git.oblomov.eu Git - linux-2.6/blob - drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invokations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They  call copy_[to|from]_bap() and
  66 *                       cmd_access().   These functions operate on the
  67 *                       RIDs and buffers without validation.  The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 /*================================================================*/
 114 /* System Includes */
 115 #define WLAN_DBVAR      prism2_debug
 116
 117 #include <linux/version.h>
 118
 119 #include <linux/module.h>
 120 #include <linux/kernel.h>
 121 #include <linux/sched.h>
 122 #include <linux/types.h>
 123 #include <linux/slab.h>
 124 #include <linux/wireless.h>
 125 #include <linux/netdevice.h>
 126 #include <linux/timer.h>
 127 #include <asm/io.h>
 128 #include <linux/delay.h>
 129 #include <asm/byteorder.h>
 130 #include <asm/bitops.h>
 131 #include <linux/list.h>
 132 #include <linux/usb.h>
 133 #include <linux/byteorder/generic.h>
 134
 135 #include "wlan_compat.h"
 136
 137 #define SUBMIT_URB(u,f)  usb_submit_urb(u,f)
 138
 139 /*================================================================*/
 140 /* Project Includes */
 141
 142 #include "p80211types.h"
 143 #include "p80211hdr.h"
 144 #include "p80211mgmt.h"
 145 #include "p80211conv.h"
 146 #include "p80211msg.h"
 147 #include "p80211netdev.h"
 148 #include "p80211req.h"
 149 #include "p80211metadef.h"
 150 #include "p80211metastruct.h"
 151 #include "hfa384x.h"
 152 #include "prism2mgmt.h"
 153
 154 /*================================================================*/
 155 /* Local Constants */
 156
 157 enum cmd_mode
 158 {
 159   DOWAIT = 0,
 160   DOASYNC
 161 };
 162 typedef enum cmd_mode CMD_MODE;
 163
 164 #define THROTTLE_JIFFIES        (HZ/8)
 165
 166 /*================================================================*/
 167 /* Local Macros */
 168
 169 #define ROUNDUP64(a) (((a)+63)&~63)
 170
 171 /*================================================================*/
 172 /* Local Types */
 173
 174 /*================================================================*/
 175 /* Local Static Definitions */
 176 extern int prism2_debug;
 177
 178 /*================================================================*/
 179 /* Local Function Declarations */
 180
 181 #ifdef DEBUG_USB
 182 static void
 183 dbprint_urb(struct urb* urb);
 184 #endif
 185
 186 static void
 187 hfa384x_int_rxmonitor(
 188         wlandevice_t *wlandev,
 189         hfa384x_usb_rxfrm_t *rxfrm);
 190
 191 static void
 192 hfa384x_usb_defer(struct work_struct *data);
 193
 194 static int
 195 submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 196
 197 static int
 198 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 199
 200 /*---------------------------------------------------*/
 201 /* Callbacks */
 202 static void
 203 hfa384x_usbout_callback(struct urb *urb);
 204 static void
 205 hfa384x_ctlxout_callback(struct urb *urb);
 206 static void
 207 hfa384x_usbin_callback(struct urb *urb);
 208
 209 static void
 210 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 211
 212 static void
 213 hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 214
 215 static void
 216 hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 217
 218 static void
 219 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 220
 221 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 222                                int urb_status);
 223
 224 /*---------------------------------------------------*/
 225 /* Functions to support the prism2 usb command queue */
 226
 227 static void
 228 hfa384x_usbctlxq_run(hfa384x_t *hw);
 229
 230 static void
 231 hfa384x_usbctlx_reqtimerfn(unsigned long data);
 232
 233 static void
 234 hfa384x_usbctlx_resptimerfn(unsigned long data);
 235
 236 static void
 237 hfa384x_usb_throttlefn(unsigned long data);
 238
 239 static void
 240 hfa384x_usbctlx_completion_task(unsigned long data);
 241
 242 static void
 243 hfa384x_usbctlx_reaper_task(unsigned long data);
 244
 245 static int
 246 hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 247
 248 static void
 249 unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 250
 251 struct usbctlx_completor
 252 {
 253         int (*complete)(struct usbctlx_completor*);
 254 };
 255 typedef struct usbctlx_completor usbctlx_completor_t;
 256
 257 static int
 258 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 259                               hfa384x_usbctlx_t *ctlx,
 260                               usbctlx_completor_t *completor);
 261
 262 static int
 263 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 264
 265 static void
 266 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 267
 268 static void
 269 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 270
 271 static int
 272 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 273                    hfa384x_cmdresult_t *result);
 274
 275 static void
 276 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 277                        hfa384x_rridresult_t *result);
 278
 279 /*---------------------------------------------------*/
 280 /* Low level req/resp CTLX formatters and submitters */
 281 static int
 282 hfa384x_docmd(
 283         hfa384x_t *hw,
 284         CMD_MODE mode,
 285         hfa384x_metacmd_t *cmd,
 286         ctlx_cmdcb_t cmdcb,
 287         ctlx_usercb_t usercb,
 288         void    *usercb_data);
 289
 290 static int
 291 hfa384x_dorrid(
 292         hfa384x_t *hw,
 293         CMD_MODE mode,
 294         u16     rid,
 295         void    *riddata,
 296         unsigned int    riddatalen,
 297         ctlx_cmdcb_t cmdcb,
 298         ctlx_usercb_t usercb,
 299         void    *usercb_data);
 300
 301 static int
 302 hfa384x_dowrid(
 303         hfa384x_t *hw,
 304         CMD_MODE mode,
 305         u16     rid,
 306         void    *riddata,
 307         unsigned int    riddatalen,
 308         ctlx_cmdcb_t cmdcb,
 309         ctlx_usercb_t usercb,
 310         void    *usercb_data);
 311
 312 static int
 313 hfa384x_dormem(
 314         hfa384x_t *hw,
 315         CMD_MODE mode,
 316         u16     page,
 317         u16     offset,
 318         void    *data,
 319         unsigned int    len,
 320         ctlx_cmdcb_t cmdcb,
 321         ctlx_usercb_t usercb,
 322         void    *usercb_data);
 323
 324 static int
 325 hfa384x_dowmem(
 326         hfa384x_t *hw,
 327         CMD_MODE mode,
 328         u16     page,
 329         u16     offset,
 330         void    *data,
 331         unsigned int    len,
 332         ctlx_cmdcb_t cmdcb,
 333         ctlx_usercb_t usercb,
 334         void    *usercb_data);
 335
 336 static int
 337 hfa384x_isgood_pdrcode(u16 pdrcode);
 338
 339 /*================================================================*/
 340 /* Function Definitions */
 341 static inline const char* ctlxstr(CTLX_STATE s)
 342 {
 343         static const char* ctlx_str[] = {
 344                 "Initial state",
 345                 "Complete",
 346                 "Request failed",
 347                 "Request pending",
 348                 "Request packet submitted",
 349                 "Request packet completed",
 350                 "Response packet completed"
 351         };
 352
 353         return ctlx_str[s];
 354 };
 355
 356
 357 static inline hfa384x_usbctlx_t*
 358 get_active_ctlx(hfa384x_t *hw)
 359 {
 360         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 361 }
 362
 363
 364 #ifdef DEBUG_USB
 365 void
 366 dbprint_urb(struct urb* urb)
 367 {
 368         WLAN_LOG_DEBUG(3,"urb->pipe=0x%08x\n", urb->pipe);
 369         WLAN_LOG_DEBUG(3,"urb->status=0x%08x\n", urb->status);
 370         WLAN_LOG_DEBUG(3,"urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 371         WLAN_LOG_DEBUG(3,"urb->transfer_buffer=0x%08x\n", (unsigned int)urb->transfer_buffer);
 372         WLAN_LOG_DEBUG(3,"urb->transfer_buffer_length=0x%08x\n", urb->transfer_buffer_length);
 373         WLAN_LOG_DEBUG(3,"urb->actual_length=0x%08x\n", urb->actual_length);
 374         WLAN_LOG_DEBUG(3,"urb->bandwidth=0x%08x\n", urb->bandwidth);
 375         WLAN_LOG_DEBUG(3,"urb->setup_packet(ctl)=0x%08x\n", (unsigned int)urb->setup_packet);
 376         WLAN_LOG_DEBUG(3,"urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 377         WLAN_LOG_DEBUG(3,"urb->interval(irq)=0x%08x\n", urb->interval);
 378         WLAN_LOG_DEBUG(3,"urb->error_count(iso)=0x%08x\n", urb->error_count);
 379         WLAN_LOG_DEBUG(3,"urb->timeout=0x%08x\n", urb->timeout);
 380         WLAN_LOG_DEBUG(3,"urb->context=0x%08x\n", (unsigned int)urb->context);
 381         WLAN_LOG_DEBUG(3,"urb->complete=0x%08x\n", (unsigned int)urb->complete);
 382 }
 383 #endif
 384
 385
 386 /*----------------------------------------------------------------
 387 * submit_rx_urb
 388 *
 389 * Listen for input data on the BULK-IN pipe. If the pipe has
 390 * stalled then schedule it to be reset.
 391 *
 392 * Arguments:
 393 *       hw              device struct
 394 *       memflags        memory allocation flags
 395 *
 396 * Returns:
 397 *       error code from submission
 398 *
 399 * Call context:
 400 *       Any
 401 ----------------------------------------------------------------*/
 402 static int
 403 submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 404 {
 405         struct sk_buff *skb;
 406         int result;
 407
 408         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 409         if (skb == NULL) {
 410                 result = -ENOMEM;
 411                 goto done;
 412         }
 413
 414         /* Post the IN urb */
 415         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 416                       hw->endp_in,
 417                       skb->data, sizeof(hfa384x_usbin_t),
 418                       hfa384x_usbin_callback, hw->wlandev);
 419
 420         hw->rx_urb_skb = skb;
 421
 422         result = -ENOLINK;
 423         if ( !hw->wlandev->hwremoved && !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 424                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 425
 426                 /* Check whether we need to reset the RX pipe */
 427                 if (result == -EPIPE) {
 428                         WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
 429                                          hw->wlandev->netdev->name);
 430                         if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
 431                                 schedule_work(&hw->usb_work);
 432                 }
 433         }
 434
 435         /* Don't leak memory if anything should go wrong */
 436         if (result != 0) {
 437                 dev_kfree_skb(skb);
 438                 hw->rx_urb_skb = NULL;
 439         }
 440
 441  done:
 442         return result;
 443 }
 444
 445 /*----------------------------------------------------------------
 446 * submit_tx_urb
 447 *
 448 * Prepares and submits the URB of transmitted data. If the
 449 * submission fails then it will schedule the output pipe to
 450 * be reset.
 451 *
 452 * Arguments:
 453 *       hw              device struct
 454 *       tx_urb          URB of data for tranmission
 455 *       memflags        memory allocation flags
 456 *
 457 * Returns:
 458 *       error code from submission
 459 *
 460 * Call context:
 461 *       Any
 462 ----------------------------------------------------------------*/
 463 static int
 464 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 465 {
 466         struct net_device *netdev = hw->wlandev->netdev;
 467         int result;
 468
 469         result = -ENOLINK;
 470         if ( netif_running(netdev) ) {
 471
 472                 if ( !hw->wlandev->hwremoved && !test_bit(WORK_TX_HALT, &hw->usb_flags) ) {
 473                         result = SUBMIT_URB(tx_urb, memflags);
 474
 475                         /* Test whether we need to reset the TX pipe */
 476                         if (result == -EPIPE) {
 477                                 WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
 478                                                  netdev->name);
 479                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 480                                 schedule_work(&hw->usb_work);
 481                         } else if (result == 0) {
 482                                 netif_stop_queue(netdev);
 483                         }
 484                 }
 485         }
 486
 487         return result;
 488 }
 489
 490 /*----------------------------------------------------------------
 491 * hfa394x_usb_defer
 492 *
 493 * There are some things that the USB stack cannot do while
 494 * in interrupt context, so we arrange this function to run
 495 * in process context.
 496 *
 497 * Arguments:
 498 *       hw      device structure
 499 *
 500 * Returns:
 501 *       nothing
 502 *
 503 * Call context:
 504 *       process (by design)
 505 ----------------------------------------------------------------*/
 506 static void
 507 hfa384x_usb_defer(struct work_struct *data)
 508 {
 509         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 510         struct net_device *netdev = hw->wlandev->netdev;
 511
 512         /* Don't bother trying to reset anything if the plug
 513          * has been pulled ...
 514          */
 515         if ( hw->wlandev->hwremoved ) {
 516                 return;
 517         }
 518
 519         /* Reception has stopped: try to reset the input pipe */
 520         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 521                 int ret;
 522
 523                 usb_kill_urb(&hw->rx_urb);  /* Cannot be holding spinlock! */
 524
 525                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 526                 if (ret != 0) {
 527                         printk(KERN_ERR
 528                                "Failed to clear rx pipe for %s: err=%d\n",
 529                                netdev->name, ret);
 530                 } else {
 531                         printk(KERN_INFO "%s rx pipe reset complete.\n",
 532                                          netdev->name);
 533                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 534                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 535                 }
 536         }
 537
 538         /* Resume receiving data back from the device. */
 539         if ( test_bit(WORK_RX_RESUME, &hw->usb_flags) ) {
 540                 int ret;
 541
 542                 ret = submit_rx_urb(hw, GFP_KERNEL);
 543                 if (ret != 0) {
 544                         printk(KERN_ERR
 545                                "Failed to resume %s rx pipe.\n", netdev->name);
 546                 } else {
 547                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 548                 }
 549         }
 550
 551         /* Transmission has stopped: try to reset the output pipe */
 552         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 553                 int ret;
 554
 555                 usb_kill_urb(&hw->tx_urb);
 556                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 557                 if (ret != 0) {
 558                         printk(KERN_ERR
 559                                "Failed to clear tx pipe for %s: err=%d\n",
 560                                netdev->name, ret);
 561                 } else {
 562                         printk(KERN_INFO "%s tx pipe reset complete.\n",
 563                                          netdev->name);
 564                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 565                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 566
 567                         /* Stopping the BULK-OUT pipe also blocked
 568                          * us from sending any more CTLX URBs, so
 569                          * we need to re-run our queue ...
 570                          */
 571                         hfa384x_usbctlxq_run(hw);
 572                 }
 573         }
 574
 575         /* Resume transmitting. */
 576         if ( test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags) ) {
 577                 netif_wake_queue(hw->wlandev->netdev);
 578         }
 579 }
 580
 581
 582 /*----------------------------------------------------------------
 583 * hfa384x_create
 584 *
 585 * Sets up the hfa384x_t data structure for use.  Note this
 586 * does _not_ intialize the actual hardware, just the data structures
 587 * we use to keep track of its state.
 588 *
 589 * Arguments:
 590 *       hw              device structure
 591 *       irq             device irq number
 592 *       iobase          i/o base address for register access
 593 *       membase         memory base address for register access
 594 *
 595 * Returns:
 596 *       nothing
 597 *
 598 * Side effects:
 599 *
 600 * Call context:
 601 *       process
 602 ----------------------------------------------------------------*/
 603 void
 604 hfa384x_create( hfa384x_t *hw, struct usb_device *usb)
 605 {
 606         memset(hw, 0, sizeof(hfa384x_t));
 607         hw->usb = usb;
 608
 609         /* set up the endpoints */
 610         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 611         hw->endp_out = usb_sndbulkpipe(usb, 2);
 612
 613         /* Set up the waitq */
 614         init_waitqueue_head(&hw->cmdq);
 615
 616         /* Initialize the command queue */
 617         spin_lock_init(&hw->ctlxq.lock);
 618         INIT_LIST_HEAD(&hw->ctlxq.pending);
 619         INIT_LIST_HEAD(&hw->ctlxq.active);
 620         INIT_LIST_HEAD(&hw->ctlxq.completing);
 621         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 622
 623         /* Initialize the authentication queue */
 624         skb_queue_head_init(&hw->authq);
 625
 626         tasklet_init(&hw->reaper_bh,
 627                      hfa384x_usbctlx_reaper_task,
 628                      (unsigned long)hw);
 629         tasklet_init(&hw->completion_bh,
 630                      hfa384x_usbctlx_completion_task,
 631                      (unsigned long)hw);
 632         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 633         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 634
 635         init_timer(&hw->throttle);
 636         hw->throttle.function = hfa384x_usb_throttlefn;
 637         hw->throttle.data = (unsigned long)hw;
 638
 639         init_timer(&hw->resptimer);
 640         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 641         hw->resptimer.data = (unsigned long)hw;
 642
 643         init_timer(&hw->reqtimer);
 644         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 645         hw->reqtimer.data = (unsigned long)hw;
 646
 647         usb_init_urb(&hw->rx_urb);
 648         usb_init_urb(&hw->tx_urb);
 649         usb_init_urb(&hw->ctlx_urb);
 650
 651         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 652         hw->state = HFA384x_STATE_INIT;
 653
 654         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 655         init_timer(&hw->commsqual_timer);
 656         hw->commsqual_timer.data = (unsigned long) hw;
 657         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 658 }
 659
 660
 661 /*----------------------------------------------------------------
 662 * hfa384x_destroy
 663 *
 664 * Partner to hfa384x_create().  This function cleans up the hw
 665 * structure so that it can be freed by the caller using a simple
 666 * kfree.  Currently, this function is just a placeholder.  If, at some
 667 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 668 * kfree, this is where it should be done.  Note that if this function
 669 * is called on a _running_ hw structure, the drvr_stop() function is
 670 * called.
