN_LOG_ERROR(
3152                         "Failed to reset bulk in endpoint.\n");
3153         }
3154
3155         if (usb_clear_halt(hw->usb, hw->endp_out)) {
3156                 WLAN_LOG_ERROR(
3157                         "Failed to reset bulk out endpoint.\n");
3158         }
3159
3160         /* Synchronous unlink, in case we're trying to restart the driver */
3161         usb_kill_urb(&hw->rx_urb);
3162
3163         /* Post the IN urb */
3164         result = submit_rx_urb(hw, GFP_KERNEL);
3165         if (result != 0) {
3166                 WLAN_LOG_ERROR(
3167                         "Fatal, failed to submit RX URB, result=%d\n",
3168                         result);
3169                 goto done;
3170         }
3171
3172         /* call initialize */
3173         result = hfa384x_cmd_initialize(hw);
3174         if (result != 0) {
3175                 usb_kill_urb(&hw->rx_urb);
3176                 WLAN_LOG_ERROR(
3177                         "cmd_initialize() failed, result=%d\n",
3178                         result);
3179                 goto done;
3180         }
3181
3182         hw->state = HFA384x_STATE_RUNNING;
3183
3184 done:
3185         DBFEXIT;
3186         return result;
3187 }
3188
3189
3190 /*----------------------------------------------------------------
3191 * hfa384x_drvr_stop
3192 *
3193 * Shuts down the MAC to the point where it is safe to unload the
3194 * driver.  Any subsystem that may be holding a data or function
3195 * ptr into the driver must be cleared/deinitialized.
3196 *
3197 * Arguments:
3198 *       hw              device structure
3199 * Returns:
3200 *       0               success
3201 *       >0              f/w reported error - f/w status code
3202 *       <0              driver reported error
3203 *
3204 * Side effects:
3205 *
3206 * Call context:
3207 *       process
3208 ----------------------------------------------------------------*/
3209 int
3210 hfa384x_drvr_stop(hfa384x_t *hw)
3211 {
3212         int     result = 0;
3213         int     i;
3214         DBFENTER;
3215
3216         might_sleep();
3217
3218         /* There's no need for spinlocks here. The USB "disconnect"
3219          * function sets this "removed" flag and then calls us.
3220          */
3221         if ( !hw->wlandev->hwremoved ) {
3222                 /* Call initialize to leave the MAC in its 'reset' state */
3223                 hfa384x_cmd_initialize(hw);
3224
3225                 /* Cancel the rxurb */
3226                 usb_kill_urb(&hw->rx_urb);
3227         }
3228
3229         hw->link_status = HFA384x_LINK_NOTCONNECTED;
3230         hw->state = HFA384x_STATE_INIT;
3231
3232         del_timer_sync(&hw->commsqual_timer);
3233
3234         /* Clear all the port status */
3235         for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
3236                 hw->port_enabled[i] = 0;
3237         }
3238
3239         DBFEXIT;
3240         return result;
3241 }
3242
3243 /*----------------------------------------------------------------
3244 * hfa384x_drvr_txframe
3245 *
3246 * Takes a frame from prism2sta and queues it for transmission.
3247 *
3248 * Arguments:
3249 *       hw              device structure
3250 *       skb             packet buffer struct.  Contains an 802.11
3251 *                       data frame.
3252 *       p80211_hdr      points to the 802.11 header for the packet.
3253 * Returns:
3254 *       0               Success and more buffs available
3255 *       1               Success but no more buffs
3256 *       2               Allocation failure
3257 *       4               Buffer full or queue busy
3258 *
3259 * Side effects:
3260 *
3261 * Call context:
3262 *       interrupt
3263 ----------------------------------------------------------------*/
3264 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb, p80211_hdr_t *p80211_hdr, p80211_metawep_t *p80211_wep)
3265
3266 {
3267         int             usbpktlen = sizeof(hfa384x_tx_frame_t);
3268         int             result;
3269         int             ret;
3270         char            *ptr;
3271
3272         DBFENTER;
3273
3274         if (hw->tx_urb.status == -EINPROGRESS) {
3275                 WLAN_LOG_WARNING("TX URB already in use\n");
3276                 result = 3;
3277                 goto exit;
3278         }
3279
3280         /* Build Tx frame structure */
3281         /* Set up the control field */
3282         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
3283
3284         /* Setup the usb type field */
3285         hw->txbuff.type = host2hfa384x_16(HFA384x_USB_TXFRM);
3286
3287         /* Set up the sw_support field to identify this frame */
3288         hw->txbuff.txfrm.desc.sw_support = 0x0123;
3289
3290 /* Tx complete and Tx exception disable per dleach.  Might be causing
3291  * buf depletion
3292  */
3293 //#define DOEXC  SLP -- doboth breaks horribly under load, doexc less so.
3294 #if defined(DOBOTH)
3295         hw->txbuff.txfrm.desc.tx_control =
3296                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3297                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
3298 #elif defined(DOEXC)
3299         hw->txbuff.txfrm.desc.tx_control =
3300                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3301                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
3302 #else
3303         hw->txbuff.txfrm.desc.tx_control =
3304                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3305                 HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
3306 #endif
3307         hw->txbuff.txfrm.desc.tx_control =
3308                 host2hfa384x_16(hw->txbuff.txfrm.desc.tx_control);
3309
3310         /* copy the header over to the txdesc */
3311         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr, sizeof(p80211_hdr_t));
3312
3313         /* if we're using host WEP, increase size by IV+ICV */
3314         if (p80211_wep->data) {
3315                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len+8);
3316                 // hw->txbuff.txfrm.desc.tx_control |= HFA384x_TX_NOENCRYPT_SET(1);
3317                 usbpktlen+=8;
3318         } else {
3319                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len);
3320         }
3321
3322         usbpktlen += skb->len;
3323
3324         /* copy over the WEP IV if we are using host WEP */
3325         ptr = hw->txbuff.txfrm.data;
3326         if (p80211_wep->data) {
3327                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
3328                 ptr+= sizeof(p80211_wep->iv);
3329                 memcpy(ptr, p80211_wep->data, skb->len);
3330         } else {
3331                 memcpy(ptr, skb->data, skb->len);
3332         }
3333         /* copy over the packet data */
3334         ptr+= skb->len;
3335
3336         /* copy over the WEP ICV if we are using host WEP */
3337         if (p80211_wep->data) {
3338                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
3339         }
3340
3341         /* Send the USB packet */
3342         usb_fill_bulk_urb( &(hw->tx_urb), hw->usb,
3343                        hw->endp_out,
3344                        &(hw->txbuff), ROUNDUP64(usbpktlen),
3345                        hfa384x_usbout_callback, hw->wlandev );
3346         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
3347
3348         result = 1;
3349         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
3350         if ( ret != 0 ) {
3351                 WLAN_LOG_ERROR(
3352                         "submit_tx_urb() failed, error=%d\n", ret);
3353                 result = 3;
3354         }
3355
3356  exit:
3357         DBFEXIT;
3358         return result;
3359 }
3360
3361 void hfa384x_tx_timeout(wlandevice_t *wlandev)
3362 {
3363         hfa384x_t       *hw = wlandev->priv;
3364         unsigned long flags;
3365
3366         DBFENTER;
3367
3368         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3369
3370         if ( !hw->wlandev->hwremoved &&
3371              /* Note the bitwise OR, not the logical OR. */
3372              ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) |
3373                !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) ) )
3374         {
3375                 schedule_work(&hw->usb_work);
3376         }
3377
3378         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3379
3380         DBFEXIT;
3381 }
3382
3383 /*----------------------------------------------------------------
3384 * hfa384x_usbctlx_reaper_task
3385 *
3386 * Tasklet to delete dead CTLX objects
3387 *
3388 * Arguments:
3389 *       data    ptr to a hfa384x_t
3390 *
3391 * Returns:
3392 *
3393 * Call context:
3394 *       Interrupt
3395 ----------------------------------------------------------------*/
3396 static void hfa384x_usbctlx_reaper_task(unsigned long data)
3397 {
3398         hfa384x_t       *hw = (hfa384x_t*)data;
3399         struct list_head *entry;
3400         struct list_head *temp;
3401         unsigned long   flags;
3402
3403         DBFENTER;
3404
3405         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3406
3407         /* This list is guaranteed to be empty if someone
3408          * has unplugged the adapter.