 671 *
 672 * Arguments:
 673 *       hw              device structure
 674 *
 675 * Returns:
 676 *       nothing, this function is not allowed to fail.
 677 *
 678 * Side effects:
 679 *
 680 * Call context:
 681 *       process
 682 ----------------------------------------------------------------*/
 683 void
 684 hfa384x_destroy( hfa384x_t *hw)
 685 {
 686         struct sk_buff *skb;
 687
 688         if ( hw->state == HFA384x_STATE_RUNNING ) {
 689                 hfa384x_drvr_stop(hw);
 690         }
 691         hw->state = HFA384x_STATE_PREINIT;
 692
 693         if (hw->scanresults) {
 694                 kfree(hw->scanresults);
 695                 hw->scanresults = NULL;
 696         }
 697
 698         /* Now to clean out the auth queue */
 699         while ( (skb = skb_dequeue(&hw->authq)) ) {
 700                 dev_kfree_skb(skb);
 701         }
 702 }
 703
 704
 705 /*----------------------------------------------------------------
 706  */
 707 static hfa384x_usbctlx_t* usbctlx_alloc(void)
 708 {
 709         hfa384x_usbctlx_t *ctlx;
 710
 711         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 712         if (ctlx != NULL)
 713         {
 714                 memset(ctlx, 0, sizeof(*ctlx));
 715                 init_completion(&ctlx->done);
 716         }
 717
 718         return ctlx;
 719 }
 720
 721
 722 /*----------------------------------------------------------------
 723  *
 724 ----------------------------------------------------------------*/
 725 static int
 726 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 727                    hfa384x_cmdresult_t *result)
 728 {
 729         result->status = hfa384x2host_16(cmdresp->status);
 730         result->resp0 = hfa384x2host_16(cmdresp->resp0);
 731         result->resp1 = hfa384x2host_16(cmdresp->resp1);
 732         result->resp2 = hfa384x2host_16(cmdresp->resp2);
 733
 734         WLAN_LOG_DEBUG(4, "cmdresult:status=0x%04x "
 735                           "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 736                         result->status,
 737                         result->resp0,
 738                         result->resp1,
 739                         result->resp2);
 740
 741         return (result->status & HFA384x_STATUS_RESULT);
 742 }
 743
 744 static void
 745 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 746                        hfa384x_rridresult_t *result)
 747 {
 748         result->rid = hfa384x2host_16(rridresp->rid);
 749         result->riddata = rridresp->data;
 750         result->riddata_len = ((hfa384x2host_16(rridresp->frmlen) - 1) * 2);
 751
 752 }
 753
 754
 755 /*----------------------------------------------------------------
 756 * Completor object:
 757 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 758 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 759 ----------------------------------------------------------------*/
 760 struct usbctlx_cmd_completor
 761 {
 762         usbctlx_completor_t     head;
 763
 764         const hfa384x_usb_cmdresp_t     *cmdresp;
 765         hfa384x_cmdresult_t     *result;
 766 };
 767 typedef struct usbctlx_cmd_completor usbctlx_cmd_completor_t;
 768
 769 static int usbctlx_cmd_completor_fn(usbctlx_completor_t *head)
 770 {
 771         usbctlx_cmd_completor_t *complete = (usbctlx_cmd_completor_t*)head;
 772         return usbctlx_get_status(complete->cmdresp, complete->result);
 773 }
 774
 775 static inline usbctlx_completor_t*
 776 init_cmd_completor(usbctlx_cmd_completor_t *completor,
 777                    const hfa384x_usb_cmdresp_t *cmdresp,
 778                    hfa384x_cmdresult_t *result)
 779 {
 780         completor->head.complete = usbctlx_cmd_completor_fn;
 781         completor->cmdresp = cmdresp;
 782         completor->result = result;
 783         return &(completor->head);
 784 }
 785
 786 /*----------------------------------------------------------------
 787 * Completor object:
 788 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 789 * when processing a CTLX that reads a RID.
 790 ----------------------------------------------------------------*/
 791 struct usbctlx_rrid_completor
 792 {
 793         usbctlx_completor_t     head;
 794
 795         const hfa384x_usb_rridresp_t    *rridresp;
 796         void                    *riddata;
 797         unsigned int                    riddatalen;
 798 };
 799 typedef struct usbctlx_rrid_completor usbctlx_rrid_completor_t;
 800
 801 static int usbctlx_rrid_completor_fn(usbctlx_completor_t *head)
 802 {
 803         usbctlx_rrid_completor_t *complete = (usbctlx_rrid_completor_t*)head;
 804         hfa384x_rridresult_t rridresult;
 805
 806         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 807
 808         /* Validate the length, note body len calculation in bytes */
 809         if ( rridresult.riddata_len != complete->riddatalen ) {
 810                 WLAN_LOG_WARNING(
 811                         "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 812                         rridresult.rid,
 813                         complete->riddatalen,
 814                         rridresult.riddata_len);
 815                 return -ENODATA;
 816         }
 817
 818         memcpy(complete->riddata,
 819                rridresult.riddata,
 820                complete->riddatalen);
 821         return 0;
 822 }
 823
 824 static inline usbctlx_completor_t*
 825 init_rrid_completor(usbctlx_rrid_completor_t *completor,
 826                     const hfa384x_usb_rridresp_t *rridresp,
 827                     void *riddata,
 828                     unsigned int riddatalen)
 829 {
 830         completor->head.complete = usbctlx_rrid_completor_fn;
 831         completor->rridresp = rridresp;
 832         completor->riddata = riddata;
 833         completor->riddatalen = riddatalen;
 834         return &(completor->head);
 835 }
 836
 837 /*----------------------------------------------------------------
 838 * Completor object:
 839 * Interprets the results of a synchronous RID-write
 840 ----------------------------------------------------------------*/
 841 typedef usbctlx_cmd_completor_t usbctlx_wrid_completor_t;
 842 #define init_wrid_completor  init_cmd_completor
 843
 844 /*----------------------------------------------------------------
 845 * Completor object:
 846 * Interprets the results of a synchronous memory-write
 847 ----------------------------------------------------------------*/
 848 typedef usbctlx_cmd_completor_t usbctlx_wmem_completor_t;
 849 #define init_wmem_completor  init_cmd_completor
 850
 851 /*----------------------------------------------------------------
 852 * Completor object:
 853 * Interprets the results of a synchronous memory-read
 854 ----------------------------------------------------------------*/
 855 struct usbctlx_rmem_completor
 856 {
 857         usbctlx_completor_t           head;
 858
 859         const hfa384x_usb_rmemresp_t  *rmemresp;
 860         void                          *data;
 861         unsigned int                          len;
 862 };
 863 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
 864
 865 static int usbctlx_rmem_completor_fn(usbctlx_completor_t *head)
 866 {
 867         usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t*)head;
 868
 869         WLAN_LOG_DEBUG(4,"rmemresp:len=%d\n", complete->rmemresp->frmlen);
 870         memcpy(complete->data, complete->rmemresp->data, complete->len);
 871         return 0;
 872 }
 873
 874 static inline usbctlx_completor_t*
 875 init_rmem_completor(usbctlx_rmem_completor_t *completor,
 876                     hfa384x_usb_rmemresp_t *rmemresp,
 877                     void *data,
 878                     unsigned int len)
 879 {
 880         completor->head.complete = usbctlx_rmem_completor_fn;
 881         completor->rmemresp = rmemresp;
 882         completor->data = data;
 883         completor->len = len;
 884         return &(completor->head);
 885 }
 886
 887 /*----------------------------------------------------------------
 888 * hfa384x_cb_status
 889 *
 890 * Ctlx_complete handler for async CMD type control exchanges.
 891 * mark the hw struct as such.
 892 *
 893 * Note: If the handling is changed here, it should probably be
 894 *       changed in docmd as well.
 895 *
 896 * Arguments:
 897 *       hw              hw struct
 898 *       ctlx            completed CTLX
 899 *
 900 * Returns:
 901 *       nothing
 902 *
 903 * Side effects:
 904 *
 905 * Call context:
 906 *       interrupt
 907 ----------------------------------------------------------------*/
 908 static void
 909 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 910 {
 911         if ( ctlx->usercb != NULL ) {
 912                 hfa384x_cmdresult_t cmdresult;
 913
 914                 if (ctlx->state != CTLX_COMPLETE) {
 915                         memset(&cmdresult, 0, sizeof(cmdresult));
 916                         cmdresult.status = HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 917                 } else {
 918                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 919                 }
 920
 921                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 922         }
 923 }
 924
 925
 926 /*----------------------------------------------------------------
 927 * hfa384x_cb_rrid
 928 *
 929 * CTLX completion handler for async RRID type control exchanges.
 930 *
 931 * Note: If the handling is changed here, it should probably be
 932 *       changed in dorrid as well.
 933 *
 934 * Arguments:
 935 *       hw              hw struct
 936 *       ctlx            completed CTLX
 937 *
 938 * Returns:
 939 *       nothing
 940 *
 941 * Side effects:
 942 *
 943 * Call context:
 944 *       interrupt
 945 ----------------------------------------------------------------*/
 946 static void
 947 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 948 {
 949         if ( ctlx->usercb != NULL ) {
 950                 hfa384x_rridresult_t rridresult;
 951
 952                 if (ctlx->state != CTLX_COMPLETE) {
 953                         memset(&rridresult, 0, sizeof(rridresult));
 954                         rridresult.rid = hfa384x2host_16(ctlx->outbuf.rridreq.rid);
 955                 } else {
 956                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp, &rridresult);
 957                 }
 958
 959                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
 960         }
 961 }
 962
 963 static inline int
 964 hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
 965 {
 966         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
 967 }
 968
 969 static inline int
 970 hfa384x_docmd_async(hfa384x_t *hw,
 971                     hfa384x_metacmd_t *cmd,
 972                     ctlx_cmdcb_t cmdcb,
 973                     ctlx_usercb_t usercb,
 974                     void *usercb_data)
 975 {
 976         return hfa384x_docmd(hw, DOASYNC, cmd,
 977                                 cmdcb, usercb, usercb_data);
 978 }
 979
 980 static inline int
 981 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
 982 {
 983         return hfa384x_dorrid(hw, DOWAIT,
 984                               rid, riddata, riddatalen,
 985                               NULL, NULL, NULL);
 986 }
 987
 988 static inline int
 989 hfa384x_dorrid_async(hfa384x_t *hw,
 990                      u16 rid, void *riddata, unsigned int riddatalen,
 991                      ctlx_cmdcb_t cmdcb,
 992                      ctlx_usercb_t usercb,
 993                      void *usercb_data)
 994 {
 995         return hfa384x_dorrid(hw, DOASYNC,
 996                               rid, riddata, riddatalen,
 997                               cmdcb, usercb, usercb_data);
 998 }
 999
1000 static inline int
1001 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1002 {
1003         return hfa384x_dowrid(hw, DOWAIT,
1004                               rid, riddata, riddatalen,
1005                               NULL, NULL, NULL);
1006 }
1007
1008 static inline int
1009 hfa384x_dowrid_async(hfa384x_t *hw,
1010                      u16 rid, void *riddata, unsigned int riddatalen,
1011                      ctlx_cmdcb_t cmdcb,
1012                      ctlx_usercb_t usercb,
1013                      void *usercb_data)
1014 {
1015         return hfa384x_dowrid(hw, DOASYNC,
1016                               rid, riddata, riddatalen,
1017                               cmdcb, usercb, usercb_data);
1018 }
1019
1020 static inline int
1021 hfa384x_dormem_wait(hfa384x_t *hw,
1022                     u16 page, u16 offset, void *data, unsigned int len)
1023 {
1024         return hfa384x_dormem(hw, DOWAIT,
1025                               page, offset, data, len,
1026                               NULL, NULL, NULL);
1027 }
1028
1029 static inline int
1030 hfa384x_dormem_async(hfa384x_t *hw,
1031                      u16 page, u16 offset, void *data, unsigned int len,
1032                      ctlx_cmdcb_t cmdcb,
1033                      ctlx_usercb_t usercb,
1034                      void *usercb_data)
1035 {
1036         return hfa384x_dormem(hw, DOASYNC,
1037                               page, offset, data, len,
1038                               cmdcb, usercb, usercb_data);
1039 }
1040
1041 static inline int
1042 hfa384x_dowmem_wait(
1043         hfa384x_t *hw,
1044         u16  page,
1045         u16  offset,
1046         void    *data,
1047         unsigned int    len)
1048 {
1049         return hfa384x_dowmem(hw, DOWAIT,
1050                                   page, offset, data, len,
1051                                   NULL, NULL, NULL);
1052 }
1053
1054 static inline int
1055 hfa384x_dowmem_async(
1056         hfa384x_t *hw,
1057         u16  page,
1058         u16  offset,
1059         void    *data,
1060         unsigned int    len,
1061         ctlx_cmdcb_t cmdcb,
1062         ctlx_usercb_t usercb,
1063         void    *usercb_data)
1064 {
1065         return hfa384x_dowmem(hw, DOASYNC,
1066                                   page, offset, data, len,
1067                                   cmdcb, usercb, usercb_data);
1068 }
1069
1070 /*----------------------------------------------------------------
1071 * hfa384x_cmd_initialize
1072 *
1073 * Issues the initialize command and sets the hw->state based
1074 * on the result.
1075 *
1076 * Arguments:
1077 *       hw              device structure
1078 *
1079 * Returns:
1080 *       0               success
1081 *       >0              f/w reported error - f/w status code
1082 *       <0              driver reported error
1083 *
1084 * Side effects:
1085 *
1086 * Call context:
1087 *       process
1088 ----------------------------------------------------------------*/
1089 int
1090 hfa384x_cmd_initialize(hfa384x_t *hw)
1091 {
1092         int     result = 0;
1093         int     i;
1094         hfa384x_metacmd_t cmd;
1095
1096         cmd.cmd = HFA384x_CMDCODE_INIT;
1097         cmd.parm0 = 0;
1098         cmd.parm1 = 0;
1099         cmd.parm2 = 0;
1100
1101         result = hfa384x_docmd_wait(hw, &cmd);
1102
1103
1104         WLAN_LOG_DEBUG(3,"cmdresp.init: "
1105                 "status=0x%04x, resp0=0x%04x, "
1106                 "resp1=0x%04x, resp2=0x%04x\n",
1107                 cmd.result.status,
1108                 cmd.result.resp0,
1109                 cmd.result.resp1,
1110                 cmd.result.resp2);
1111         if ( result == 0 ) {
1112                 for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
1113                         hw->port_enabled[i] = 0;
1114                 }
1115         }
1116
1117         hw->link_status = HFA384x_LINK_NOTCONNECTED;
1118
1119         return result;
1120 }
1121
1122
1123 /*----------------------------------------------------------------
1124 * hfa384x_cmd_disable
1125 *
1126 * Issues the disable command to stop communications on one of
1127 * the MACs 'ports'.
1128 *
1129 * Arguments:
1130 *       hw              device structure
1131 *       macport         MAC port number (host order)
1132 *
1133 * Returns:
1134 *       0               success
1135 *       >0              f/w reported failure - f/w status code
1136 *       <0              driver reported error (timeout|bad arg)
1137 *
1138 * Side effects:
1139 *
1140 * Call context:
1141 *       process
1142 ----------------------------------------------------------------*/
1143 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1144 {
1145         int     result = 0;
1146         hfa384x_metacmd_t cmd;
1147
1148         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1149                   HFA384x_CMD_MACPORT_SET(macport);
1150         cmd.parm0 = 0;
1151         cmd.parm1 = 0;
1152         cmd.parm2 = 0;
1153
1154         result = hfa384x_docmd_wait(hw, &cmd);
1155
1156         return result;
1157 }
1158
1159
1160 /*----------------------------------------------------------------
1161 * hfa384x_cmd_enable
1162 *
1163 * Issues the enable command to enable communications on one of
1164 * the MACs 'ports'.
1165 *
1166 * Arguments:
1167 *       hw              device structure
1168 *       macport         MAC port number
1169 *
1170 * Returns:
1171 *       0               success
1172 *       >0              f/w reported failure - f/w status code
1173 *       <0              driver reported error (timeout|bad arg)
1174 *
1175 * Side effects:
1176 *
1177 * Call context:
1178 *       process
1179 ----------------------------------------------------------------*/
1180 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1181 {
1182         int     result = 0;
1183         hfa384x_metacmd_t cmd;
1184
1185         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1186                   HFA384x_CMD_MACPORT_SET(macport);
1187         cmd.parm0 = 0;
1188         cmd.parm1 = 0;
1189         cmd.parm2 = 0;
1190
1191         result = hfa384x_docmd_wait(hw, &cmd);
1192
1193         return result;
1194 }
1195
1196 /*----------------------------------------------------------------
1197 * hfa384x_cmd_monitor
1198 *
1199 * Enables the 'monitor mode' of the MAC.  Here's the description of
1200 * monitor mode that I've received thus far:
1201 *
1202 *  "The "monitor mode" of operation is that the MAC passes all
1203 *  frames for which the PLCP checks are correct. All received
1204 *  MPDUs are passed to the host with MAC Port = 7, with a
1205 *  receive status of good, FCS error, or undecryptable. Passing
1206 *  certain MPDUs is a violation of the 802.11 standard, but useful
1207 *  for a debugging tool."  Normal communication is not possible
1208 *  while monitor mode is enabled.
1209 *
1210 * Arguments:
1211 *       hw              device structure
1212 *       enable          a code (0x0b|0x0f) that enables/disables
1213 *                       monitor mode. (host order)
1214 *
1215 * Returns:
1216 *       0               success
1217 *       >0              f/w reported failure - f/w status code
1218 *       <0              driver reported error (timeout|bad arg)
1219 *
1220 * Side effects:
1221 *
1222 * Call context:
1223 *       process
1224 ----------------------------------------------------------------*/
1225 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1226 {
1227         int     result = 0;
1228         hfa384x_metacmd_t cmd;
1229
1230         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1231                 HFA384x_CMD_AINFO_SET(enable);
1232         cmd.parm0 = 0;
1233         cmd.parm1 = 0;
1234         cmd.parm2 = 0;
1235
1236         result = hfa384x_docmd_wait(hw, &cmd);
1237
1238         return result;
1239 }
1240
1241
1242 /*----------------------------------------------------------------
1243 * hfa384x_cmd_download
1244 *
1245 * Sets the controls for the MAC controller code/data download
1246 * process.  The arguments set the mode and address associated
1247 * with a download.  Note that the aux registers should be enabled
1248 * prior to setting one of the download enable modes.
1249 *
1250 * Arguments:
1251 *       hw              device structure
1252 *       mode            0 - Disable programming and begin code exec
1253 *                       1 - Enable volatile mem programming
1254 *                       2 - Enable non-volatile mem programming
1255 *                       3 - Program non-volatile section from NV download
1256 *                           buffer.
1257 *                       (host order)
1258 *       lowaddr
1259 *       highaddr        For mode 1, sets the high & low order bits of
1260 *                       the "destination address".  This address will be
1261 *                       the execution start address when download is
1262 *                       subsequently disabled.
1263 *                       For mode 2, sets the high & low order bits of
1264 *                       the destination in NV ram.
1265 *                       For modes 0 & 3, should be zero. (host order)
1266 *                       NOTE: these are CMD format.
1267 *       codelen         Length of the data to write in mode 2,
1268 *                       zero otherwise. (host order)
1269 *
1270 * Returns:
1271 *       0               success
1272 *       >0              f/w reported failure - f/w status code
1273 *       <0              driver reported error (timeout|bad arg)
1274 *
1275 * Side effects:
1276 *
1277 * Call context:
1278 *       process
1279 ----------------------------------------------------------------*/
1280 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1281                                 u16 highaddr, u16 codelen)
1282 {
1283         int     result = 0;
1284         hfa384x_metacmd_t cmd;
1285
1286         WLAN_LOG_DEBUG(5,
1287                 "mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1288                 mode, lowaddr, highaddr, codelen);
1289
1290         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1291                    HFA384x_CMD_PROGMODE_SET(mode));
1292
1293         cmd.parm0 = lowaddr;
1294         cmd.parm1 = highaddr;
1295         cmd.parm2 = codelen;
1296
1297         result = hfa384x_docmd_wait(hw, &cmd);
1298
1299         return result;
1300 }
1301
1302
1303 /*----------------------------------------------------------------
1304 * hfa384x_copy_from_aux
1305 *
1306 * Copies a collection of bytes from the controller memory.  The
1307 * Auxiliary port MUST be enabled prior to calling this function.
1308 * We _might_ be in a download state.
1309 *
1310 * Arguments:
1311 *       hw              device structure
1312 *       cardaddr        address in hfa384x data space to read
1313 *       auxctl          address space select
1314 *       buf             ptr to destination host buffer
1315 *       len             length of data to transfer (in bytes)
1316 *
1317 * Returns:
1318 *       nothing
1319 *
1320 * Side effects:
1321 *       buf contains the data copied
1322 *
1323 * Call context:
1324 *       process
1325 *       interrupt
1326 ----------------------------------------------------------------*/
1327 void
1328 hfa384x_copy_from_aux(
1329         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1330 {
1331         WLAN_LOG_ERROR("not used in USB.\n");
1332 }
1333
1334
1335 /*----------------------------------------------------------------
1336 * hfa384x_copy_to_aux
1337 *
1338 * Copies a collection of bytes to the controller memory.  The
1339 * Auxiliary port MUST be enabled prior to calling this function.
1340 * We _might_ be in a download state.
1341 *
1342 * Arguments:
1343 *       hw              device structure
1344 *       cardaddr        address in hfa384x data space to read
1345 *       auxctl          address space select
1346 *       buf             ptr to destination host buffer
1347 *       len             length of data to transfer (in bytes)
1348 *
1349 * Returns:
1350 *       nothing
1351 *
1352 * Side effects:
1353 *       Controller memory now contains a copy of buf
1354 *
1355 * Call context:
1356 *       process
1357 *       interrupt
1358 ----------------------------------------------------------------*/
1359 void
1360 hfa384x_copy_to_aux(
1361         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1362 {
1363         WLAN_LOG_ERROR("not used in USB.\n");
1364 }
1365
1366
1367 /*----------------------------------------------------------------
1368 * hfa384x_corereset
1369 *
1370 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1371 * structure is in its "created" state.  That is, it is initialized
1372 * with proper values.  Note that if a reset is done after the
1373 * device has been active for awhile, the caller might have to clean
1374 * up some leftover cruft in the hw structure.
1375 *
1376 * Arguments:
1377 *       hw              device structure
1378 *       holdtime        how long (in ms) to hold the reset
1379 *       settletime      how long (in ms) to wait after releasing
1380 *                       the reset
1381 *
1382 * Returns:
1383 *       nothing
1384 *
1385 * Side effects:
1386 *
1387 * Call context:
1388 *       process
1389 ----------------------------------------------------------------*/
1390 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1391 {
1392         int                     result = 0;
1393
1394         result=usb_reset_device(hw->usb);
1395         if(result<0) {
1396                 WLAN_LOG_ERROR("usb_reset_device() failed, result=%d.\n",result);
1397         }
1398
1399         return result;
1400 }
1401
1402
1403 /*----------------------------------------------------------------
1404 * hfa384x_usbctlx_complete_sync
1405 *
1406 * Waits for a synchronous CTLX object to complete,
1407 * and then handles the response.
1408 *
1409 * Arguments:
1410 *       hw              device structure
1411 *       ctlx            CTLX ptr
1412 *       completor       functor object to decide what to
1413 *                       do with the CTLX's result.
1414 *
1415 * Returns:
1416 *       0               Success
1417 *       -ERESTARTSYS    Interrupted by a signal
1418 *       -EIO            CTLX failed
1419 *       -ENODEV         Adapter was unplugged
1420 *       ???             Result from completor
1421 *
1422 * Side effects:
1423 *
1424 * Call context:
1425 *       process
1426 ----------------------------------------------------------------*/
1427 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1428                                          hfa384x_usbctlx_t *ctlx,
1429                                          usbctlx_completor_t *completor)
1430 {
1431         unsigned long flags;
1432         int result;
1433
1434         result = wait_for_completion_interruptible(&ctlx->done);
1435
1436         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1437
1438         /*
1439          * We can only handle the CTLX if the USB disconnect
1440          * function has not run yet ...
1441          */
1442         cleanup:
1443         if ( hw->wlandev->hwremoved )
1444         {
1445                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1446                 result = -ENODEV;
1447         }
1448         else if ( result != 0 )
1449         {
1450                 int runqueue = 0;
1451
1452                 /*
1453                  * We were probably interrupted, so delete
1454                  * this CTLX asynchronously, kill the timers
1455                  * and the URB, and then start the next
1456                  * pending CTLX.
1457                  *
1458                  * NOTE: We can only delete the timers and
1459                  *       the URB if this CTLX is active.
1460                  */
1461                 if (ctlx == get_active_ctlx(hw))
1462                 {
1463                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1464
1465                         del_singleshot_timer_sync(&hw->reqtimer);
1466                         del_singleshot_timer_sync(&hw->resptimer);
1467                         hw->req_timer_done = 1;
1468                         hw->resp_timer_done = 1;
1469                         usb_kill_urb(&hw->ctlx_urb);
1470
1471                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1472
1473                         runqueue = 1;
1474
1475                         /*
1476                          * This scenario is so unlikely that I'm
1477                          * happy with a grubby "goto" solution ...
1478                          */
1479                         if ( hw->wlandev->hwremoved )
1480                                 goto cleanup;
1481                 }
1482
1483                 /*
1484                  * The completion task will send this CTLX
1485                  * to the reaper the next time it runs. We
1486                  * are no longer in a hurry.
1487                  */
1488                 ctlx->reapable = 1;
1489                 ctlx->state = CTLX_REQ_FAILED;
1490                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1491
1492                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1493
1494                 if (runqueue)
1495                         hfa384x_usbctlxq_run(hw);
1496         } else {
1497                 if (ctlx->state == CTLX_COMPLETE) {
1498                         result = completor->complete(completor);
1499                 } else {
1500                         WLAN_LOG_WARNING("CTLX[%d] error: state(%s)\n",
1501                                          hfa384x2host_16(ctlx->outbuf.type),
1502                                          ctlxstr(ctlx->state));
1503                         result = -EIO;
1504                 }
1505
1506                 list_del(&ctlx->list);
1507                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1508                 kfree(ctlx);
1509         }
1510
1511         return result;
1512 }
1513
1514 /*----------------------------------------------------------------
1515 * hfa384x_docmd
1516 *
1517 * Constructs a command CTLX and submits it.
1518 *
1519 * NOTE: Any changes to the 'post-submit' code in this function
1520 *       need to be carried over to hfa384x_cbcmd() since the handling
1521 *       is virtually identical.
1522 *
1523 * Arguments:
1524 *       hw              device structure
1525 *       mode            DOWAIT or DOASYNC
1526 *       cmd             cmd structure.  Includes all arguments and result
1527 *                       data points.  All in host order. in host order
1528 *       cmdcb           command-specific callback
1529 *       usercb          user callback for async calls, NULL for DOWAIT calls
1530 *       usercb_data     user supplied data pointer for async calls, NULL
1531 *                       for DOASYNC calls
1532 *
1533 * Returns:
1534 *       0               success
1535 *       -EIO            CTLX failure
1536 *       -ERESTARTSYS    Awakened on signal
1537 *       >0              command indicated error, Status and Resp0-2 are
1538 *                       in hw structure.
1539 *
1540 * Side effects:
1541 *
1542 *
1543 * Call context:
1544 *       process
1545 ----------------------------------------------------------------*/
1546 static int
1547 hfa384x_docmd(
1548         hfa384x_t *hw,
1549         CMD_MODE mode,
1550         hfa384x_metacmd_t *cmd,
1551         ctlx_cmdcb_t    cmdcb,
1552         ctlx_usercb_t   usercb,
1553         void    *usercb_data)
1554 {
1555         int                     result;
1556         hfa384x_usbctlx_t       *ctlx;
1557
1558         ctlx = usbctlx_alloc();
1559         if ( ctlx == NULL ) {
1560                 result = -ENOMEM;
1561                 goto done;
1562         }
1563
1564         /* Initialize the command */
1565         ctlx->outbuf.cmdreq.type =      host2hfa384x_16(HFA384x_USB_CMDREQ);
1566         ctlx->outbuf.cmdreq.cmd =       host2hfa384x_16(cmd->cmd);
1567         ctlx->outbuf.cmdreq.parm0 =     host2hfa384x_16(cmd->parm0);
1568         ctlx->outbuf.cmdreq.parm1 =     host2hfa384x_16(cmd->parm1);
1569         ctlx->outbuf.cmdreq.parm2 =     host2hfa384x_16(cmd->parm2);
1570
1571         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1572
1573         WLAN_LOG_DEBUG(4, "cmdreq: cmd=0x%04x "
1574                 "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1575                 cmd->cmd,
1576                 cmd->parm0,
1577                 cmd->parm1,
1578                 cmd->parm2);
1579
1580         ctlx->reapable = mode;
1581         ctlx->cmdcb = cmdcb;
1582         ctlx->usercb = usercb;
1583         ctlx->usercb_data = usercb_data;
1584
1585         result = hfa384x_usbctlx_submit(hw, ctlx);
1586         if (result != 0) {
1587                 kfree(ctlx);
1588         } else if (mode == DOWAIT) {
1589                 usbctlx_cmd_completor_t completor;
1590
1591                 result = hfa384x_usbctlx_complete_sync(
1592                              hw, ctlx, init_cmd_completor(&completor,
1593                                                           &ctlx->inbuf.cmdresp,
1594                                                           &cmd->result) );
1595         }
1596
1597 done:
1598         return result;
1599 }
1600
1601
1602 /*----------------------------------------------------------------
1603 * hfa384x_dorrid
1604 *
1605 * Constructs a read rid CTLX and issues it.
1606 *
1607 * NOTE: Any changes to the 'post-submit' code in this function
1608 *       need to be carried over to hfa384x_cbrrid() since the handling
1609 *       is virtually identical.
1610 *
1611 * Arguments:
1612 *       hw              device structure
1613 *       mode            DOWAIT or DOASYNC
1614 *       rid             Read RID number (host order)
1615 *       riddata         Caller supplied buffer that MAC formatted RID.data
1616 *                       record will be written to for DOWAIT calls. Should
1617 *                       be NULL for DOASYNC calls.
1618 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1619 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1620 *       usercb          user callback for async calls, NULL for DOWAIT calls
1621 *       usercb_data     user supplied data pointer for async calls, NULL
1622 *                       for DOWAIT calls
1623 *
1624 * Returns:
1625 *       0               success
1626 *       -EIO            CTLX failure
1627 *       -ERESTARTSYS    Awakened on signal
1628 *       -ENODATA        riddatalen != macdatalen
1629 *       >0              command indicated error, Status and Resp0-2 are
1630 *                       in hw structure.
1631 *
1632 * Side effects:
1633 *
1634 * Call context:
1635 *       interrupt (DOASYNC)
1636 *       process (DOWAIT or DOASYNC)
1637 ----------------------------------------------------------------*/
1638 static int
1639 hfa384x_dorrid(
1640         hfa384x_t *hw,
1641         CMD_MODE mode,
1642         u16     rid,
1643         void    *riddata,
1644         unsigned int    riddatalen,
1645         ctlx_cmdcb_t cmdcb,
1646         ctlx_usercb_t usercb,
1647         void    *usercb_data)
1648 {
1649         int                     result;
1650         hfa384x_usbctlx_t       *ctlx;
1651
1652         ctlx = usbctlx_alloc();
1653         if ( ctlx == NULL ) {
1654                 result = -ENOMEM;
1655                 goto done;
1656         }
1657
1658         /* Initialize the command */
1659         ctlx->outbuf.rridreq.type =   host2hfa384x_16(HFA384x_USB_RRIDREQ);
1660         ctlx->outbuf.rridreq.frmlen =
1661                 host2hfa384x_16(sizeof(ctlx->outbuf.rridreq.rid));
1662         ctlx->outbuf.rridreq.rid =    host2hfa384x_16(rid);
1663
1664         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1665
1666         ctlx->reapable = mode;
1667         ctlx->cmdcb = cmdcb;
1668         ctlx->usercb = usercb;
1669         ctlx->usercb_data = usercb_data;
1670
1671         /* Submit the CTLX */
1672         result = hfa384x_usbctlx_submit(hw, ctlx);
1673         if (result != 0) {
1674                 kfree(ctlx);
1675         } else if (mode == DOWAIT) {
1676                 usbctlx_rrid_completor_t completor;
1677
1678                 result = hfa384x_usbctlx_complete_sync(
1679                            hw, ctlx, init_rrid_completor(&completor,
1680                                                          &ctlx->inbuf.rridresp,
1681                                                          riddata,
1682                                                          riddatalen) );
1683         }
1684
1685 done:
1686         return result;
1687 }
1688
1689
1690 /*----------------------------------------------------------------
1691 * hfa384x_dowrid
1692 *
1693 * Constructs a write rid CTLX and issues it.
1694 *
1695 * NOTE: Any changes to the 'post-submit' code in this function
1696 *       need to be carried over to hfa384x_cbwrid() since the handling
1697 *       is virtually identical.
1698 *
1699 * Arguments:
1700 *       hw              device structure
1701 *       CMD_MODE        DOWAIT or DOASYNC
1702 *       rid             RID code
1703 *       riddata         Data portion of RID formatted for MAC
1704 *       riddatalen      Length of the data portion in bytes
1705 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1706 *       usercb          user callback for async calls, NULL for DOWAIT calls
1707 *       usercb_data     user supplied data pointer for async calls
1708 *
1709 * Returns:
1710 *       0               success
1711 *       -ETIMEDOUT      timed out waiting for register ready or
1712 *                       command completion
1713 *       >0              command indicated error, Status and Resp0-2 are
1714 *                       in hw structure.