3409          */
3410         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
3411                 hfa384x_usbctlx_t       *ctlx;
3412
3413                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3414                 list_del(&ctlx->list);
3415                 kfree(ctlx);
3416         }
3417
3418         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3419
3420         DBFEXIT;
3421 }
3422
3423 /*----------------------------------------------------------------
3424 * hfa384x_usbctlx_completion_task
3425 *
3426 * Tasklet to call completion handlers for returned CTLXs
3427 *
3428 * Arguments:
3429 *       data    ptr to hfa384x_t
3430 *
3431 * Returns:
3432 *       Nothing
3433 *
3434 * Call context:
3435 *       Interrupt
3436 ----------------------------------------------------------------*/
3437 static void hfa384x_usbctlx_completion_task(unsigned long data)
3438 {
3439         hfa384x_t *hw = (hfa384x_t*)data;
3440         struct list_head *entry;
3441         struct list_head *temp;
3442         unsigned long flags;
3443
3444         int reap = 0;
3445
3446         DBFENTER;
3447
3448         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3449
3450         /* This list is guaranteed to be empty if someone
3451          * has unplugged the adapter ...
3452          */
3453         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
3454                 hfa384x_usbctlx_t *ctlx;
3455
3456                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3457
3458                 /* Call the completion function that this
3459                  * command was assigned, assuming it has one.
3460                  */
3461                 if ( ctlx->cmdcb != NULL ) {
3462                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3463                         ctlx->cmdcb(hw, ctlx);
3464                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3465
3466                         /* Make sure we don't try and complete
3467                          * this CTLX more than once!
3468                          */
3469                         ctlx->cmdcb = NULL;
3470
3471                         /* Did someone yank the adapter out
3472                          * while our list was (briefly) unlocked?
3473                          */
3474                         if ( hw->wlandev->hwremoved )
3475                         {
3476                                 reap = 0;
3477                                 break;
3478                         }
3479                 }
3480
3481                 /*
3482                  * "Reapable" CTLXs are ones which don't have any
3483                  * threads waiting for them to die. Hence they must
3484                  * be delivered to The Reaper!
3485                  */
3486                 if ( ctlx->reapable ) {
3487                         /* Move the CTLX off the "completing" list (hopefully)
3488                          * on to the "reapable" list where the reaper task
3489                          * can find it. And "reapable" means that this CTLX
3490                          * isn't sitting on a wait-queue somewhere.
3491                          */
3492                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
3493                         reap = 1;
3494                 }
3495
3496                 complete(&ctlx->done);
3497         }
3498         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3499
3500         if (reap)
3501                 tasklet_schedule(&hw->reaper_bh);
3502
3503         DBFEXIT;
3504 }
3505
3506 /*----------------------------------------------------------------
3507 * unlocked_usbctlx_cancel_async
3508 *
3509 * Mark the CTLX dead asynchronously, and ensure that the
3510 * next command on the queue is run afterwards.
3511 *
3512 * Arguments:
3513 *       hw      ptr to the hfa384x_t structure
3514 *       ctlx    ptr to a CTLX structure
3515 *
3516 * Returns:
3517 *       0       the CTLX's URB is inactive
3518 * -EINPROGRESS  the URB is currently being unlinked
3519 *
3520 * Call context:
3521 *       Either process or interrupt, but presumably interrupt
3522 ----------------------------------------------------------------*/
3523 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3524 {
3525         int ret;
3526
3527         DBFENTER;
3528
3529         /*
3530          * Try to delete the URB containing our request packet.
3531          * If we succeed, then its completion handler will be
3532          * called with a status of -ECONNRESET.
3533          */
3534         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3535         ret = usb_unlink_urb(&hw->ctlx_urb);
3536
3537         if (ret != -EINPROGRESS) {
3538                 /*
3539                  * The OUT URB had either already completed
3540                  * or was still in the pending queue, so the
3541                  * URB's completion function will not be called.
3542                  * We will have to complete the CTLX ourselves.
3543                  */
3544                 ctlx->state = CTLX_REQ_FAILED;
3545                 unlocked_usbctlx_complete(hw, ctlx);
3546                 ret = 0;
3547         }
3548
3549         DBFEXIT;
3550
3551         return ret;
3552 }
3553
3554 /*----------------------------------------------------------------
3555 * unlocked_usbctlx_complete
3556 *
3557 * A CTLX has completed.  It may have been successful, it may not
3558 * have been. At this point, the CTLX should be quiescent.  The URBs
3559 * aren't active and the timers should have been stopped.
3560 *
3561 * The CTLX is migrated to the "completing" queue, and the completing
3562 * tasklet is scheduled.
3563 *
3564 * Arguments:
3565 *       hw              ptr to a hfa384x_t structure
3566 *       ctlx            ptr to a ctlx structure
3567 *
3568 * Returns:
3569 *       nothing
3570 *
3571 * Side effects:
3572 *
3573 * Call context:
3574 *       Either, assume interrupt
3575 ----------------------------------------------------------------*/
3576 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3577 {
3578         DBFENTER;
3579
3580         /* Timers have been stopped, and ctlx should be in
3581          * a terminal state. Retire it from the "active"
3582          * queue.
3583          */
3584         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3585         tasklet_schedule(&hw->completion_bh);
3586
3587         switch (ctlx->state) {
3588         case CTLX_COMPLETE:
3589         case CTLX_REQ_FAILED:
3590                 /* This are the correct terminating states. */
3591                 break;
3592
3593         default:
3594                 WLAN_LOG_ERROR("CTLX[%d] not in a terminating state(%s)\n",
3595                                hfa384x2host_16(ctlx->outbuf.type),
3596                                ctlxstr(ctlx->state));
3597                 break;
3598         } /* switch */
3599
3600         DBFEXIT;
3601 }
3602
3603 /*----------------------------------------------------------------
3604 * hfa384x_usbctlxq_run
3605 *
3606 * Checks to see if the head item is running.  If not, starts it.