1715 *
1716 * Side effects:
1717 *
1718 * Call context:
1719 *       interrupt (DOASYNC)
1720 *       process (DOWAIT or DOASYNC)
1721 ----------------------------------------------------------------*/
1722 static int
1723 hfa384x_dowrid(
1724         hfa384x_t *hw,
1725         CMD_MODE mode,
1726         u16     rid,
1727         void    *riddata,
1728         unsigned int    riddatalen,
1729         ctlx_cmdcb_t cmdcb,
1730         ctlx_usercb_t usercb,
1731         void    *usercb_data)
1732 {
1733         int                     result;
1734         hfa384x_usbctlx_t       *ctlx;
1735
1736         ctlx = usbctlx_alloc();
1737         if ( ctlx == NULL ) {
1738                 result = -ENOMEM;
1739                 goto done;
1740         }
1741
1742         /* Initialize the command */
1743         ctlx->outbuf.wridreq.type =   host2hfa384x_16(HFA384x_USB_WRIDREQ);
1744         ctlx->outbuf.wridreq.frmlen = host2hfa384x_16(
1745                                         (sizeof(ctlx->outbuf.wridreq.rid) +
1746                                         riddatalen + 1) / 2);
1747         ctlx->outbuf.wridreq.rid =    host2hfa384x_16(rid);
1748         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1749
1750         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1751                            sizeof(ctlx->outbuf.wridreq.frmlen) +
1752                            sizeof(ctlx->outbuf.wridreq.rid) +
1753                            riddatalen;
1754
1755         ctlx->reapable = mode;
1756         ctlx->cmdcb = cmdcb;
1757         ctlx->usercb = usercb;
1758         ctlx->usercb_data = usercb_data;
1759
1760         /* Submit the CTLX */
1761         result = hfa384x_usbctlx_submit(hw, ctlx);
1762         if (result != 0) {
1763                 kfree(ctlx);
1764         } else if (mode == DOWAIT) {
1765                 usbctlx_wrid_completor_t completor;
1766                 hfa384x_cmdresult_t wridresult;
1767
1768                 result = hfa384x_usbctlx_complete_sync(
1769                                hw,
1770                                ctlx,
1771                                init_wrid_completor(&completor,
1772                                                    &ctlx->inbuf.wridresp,
1773                                                    &wridresult) );
1774         }
1775
1776 done:
1777         return result;
1778 }
1779
1780 /*----------------------------------------------------------------
1781 * hfa384x_dormem
1782 *
1783 * Constructs a readmem CTLX and issues it.
1784 *
1785 * NOTE: Any changes to the 'post-submit' code in this function
1786 *       need to be carried over to hfa384x_cbrmem() since the handling
1787 *       is virtually identical.
1788 *
1789 * Arguments:
1790 *       hw              device structure
1791 *       mode            DOWAIT or DOASYNC
1792 *       page            MAC address space page (CMD format)
1793 *       offset          MAC address space offset
1794 *       data            Ptr to data buffer to receive read
1795 *       len             Length of the data to read (max == 2048)
1796 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1797 *       usercb          user callback for async calls, NULL for DOWAIT calls
1798 *       usercb_data     user supplied data pointer for async calls
1799 *
1800 * Returns:
1801 *       0               success
1802 *       -ETIMEDOUT      timed out waiting for register ready or
1803 *                       command completion
1804 *       >0              command indicated error, Status and Resp0-2 are
1805 *                       in hw structure.
1806 *
1807 * Side effects:
1808 *
1809 * Call context:
1810 *       interrupt (DOASYNC)
1811 *       process (DOWAIT or DOASYNC)
1812 ----------------------------------------------------------------*/
1813 static int
1814 hfa384x_dormem(
1815         hfa384x_t *hw,
1816         CMD_MODE mode,
1817         u16     page,
1818         u16     offset,
1819         void    *data,
1820         unsigned int    len,
1821         ctlx_cmdcb_t cmdcb,
1822         ctlx_usercb_t usercb,
1823         void    *usercb_data)
1824 {
1825         int                     result;
1826         hfa384x_usbctlx_t       *ctlx;
1827
1828         ctlx = usbctlx_alloc();
1829         if ( ctlx == NULL ) {
1830                 result = -ENOMEM;
1831                 goto done;
1832         }
1833
1834         /* Initialize the command */
1835         ctlx->outbuf.rmemreq.type =    host2hfa384x_16(HFA384x_USB_RMEMREQ);
1836         ctlx->outbuf.rmemreq.frmlen =  host2hfa384x_16(
1837                                         sizeof(ctlx->outbuf.rmemreq.offset) +
1838                                         sizeof(ctlx->outbuf.rmemreq.page) +
1839                                         len);
1840         ctlx->outbuf.rmemreq.offset =   host2hfa384x_16(offset);
1841         ctlx->outbuf.rmemreq.page =     host2hfa384x_16(page);
1842
1843         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1844
1845         WLAN_LOG_DEBUG(4,
1846                 "type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1847                 ctlx->outbuf.rmemreq.type,
1848                 ctlx->outbuf.rmemreq.frmlen,
1849                 ctlx->outbuf.rmemreq.offset,
1850                 ctlx->outbuf.rmemreq.page);
1851
1852         WLAN_LOG_DEBUG(4,"pktsize=%zd\n",
1853                 ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1854
1855         ctlx->reapable = mode;
1856         ctlx->cmdcb = cmdcb;
1857         ctlx->usercb = usercb;
1858         ctlx->usercb_data = usercb_data;
1859
1860         result = hfa384x_usbctlx_submit(hw, ctlx);
1861         if (result != 0) {
1862                 kfree(ctlx);
1863         } else if ( mode == DOWAIT ) {
1864                 usbctlx_rmem_completor_t completor;
1865
1866                 result = hfa384x_usbctlx_complete_sync(
1867                            hw, ctlx, init_rmem_completor(&completor,
1868                                                          &ctlx->inbuf.rmemresp,
1869                                                          data,
1870                                                          len) );
1871         }
1872
1873 done:
1874         return result;
1875 }
1876
1877
1878
1879 /*----------------------------------------------------------------
1880 * hfa384x_dowmem
1881 *
1882 * Constructs a writemem CTLX and issues it.
1883 *
1884 * NOTE: Any changes to the 'post-submit' code in this function
1885 *       need to be carried over to hfa384x_cbwmem() since the handling
1886 *       is virtually identical.
1887 *
1888 * Arguments:
1889 *       hw              device structure
1890 *       mode            DOWAIT or DOASYNC
1891 *       page            MAC address space page (CMD format)
1892 *       offset          MAC address space offset
1893 *       data            Ptr to data buffer containing write data
1894 *       len             Length of the data to read (max == 2048)
1895 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1896 *       usercb          user callback for async calls, NULL for DOWAIT calls
1897 *       usercb_data     user supplied data pointer for async calls.
1898 *
1899 * Returns:
1900 *       0               success
1901 *       -ETIMEDOUT      timed out waiting for register ready or
1902 *                       command completion
1903 *       >0              command indicated error, Status and Resp0-2 are
1904 *                       in hw structure.
1905 *
1906 * Side effects:
1907 *
1908 * Call context:
1909 *       interrupt (DOWAIT)
1910 *       process (DOWAIT or DOASYNC)
1911 ----------------------------------------------------------------*/
1912 static int
1913 hfa384x_dowmem(
1914         hfa384x_t *hw,
1915         CMD_MODE mode,
1916         u16     page,
1917         u16     offset,
1918         void    *data,
1919         unsigned int    len,
1920         ctlx_cmdcb_t cmdcb,
1921         ctlx_usercb_t usercb,
1922         void    *usercb_data)
1923 {
1924         int                     result;
1925         hfa384x_usbctlx_t       *ctlx;
1926
1927         WLAN_LOG_DEBUG(5, "page=0x%04x offset=0x%04x len=%d\n",
1928                 page,offset,len);
1929
1930         ctlx = usbctlx_alloc();
1931         if ( ctlx == NULL ) {
1932                 result = -ENOMEM;
1933                 goto done;
1934         }
1935
1936         /* Initialize the command */
1937         ctlx->outbuf.wmemreq.type =   host2hfa384x_16(HFA384x_USB_WMEMREQ);
1938         ctlx->outbuf.wmemreq.frmlen = host2hfa384x_16(
1939                                         sizeof(ctlx->outbuf.wmemreq.offset) +
1940                                         sizeof(ctlx->outbuf.wmemreq.page) +
1941                                         len);
1942         ctlx->outbuf.wmemreq.offset = host2hfa384x_16(offset);
1943         ctlx->outbuf.wmemreq.page =   host2hfa384x_16(page);
1944         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1945
1946         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1947                            sizeof(ctlx->outbuf.wmemreq.frmlen) +
1948                            sizeof(ctlx->outbuf.wmemreq.offset) +
1949                            sizeof(ctlx->outbuf.wmemreq.page) +
1950                            len;
1951
1952         ctlx->reapable = mode;
1953         ctlx->cmdcb = cmdcb;
1954         ctlx->usercb = usercb;
1955         ctlx->usercb_data = usercb_data;
1956
1957         result = hfa384x_usbctlx_submit(hw, ctlx);
1958         if (result != 0) {
1959                 kfree(ctlx);
1960         } else if ( mode == DOWAIT ) {
1961                 usbctlx_wmem_completor_t completor;
1962                 hfa384x_cmdresult_t wmemresult;
1963
1964                 result = hfa384x_usbctlx_complete_sync(
1965                                hw,
1966                                ctlx,
1967                                init_wmem_completor(&completor,
1968                                                    &ctlx->inbuf.wmemresp,
1969                                                    &wmemresult) );
1970         }
1971
1972 done:
1973         return result;
1974 }
1975
1976
1977 /*----------------------------------------------------------------
1978 * hfa384x_drvr_commtallies
1979 *
1980 * Send a commtallies inquiry to the MAC.  Note that this is an async
1981 * call that will result in an info frame arriving sometime later.
1982 *
1983 * Arguments:
1984 *       hw              device structure
1985 *
1986 * Returns:
1987 *       zero            success.
1988 *
1989 * Side effects:
1990 *
1991 * Call context:
1992 *       process
1993 ----------------------------------------------------------------*/
1994 int hfa384x_drvr_commtallies( hfa384x_t *hw )
1995 {
1996         hfa384x_metacmd_t cmd;
1997
1998         cmd.cmd = HFA384x_CMDCODE_INQ;
1999         cmd.parm0 = HFA384x_IT_COMMTALLIES;
2000         cmd.parm1 = 0;
2001         cmd.parm2 = 0;
2002
2003         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
2004
2005         return 0;
2006 }
2007
2008
2009 /*----------------------------------------------------------------
2010 * hfa384x_drvr_disable
2011 *
2012 * Issues the disable command to stop communications on one of
2013 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2014 * APs may also disable macports 1-6.  Only ports that have been
2015 * previously enabled may be disabled.
2016 *
2017 * Arguments:
2018 *       hw              device structure
2019 *       macport         MAC port number (host order)
2020 *
2021 * Returns:
2022 *       0               success
2023 *       >0              f/w reported failure - f/w status code
2024 *       <0              driver reported error (timeout|bad arg)
2025 *
2026 * Side effects:
2027 *
2028 * Call context:
2029 *       process
2030 ----------------------------------------------------------------*/
2031 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
2032 {
2033         int     result = 0;
2034
2035         if ((!hw->isap && macport != 0) ||
2036             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2037             !(hw->port_enabled[macport]) ){
2038                 result = -EINVAL;
2039         } else {
2040                 result = hfa384x_cmd_disable(hw, macport);
2041                 if ( result == 0 ) {
2042                         hw->port_enabled[macport] = 0;
2043                 }
2044         }
2045         return result;
2046 }
2047
2048
2049 /*----------------------------------------------------------------
2050 * hfa384x_drvr_enable
2051 *
2052 * Issues the enable command to enable communications on one of
2053 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2054 * APs may also enable macports 1-6.  Only ports that are currently
2055 * disabled may be enabled.
2056 *
2057 * Arguments:
2058 *       hw              device structure
2059 *       macport         MAC port number
2060 *
2061 * Returns:
2062 *       0               success
2063 *       >0              f/w reported failure - f/w status code
2064 *       <0              driver reported error (timeout|bad arg)
2065 *
2066 * Side effects:
2067 *
2068 * Call context:
2069 *       process
2070 ----------------------------------------------------------------*/
2071 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
2072 {
2073         int     result = 0;
2074
2075         if ((!hw->isap && macport != 0) ||
2076             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2077             (hw->port_enabled[macport]) ){
2078                 result = -EINVAL;
2079         } else {
2080                 result = hfa384x_cmd_enable(hw, macport);
2081                 if ( result == 0 ) {
2082                         hw->port_enabled[macport] = 1;
2083                 }
2084         }
2085         return result;
2086 }
2087
2088
2089 /*----------------------------------------------------------------
2090 * hfa384x_drvr_flashdl_enable
2091 *
2092 * Begins the flash download state.  Checks to see that we're not
2093 * already in a download state and that a port isn't enabled.
2094 * Sets the download state and retrieves the flash download
2095 * buffer location, buffer size, and timeout length.
2096 *
2097 * Arguments:
2098 *       hw              device structure
2099 *
2100 * Returns:
2101 *       0               success
2102 *       >0              f/w reported error - f/w status code
2103 *       <0              driver reported error
2104 *
2105 * Side effects:
2106 *
2107 * Call context:
2108 *       process
2109 ----------------------------------------------------------------*/
2110 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
2111 {
2112         int             result = 0;
2113         int             i;
2114
2115         /* Check that a port isn't active */
2116         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2117                 if ( hw->port_enabled[i] ) {
2118                         WLAN_LOG_DEBUG(1,"called when port enabled.\n");
2119                         return -EINVAL;
2120                 }
2121         }
2122
2123         /* Check that we're not already in a download state */
2124         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2125                 return -EINVAL;
2126         }
2127
2128         /* Retrieve the buffer loc&size and timeout */
2129         if ( (result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
2130                                 &(hw->bufinfo), sizeof(hw->bufinfo))) ) {
2131                 return result;
2132         }
2133         hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
2134         hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
2135         hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
2136         if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
2137                                 &(hw->dltimeout))) ) {
2138                 return result;
2139         }
2140         hw->dltimeout = hfa384x2host_16(hw->dltimeout);
2141
2142         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2143
2144         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
2145
2146         return result;
2147 }
2148
2149
2150 /*----------------------------------------------------------------
2151 * hfa384x_drvr_flashdl_disable
2152 *
2153 * Ends the flash download state.  Note that this will cause the MAC
2154 * firmware to restart.
2155 *
2156 * Arguments:
2157 *       hw              device structure
2158 *
2159 * Returns:
2160 *       0               success
2161 *       >0              f/w reported error - f/w status code
2162 *       <0              driver reported error
2163 *
2164 * Side effects:
2165 *
2166 * Call context:
2167 *       process
2168 ----------------------------------------------------------------*/
2169 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
2170 {
2171         /* Check that we're already in the download state */
2172         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2173                 return -EINVAL;
2174         }
2175
2176         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2177
2178         /* There isn't much we can do at this point, so I don't */
2179         /*  bother  w/ the return value */
2180         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2181         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2182
2183         return 0;
2184 }
2185
2186
2187 /*----------------------------------------------------------------
2188 * hfa384x_drvr_flashdl_write
2189 *
2190 * Performs a FLASH download of a chunk of data. First checks to see
2191 * that we're in the FLASH download state, then sets the download
2192 * mode, uses the aux functions to 1) copy the data to the flash
2193 * buffer, 2) sets the download 'write flash' mode, 3) readback and
2194 * compare.  Lather rinse, repeat as many times an necessary to get
2195 * all the given data into flash.
2196 * When all data has been written using this function (possibly
2197 * repeatedly), call drvr_flashdl_disable() to end the download state
2198 * and restart the MAC.
2199 *
2200 * Arguments:
2201 *       hw              device structure
2202 *       daddr           Card address to write to. (host order)
2203 *       buf             Ptr to data to write.
2204 *       len             Length of data (host order).
2205 *
2206 * Returns:
2207 *       0               success
2208 *       >0              f/w reported error - f/w status code
2209 *       <0              driver reported error
2210 *
2211 * Side effects:
2212 *
2213 * Call context:
2214 *       process
2215 ----------------------------------------------------------------*/
2216 int
2217 hfa384x_drvr_flashdl_write(
2218         hfa384x_t       *hw,
2219         u32             daddr,
2220         void            *buf,
2221         u32             len)
2222 {
2223         int             result = 0;
2224         u32             dlbufaddr;
2225         int             nburns;
2226         u32             burnlen;
2227         u32             burndaddr;
2228         u16             burnlo;
2229         u16             burnhi;
2230         int             nwrites;
2231         u8              *writebuf;
2232         u16             writepage;
2233         u16             writeoffset;
2234         u32             writelen;
2235         int             i;
2236         int             j;
2237
2238         WLAN_LOG_DEBUG(5,"daddr=0x%08x len=%d\n", daddr, len);
2239
2240         /* Check that we're in the flash download state */
2241         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2242                 return -EINVAL;
2243         }
2244
2245         WLAN_LOG_INFO("Download %d bytes to flash @0x%06x\n", len, daddr);
2246
2247         /* Convert to flat address for arithmetic */
2248         /* NOTE: dlbuffer RID stores the address in AUX format */
2249         dlbufaddr = HFA384x_ADDR_AUX_MKFLAT(
2250                         hw->bufinfo.page, hw->bufinfo.offset);
2251         WLAN_LOG_DEBUG(5,
2252                 "dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2253                 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2254
2255 #if 0
2256 WLAN_LOG_WARNING("dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
2257 #endif
2258         /* Calculations to determine how many fills of the dlbuffer to do
2259          * and how many USB wmemreq's to do for each fill.  At this point
2260          * in time, the dlbuffer size and the wmemreq size are the same.
2261          * Therefore, nwrites should always be 1.  The extra complexity
2262          * here is a hedge against future changes.
2263          */
2264
2265         /* Figure out how many times to do the flash programming */
2266         nburns = len / hw->bufinfo.len;
2267         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2268
2269         /* For each flash program cycle, how many USB wmemreq's are needed? */
2270         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2271         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2272
2273         /* For each burn */
2274         for ( i = 0; i < nburns; i++) {
2275                 /* Get the dest address and len */
2276                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2277                                 hw->bufinfo.len :
2278                                 (len - (hw->bufinfo.len * i));
2279                 burndaddr = daddr + (hw->bufinfo.len * i);
2280                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2281                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2282
2283                 WLAN_LOG_INFO("Writing %d bytes to flash @0x%06x\n",
2284                         burnlen, burndaddr);
2285
2286                 /* Set the download mode */
2287                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2288                                 burnlo, burnhi, burnlen);
2289                 if ( result ) {
2290                         WLAN_LOG_ERROR("download(NV,lo=%x,hi=%x,len=%x) "
2291                                 "cmd failed, result=%d. Aborting d/l\n",
2292                                 burnlo, burnhi, burnlen, result);
2293                         goto exit_proc;
2294                 }
2295
2296                 /* copy the data to the flash download buffer */
2297                 for ( j=0; j < nwrites; j++) {
2298                         writebuf = buf +
2299                                 (i*hw->bufinfo.len) +
2300                                 (j*HFA384x_USB_RWMEM_MAXLEN);
2301
2302                         writepage = HFA384x_ADDR_CMD_MKPAGE(
2303                                         dlbufaddr +
2304                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2305                         writeoffset = HFA384x_ADDR_CMD_MKOFF(
2306                                         dlbufaddr +
2307                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2308
2309                         writelen = burnlen-(j*HFA384x_USB_RWMEM_MAXLEN);
2310                         writelen = writelen  > HFA384x_USB_RWMEM_MAXLEN ?
2311                                         HFA384x_USB_RWMEM_MAXLEN :
2312                                         writelen;
2313
2314                         result = hfa384x_dowmem_wait( hw,
2315                                         writepage,
2316                                         writeoffset,
2317                                         writebuf,
2318                                         writelen );
2319 #if 0
2320
2321 Comment out for debugging, assume the write was successful.
2322                         if (result) {
2323                                 WLAN_LOG_ERROR(
2324                                         "Write to dl buffer failed, "
2325                                         "result=0x%04x. Aborting.\n",
2326                                         result);
2327                                 goto exit_proc;
2328                         }
2329 #endif
2330
2331                 }
2332
2333                 /* set the download 'write flash' mode */
2334                 result = hfa384x_cmd_download(hw,
2335                                 HFA384x_PROGMODE_NVWRITE,
2336                                 0,0,0);
2337                 if ( result ) {
2338                         WLAN_LOG_ERROR(
2339                                 "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2340                                 "cmd failed, result=%d. Aborting d/l\n",
2341                                 burnlo, burnhi, burnlen, result);
2342                         goto exit_proc;
2343                 }
2344
2345                 /* TODO: We really should do a readback and compare. */
2346         }
2347
2348 exit_proc:
2349
2350         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2351         /*  actually disable programming mode.  Remember, that will cause the */
2352         /*  the firmware to effectively reset itself. */
2353
2354         return result;
2355 }
2356
2357
2358 /*----------------------------------------------------------------
2359 * hfa384x_drvr_getconfig
2360 *
2361 * Performs the sequence necessary to read a config/info item.
2362 *
2363 * Arguments:
2364 *       hw              device structure
2365 *       rid             config/info record id (host order)
2366 *       buf             host side record buffer.  Upon return it will
2367 *                       contain the body portion of the record (minus the
2368 *                       RID and len).
2369 *       len             buffer length (in bytes, should match record length)
2370 *
2371 * Returns:
2372 *       0               success
2373 *       >0              f/w reported error - f/w status code
2374 *       <0              driver reported error
2375 *       -ENODATA        length mismatch between argument and retrieved
2376 *                       record.
2377 *
2378 * Side effects:
2379 *
2380 * Call context:
2381 *       process
2382 ----------------------------------------------------------------*/
2383 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2384 {
2385         int                     result;
2386
2387         result = hfa384x_dorrid_wait(hw, rid, buf, len);
2388
2389         return result;
2390 }
2391
2392 /*----------------------------------------------------------------
2393  * hfa384x_drvr_getconfig_async
2394  *
2395  * Performs the sequence necessary to perform an async read of
2396  * of a config/info item.
2397  *
2398  * Arguments:
2399  *       hw              device structure
2400  *       rid             config/info record id (host order)
2401  *       buf             host side record buffer.  Upon return it will
2402  *                       contain the body portion of the record (minus the
2403  *                       RID and len).
2404  *       len             buffer length (in bytes, should match record length)
2405  *       cbfn            caller supplied callback, called when the command
2406  *                       is done (successful or not).
2407  *       cbfndata        pointer to some caller supplied data that will be
2408  *                       passed in as an argument to the cbfn.
2409  *
2410  * Returns:
2411  *       nothing         the cbfn gets a status argument identifying if
2412  *                       any errors occur.
2413  * Side effects:
2414  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2415  *
2416  * Call context:
2417  *       Any
2418  ----------------------------------------------------------------*/
2419 int
2420 hfa384x_drvr_getconfig_async(
2421          hfa384x_t               *hw,
2422          u16                  rid,
2423          ctlx_usercb_t           usercb,
2424          void                    *usercb_data)
2425 {
2426          return hfa384x_dorrid_async(hw, rid, NULL, 0,
2427                                      hfa384x_cb_rrid, usercb, usercb_data);
2428 }
2429
2430 /*----------------------------------------------------------------
2431  * hfa384x_drvr_setconfig_async
2432  *
2433  * Performs the sequence necessary to write a config/info item.
2434  *
2435  * Arguments:
2436  *       hw              device structure
2437  *       rid             config/info record id (in host order)
2438  *       buf             host side record buffer
2439  *       len             buffer length (in bytes)
2440  *       usercb          completion callback
2441  *       usercb_data     completion callback argument
2442  *
2443  * Returns:
2444  *       0               success
2445  *       >0              f/w reported error - f/w status code
2446  *       <0              driver reported error
2447  *
2448  * Side effects:
2449  *
2450  * Call context:
2451  *       process
2452  ----------------------------------------------------------------*/
2453 int
2454 hfa384x_drvr_setconfig_async(
2455          hfa384x_t       *hw,
2456          u16          rid,
2457          void            *buf,
2458          u16          len,
2459          ctlx_usercb_t   usercb,
2460          void            *usercb_data)
2461 {
2462         return hfa384x_dowrid_async(hw, rid, buf, len,
2463                                     hfa384x_cb_status, usercb, usercb_data);
2464 }
2465
2466 /*----------------------------------------------------------------
2467 * hfa384x_drvr_handover
2468 *
2469 * Sends a handover notification to the MAC.
2470 *
2471 * Arguments:
2472 *       hw              device structure
2473 *       addr            address of station that's left
2474 *
2475 * Returns:
2476 *       zero            success.
2477 *       -ERESTARTSYS    received signal while waiting for semaphore.
2478 *       -EIO            failed to write to bap, or failed in cmd.
2479 *
2480 * Side effects:
2481 *
2482 * Call context:
2483 *       process
2484 ----------------------------------------------------------------*/
2485 int hfa384x_drvr_handover( hfa384x_t *hw, u8 *addr)
2486 {
2487         WLAN_LOG_ERROR("Not currently supported in USB!\n");
2488         return -EIO;
2489 }
2490
2491 /*----------------------------------------------------------------
2492 * hfa384x_drvr_low_level
2493 *
2494 * Write test commands to the card.  Some test commands don't make
2495 * sense without prior set-up.  For example, continous TX isn't very
2496 * useful until you set the channel.  That functionality should be
2497 *
2498 * Side effects:
2499 *
2500 * Call context:
2501 *      process thread
2502 * -----------------------------------------------------------------*/
2503 int hfa384x_drvr_low_level(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
2504 {
2505         int             result;
2506
2507         /* Do i need a host2hfa... conversion ? */
2508
2509         result = hfa384x_docmd_wait(hw, cmd);
2510
2511         return result;
2512 }
2513
2514 /*----------------------------------------------------------------
2515 * hfa384x_drvr_ramdl_disable
2516 *
2517 * Ends the ram download state.
2518 *
2519 * Arguments:
2520 *       hw              device structure
2521 *
2522 * Returns:
2523 *       0               success
2524 *       >0              f/w reported error - f/w status code
2525 *       <0              driver reported error
2526 *
2527 * Side effects:
2528 *
2529 * Call context:
2530 *       process
2531 ----------------------------------------------------------------*/
2532 int
2533 hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2534 {
2535         /* Check that we're already in the download state */
2536         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2537                 return -EINVAL;
2538         }
2539
2540         WLAN_LOG_DEBUG(3,"ramdl_disable()\n");
2541
2542         /* There isn't much we can do at this point, so I don't */
2543         /*  bother  w/ the return value */
2544         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2545         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2546
2547         return 0;
2548 }
2549
2550
2551 /*----------------------------------------------------------------
2552 * hfa384x_drvr_ramdl_enable
2553 *
2554 * Begins the ram download state.  Checks to see that we're not
2555 * already in a download state and that a port isn't enabled.
2556 * Sets the download state and calls cmd_download with the
2557 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2558 *
2559 * Arguments:
2560 *       hw              device structure
2561 *       exeaddr         the card execution address that will be
2562 *                       jumped to when ramdl_disable() is called
2563 *                       (host order).
2564 *
2565 * Returns:
2566 *       0               success
2567 *       >0              f/w reported error - f/w status code
2568 *       <0              driver reported error
2569 *
2570 * Side effects:
2571 *
2572 * Call context:
2573 *       process
2574 ----------------------------------------------------------------*/
2575 int
2576 hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2577 {
2578         int             result = 0;
2579         u16             lowaddr;
2580         u16             hiaddr;
2581         int             i;
2582
2583         /* Check that a port isn't active */
2584         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2585                 if ( hw->port_enabled[i] ) {
2586                         WLAN_LOG_ERROR(
2587                                 "Can't download with a macport enabled.\n");
2588                         return -EINVAL;
2589                 }
2590         }
2591
2592         /* Check that we're not already in a download state */
2593         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2594                 WLAN_LOG_ERROR(
2595                         "Download state not disabled.\n");
2596                 return -EINVAL;
2597         }
2598
2599         WLAN_LOG_DEBUG(3,"ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2600
2601         /* Call the download(1,addr) function */
2602         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2603         hiaddr =  HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2604
2605         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2606                         lowaddr, hiaddr, 0);
2607
2608         if ( result == 0) {
2609                 /* Set the download state */
2610                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2611         } else {
2612                 WLAN_LOG_DEBUG(1,
2613                         "cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2614                         lowaddr,
2615                         hiaddr,
2616                         result);
2617         }
2618
2619         return result;
2620 }
2621
2622
2623 /*----------------------------------------------------------------
2624 * hfa384x_drvr_ramdl_write
2625 *
2626 * Performs a RAM download of a chunk of data. First checks to see
2627 * that we're in the RAM download state, then uses the [read|write]mem USB
2628 * commands to 1) copy the data, 2) readback and compare.  The download
2629 * state is unaffected.  When all data has been written using
2630 * this function, call drvr_ramdl_disable() to end the download state
2631 * and restart the MAC.
2632 *
2633 * Arguments:
2634 *       hw              device structure
2635 *       daddr           Card address to write to. (host order)
2636 *       buf             Ptr to data to write.
2637 *       len             Length of data (host order).
2638 *
2639 * Returns:
2640 *       0               success
2641 *       >0              f/w reported error - f/w status code
2642 *       <0              driver reported error
2643 *
2644 * Side effects:
2645 *
2646 * Call context:
2647 *       process
2648 ----------------------------------------------------------------*/
2649 int
2650 hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void* buf, u32 len)
2651 {
2652         int             result = 0;
2653         int             nwrites;
2654         u8              *data = buf;
2655         int             i;
2656         u32             curraddr;
2657         u16             currpage;
2658         u16             curroffset;
2659         u16             currlen;
2660
2661         /* Check that we're in the ram download state */
2662         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2663                 return -EINVAL;
2664         }
2665
2666         WLAN_LOG_INFO("Writing %d bytes to ram @0x%06x\n", len, daddr);
2667
2668         /* How many dowmem calls?  */
2669         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2670         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2671
2672         /* Do blocking wmem's */
2673         for(i=0; i < nwrites; i++) {
2674                 /* make address args */
2675                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2676                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2677                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2678                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2679                 if ( currlen > HFA384x_USB_RWMEM_MAXLEN) {
2680                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2681                 }
2682
2683                 /* Do blocking ctlx */
2684                 result = hfa384x_dowmem_wait( hw,
2685                                 currpage,
2686                                 curroffset,
2687                                 data + (i*HFA384x_USB_RWMEM_MAXLEN),
2688                                 currlen );
2689
2690                 if (result) break;
2691
2692                 /* TODO: We really should have a readback. */
2693         }
2694
2695         return result;
2696 }
2697
2698
2699 /*----------------------------------------------------------------
2700 * hfa384x_drvr_readpda
2701 *
2702 * Performs the sequence to read the PDA space.  Note there is no
2703 * drvr_writepda() function.  Writing a PDA is
2704 * generally implemented by a calling component via calls to
2705 * cmd_download and writing to the flash download buffer via the
2706 * aux regs.
2707 *
2708 * Arguments:
2709 *       hw              device structure
2710 *       buf             buffer to store PDA in
2711 *       len             buffer length
2712 *
2713 * Returns:
2714 *       0               success
2715 *       >0              f/w reported error - f/w status code
2716 *       <0              driver reported error
2717 *       -ETIMEOUT       timout waiting for the cmd regs to become
2718 *                       available, or waiting for the control reg
2719 *                       to indicate the Aux port is enabled.
2720 *       -ENODATA        the buffer does NOT contain a valid PDA.
2721 *                       Either the card PDA is bad, or the auxdata
2722 *                       reads are giving us garbage.
2723
2724 *
2725 * Side effects:
2726 *
2727 * Call context:
2728 *       process or non-card interrupt.
2729 ----------------------------------------------------------------*/
2730 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2731 {
2732         int             result = 0;
2733         u16             *pda = buf;
2734         int             pdaok = 0;
2735         int             morepdrs = 1;
2736         int             currpdr = 0;    /* word offset of the current pdr */
2737         size_t          i;
2738         u16             pdrlen;         /* pdr length in bytes, host order */
2739         u16             pdrcode;        /* pdr code, host order */
2740         u16             currpage;
2741         u16             curroffset;
2742         struct pdaloc {
2743                 u32     cardaddr;
2744                 u16     auxctl;
2745         } pdaloc[] =
2746         {
2747                 { HFA3842_PDA_BASE,             0},
2748                 { HFA3841_PDA_BASE,             0},
2749                 { HFA3841_PDA_BOGUS_BASE,       0}
2750         };
2751
2752         /* Read the pda from each known address.  */
2753         for ( i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2754                 /* Make address */
2755                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2756                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2757
2758                 result = hfa384x_dormem_wait(hw,
2759                         currpage,
2760                         curroffset,
2761                         buf,
2762                         len);           /* units of bytes */
2763
2764                 if (result) {
2765                         WLAN_LOG_WARNING(
2766                                           "Read from index %zd failed, continuing\n",
2767                                 i );
2768                         continue;
2769                 }
2770
2771                 /* Test for garbage */
2772                 pdaok = 1;      /* initially assume good */
2773                 morepdrs = 1;
2774                 while ( pdaok && morepdrs ) {
2775                         pdrlen = hfa384x2host_16(pda[currpdr]) * 2;
2776                         pdrcode = hfa384x2host_16(pda[currpdr+1]);
2777                         /* Test the record length */
2778                         if ( pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2779                                 WLAN_LOG_ERROR("pdrlen invalid=%d\n",
2780                                         pdrlen);
2781                                 pdaok = 0;
2782                                 break;
2783                         }
2784                         /* Test the code */
2785                         if ( !hfa384x_isgood_pdrcode(pdrcode) ) {
2786                                 WLAN_LOG_ERROR("pdrcode invalid=%d\n",
2787                                         pdrcode);
2788                                 pdaok = 0;
2789                                 break;
2790                         }
2791                         /* Test for completion */
2792                         if ( pdrcode == HFA384x_PDR_END_OF_PDA) {
2793                                 morepdrs = 0;
2794                         }
2795
2796                         /* Move to the next pdr (if necessary) */
2797                         if ( morepdrs ) {
2798                                 /* note the access to pda[], need words here */
2799                                 currpdr += hfa384x2host_16(pda[currpdr]) + 1;
2800                         }
2801                 }
2802                 if ( pdaok ) {
2803                         WLAN_LOG_INFO(
2804                                 "PDA Read from 0x%08x in %s space.\n",
2805                                 pdaloc[i].cardaddr,
2806                                 pdaloc[i].auxctl == 0 ? "EXTDS" :
2807                                 pdaloc[i].auxctl == 1 ? "NV" :
2808                                 pdaloc[i].auxctl == 2 ? "PHY" :
2809                                 pdaloc[i].auxctl == 3 ? "ICSRAM" :
2810                                 "<bogus auxctl>");
2811                         break;
2812                 }
2813         }
2814         result = pdaok ? 0 : -ENODATA;
2815
2816         if ( result ) {
2817                 WLAN_LOG_DEBUG(3,"Failure: pda is not okay\n");
2818         }
2819
2820         return result;
2821 }
2822
2823
2824 /*----------------------------------------------------------------
2825 * hfa384x_drvr_setconfig
2826 *
2827 * Performs the sequence necessary to write a config/info item.