3607 *
3608 * Arguments:
3609 *       hw      ptr to hfa384x_t
3610 *
3611 * Returns:
3612 *       nothing
3613 *
3614 * Side effects:
3615 *
3616 * Call context:
3617 *       any
3618 ----------------------------------------------------------------*/
3619 static void
3620 hfa384x_usbctlxq_run(hfa384x_t  *hw)
3621 {
3622         unsigned long           flags;
3623         DBFENTER;
3624
3625         /* acquire lock */
3626         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3627
3628         /* Only one active CTLX at any one time, because there's no
3629          * other (reliable) way to match the response URB to the
3630          * correct CTLX.
3631          *
3632          * Don't touch any of these CTLXs if the hardware
3633          * has been removed or the USB subsystem is stalled.
3634          */
3635         if ( !list_empty(&hw->ctlxq.active) ||
3636              test_bit(WORK_TX_HALT, &hw->usb_flags) ||
3637              hw->wlandev->hwremoved )
3638                 goto unlock;
3639
3640         while ( !list_empty(&hw->ctlxq.pending) ) {
3641                 hfa384x_usbctlx_t       *head;
3642                 int                     result;
3643
3644                 /* This is the first pending command */
3645                 head = list_entry(hw->ctlxq.pending.next,
3646                                   hfa384x_usbctlx_t,
3647                                   list);
3648
3649                 /* We need to split this off to avoid a race condition */
3650                 list_move_tail(&head->list, &hw->ctlxq.active);
3651
3652                 /* Fill the out packet */
3653                 usb_fill_bulk_urb( &(hw->ctlx_urb), hw->usb,
3654                                    hw->endp_out,
3655                                    &(head->outbuf), ROUNDUP64(head->outbufsize),
3656                                    hfa384x_ctlxout_callback, hw);
3657                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3658
3659                 /* Now submit the URB and update the CTLX's state
3660                  */
3661                 if ((result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC)) == 0) {
3662                         /* This CTLX is now running on the active queue */
3663                         head->state = CTLX_REQ_SUBMITTED;
3664
3665                         /* Start the OUT wait timer */
3666                         hw->req_timer_done = 0;
3667                         hw->reqtimer.expires = jiffies + HZ;
3668                         add_timer(&hw->reqtimer);
3669
3670                         /* Start the IN wait timer */
3671                         hw->resp_timer_done = 0;
3672                         hw->resptimer.expires = jiffies + 2*HZ;
3673                         add_timer(&hw->resptimer);
3674
3675                         break;
3676                 }
3677
3678                 if (result == -EPIPE) {
3679                         /* The OUT pipe needs resetting, so put
3680                          * this CTLX back in the "pending" queue
3681                          * and schedule a reset ...
3682                          */
3683                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
3684                                          hw->wlandev->netdev->name);
3685                         list_move(&head->list, &hw->ctlxq.pending);
3686                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3687                         schedule_work(&hw->usb_work);
3688                         break;
3689                 }
3690
3691                 if (result == -ESHUTDOWN) {
3692                         WLAN_LOG_WARNING("%s urb shutdown!\n",
3693                                          hw->wlandev->netdev->name);
3694                         break;
3695                 }
3696
3697                 WLAN_LOG_ERROR("Failed to submit CTLX[%d]: error=%d\n",
3698                                hfa384x2host_16(head->outbuf.type), result);
3699                 unlocked_usbctlx_complete(hw, head);
3700         } /* while */
3701
3702         unlock:
3703         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3704
3705         DBFEXIT;
3706 }
3707
3708
3709 /*----------------------------------------------------------------
3710 * hfa384x_usbin_callback
3711 *
3712 * Callback for URBs on the BULKIN endpoint.
3713 *
3714 * Arguments:
3715 *       urb             ptr to the completed urb
3716 *
3717 * Returns:
3718 *       nothing
3719 *
3720 * Side effects:
3721 *
3722 * Call context:
3723 *       interrupt
3724 ----------------------------------------------------------------*/
3725 #ifdef URB_ONLY_CALLBACK
3726 static void hfa384x_usbin_callback(struct urb *urb)
3727 #else
3728 static void hfa384x_usbin_callback(struct urb *urb, struct pt_regs *regs)
3729 #endif
3730 {
3731         wlandevice_t            *wlandev = urb->context;
3732         hfa384x_t               *hw;
3733         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3734         struct sk_buff          *skb = NULL;
3735         int                     result;
3736         int                     urb_status;
3737         u16                     type;
3738
3739         enum USBIN_ACTION {
3740                 HANDLE,
3741                 RESUBMIT,
3742                 ABORT
3743         } action;
3744
3745         DBFENTER;
3746
3747         if ( !wlandev ||
3748              !wlandev->netdev ||
3749              !netif_device_present(wlandev->netdev) )
3750                 goto exit;
3751
3752         hw = wlandev->priv;
3753         if (!hw)
3754                 goto exit;
3755
3756         skb = hw->rx_urb_skb;
3757         if (!skb || (skb->data != urb->transfer_buffer)) {
3758                 BUG();
3759         }
3760         hw->rx_urb_skb = NULL;
3761
3762         /* Check for error conditions within the URB */
3763         switch (urb->status) {
3764         case 0:
3765                 action = HANDLE;
3766
3767                 /* Check for short packet */
3768                 if ( urb->actual_length == 0 ) {
3769                         ++(wlandev->linux_stats.rx_errors);
3770                         ++(wlandev->linux_stats.rx_length_errors);
3771                         action = RESUBMIT;
3772                 }
3773                 break;
3774
3775         case -EPIPE:
3776                 WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
3777                                  wlandev->netdev->name);
3778                 if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
3779                         schedule_work(&hw->usb_work);
3780                 ++(wlandev->linux_stats.rx_errors);
3781                 action = ABORT;
3782                 break;
3783
3784         case -EILSEQ:
3785         case -ETIMEDOUT:
3786         case -EPROTO:
3787                 if ( !test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3788                      !timer_pending(&hw->throttle) ) {
3789                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3790                 }
3791                 ++(wlandev->linux_stats.rx_errors);
3792                 action = ABORT;
3793                 break;
3794
3795         case -EOVERFLOW:
3796                 ++(wlandev->linux_stats.rx_over_errors);
3797                 action = RESUBMIT;
3798                 break;
3799
3800         case -ENODEV:
3801         case -ESHUTDOWN:
3802                 WLAN_LOG_DEBUG(3,"status=%d, device removed.\n", urb->status);
3803                 action = ABORT;
3804                 break;
3805
3806         case -ENOENT:
3807         case -ECONNRESET:
3808                 WLAN_LOG_DEBUG(3,"status=%d, urb explicitly unlinked.\n", urb->status);
3809                 action = ABORT;
3810                 break;
3811
3812         default:
3813                 WLAN_LOG_DEBUG(3,"urb status=%d, transfer flags=0x%x\n",
3814                                  urb->status, urb->transfer_flags);
3815                 ++(wlandev->linux_stats.rx_errors);
3816                 action = RESUBMIT;
3817                 break;
3818         }
3819
3820         urb_status = urb->status;
3821
3822         if (action != ABORT) {
3823                 /* Repost the RX URB */
3824                 result = submit_rx_urb(hw, GFP_ATOMIC);
3825
3826                 if (result != 0) {
3827                         WLAN_LOG_ERROR(
3828                                 "Fatal, failed to resubmit rx_urb. error=%d\n",
3829                                 result);
3830                 }
3831         }
3832
3833         /* Handle any USB-IN packet */
3834         /* Note: the check of the sw_support field, the type field doesn't
3835          *       have bit 12 set like the docs suggest.