2828 *
2829 * Arguments:
2830 *       hw              device structure
2831 *       rid             config/info record id (in host order)
2832 *       buf             host side record buffer
2833 *       len             buffer length (in bytes)
2834 *
2835 * Returns:
2836 *       0               success
2837 *       >0              f/w reported error - f/w status code
2838 *       <0              driver reported error
2839 *
2840 * Side effects:
2841 *
2842 * Call context:
2843 *       process
2844 ----------------------------------------------------------------*/
2845 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2846 {
2847         return hfa384x_dowrid_wait(hw, rid, buf, len);
2848 }
2849
2850 /*----------------------------------------------------------------
2851 * hfa384x_drvr_start
2852 *
2853 * Issues the MAC initialize command, sets up some data structures,
2854 * and enables the interrupts.  After this function completes, the
2855 * low-level stuff should be ready for any/all commands.
2856 *
2857 * Arguments:
2858 *       hw              device structure
2859 * Returns:
2860 *       0               success
2861 *       >0              f/w reported error - f/w status code
2862 *       <0              driver reported error
2863 *
2864 * Side effects:
2865 *
2866 * Call context:
2867 *       process
2868 ----------------------------------------------------------------*/
2869
2870 int hfa384x_drvr_start(hfa384x_t *hw)
2871 {
2872         int             result, result1, result2;
2873         u16             status;
2874
2875         might_sleep();
2876
2877         /* Clear endpoint stalls - but only do this if the endpoint
2878          * is showing a stall status. Some prism2 cards seem to behave
2879          * badly if a clear_halt is called when the endpoint is already
2880          * ok
2881          */
2882         result = usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2883         if (result < 0) {
2884                 WLAN_LOG_ERROR(
2885                         "Cannot get bulk in endpoint status.\n");
2886                 goto done;
2887         }
2888         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in)) {
2889                 WLAN_LOG_ERROR(
2890                         "Failed to reset bulk in endpoint.\n");
2891         }
2892
2893         result = usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2894         if (result < 0) {
2895                 WLAN_LOG_ERROR(
2896                         "Cannot get bulk out endpoint status.\n");
2897                 goto done;
2898         }
2899         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out)) {
2900                 WLAN_LOG_ERROR(
2901                         "Failed to reset bulk out endpoint.\n");
2902         }
2903
2904         /* Synchronous unlink, in case we're trying to restart the driver */
2905         usb_kill_urb(&hw->rx_urb);
2906
2907         /* Post the IN urb */
2908         result = submit_rx_urb(hw, GFP_KERNEL);
2909         if (result != 0) {
2910                 WLAN_LOG_ERROR(
2911                         "Fatal, failed to submit RX URB, result=%d\n",
2912                         result);
2913                 goto done;
2914         }
2915
2916         /* Call initialize twice, with a 1 second sleep in between.
2917          * This is a nasty work-around since many prism2 cards seem to
2918          * need time to settle after an init from cold. The second
2919          * call to initialize in theory is not necessary - but we call
2920          * it anyway as a double insurance policy:
2921          * 1) If the first init should fail, the second may well succeed
2922          *    and the card can still be used
2923          * 2) It helps ensures all is well with the card after the first
2924          *    init and settle time.
2925          */
2926         result1 = hfa384x_cmd_initialize(hw);
2927         msleep(1000);
2928         result = result2 = hfa384x_cmd_initialize(hw);
2929         if (result1 != 0) {
2930                 if (result2 != 0) {
2931                         WLAN_LOG_ERROR(
2932                                 "cmd_initialize() failed on two attempts, results %d and %d\n",
2933                                 result1, result2);
2934                         usb_kill_urb(&hw->rx_urb);
2935                         goto done;
2936                 } else {
2937                         WLAN_LOG_DEBUG(0, "First cmd_initialize() failed (result %d),\n",
2938                                 result1);
2939                         WLAN_LOG_DEBUG(0, "but second attempt succeeded. All should be ok\n");
2940                 }
2941         } else if (result2 != 0) {
2942                 WLAN_LOG_WARNING(
2943                         "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2944                         result2);
2945                 WLAN_LOG_WARNING("Most likely the card will be functional\n");
2946                         goto done;
2947         }
2948
2949         hw->state = HFA384x_STATE_RUNNING;
2950
2951 done:
2952         return result;
2953 }
2954
2955
2956 /*----------------------------------------------------------------
2957 * hfa384x_drvr_stop
2958 *
2959 * Shuts down the MAC to the point where it is safe to unload the
2960 * driver.  Any subsystem that may be holding a data or function
2961 * ptr into the driver must be cleared/deinitialized.
2962 *
2963 * Arguments:
2964 *       hw              device structure
2965 * Returns:
2966 *       0               success
2967 *       >0              f/w reported error - f/w status code
2968 *       <0              driver reported error
2969 *
2970 * Side effects:
2971 *
2972 * Call context:
2973 *       process
2974 ----------------------------------------------------------------*/
2975 int
2976 hfa384x_drvr_stop(hfa384x_t *hw)
2977 {
2978         int     result = 0;
2979         int     i;
2980
2981         might_sleep();
2982
2983         /* There's no need for spinlocks here. The USB "disconnect"
2984          * function sets this "removed" flag and then calls us.
2985          */
2986         if ( !hw->wlandev->hwremoved ) {
2987                 /* Call initialize to leave the MAC in its 'reset' state */
2988                 hfa384x_cmd_initialize(hw);
2989
2990                 /* Cancel the rxurb */
2991                 usb_kill_urb(&hw->rx_urb);
2992         }
2993
2994         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2995         hw->state = HFA384x_STATE_INIT;
2996
2997         del_timer_sync(&hw->commsqual_timer);
2998
2999         /* Clear all the port status */
3000         for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
3001                 hw->port_enabled[i] = 0;
3002         }
3003
3004         return result;
3005 }
3006
3007 /*----------------------------------------------------------------
3008 * hfa384x_drvr_txframe
3009 *
3010 * Takes a frame from prism2sta and queues it for transmission.
3011 *
3012 * Arguments:
3013 *       hw              device structure
3014 *       skb             packet buffer struct.  Contains an 802.11
3015 *                       data frame.
3016 *       p80211_hdr      points to the 802.11 header for the packet.
3017 * Returns:
3018 *       0               Success and more buffs available
3019 *       1               Success but no more buffs
3020 *       2               Allocation failure
3021 *       4               Buffer full or queue busy
3022 *
3023 * Side effects:
3024 *
3025 * Call context:
3026 *       interrupt
3027 ----------------------------------------------------------------*/
3028 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb, p80211_hdr_t *p80211_hdr, p80211_metawep_t *p80211_wep)
3029
3030 {
3031         int             usbpktlen = sizeof(hfa384x_tx_frame_t);
3032         int             result;
3033         int             ret;
3034         char            *ptr;
3035
3036         if (hw->tx_urb.status == -EINPROGRESS) {
3037                 WLAN_LOG_WARNING("TX URB already in use\n");
3038                 result = 3;
3039                 goto exit;
3040         }
3041
3042         /* Build Tx frame structure */
3043         /* Set up the control field */
3044         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
3045
3046         /* Setup the usb type field */
3047         hw->txbuff.type = host2hfa384x_16(HFA384x_USB_TXFRM);
3048
3049         /* Set up the sw_support field to identify this frame */
3050         hw->txbuff.txfrm.desc.sw_support = 0x0123;
3051
3052 /* Tx complete and Tx exception disable per dleach.  Might be causing
3053  * buf depletion
3054  */
3055 //#define DOEXC  SLP -- doboth breaks horribly under load, doexc less so.
3056 #if defined(DOBOTH)
3057         hw->txbuff.txfrm.desc.tx_control =
3058                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3059                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
3060 #elif defined(DOEXC)
3061         hw->txbuff.txfrm.desc.tx_control =
3062                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3063                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
3064 #else
3065         hw->txbuff.txfrm.desc.tx_control =
3066                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3067                 HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
3068 #endif
3069         hw->txbuff.txfrm.desc.tx_control =
3070                 host2hfa384x_16(hw->txbuff.txfrm.desc.tx_control);
3071
3072         /* copy the header over to the txdesc */
3073         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr, sizeof(p80211_hdr_t));
3074
3075         /* if we're using host WEP, increase size by IV+ICV */
3076         if (p80211_wep->data) {
3077                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len+8);
3078                 // hw->txbuff.txfrm.desc.tx_control |= HFA384x_TX_NOENCRYPT_SET(1);
3079                 usbpktlen+=8;
3080         } else {
3081                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len);
3082         }
3083
3084         usbpktlen += skb->len;
3085
3086         /* copy over the WEP IV if we are using host WEP */
3087         ptr = hw->txbuff.txfrm.data;
3088         if (p80211_wep->data) {
3089                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
3090                 ptr+= sizeof(p80211_wep->iv);
3091                 memcpy(ptr, p80211_wep->data, skb->len);
3092         } else {
3093                 memcpy(ptr, skb->data, skb->len);
3094         }
3095         /* copy over the packet data */
3096         ptr+= skb->len;
3097
3098         /* copy over the WEP ICV if we are using host WEP */
3099         if (p80211_wep->data) {
3100                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
3101         }
3102
3103         /* Send the USB packet */
3104         usb_fill_bulk_urb( &(hw->tx_urb), hw->usb,
3105                        hw->endp_out,
3106                        &(hw->txbuff), ROUNDUP64(usbpktlen),
3107                        hfa384x_usbout_callback, hw->wlandev );
3108         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
3109
3110         result = 1;
3111         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
3112         if ( ret != 0 ) {
3113                 WLAN_LOG_ERROR(
3114                         "submit_tx_urb() failed, error=%d\n", ret);
3115                 result = 3;
3116         }
3117
3118  exit:
3119         return result;
3120 }
3121
3122 void hfa384x_tx_timeout(wlandevice_t *wlandev)
3123 {
3124         hfa384x_t       *hw = wlandev->priv;
3125         unsigned long flags;
3126
3127         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3128
3129         if ( !hw->wlandev->hwremoved &&
3130              /* Note the bitwise OR, not the logical OR. */
3131              ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) |
3132                !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) ) )
3133         {
3134                 schedule_work(&hw->usb_work);
3135         }
3136
3137         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3138 }
3139
3140 /*----------------------------------------------------------------
3141 * hfa384x_usbctlx_reaper_task
3142 *
3143 * Tasklet to delete dead CTLX objects
3144 *
3145 * Arguments:
3146 *       data    ptr to a hfa384x_t
3147 *
3148 * Returns:
3149 *
3150 * Call context:
3151 *       Interrupt
3152 ----------------------------------------------------------------*/
3153 static void hfa384x_usbctlx_reaper_task(unsigned long data)
3154 {
3155         hfa384x_t       *hw = (hfa384x_t*)data;
3156         struct list_head *entry;
3157         struct list_head *temp;
3158         unsigned long   flags;
3159
3160         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3161
3162         /* This list is guaranteed to be empty if someone
3163          * has unplugged the adapter.
3164          */
3165         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
3166                 hfa384x_usbctlx_t       *ctlx;
3167
3168                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3169                 list_del(&ctlx->list);
3170                 kfree(ctlx);
3171         }
3172
3173         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3174
3175 }
3176
3177 /*----------------------------------------------------------------
3178 * hfa384x_usbctlx_completion_task
3179 *
3180 * Tasklet to call completion handlers for returned CTLXs
3181 *
3182 * Arguments:
3183 *       data    ptr to hfa384x_t
3184 *
3185 * Returns:
3186 *       Nothing
3187 *
3188 * Call context:
3189 *       Interrupt
3190 ----------------------------------------------------------------*/
3191 static void hfa384x_usbctlx_completion_task(unsigned long data)
3192 {
3193         hfa384x_t *hw = (hfa384x_t*)data;
3194         struct list_head *entry;
3195         struct list_head *temp;
3196         unsigned long flags;
3197
3198         int reap = 0;
3199
3200         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3201
3202         /* This list is guaranteed to be empty if someone
3203          * has unplugged the adapter ...
3204          */
3205         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
3206                 hfa384x_usbctlx_t *ctlx;
3207
3208                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3209
3210                 /* Call the completion function that this
3211                  * command was assigned, assuming it has one.
3212                  */
3213                 if ( ctlx->cmdcb != NULL ) {
3214                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3215                         ctlx->cmdcb(hw, ctlx);
3216                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3217
3218                         /* Make sure we don't try and complete
3219                          * this CTLX more than once!
3220                          */
3221                         ctlx->cmdcb = NULL;
3222
3223                         /* Did someone yank the adapter out
3224                          * while our list was (briefly) unlocked?
3225                          */
3226                         if ( hw->wlandev->hwremoved )
3227                         {
3228                                 reap = 0;
3229                                 break;
3230                         }
3231                 }
3232
3233                 /*
3234                  * "Reapable" CTLXs are ones which don't have any
3235                  * threads waiting for them to die. Hence they must
3236                  * be delivered to The Reaper!
3237                  */
3238                 if ( ctlx->reapable ) {
3239                         /* Move the CTLX off the "completing" list (hopefully)
3240                          * on to the "reapable" list where the reaper task
3241                          * can find it. And "reapable" means that this CTLX
3242                          * isn't sitting on a wait-queue somewhere.
3243                          */
3244                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
3245                         reap = 1;
3246                 }
3247
3248                 complete(&ctlx->done);
3249         }
3250         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3251
3252         if (reap)
3253                 tasklet_schedule(&hw->reaper_bh);
3254 }
3255
3256 /*----------------------------------------------------------------
3257 * unlocked_usbctlx_cancel_async
3258 *
3259 * Mark the CTLX dead asynchronously, and ensure that the
3260 * next command on the queue is run afterwards.
3261 *
3262 * Arguments:
3263 *       hw      ptr to the hfa384x_t structure
3264 *       ctlx    ptr to a CTLX structure
3265 *
3266 * Returns:
3267 *       0       the CTLX's URB is inactive
3268 * -EINPROGRESS  the URB is currently being unlinked
3269 *
3270 * Call context:
3271 *       Either process or interrupt, but presumably interrupt
3272 ----------------------------------------------------------------*/
3273 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3274 {
3275         int ret;
3276
3277         /*
3278          * Try to delete the URB containing our request packet.
3279          * If we succeed, then its completion handler will be
3280          * called with a status of -ECONNRESET.
3281          */
3282         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3283         ret = usb_unlink_urb(&hw->ctlx_urb);
3284
3285         if (ret != -EINPROGRESS) {
3286                 /*
3287                  * The OUT URB had either already completed
3288                  * or was still in the pending queue, so the
3289                  * URB's completion function will not be called.
3290                  * We will have to complete the CTLX ourselves.
3291                  */
3292                 ctlx->state = CTLX_REQ_FAILED;
3293                 unlocked_usbctlx_complete(hw, ctlx);
3294                 ret = 0;
3295         }
3296
3297         return ret;
3298 }
3299
3300 /*----------------------------------------------------------------
3301 * unlocked_usbctlx_complete
3302 *
3303 * A CTLX has completed.  It may have been successful, it may not
3304 * have been. At this point, the CTLX should be quiescent.  The URBs
3305 * aren't active and the timers should have been stopped.
3306 *
3307 * The CTLX is migrated to the "completing" queue, and the completing
3308 * tasklet is scheduled.
3309 *
3310 * Arguments:
3311 *       hw              ptr to a hfa384x_t structure
3312 *       ctlx            ptr to a ctlx structure
3313 *
3314 * Returns:
3315 *       nothing
3316 *
3317 * Side effects:
3318 *
3319 * Call context:
3320 *       Either, assume interrupt
3321 ----------------------------------------------------------------*/
3322 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3323 {
3324         /* Timers have been stopped, and ctlx should be in
3325          * a terminal state. Retire it from the "active"
3326          * queue.
3327          */
3328         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3329         tasklet_schedule(&hw->completion_bh);
3330
3331         switch (ctlx->state) {
3332         case CTLX_COMPLETE:
3333         case CTLX_REQ_FAILED:
3334                 /* This are the correct terminating states. */
3335                 break;
3336
3337         default:
3338                 WLAN_LOG_ERROR("CTLX[%d] not in a terminating state(%s)\n",
3339                                hfa384x2host_16(ctlx->outbuf.type),
3340                                ctlxstr(ctlx->state));
3341                 break;
3342         } /* switch */
3343 }
3344
3345 /*----------------------------------------------------------------
3346 * hfa384x_usbctlxq_run
3347 *
3348 * Checks to see if the head item is running.  If not, starts it.