3836          */
3837         type = hfa384x2host_16(usbin->type);
3838         if (HFA384x_USB_ISRXFRM(type)) {
3839                 if (action == HANDLE) {
3840                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3841                                 hfa384x_usbin_txcompl(wlandev, usbin);
3842                         } else {
3843                                 skb_put(skb, sizeof(*usbin));
3844                                 hfa384x_usbin_rx(wlandev, skb);
3845                                 skb = NULL;
3846                         }
3847                 }
3848                 goto exit;
3849         }
3850         if (HFA384x_USB_ISTXFRM(type)) {
3851                 if (action == HANDLE)
3852                         hfa384x_usbin_txcompl(wlandev, usbin);
3853                 goto exit;
3854         }
3855         switch (type) {
3856         case HFA384x_USB_INFOFRM:
3857                 if (action == ABORT)
3858                         goto exit;
3859                 if (action == HANDLE)
3860                         hfa384x_usbin_info(wlandev, usbin);
3861                 break;
3862
3863         case HFA384x_USB_CMDRESP:
3864         case HFA384x_USB_WRIDRESP:
3865         case HFA384x_USB_RRIDRESP:
3866         case HFA384x_USB_WMEMRESP:
3867         case HFA384x_USB_RMEMRESP:
3868                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3869                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3870                 break;
3871
3872         case HFA384x_USB_BUFAVAIL:
3873                 WLAN_LOG_DEBUG(3,"Received BUFAVAIL packet, frmlen=%d\n",
3874                         usbin->bufavail.frmlen);
3875                 break;
3876
3877         case HFA384x_USB_ERROR:
3878                 WLAN_LOG_DEBUG(3,"Received USB_ERROR packet, errortype=%d\n",
3879                         usbin->usberror.errortype);
3880                 break;
3881
3882         default:
3883                 WLAN_LOG_DEBUG(3,"Unrecognized USBIN packet, type=%x, status=%d\n",
3884                         usbin->type, urb_status);
3885                 break;
3886         } /* switch */
3887
3888 exit:
3889
3890         if (skb)
3891                 dev_kfree_skb(skb);
3892
3893         DBFEXIT;
3894 }
3895
3896
3897 /*----------------------------------------------------------------
3898 * hfa384x_usbin_ctlx
3899 *
3900 * We've received a URB containing a Prism2 "response" message.
3901 * This message needs to be matched up with a CTLX on the active
3902 * queue and our state updated accordingly.
3903 *
3904 * Arguments:
3905 *       hw              ptr to hfa384x_t
3906 *       usbin           ptr to USB IN packet
3907 *       urb_status      status of this Bulk-In URB
3908 *
3909 * Returns:
3910 *       nothing
3911 *
3912 * Side effects:
3913 *
3914 * Call context:
3915 *       interrupt
3916 ----------------------------------------------------------------*/
3917 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3918                                int urb_status)
3919 {
3920         hfa384x_usbctlx_t       *ctlx;
3921         int                     run_queue = 0;
3922         unsigned long           flags;
3923
3924         DBFENTER;
3925
3926 retry:
3927         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3928
3929         /* There can be only one CTLX on the active queue
3930          * at any one time, and this is the CTLX that the
3931          * timers are waiting for.
3932          */
3933         if ( list_empty(&hw->ctlxq.active) ) {
3934                 goto unlock;
3935         }
3936
3937         /* Remove the "response timeout". It's possible that
3938          * we are already too late, and that the timeout is
3939          * already running. And that's just too bad for us,
3940          * because we could lose our CTLX from the active
3941          * queue here ...
3942          */
3943         if (del_timer(&hw->resptimer) == 0) {
3944                 if (hw->resp_timer_done == 0) {
3945                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3946                         goto retry;
3947                 }
3948         }
3949         else {
3950                 hw->resp_timer_done = 1;
3951         }
3952
3953         ctlx = get_active_ctlx(hw);
3954
3955         if (urb_status != 0) {
3956                 /*
3957                  * Bad CTLX, so get rid of it. But we only
3958                  * remove it from the active queue if we're no
3959                  * longer expecting the OUT URB to complete.
3960                  */
3961                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3962                         run_queue = 1;
3963         } else {
3964                 const u16 intype = (usbin->type&~host2hfa384x_16(0x8000));
3965
3966                 /*
3967                  * Check that our message is what we're expecting ...
3968                  */
3969                 if (ctlx->outbuf.type != intype) {
3970                         WLAN_LOG_WARNING("Expected IN[%d], received IN[%d] - ignored.\n",
3971                                          hfa384x2host_16(ctlx->outbuf.type),
3972                                          hfa384x2host_16(intype));
3973                         goto unlock;
3974                 }
3975
3976                 /* This URB has succeeded, so grab the data ... */
3977                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3978
3979                 switch (ctlx->state) {
3980                 case CTLX_REQ_SUBMITTED:
3981                         /*
3982                          * We have received our response URB before
3983                          * our request has been acknowledged. Odd,
3984                          * but our OUT URB is still alive...
3985                          */
3986                         WLAN_LOG_DEBUG(0, "Causality violation: please reboot Universe, or email linux-wlan-devel@lists.linux-wlan.com\n");
3987                         ctlx->state = CTLX_RESP_COMPLETE;
3988                         break;
3989
3990                 case CTLX_REQ_COMPLETE:
3991                         /*
3992                          * This is the usual path: our request
3993                          * has already been acknowledged, and
3994                          * now we have received the reply too.
3995                          */
3996                         ctlx->state = CTLX_COMPLETE;
3997                         unlocked_usbctlx_complete(hw, ctlx);
3998                         run_queue = 1;
3999                         break;
4000
4001                 default:
4002                         /*
4003                          * Throw this CTLX away ...
4004                          */
4005                         WLAN_LOG_ERROR("Matched IN URB, CTLX[%d] in invalid state(%s)."
4006                                        " Discarded.\n",
4007                                        hfa384x2host_16(ctlx->outbuf.type),
4008                                        ctlxstr(ctlx->state));
4009                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
4010                                 run_queue = 1;
4011                         break;
4012                 } /* switch */
4013         }
4014
4015 unlock:
4016         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4017
4018         if (run_queue)
4019                 hfa384x_usbctlxq_run(hw);
4020
4021         DBFEXIT;
4022 }
4023
4024
4025 /*----------------------------------------------------------------
4026 * hfa384x_usbin_txcompl
4027 *
4028 * At this point we have the results of a previous transmit.
4029 *
4030 * Arguments:
4031 *       wlandev         wlan device
4032 *       usbin           ptr to the usb transfer buffer
4033 *
4034 * Returns:
4035 *       nothing
4036 *
4037 * Side effects:
4038 *
4039 * Call context:
4040 *       interrupt
4041 ----------------------------------------------------------------*/
4042 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4043 {
4044         u16                     status;
4045         DBFENTER;
4046
4047         status = hfa384x2host_16(usbin->type); /* yeah I know it says type...*/
4048
4049         /* Was there an error? */
4050         if (HFA384x_TXSTATUS_ISERROR(status)) {
4051                 prism2sta_ev_txexc(wlandev, status);
4052         } else {
4053                 prism2sta_ev_tx(wlandev, status);
4054         }
4055         // prism2sta_ev_alloc(wlandev);
4056
4057         DBFEXIT;
4058 }
4059
4060
4061 /*----------------------------------------------------------------
4062 * hfa384x_usbin_rx
4063 *
4064 * At this point we have a successful received a rx frame packet.