3349 *
3350 * Arguments:
3351 *       hw      ptr to hfa384x_t
3352 *
3353 * Returns:
3354 *       nothing
3355 *
3356 * Side effects:
3357 *
3358 * Call context:
3359 *       any
3360 ----------------------------------------------------------------*/
3361 static void
3362 hfa384x_usbctlxq_run(hfa384x_t  *hw)
3363 {
3364         unsigned long           flags;
3365
3366         /* acquire lock */
3367         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3368
3369         /* Only one active CTLX at any one time, because there's no
3370          * other (reliable) way to match the response URB to the
3371          * correct CTLX.
3372          *
3373          * Don't touch any of these CTLXs if the hardware
3374          * has been removed or the USB subsystem is stalled.
3375          */
3376         if ( !list_empty(&hw->ctlxq.active) ||
3377              test_bit(WORK_TX_HALT, &hw->usb_flags) ||
3378              hw->wlandev->hwremoved )
3379                 goto unlock;
3380
3381         while ( !list_empty(&hw->ctlxq.pending) ) {
3382                 hfa384x_usbctlx_t       *head;
3383                 int                     result;
3384
3385                 /* This is the first pending command */
3386                 head = list_entry(hw->ctlxq.pending.next,
3387                                   hfa384x_usbctlx_t,
3388                                   list);
3389
3390                 /* We need to split this off to avoid a race condition */
3391                 list_move_tail(&head->list, &hw->ctlxq.active);
3392
3393                 /* Fill the out packet */
3394                 usb_fill_bulk_urb( &(hw->ctlx_urb), hw->usb,
3395                                    hw->endp_out,
3396                                    &(head->outbuf), ROUNDUP64(head->outbufsize),
3397                                    hfa384x_ctlxout_callback, hw);
3398                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3399
3400                 /* Now submit the URB and update the CTLX's state
3401                  */
3402                 if ((result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC)) == 0) {
3403                         /* This CTLX is now running on the active queue */
3404                         head->state = CTLX_REQ_SUBMITTED;
3405
3406                         /* Start the OUT wait timer */
3407                         hw->req_timer_done = 0;
3408                         hw->reqtimer.expires = jiffies + HZ;
3409                         add_timer(&hw->reqtimer);
3410
3411                         /* Start the IN wait timer */
3412                         hw->resp_timer_done = 0;
3413                         hw->resptimer.expires = jiffies + 2*HZ;
3414                         add_timer(&hw->resptimer);
3415
3416                         break;
3417                 }
3418
3419                 if (result == -EPIPE) {
3420                         /* The OUT pipe needs resetting, so put
3421                          * this CTLX back in the "pending" queue
3422                          * and schedule a reset ...
3423                          */
3424                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
3425                                          hw->wlandev->netdev->name);
3426                         list_move(&head->list, &hw->ctlxq.pending);
3427                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3428                         schedule_work(&hw->usb_work);
3429                         break;
3430                 }
3431
3432                 if (result == -ESHUTDOWN) {
3433                         WLAN_LOG_WARNING("%s urb shutdown!\n",
3434                                          hw->wlandev->netdev->name);
3435                         break;
3436                 }
3437
3438                 WLAN_LOG_ERROR("Failed to submit CTLX[%d]: error=%d\n",
3439                                hfa384x2host_16(head->outbuf.type), result);
3440                 unlocked_usbctlx_complete(hw, head);
3441         } /* while */
3442
3443         unlock:
3444         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3445 }
3446
3447
3448 /*----------------------------------------------------------------
3449 * hfa384x_usbin_callback
3450 *
3451 * Callback for URBs on the BULKIN endpoint.
3452 *
3453 * Arguments:
3454 *       urb             ptr to the completed urb
3455 *
3456 * Returns:
3457 *       nothing
3458 *
3459 * Side effects:
3460 *
3461 * Call context:
3462 *       interrupt
3463 ----------------------------------------------------------------*/
3464 static void hfa384x_usbin_callback(struct urb *urb)
3465 {
3466         wlandevice_t            *wlandev = urb->context;
3467         hfa384x_t               *hw;
3468         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3469         struct sk_buff          *skb = NULL;
3470         int                     result;
3471         int                     urb_status;
3472         u16                     type;
3473
3474         enum USBIN_ACTION {
3475                 HANDLE,
3476                 RESUBMIT,
3477                 ABORT
3478         } action;
3479
3480         if ( !wlandev ||
3481              !wlandev->netdev ||
3482              wlandev->hwremoved )
3483                 goto exit;
3484
3485         hw = wlandev->priv;
3486         if (!hw)
3487                 goto exit;
3488
3489         skb = hw->rx_urb_skb;
3490         if (!skb || (skb->data != urb->transfer_buffer)) {
3491                 BUG();
3492         }
3493         hw->rx_urb_skb = NULL;
3494
3495         /* Check for error conditions within the URB */
3496         switch (urb->status) {
3497         case 0:
3498                 action = HANDLE;
3499
3500                 /* Check for short packet */
3501                 if ( urb->actual_length == 0 ) {
3502                         ++(wlandev->linux_stats.rx_errors);
3503                         ++(wlandev->linux_stats.rx_length_errors);
3504                         action = RESUBMIT;
3505                 }
3506                 break;
3507
3508         case -EPIPE:
3509                 WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
3510                                  wlandev->netdev->name);
3511                 if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
3512                         schedule_work(&hw->usb_work);
3513                 ++(wlandev->linux_stats.rx_errors);
3514                 action = ABORT;
3515                 break;
3516
3517         case -EILSEQ:
3518         case -ETIMEDOUT:
3519         case -EPROTO:
3520                 if ( !test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3521                      !timer_pending(&hw->throttle) ) {
3522                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3523                 }
3524                 ++(wlandev->linux_stats.rx_errors);
3525                 action = ABORT;
3526                 break;
3527
3528         case -EOVERFLOW:
3529                 ++(wlandev->linux_stats.rx_over_errors);
3530                 action = RESUBMIT;
3531                 break;
3532
3533         case -ENODEV:
3534         case -ESHUTDOWN:
3535                 WLAN_LOG_DEBUG(3,"status=%d, device removed.\n", urb->status);
3536                 action = ABORT;
3537                 break;
3538
3539         case -ENOENT:
3540         case -ECONNRESET:
3541                 WLAN_LOG_DEBUG(3,"status=%d, urb explicitly unlinked.\n", urb->status);
3542                 action = ABORT;
3543                 break;
3544
3545         default:
3546                 WLAN_LOG_DEBUG(3,"urb status=%d, transfer flags=0x%x\n",
3547                                  urb->status, urb->transfer_flags);
3548                 ++(wlandev->linux_stats.rx_errors);
3549                 action = RESUBMIT;
3550                 break;
3551         }
3552
3553         urb_status = urb->status;
3554
3555         if (action != ABORT) {
3556                 /* Repost the RX URB */
3557                 result = submit_rx_urb(hw, GFP_ATOMIC);
3558
3559                 if (result != 0) {
3560                         WLAN_LOG_ERROR(
3561                                 "Fatal, failed to resubmit rx_urb. error=%d\n",
3562                                 result);
3563                 }
3564         }
3565
3566         /* Handle any USB-IN packet */
3567         /* Note: the check of the sw_support field, the type field doesn't
3568          *       have bit 12 set like the docs suggest.
3569          */
3570         type = hfa384x2host_16(usbin->type);
3571         if (HFA384x_USB_ISRXFRM(type)) {
3572                 if (action == HANDLE) {
3573                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3574                                 hfa384x_usbin_txcompl(wlandev, usbin);
3575                         } else {
3576                                 skb_put(skb, sizeof(*usbin));
3577                                 hfa384x_usbin_rx(wlandev, skb);
3578                                 skb = NULL;
3579                         }
3580                 }
3581                 goto exit;
3582         }
3583         if (HFA384x_USB_ISTXFRM(type)) {
3584                 if (action == HANDLE)
3585                         hfa384x_usbin_txcompl(wlandev, usbin);
3586                 goto exit;
3587         }
3588         switch (type) {
3589         case HFA384x_USB_INFOFRM:
3590                 if (action == ABORT)
3591                         goto exit;
3592                 if (action == HANDLE)
3593                         hfa384x_usbin_info(wlandev, usbin);
3594                 break;
3595
3596         case HFA384x_USB_CMDRESP:
3597         case HFA384x_USB_WRIDRESP:
3598         case HFA384x_USB_RRIDRESP:
3599         case HFA384x_USB_WMEMRESP:
3600         case HFA384x_USB_RMEMRESP:
3601                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3602                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3603                 break;
3604
3605         case HFA384x_USB_BUFAVAIL:
3606                 WLAN_LOG_DEBUG(3,"Received BUFAVAIL packet, frmlen=%d\n",
3607                         usbin->bufavail.frmlen);
3608                 break;
3609
3610         case HFA384x_USB_ERROR:
3611                 WLAN_LOG_DEBUG(3,"Received USB_ERROR packet, errortype=%d\n",
3612                         usbin->usberror.errortype);
3613                 break;
3614
3615         default:
3616                 WLAN_LOG_DEBUG(3,"Unrecognized USBIN packet, type=%x, status=%d\n",
3617                         usbin->type, urb_status);
3618                 break;
3619         } /* switch */
3620
3621 exit:
3622
3623         if (skb)
3624                 dev_kfree_skb(skb);
3625 }
3626
3627
3628 /*----------------------------------------------------------------
3629 * hfa384x_usbin_ctlx
3630 *
3631 * We've received a URB containing a Prism2 "response" message.
3632 * This message needs to be matched up with a CTLX on the active
3633 * queue and our state updated accordingly.
3634 *
3635 * Arguments:
3636 *       hw              ptr to hfa384x_t
3637 *       usbin           ptr to USB IN packet
3638 *       urb_status      status of this Bulk-In URB
3639 *
3640 * Returns:
3641 *       nothing
3642 *
3643 * Side effects:
3644 *
3645 * Call context:
3646 *       interrupt
3647 ----------------------------------------------------------------*/
3648 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3649                                int urb_status)
3650 {
3651         hfa384x_usbctlx_t       *ctlx;
3652         int                     run_queue = 0;
3653         unsigned long           flags;
3654
3655 retry:
3656         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3657
3658         /* There can be only one CTLX on the active queue
3659          * at any one time, and this is the CTLX that the
3660          * timers are waiting for.
3661          */
3662         if ( list_empty(&hw->ctlxq.active) ) {
3663                 goto unlock;
3664         }
3665
3666         /* Remove the "response timeout". It's possible that
3667          * we are already too late, and that the timeout is
3668          * already running. And that's just too bad for us,
3669          * because we could lose our CTLX from the active
3670          * queue here ...
3671          */
3672         if (del_timer(&hw->resptimer) == 0) {
3673                 if (hw->resp_timer_done == 0) {
3674                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3675                         goto retry;
3676                 }
3677         }
3678         else {
3679                 hw->resp_timer_done = 1;
3680         }
3681
3682         ctlx = get_active_ctlx(hw);
3683
3684         if (urb_status != 0) {
3685                 /*
3686                  * Bad CTLX, so get rid of it. But we only
3687                  * remove it from the active queue if we're no
3688                  * longer expecting the OUT URB to complete.
3689                  */
3690                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3691                         run_queue = 1;
3692         } else {
3693                 const u16 intype = (usbin->type&~host2hfa384x_16(0x8000));
3694
3695                 /*
3696                  * Check that our message is what we're expecting ...
3697                  */
3698                 if (ctlx->outbuf.type != intype) {
3699                         WLAN_LOG_WARNING("Expected IN[%d], received IN[%d] - ignored.\n",
3700                                          hfa384x2host_16(ctlx->outbuf.type),
3701                                          hfa384x2host_16(intype));
3702                         goto unlock;
3703                 }
3704
3705                 /* This URB has succeeded, so grab the data ... */
3706                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3707
3708                 switch (ctlx->state) {
3709                 case CTLX_REQ_SUBMITTED:
3710                         /*
3711                          * We have received our response URB before
3712                          * our request has been acknowledged. Odd,
3713                          * but our OUT URB is still alive...
3714                          */
3715                         WLAN_LOG_DEBUG(0, "Causality violation: please reboot Universe, or email linux-wlan-devel@lists.linux-wlan.com\n");
3716                         ctlx->state = CTLX_RESP_COMPLETE;
3717                         break;
3718
3719                 case CTLX_REQ_COMPLETE:
3720                         /*
3721                          * This is the usual path: our request
3722                          * has already been acknowledged, and
3723                          * now we have received the reply too.
3724                          */
3725                         ctlx->state = CTLX_COMPLETE;
3726                         unlocked_usbctlx_complete(hw, ctlx);
3727                         run_queue = 1;
3728                         break;
3729
3730                 default:
3731                         /*
3732                          * Throw this CTLX away ...
3733                          */
3734                         WLAN_LOG_ERROR("Matched IN URB, CTLX[%d] in invalid state(%s)."
3735                                        " Discarded.\n",
3736                                        hfa384x2host_16(ctlx->outbuf.type),
3737                                        ctlxstr(ctlx->state));
3738                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3739                                 run_queue = 1;
3740                         break;
3741                 } /* switch */
3742         }
3743
3744 unlock:
3745         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3746
3747         if (run_queue)
3748                 hfa384x_usbctlxq_run(hw);
3749 }
3750
3751
3752 /*----------------------------------------------------------------
3753 * hfa384x_usbin_txcompl
3754 *
3755 * At this point we have the results of a previous transmit.
3756 *
3757 * Arguments:
3758 *       wlandev         wlan device
3759 *       usbin           ptr to the usb transfer buffer
3760 *
3761 * Returns:
3762 *       nothing
3763 *
3764 * Side effects:
3765 *
3766 * Call context:
3767 *       interrupt
3768 ----------------------------------------------------------------*/
3769 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3770 {
3771         u16                     status;
3772
3773         status = hfa384x2host_16(usbin->type); /* yeah I know it says type...*/
3774
3775         /* Was there an error? */
3776         if (HFA384x_TXSTATUS_ISERROR(status)) {
3777                 prism2sta_ev_txexc(wlandev, status);
3778         } else {
3779                 prism2sta_ev_tx(wlandev, status);
3780         }
3781         // prism2sta_ev_alloc(wlandev);
3782 }
3783
3784
3785 /*----------------------------------------------------------------
3786 * hfa384x_usbin_rx
3787 *
3788 * At this point we have a successful received a rx frame packet.
3789 *
3790 * Arguments:
3791 *       wlandev         wlan device
3792 *       usbin           ptr to the usb transfer buffer
3793 *
3794 * Returns:
3795 *       nothing
3796 *
3797 * Side effects:
3798 *
3799 * Call context:
3800 *       interrupt
3801 ----------------------------------------------------------------*/
3802 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
3803 {
3804         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) skb->data;
3805         hfa384x_t               *hw = wlandev->priv;
3806         int                     hdrlen;
3807         p80211_rxmeta_t         *rxmeta;
3808         u16                  data_len;
3809         u16                  fc;
3810
3811         /* Byte order convert once up front. */
3812         usbin->rxfrm.desc.status =
3813                 hfa384x2host_16(usbin->rxfrm.desc.status);
3814         usbin->rxfrm.desc.time =
3815                 hfa384x2host_32(usbin->rxfrm.desc.time);
3816
3817         /* Now handle frame based on port# */
3818         switch( HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) )
3819         {
3820         case 0:
3821                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3822
3823                 /* If exclude and we receive an unencrypted, drop it */
3824                 if ( (wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3825                      !WLAN_GET_FC_ISWEP(fc)){
3826                         goto done;
3827                 }
3828
3829                 data_len = hfa384x2host_16(usbin->rxfrm.desc.data_len);
3830
3831                 /* How much header data do we have? */
3832                 hdrlen = p80211_headerlen(fc);
3833
3834                 /* Pull off the descriptor */
3835                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
3836
3837                 /* Now shunt the header block up against the data block
3838                  * with an "overlapping" copy
3839                  */
3840                 memmove(skb_push(skb, hdrlen),
3841                         &usbin->rxfrm.desc.frame_control,
3842                         hdrlen);
3843
3844                 skb->dev = wlandev->netdev;
3845                 skb->dev->last_rx = jiffies;
3846
3847                 /* And set the frame length properly */
3848                 skb_trim(skb, data_len + hdrlen);
3849
3850                 /* The prism2 series does not return the CRC */
3851                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3852
3853                 skb_reset_mac_header(skb);
3854
3855                 /* Attach the rxmeta, set some stuff */
3856                 p80211skb_rxmeta_attach(wlandev, skb);
3857                 rxmeta = P80211SKB_RXMETA(skb);
3858                 rxmeta->mactime = usbin->rxfrm.desc.time;
3859                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3860                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3861                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3862
3863                 prism2sta_ev_rx(wlandev, skb);
3864
3865                 break;
3866
3867         case 7:
3868                 if ( ! HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status) ) {
3869                         /* Copy to wlansnif skb */
3870                         hfa384x_int_rxmonitor( wlandev, &usbin->rxfrm);
3871                         dev_kfree_skb(skb);
3872                 } else {
3873                         WLAN_LOG_DEBUG(3,"Received monitor frame: FCSerr set\n");
3874                 }
3875                 break;
3876
3877         default:
3878                 WLAN_LOG_WARNING("Received frame on unsupported port=%d\n",
3879                         HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) );
3880                 goto done;
3881                 break;
3882         }
3883
3884 done:
3885         return;
3886 }
3887
3888 /*----------------------------------------------------------------
3889 * hfa384x_int_rxmonitor
3890 *
3891 * Helper function for int_rx.  Handles monitor frames.