4065 *
4066 * Arguments:
4067 *       wlandev         wlan device
4068 *       usbin           ptr to the usb transfer buffer
4069 *
4070 * Returns:
4071 *       nothing
4072 *
4073 * Side effects:
4074 *
4075 * Call context:
4076 *       interrupt
4077 ----------------------------------------------------------------*/
4078 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
4079 {
4080         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) skb->data;
4081         hfa384x_t               *hw = wlandev->priv;
4082         int                     hdrlen;
4083         p80211_rxmeta_t         *rxmeta;
4084         u16                  data_len;
4085         u16                  fc;
4086
4087         DBFENTER;
4088
4089         /* Byte order convert once up front. */
4090         usbin->rxfrm.desc.status =
4091                 hfa384x2host_16(usbin->rxfrm.desc.status);
4092         usbin->rxfrm.desc.time =
4093                 hfa384x2host_32(usbin->rxfrm.desc.time);
4094
4095         /* Now handle frame based on port# */
4096         switch( HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) )
4097         {
4098         case 0:
4099                 fc = ieee2host16(usbin->rxfrm.desc.frame_control);
4100
4101                 /* If exclude and we receive an unencrypted, drop it */
4102                 if ( (wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
4103                      !WLAN_GET_FC_ISWEP(fc)){
4104                         goto done;
4105                 }
4106
4107                 data_len = hfa384x2host_16(usbin->rxfrm.desc.data_len);
4108
4109                 /* How much header data do we have? */
4110                 hdrlen = p80211_headerlen(fc);
4111
4112                 /* Pull off the descriptor */
4113                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
4114
4115                 /* Now shunt the header block up against the data block
4116                  * with an "overlapping" copy
4117                  */
4118                 memmove(skb_push(skb, hdrlen),
4119                         &usbin->rxfrm.desc.frame_control,
4120                         hdrlen);
4121
4122                 skb->dev = wlandev->netdev;
4123                 skb->dev->last_rx = jiffies;
4124
4125                 /* And set the frame length properly */
4126                 skb_trim(skb, data_len + hdrlen);
4127
4128                 /* The prism2 series does not return the CRC */
4129                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
4130
4131                 skb_reset_mac_header(skb);
4132
4133                 /* Attach the rxmeta, set some stuff */
4134                 p80211skb_rxmeta_attach(wlandev, skb);
4135                 rxmeta = P80211SKB_RXMETA(skb);
4136                 rxmeta->mactime = usbin->rxfrm.desc.time;
4137                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
4138                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
4139                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
4140
4141                 prism2sta_ev_rx(wlandev, skb);
4142
4143                 break;
4144
4145         case 7:
4146                 if ( ! HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status) ) {
4147                         /* Copy to wlansnif skb */
4148                         hfa384x_int_rxmonitor( wlandev, &usbin->rxfrm);
4149                         dev_kfree_skb(skb);
4150                 } else {
4151                         WLAN_LOG_DEBUG(3,"Received monitor frame: FCSerr set\n");
4152                 }
4153                 break;
4154
4155         default:
4156                 WLAN_LOG_WARNING("Received frame on unsupported port=%d\n",
4157                         HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) );
4158                 goto done;
4159                 break;
4160         }
4161
4162 done:
4163         DBFEXIT;
4164         return;
4165 }
4166
4167 /*----------------------------------------------------------------
4168 * hfa384x_int_rxmonitor
4169 *
4170 * Helper function for int_rx.  Handles monitor frames.
4171 * Note that this function allocates space for the FCS and sets it
4172 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
4173 * higher layers expect it.  0xffffffff is used as a flag to indicate
4174 * the FCS is bogus.
4175 *
4176 * Arguments:
4177 *       wlandev         wlan device structure
4178 *       rxfrm           rx descriptor read from card in int_rx
4179 *
4180 * Returns:
4181 *       nothing
4182 *
4183 * Side effects:
4184 *       Allocates an skb and passes it up via the PF_PACKET interface.
4185 * Call context:
4186 *       interrupt
4187 ----------------------------------------------------------------*/
4188 static void hfa384x_int_rxmonitor( wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm)
4189 {
4190         hfa384x_rx_frame_t              *rxdesc = &(rxfrm->desc);
4191         unsigned int                            hdrlen = 0;
4192         unsigned int                            datalen = 0;
4193         unsigned int                            skblen = 0;
4194         p80211msg_lnxind_wlansniffrm_t  *msg;
4195         u8                              *datap;
4196         u16                             fc;
4197         struct sk_buff                  *skb;
4198         hfa384x_t                       *hw = wlandev->priv;
4199
4200
4201         DBFENTER;
4202         /* Don't forget the status, time, and data_len fields are in host order */
4203         /* Figure out how big the frame is */
4204         fc = ieee2host16(rxdesc->frame_control);
4205         hdrlen = p80211_headerlen(fc);
4206         datalen = hfa384x2host_16(rxdesc->data_len);
4207
4208         /* Allocate an ind message+framesize skb */
4209         skblen = sizeof(p80211msg_lnxind_wlansniffrm_t) +
4210                 hdrlen + datalen + WLAN_CRC_LEN;
4211
4212         /* sanity check the length */
4213         if ( skblen >
4214                 (sizeof(p80211msg_lnxind_wlansniffrm_t) +
4215                 WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN) ) {
4216                 WLAN_LOG_DEBUG(1, "overlen frm: len=%zd\n",
4217                         skblen - sizeof(p80211msg_lnxind_wlansniffrm_t));
4218         }
4219
4220         if ( (skb = dev_alloc_skb(skblen)) == NULL ) {
4221                 WLAN_LOG_ERROR("alloc_skb failed trying to allocate %d bytes\n", skblen);
4222                 return;
4223         }
4224
4225         /* only prepend the prism header if in the right mode */
4226         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4227             (hw->sniffhdr == 0)) {
4228                 datap = skb_put(skb, sizeof(p80211msg_lnxind_wlansniffrm_t));
4229                 msg = (p80211msg_lnxind_wlansniffrm_t*) datap;
4230
4231                 /* Initialize the message members */
4232                 msg->msgcode = DIDmsg_lnxind_wlansniffrm;
4233                 msg->msglen = sizeof(p80211msg_lnxind_wlansniffrm_t);
4234                 strcpy(msg->devname, wlandev->name);
4235
4236                 msg->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
4237                 msg->hosttime.status = 0;
4238                 msg->hosttime.len = 4;
4239                 msg->hosttime.data = jiffies;
4240
4241                 msg->mactime.did = DIDmsg_lnxind_wlansniffrm_mactime;
4242                 msg->mactime.status = 0;
4243                 msg->mactime.len = 4;
4244                 msg->mactime.data = rxdesc->time;
4245
4246                 msg->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
4247                 msg->channel.status = 0;
4248                 msg->channel.len = 4;
4249                 msg->channel.data = hw->sniff_channel;
4250
4251                 msg->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
4252                 msg->rssi.status = P80211ENUM_msgitem_status_no_value;
4253                 msg->rssi.len = 4;
4254                 msg->rssi.data = 0;
4255
4256                 msg->sq.did = DIDmsg_lnxind_wlansniffrm_sq;
4257                 msg->sq.status = P80211ENUM_msgitem_status_no_value;
4258                 msg->sq.len = 4;
4259                 msg->sq.data = 0;
4260
4261                 msg->signal.did = DIDmsg_lnxind_wlansniffrm_signal;
4262                 msg->signal.status = 0;
4263                 msg->signal.len = 4;
4264                 msg->signal.data = rxdesc->signal;
4265
4266                 msg->noise.did = DIDmsg_lnxind_wlansniffrm_noise;
4267                 msg->noise.status = 0;
4268                 msg->noise.len = 4;
4269                 msg->noise.data = rxdesc->silence;
4270
4271                 msg->rate.did = DIDmsg_lnxind_wlansniffrm_rate;
4272                 msg->rate.status = 0;
4273                 msg->rate.len = 4;
4274                 msg->rate.data = rxdesc->rate / 5; /* set to 802.11 units */
4275
4276                 msg->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
4277                 msg->istx.status = 0;
4278                 msg->istx.len = 4;
4279                 msg->istx.data = P80211ENUM_truth_false;
4280
4281                 msg->frmlen.did = DIDmsg_lnxind_wlansniffrm_frmlen;
4282                 msg->frmlen.status = 0;
4283                 msg->frmlen.len = 4;
4284                 msg->frmlen.data = hdrlen + datalen + WLAN_CRC_LEN;
4285         } else if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4286                    (hw->sniffhdr != 0)) {
4287                 p80211_caphdr_t         *caphdr;
4288                 /* The NEW header format! */
4289                 datap = skb_put(skb, sizeof(p80211_caphdr_t));
4290                 caphdr = (p80211_caphdr_t*) datap;
4291
4292                 caphdr->version =       htonl(P80211CAPTURE_VERSION);
4293                 caphdr->length =        htonl(sizeof(p80211_caphdr_t));
4294                 caphdr->mactime =       __cpu_to_be64(rxdesc->time) * 1000;
4295                 caphdr->hosttime =      __cpu_to_be64(jiffies);
4296                 caphdr->phytype =       htonl(4); /* dss_dot11_b */
4297                 caphdr->channel =       htonl(hw->sniff_channel);
4298                 caphdr->datarate =      htonl(rxdesc->rate);
4299                 caphdr->antenna =       htonl(0); /* unknown */
4300                 caphdr->priority =      htonl(0); /* unknown */
4301                 caphdr->ssi_type =      htonl(3); /* rssi_raw */
4302                 caphdr->ssi_signal =    htonl(rxdesc->signal);
4303                 caphdr->ssi_noise =     htonl(rxdesc->silence);
4304                 caphdr->preamble =      htonl(0); /* unknown */
4305                 caphdr->encoding =      htonl(1); /* cck */
4306         }
4307
4308         /* Copy the 802.11 header to the skb (ctl frames may be less than a full header) */
4309         datap = skb_put(skb, hdrlen);
4310         memcpy( datap, &(rxdesc->frame_control), hdrlen);
4311
4312         /* If any, copy the data from the card to the skb */
4313         if ( datalen > 0 )
4314         {
4315                 datap = skb_put(skb, datalen);
4316                 memcpy(datap, rxfrm->data, datalen);
4317
4318                 /* check for unencrypted stuff if WEP bit set. */
4319                 if (*(datap - hdrlen + 1) & 0x40) // wep set
4320                   if ((*(datap) == 0xaa) && (*(datap+1) == 0xaa))
4321                     *(datap - hdrlen + 1) &= 0xbf; // clear wep; it's the 802.2 header!
4322         }
4323
4324         if (hw->sniff_fcs) {
4325                 /* Set the FCS */
4326                 datap = skb_put(skb, WLAN_CRC_LEN);
4327                 memset( datap, 0xff, WLAN_CRC_LEN);
4328         }
4329
4330         /* pass it back up */
4331         prism2sta_ev_rx(wlandev, skb);
4332
4333         DBFEXIT;
4334         return;
4335 }
4336
4337
4338
4339 /*----------------------------------------------------------------
4340 * hfa384x_usbin_info
4341 *
4342 * At this point we have a successful received a Prism2 info frame.
4343 *
4344 * Arguments:
4345 *       wlandev         wlan device
4346 *       usbin           ptr to the usb transfer buffer
4347 *
4348 * Returns:
4349 *       nothing
4350 *
4351 * Side effects:
4352 *
4353 * Call context:
4354 *       interrupt
4355 ----------------------------------------------------------------*/
4356 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4357 {
4358         DBFENTER;
4359
4360         usbin->infofrm.info.framelen = hfa384x2host_16(usbin->infofrm.info.framelen);
4361         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
4362
4363         DBFEXIT;
4364 }
4365
4366
4367
4368 /*----------------------------------------------------------------
4369 * hfa384x_usbout_callback
4370 *
4371 * Callback for URBs on the BULKOUT endpoint.
4372 *
4373 * Arguments:
4374 *       urb             ptr to the completed urb
4375 *
4376 * Returns:
4377 *       nothing
4378 *
4379 * Side effects:
4380 *
4381 * Call context:
4382 *       interrupt
4383 ----------------------------------------------------------------*/
4384 #ifdef URB_ONLY_CALLBACK
4385 static void hfa384x_usbout_callback(struct urb *urb)
4386 #else
4387 static void hfa384x_usbout_callback(struct urb *urb, struct pt_regs *regs)
4388 #endif
4389 {
4390         wlandevice_t            *wlandev = urb->context;
4391         hfa384x_usbout_t        *usbout = urb->transfer_buffer;
4392         DBFENTER;
4393
4394 #ifdef DEBUG_USB
4395         dbprint_urb(urb);
4396 #endif
4397
4398         if ( wlandev &&
4399              wlandev->netdev ) {
4400
4401                 switch(urb->status) {
4402                 case 0:
4403                         hfa384x_usbout_tx(wlandev, usbout);
4404                         break;
4405
4406                 case -EPIPE:
4407                 {
4408                         hfa384x_t *hw = wlandev->priv;
4409                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4410                                          wlandev->netdev->name);
4411                         if ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) )
4412                                 schedule_work(&hw->usb_work);
4413                         ++(wlandev->linux_stats.tx_errors);
4414                         break;
4415                 }
4416
4417                 case -EPROTO:
4418                 case -ETIMEDOUT:
4419                 case -EILSEQ:
4420                 {
4421                         hfa384x_t *hw = wlandev->priv;
4422
4423                         if ( !test_and_set_bit(THROTTLE_TX, &hw->usb_flags)
4424                              && !timer_pending(&hw->throttle) ) {
4425                                 mod_timer(&hw->throttle,
4426                                           jiffies + THROTTLE_JIFFIES);
4427                         }
4428                         ++(wlandev->linux_stats.tx_errors);
4429                         netif_stop_queue(wlandev->netdev);
4430                         break;
4431                 }
4432
4433                 case -ENOENT:
4434                 case -ESHUTDOWN:
4435                         /* Ignorable errors */
4436                         break;
4437
4438                 default:
4439                         WLAN_LOG_INFO("unknown urb->status=%d\n", urb->status);
4440                         ++(wlandev->linux_stats.tx_errors);
4441                         break;
4442                 } /* switch */
4443         }
4444
4445         DBFEXIT;
4446 }
4447
4448
4449 /*----------------------------------------------------------------
4450 * hfa384x_ctlxout_callback
4451 *
4452 * Callback for control data on the BULKOUT endpoint.
4453 *
4454 * Arguments:
4455 *       urb             ptr to the completed urb
4456 *
4457 * Returns:
4458 * nothing
4459 *
4460 * Side effects:
4461 *
4462 * Call context:
4463 * interrupt
4464 ----------------------------------------------------------------*/
4465 #ifdef URB_ONLY_CALLBACK
4466 static void hfa384x_ctlxout_callback(struct urb *urb)
4467 #else
4468 static void hfa384x_ctlxout_callback(struct urb *urb, struct pt_regs *regs)
4469 #endif
4470 {
4471         hfa384x_t       *hw = urb->context;
4472         int             delete_resptimer = 0;
4473         int             timer_ok = 1;
4474         int             run_queue = 0;
4475         hfa384x_usbctlx_t       *ctlx;
4476         unsigned long   flags;
4477
4478         DBFENTER;
4479
4480         WLAN_LOG_DEBUG(3,"urb->status=%d\n", urb->status);
4481 #ifdef DEBUG_USB
4482         dbprint_urb(urb);
4483 #endif
4484         if ( (urb->status == -ESHUTDOWN) ||
4485              (urb->status == -ENODEV) ||
4486              (hw == NULL) )
4487                 goto done;
4488
4489 retry:
4490         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4491
4492         /*
4493          * Only one CTLX at a time on the "active" list, and
4494          * none at all if we are unplugged. However, we can
4495          * rely on the disconnect function to clean everything
4496          * up if someone unplugged the adapter.
4497          */
4498         if ( list_empty(&hw->ctlxq.active) ) {
4499                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4500                 goto done;
4501         }
4502
4503         /*
4504          * Having something on the "active" queue means
4505          * that we have timers to worry about ...
4506          */
4507         if (del_timer(&hw->reqtimer) == 0) {
4508                 if (hw->req_timer_done == 0) {
4509                         /*
4510                          * This timer was actually running while we
4511                          * were trying to delete it. Let it terminate
4512                          * gracefully instead.
4513                          */
4514                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4515                         goto retry;
4516                 }
4517         }
4518         else {
4519                 hw->req_timer_done = 1;
4520         }
4521
4522         ctlx = get_active_ctlx(hw);
4523
4524         if ( urb->status == 0 ) {
4525                 /* Request portion of a CTLX is successful */
4526                 switch ( ctlx->state ) {
4527                 case CTLX_REQ_SUBMITTED:
4528                         /* This OUT-ACK received before IN */
4529                         ctlx->state = CTLX_REQ_COMPLETE;
4530                         break;
4531
4532                 case CTLX_RESP_COMPLETE:
4533                         /* IN already received before this OUT-ACK,
4534                          * so this command must now be complete.
4535                          */
4536                         ctlx->state = CTLX_COMPLETE;
4537                         unlocked_usbctlx_complete(hw, ctlx);
4538                         run_queue = 1;
4539                         break;
4540
4541                 default:
4542                         /* This is NOT a valid CTLX "success" state! */
4543                         WLAN_LOG_ERROR(
4544                             "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
4545                             hfa384x2host_16(ctlx->outbuf.type),
4546                             ctlxstr(ctlx->state), urb->status);
4547                         break;
4548                 } /* switch */
4549         } else {
4550                 /* If the pipe has stalled then we need to reset it */
4551                 if ( (urb->status == -EPIPE) &&
4552                       !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) ) {
4553                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4554                                          hw->wlandev->netdev->name);
4555                         schedule_work(&hw->usb_work);
4556                 }
4557
4558                 /* If someone cancels the OUT URB then its status
4559                  * should be either -ECONNRESET or -ENOENT.
4560                  */
4561                 ctlx->state = CTLX_REQ_FAILED;
4562                 unlocked_usbctlx_complete(hw, ctlx);
4563                 delete_resptimer = 1;
4564                 run_queue = 1;
4565         }
4566
4567  delresp:
4568         if (delete_resptimer) {
4569                 if ((timer_ok = del_timer(&hw->resptimer)) != 0) {
4570                         hw->resp_timer_done = 1;
4571                 }
4572         }
4573
4574         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4575
4576         if ( !timer_ok && (hw->resp_timer_done == 0) ) {
4577                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
4578                 goto delresp;
4579         }
4580
4581         if (run_queue)
4582                 hfa384x_usbctlxq_run(hw);
4583
4584  done:
4585         DBFEXIT;
4586 }
4587
4588
4589 /*----------------------------------------------------------------
4590 * hfa384x_usbctlx_reqtimerfn
4591 *
4592 * Timer response function for CTLX request timeouts.  If this
4593 * function is called, it means that the callback for the OUT
4594 * URB containing a Prism2.x XXX_Request was never called.
4595 *
4596 * Arguments:
4597 *       data            a ptr to the hfa384x_t
4598 *
4599 * Returns:
4600 *       nothing
4601 *
4602 * Side effects:
4603 *
4604 * Call context:
4605 *       interrupt
4606 ----------------------------------------------------------------*/
4607 static void
4608 hfa384x_usbctlx_reqtimerfn(unsigned long data)
4609 {
4610         hfa384x_t       *hw = (hfa384x_t*)data;
4611         unsigned long   flags;
4612         DBFENTER;
4613
4614         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4615
4616         hw->req_timer_done = 1;
4617
4618         /* Removing the hardware automatically empties
4619          * the active list ...
4620          */
4621         if ( !list_empty(&hw->ctlxq.active) )
4622         {
4623                 /*
4624                  * We must ensure that our URB is removed from
4625                  * the system, if it hasn't already expired.
4626                  */
4627                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
4628                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS)
4629                 {
4630                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4631
4632                         ctlx->state = CTLX_REQ_FAILED;
4633
4634                         /* This URB was active, but has now been
4635                          * cancelled. It will now have a status of
4636                          * -ECONNRESET in the callback function.
4637                          *
4638                          * We are cancelling this CTLX, so we're
4639                          * not going to need to wait for a response.
4640                          * The URB's callback function will check
4641                          * that this timer is truly dead.
4642                          */
4643                         if (del_timer(&hw->resptimer) != 0)
4644                                 hw->resp_timer_done = 1;
4645                 }
4646         }
4647
4648         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4649
4650         DBFEXIT;
4651 }
4652
4653
4654 /*----------------------------------------------------------------
4655 * hfa384x_usbctlx_resptimerfn
4656 *
4657 * Timer response function for CTLX response timeouts.  If this
4658 * function is called, it means that the callback for the IN
4659 * URB containing a Prism2.x XXX_Response was never called.
4660 *
4661 * Arguments:
4662 *       data            a ptr to the hfa384x_t
4663 *
4664 * Returns:
4665 *       nothing
4666 *
4667 * Side effects:
4668 *
4669 * Call context:
4670 *       interrupt
4671 ----------------------------------------------------------------*/
4672 static void
4673 hfa384x_usbctlx_resptimerfn(unsigned long data)
4674 {
4675         hfa384x_t *hw = (hfa384x_t*)data;
4676         unsigned long   flags;
4677
4678         DBFENTER;
4679
4680         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4681
4682         hw->resp_timer_done = 1;
4683
4684         /* The active list will be empty if the
4685          * adapter has been unplugged ...
4686          */
4687         if ( !list_empty(&hw->ctlxq.active) )
4688         {
4689                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4690
4691                 if ( unlocked_usbctlx_cancel_async(hw, ctlx) == 0 )
4692                 {
4693                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4694                         hfa384x_usbctlxq_run(hw);
4695                         goto done;
4696                 }
4697         }
4698
4699         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4700
4701  done:
4702         DBFEXIT;
4703 }
4704
4705 /*----------------------------------------------------------------
4706 * hfa384x_usb_throttlefn
4707 *
4708 *
4709 * Arguments:
4710 *       data    ptr to hw
4711 *
4712 * Returns:
4713 *       Nothing
4714 *
4715 * Side effects:
4716 *
4717 * Call context:
4718 *       Interrupt
4719 ----------------------------------------------------------------*/
4720 static void
4721 hfa384x_usb_throttlefn(unsigned long data)
4722 {
4723         hfa384x_t *hw = (hfa384x_t*)data;
4724         unsigned long   flags;
4725
4726         DBFENTER;
4727
4728         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4729
4730         /*
4731          * We need to check BOTH the RX and the TX throttle controls,
4732          * so we use the bitwise OR instead of the logical OR.
4733          */
4734         WLAN_LOG_DEBUG(3, "flags=0x%lx\n", hw->usb_flags);
4735         if ( !hw->wlandev->hwremoved &&
4736              (
4737                (test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4738                !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4739                |
4740                (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4741                 !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4742              ) )
4743         {
4744                 schedule_work(&hw->usb_work);
4745         }
4746
4747         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4748
4749         DBFEXIT;
4750 }
4751
4752
4753 /*----------------------------------------------------------------
4754 * hfa384x_usbctlx_submit
4755 *
4756 * Called from the doxxx functions to submit a CTLX to the queue
4757 *
4758 * Arguments:
4759 *       hw              ptr to the hw struct
4760 *       ctlx            ctlx structure to enqueue
4761 *
4762 * Returns:
4763 *       -ENODEV if the adapter is unplugged
4764 *       0
4765 *
4766 * Side effects:
4767 *
4768 * Call context:
4769 *       process or interrupt
4770 ----------------------------------------------------------------*/
4771 static int
4772 hfa384x_usbctlx_submit(
4773         hfa384x_t               *hw,
4774         hfa384x_usbctlx_t       *ctlx)
4775 {
4776         unsigned long flags;
4777         int ret;
4778
4779         DBFENTER;
4780
4781         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4782
4783         if (hw->wlandev->hwremoved) {
4784                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4785                 ret = -ENODEV;
4786         } else {
4787                 ctlx->state = CTLX_PENDING;
4788                 list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4789
4790                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4791                 hfa384x_usbctlxq_run(hw);
4792                 ret = 0;
4793         }
4794
4795         DBFEXIT;
4796         return ret;
4797 }
4798
4799
4800 /*----------------------------------------------------------------
4801 * hfa384x_usbout_tx
4802 *
4803 * At this point we have finished a send of a frame.  Mark the URB
4804 * as available and call ev_alloc to notify higher layers we're
4805 * ready for more.
4806 *
4807 * Arguments:
4808 *       wlandev         wlan device
4809 *       usbout          ptr to the usb transfer buffer
4810 *
4811 * Returns:
4812 *       nothing
4813 *
4814 * Side effects:
4815 *
4816 * Call context:
4817 *       interrupt
4818 ----------------------------------------------------------------*/
4819 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4820 {
4821         DBFENTER;
4822
4823         prism2sta_ev_alloc(wlandev);
4824
4825         DBFEXIT;
4826 }
4827
4828 /*----------------------------------------------------------------
4829 * hfa384x_isgood_pdrcore
4830 *
4831 * Quick check of PDR codes.
4832 *
4833 * Arguments:
4834 *       pdrcode         PDR code number (host order)
4835 *
4836 * Returns:
4837 *       zero            not good.
4838 *       one             is good.
4839 *
4840 * Side effects:
4841 *
4842 * Call context:
4843 ----------------------------------------------------------------*/
4844 static int
4845 hfa384x_isgood_pdrcode(u16 pdrcode)
4846 {
4847         switch(pdrcode) {
4848         case HFA384x_PDR_END_OF_PDA:
4849         case HFA384x_PDR_PCB_PARTNUM:
4850         case HFA384x_PDR_PDAVER:
4851         case HFA384x_PDR_NIC_SERIAL:
4852         case HFA384x_PDR_MKK_MEASUREMENTS:
4853         case HFA384x_PDR_NIC_RAMSIZE:
4854         case HFA384x_PDR_MFISUPRANGE:
4855         case HFA384x_PDR_CFISUPRANGE:
4856         case HFA384x_PDR_NICID:
4857         case HFA384x_PDR_MAC_ADDRESS:
4858         case HFA384x_PDR_REGDOMAIN:
4859         case HFA384x_PDR_ALLOWED_CHANNEL:
4860         case HFA384x_PDR_DEFAULT_CHANNEL:
4861         case HFA384x_PDR_TEMPTYPE:
4862         case HFA384x_PDR_IFR_SETTING:
4863         case HFA384x_PDR_RFR_SETTING:
4864         case HFA384x_PDR_HFA3861_BASELINE:
4865         case HFA384x_PDR_HFA3861_SHADOW:
4866         case HFA384x_PDR_HFA3861_IFRF:
4867         case HFA384x_PDR_HFA3861_CHCALSP:
4868         case HFA384x_PDR_HFA3861_CHCALI:
4869         case HFA384x_PDR_3842_NIC_CONFIG:
4870         case HFA384x_PDR_USB_ID:
4871         case HFA384x_PDR_PCI_ID:
4872         case HFA384x_PDR_PCI_IFCONF:
4873         case HFA384x_PDR_PCI_PMCONF:
4874         case HFA384x_PDR_RFENRGY:
4875         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4876         case HFA384x_PDR_HFA3861_MANF_TESTI:
4877                 /* code is OK */
4878                 return 1;
4879                 break;
4880         default:
4881                 if ( pdrcode < 0x1000 ) {
4882                         /* code is OK, but we don't know exactly what it is */
4883                         WLAN_LOG_DEBUG(3,
4884                                 "Encountered unknown PDR#=0x%04x, "
4885                                 "assuming it's ok.\n",
4886                                 pdrcode);
4887                         return 1;
4888                 } else {
4889                         /* bad code */
4890                         WLAN_LOG_DEBUG(3,
4891                                 "Encountered unknown PDR#=0x%04x, "
4892                                 "(>=0x1000), assuming it's bad.\n",
4893                                 pdrcode);
4894                         return 0;
4895                 }
4896                 break;
4897         }
4898         return 0; /* avoid compiler warnings */
4899 }
4900