3892 * Note that this function allocates space for the FCS and sets it
3893 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3894 * higher layers expect it.  0xffffffff is used as a flag to indicate
3895 * the FCS is bogus.
3896 *
3897 * Arguments:
3898 *       wlandev         wlan device structure
3899 *       rxfrm           rx descriptor read from card in int_rx
3900 *
3901 * Returns:
3902 *       nothing
3903 *
3904 * Side effects:
3905 *       Allocates an skb and passes it up via the PF_PACKET interface.
3906 * Call context:
3907 *       interrupt
3908 ----------------------------------------------------------------*/
3909 static void hfa384x_int_rxmonitor( wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm)
3910 {
3911         hfa384x_rx_frame_t              *rxdesc = &(rxfrm->desc);
3912         unsigned int                            hdrlen = 0;
3913         unsigned int                            datalen = 0;
3914         unsigned int                            skblen = 0;
3915         u8                              *datap;
3916         u16                             fc;
3917         struct sk_buff                  *skb;
3918         hfa384x_t                       *hw = wlandev->priv;
3919
3920         /* Don't forget the status, time, and data_len fields are in host order */
3921         /* Figure out how big the frame is */
3922         fc = le16_to_cpu(rxdesc->frame_control);
3923         hdrlen = p80211_headerlen(fc);
3924         datalen = hfa384x2host_16(rxdesc->data_len);
3925
3926         /* Allocate an ind message+framesize skb */
3927         skblen = sizeof(p80211_caphdr_t) +
3928                 hdrlen + datalen + WLAN_CRC_LEN;
3929
3930         /* sanity check the length */
3931         if ( skblen >
3932              (sizeof(p80211_caphdr_t) +
3933               WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN) ) {
3934                 WLAN_LOG_DEBUG(1, "overlen frm: len=%zd\n",
3935                                skblen - sizeof(p80211_caphdr_t));
3936         }
3937
3938         if ( (skb = dev_alloc_skb(skblen)) == NULL ) {
3939                 WLAN_LOG_ERROR("alloc_skb failed trying to allocate %d bytes\n", skblen);
3940                 return;
3941         }
3942
3943         /* only prepend the prism header if in the right mode */
3944         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3945             (hw->sniffhdr != 0)) {
3946                 p80211_caphdr_t         *caphdr;
3947                 /* The NEW header format! */
3948                 datap = skb_put(skb, sizeof(p80211_caphdr_t));
3949                 caphdr = (p80211_caphdr_t*) datap;
3950
3951                 caphdr->version =       htonl(P80211CAPTURE_VERSION);
3952                 caphdr->length =        htonl(sizeof(p80211_caphdr_t));
3953                 caphdr->mactime =       __cpu_to_be64(rxdesc->time) * 1000;
3954                 caphdr->hosttime =      __cpu_to_be64(jiffies);
3955                 caphdr->phytype =       htonl(4); /* dss_dot11_b */
3956                 caphdr->channel =       htonl(hw->sniff_channel);
3957                 caphdr->datarate =      htonl(rxdesc->rate);
3958                 caphdr->antenna =       htonl(0); /* unknown */
3959                 caphdr->priority =      htonl(0); /* unknown */
3960                 caphdr->ssi_type =      htonl(3); /* rssi_raw */
3961                 caphdr->ssi_signal =    htonl(rxdesc->signal);
3962                 caphdr->ssi_noise =     htonl(rxdesc->silence);
3963                 caphdr->preamble =      htonl(0); /* unknown */
3964                 caphdr->encoding =      htonl(1); /* cck */
3965         }
3966
3967         /* Copy the 802.11 header to the skb (ctl frames may be less than a full header) */
3968         datap = skb_put(skb, hdrlen);
3969         memcpy( datap, &(rxdesc->frame_control), hdrlen);
3970
3971         /* If any, copy the data from the card to the skb */
3972         if ( datalen > 0 )
3973         {
3974                 datap = skb_put(skb, datalen);
3975                 memcpy(datap, rxfrm->data, datalen);
3976
3977                 /* check for unencrypted stuff if WEP bit set. */
3978                 if (*(datap - hdrlen + 1) & 0x40) // wep set
3979                   if ((*(datap) == 0xaa) && (*(datap+1) == 0xaa))
3980                     *(datap - hdrlen + 1) &= 0xbf; // clear wep; it's the 802.2 header!
3981         }
3982
3983         if (hw->sniff_fcs) {
3984                 /* Set the FCS */
3985                 datap = skb_put(skb, WLAN_CRC_LEN);
3986                 memset( datap, 0xff, WLAN_CRC_LEN);
3987         }
3988
3989         /* pass it back up */
3990         prism2sta_ev_rx(wlandev, skb);
3991
3992         return;
3993 }
3994
3995
3996
3997 /*----------------------------------------------------------------
3998 * hfa384x_usbin_info
3999 *
4000 * At this point we have a successful received a Prism2 info frame.
4001 *
4002 * Arguments:
4003 *       wlandev         wlan device
4004 *       usbin           ptr to the usb transfer buffer
4005 *
4006 * Returns:
4007 *       nothing
4008 *
4009 * Side effects:
4010 *
4011 * Call context:
4012 *       interrupt
4013 ----------------------------------------------------------------*/
4014 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4015 {
4016         usbin->infofrm.info.framelen = hfa384x2host_16(usbin->infofrm.info.framelen);
4017         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
4018 }
4019
4020
4021
4022 /*----------------------------------------------------------------
4023 * hfa384x_usbout_callback
4024 *
4025 * Callback for URBs on the BULKOUT endpoint.
4026 *
4027 * Arguments:
4028 *       urb             ptr to the completed urb
4029 *
4030 * Returns:
4031 *       nothing
4032 *
4033 * Side effects:
4034 *
4035 * Call context:
4036 *       interrupt
4037 ----------------------------------------------------------------*/
4038 static void hfa384x_usbout_callback(struct urb *urb)
4039 {
4040         wlandevice_t            *wlandev = urb->context;
4041         hfa384x_usbout_t        *usbout = urb->transfer_buffer;
4042
4043 #ifdef DEBUG_USB
4044         dbprint_urb(urb);
4045 #endif
4046
4047         if ( wlandev &&
4048              wlandev->netdev ) {
4049
4050                 switch(urb->status) {
4051                 case 0:
4052                         hfa384x_usbout_tx(wlandev, usbout);
4053                         break;
4054
4055                 case -EPIPE:
4056                 {
4057                         hfa384x_t *hw = wlandev->priv;
4058                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4059                                          wlandev->netdev->name);
4060                         if ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) )
4061                                 schedule_work(&hw->usb_work);
4062                         ++(wlandev->linux_stats.tx_errors);
4063                         break;
4064                 }
4065
4066                 case -EPROTO:
4067                 case -ETIMEDOUT:
4068                 case -EILSEQ:
4069                 {
4070                         hfa384x_t *hw = wlandev->priv;
4071
4072                         if ( !test_and_set_bit(THROTTLE_TX, &hw->usb_flags)
4073                              && !timer_pending(&hw->throttle) ) {
4074                                 mod_timer(&hw->throttle,
4075                                           jiffies + THROTTLE_JIFFIES);
4076                         }
4077                         ++(wlandev->linux_stats.tx_errors);
4078                         netif_stop_queue(wlandev->netdev);
4079                         break;
4080                 }
4081
4082                 case -ENOENT:
4083                 case -ESHUTDOWN:
4084                         /* Ignorable errors */
4085                         break;
4086
4087                 default:
4088                         WLAN_LOG_INFO("unknown urb->status=%d\n", urb->status);
4089                         ++(wlandev->linux_stats.tx_errors);
4090                         break;
4091                 } /* switch */
4092         }
4093 }
4094
4095
4096 /*----------------------------------------------------------------
4097 * hfa384x_ctlxout_callback
4098 *
4099 * Callback for control data on the BULKOUT endpoint.
4100 *
4101 * Arguments:
4102 *       urb             ptr to the completed urb
4103 *
4104 * Returns:
4105 * nothing
4106 *
4107 * Side effects:
4108 *
4109 * Call context:
4110 * interrupt
4111 ----------------------------------------------------------------*/
4112 static void hfa384x_ctlxout_callback(struct urb *urb)
4113 {
4114         hfa384x_t       *hw = urb->context;
4115         int             delete_resptimer = 0;
4116         int             timer_ok = 1;
4117         int             run_queue = 0;
4118         hfa384x_usbctlx_t       *ctlx;
4119         unsigned long   flags;
4120
4121         WLAN_LOG_DEBUG(3,"urb->status=%d\n", urb->status);
4122 #ifdef DEBUG_USB
4123         dbprint_urb(urb);
4124 #endif
4125         if ( (urb->status == -ESHUTDOWN) ||
4126              (urb->status == -ENODEV) ||
4127              (hw == NULL) )
4128                 goto done;
4129
4130 retry:
4131         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4132
4133         /*
4134          * Only one CTLX at a time on the "active" list, and
4135          * none at all if we are unplugged. However, we can
4136          * rely on the disconnect function to clean everything
4137          * up if someone unplugged the adapter.
4138          */
4139         if ( list_empty(&hw->ctlxq.active) ) {
4140                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4141                 goto done;
4142         }
4143
4144         /*
4145          * Having something on the "active" queue means
4146          * that we have timers to worry about ...
4147          */
4148         if (del_timer(&hw->reqtimer) == 0) {
4149                 if (hw->req_timer_done == 0) {
4150                         /*
4151                          * This timer was actually running while we
4152                          * were trying to delete it. Let it terminate
4153                          * gracefully instead.
4154                          */
4155                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4156                         goto retry;
4157                 }
4158         }
4159         else {
4160                 hw->req_timer_done = 1;
4161         }
4162
4163         ctlx = get_active_ctlx(hw);
4164
4165         if ( urb->status == 0 ) {
4166                 /* Request portion of a CTLX is successful */
4167                 switch ( ctlx->state ) {
4168                 case CTLX_REQ_SUBMITTED:
4169                         /* This OUT-ACK received before IN */
4170                         ctlx->state = CTLX_REQ_COMPLETE;
4171                         break;
4172
4173                 case CTLX_RESP_COMPLETE:
4174                         /* IN already received before this OUT-ACK,
4175                          * so this command must now be complete.
4176                          */
4177                         ctlx->state = CTLX_COMPLETE;
4178                         unlocked_usbctlx_complete(hw, ctlx);
4179                         run_queue = 1;
4180                         break;
4181
4182                 default:
4183                         /* This is NOT a valid CTLX "success" state! */
4184                         WLAN_LOG_ERROR(
4185                             "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
4186                             hfa384x2host_16(ctlx->outbuf.type),
4187                             ctlxstr(ctlx->state), urb->status);
4188                         break;
4189                 } /* switch */
4190         } else {
4191                 /* If the pipe has stalled then we need to reset it */
4192                 if ( (urb->status == -EPIPE) &&
4193                       !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) ) {
4194                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4195                                          hw->wlandev->netdev->name);
4196                         schedule_work(&hw->usb_work);
4197                 }
4198
4199                 /* If someone cancels the OUT URB then its status
4200                  * should be either -ECONNRESET or -ENOENT.
4201                  */
4202                 ctlx->state = CTLX_REQ_FAILED;
4203                 unlocked_usbctlx_complete(hw, ctlx);
4204                 delete_resptimer = 1;
4205                 run_queue = 1;
4206         }
4207
4208  delresp:
4209         if (delete_resptimer) {
4210                 if ((timer_ok = del_timer(&hw->resptimer)) != 0) {
4211                         hw->resp_timer_done = 1;
4212                 }
4213         }
4214
4215         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4216
4217         if ( !timer_ok && (hw->resp_timer_done == 0) ) {
4218                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
4219                 goto delresp;
4220         }
4221
4222         if (run_queue)
4223                 hfa384x_usbctlxq_run(hw);
4224
4225  done:
4226         ;
4227 }
4228
4229
4230 /*----------------------------------------------------------------
4231 * hfa384x_usbctlx_reqtimerfn
4232 *
4233 * Timer response function for CTLX request timeouts.  If this
4234 * function is called, it means that the callback for the OUT
4235 * URB containing a Prism2.x XXX_Request was never called.
4236 *
4237 * Arguments:
4238 *       data            a ptr to the hfa384x_t
4239 *
4240 * Returns:
4241 *       nothing
4242 *
4243 * Side effects:
4244 *
4245 * Call context:
4246 *       interrupt
4247 ----------------------------------------------------------------*/
4248 static void
4249 hfa384x_usbctlx_reqtimerfn(unsigned long data)
4250 {
4251         hfa384x_t       *hw = (hfa384x_t*)data;
4252         unsigned long   flags;
4253
4254         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4255
4256         hw->req_timer_done = 1;
4257
4258         /* Removing the hardware automatically empties
4259          * the active list ...
4260          */
4261         if ( !list_empty(&hw->ctlxq.active) )
4262         {
4263                 /*
4264                  * We must ensure that our URB is removed from
4265                  * the system, if it hasn't already expired.
4266                  */
4267                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
4268                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS)
4269                 {
4270                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4271
4272                         ctlx->state = CTLX_REQ_FAILED;
4273
4274                         /* This URB was active, but has now been
4275                          * cancelled. It will now have a status of
4276                          * -ECONNRESET in the callback function.
4277                          *
4278                          * We are cancelling this CTLX, so we're
4279                          * not going to need to wait for a response.
4280                          * The URB's callback function will check
4281                          * that this timer is truly dead.
4282                          */
4283                         if (del_timer(&hw->resptimer) != 0)
4284                                 hw->resp_timer_done = 1;
4285                 }
4286         }
4287
4288         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4289 }
4290
4291
4292 /*----------------------------------------------------------------
4293 * hfa384x_usbctlx_resptimerfn
4294 *
4295 * Timer response function for CTLX response timeouts.  If this
4296 * function is called, it means that the callback for the IN
4297 * URB containing a Prism2.x XXX_Response was never called.
4298 *
4299 * Arguments:
4300 *       data            a ptr to the hfa384x_t
4301 *
4302 * Returns:
4303 *       nothing
4304 *
4305 * Side effects:
4306 *
4307 * Call context:
4308 *       interrupt
4309 ----------------------------------------------------------------*/
4310 static void
4311 hfa384x_usbctlx_resptimerfn(unsigned long data)
4312 {
4313         hfa384x_t *hw = (hfa384x_t*)data;
4314         unsigned long   flags;
4315
4316         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4317
4318         hw->resp_timer_done = 1;
4319
4320         /* The active list will be empty if the
4321          * adapter has been unplugged ...
4322          */
4323         if ( !list_empty(&hw->ctlxq.active) )
4324         {
4325                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4326
4327                 if ( unlocked_usbctlx_cancel_async(hw, ctlx) == 0 )
4328                 {
4329                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4330                         hfa384x_usbctlxq_run(hw);
4331                         goto done;
4332                 }
4333         }
4334
4335         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4336
4337  done:
4338         ;
4339
4340 }
4341
4342 /*----------------------------------------------------------------
4343 * hfa384x_usb_throttlefn
4344 *
4345 *
4346 * Arguments:
4347 *       data    ptr to hw
4348 *
4349 * Returns:
4350 *       Nothing
4351 *
4352 * Side effects:
4353 *
4354 * Call context:
4355 *       Interrupt
4356 ----------------------------------------------------------------*/
4357 static void
4358 hfa384x_usb_throttlefn(unsigned long data)
4359 {
4360         hfa384x_t *hw = (hfa384x_t*)data;
4361         unsigned long   flags;
4362
4363         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4364
4365         /*
4366          * We need to check BOTH the RX and the TX throttle controls,
4367          * so we use the bitwise OR instead of the logical OR.
4368          */
4369         WLAN_LOG_DEBUG(3, "flags=0x%lx\n", hw->usb_flags);
4370         if ( !hw->wlandev->hwremoved &&
4371              (
4372                (test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4373                !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4374                |
4375                (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4376                 !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4377              ) )
4378         {
4379                 schedule_work(&hw->usb_work);
4380         }
4381
4382         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4383 }
4384
4385
4386 /*----------------------------------------------------------------
4387 * hfa384x_usbctlx_submit
4388 *
4389 * Called from the doxxx functions to submit a CTLX to the queue
4390 *
4391 * Arguments:
4392 *       hw              ptr to the hw struct
4393 *       ctlx            ctlx structure to enqueue
4394 *
4395 * Returns:
4396 *       -ENODEV if the adapter is unplugged
4397 *       0
4398 *
4399 * Side effects:
4400 *
4401 * Call context:
4402 *       process or interrupt
4403 ----------------------------------------------------------------*/
4404 static int
4405 hfa384x_usbctlx_submit(
4406         hfa384x_t               *hw,
4407         hfa384x_usbctlx_t       *ctlx)
4408 {
4409         unsigned long flags;
4410         int ret;
4411
4412         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4413
4414         if (hw->wlandev->hwremoved) {
4415                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4416                 ret = -ENODEV;
4417         } else {
4418                 ctlx->state = CTLX_PENDING;
4419                 list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4420
4421                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4422                 hfa384x_usbctlxq_run(hw);
4423                 ret = 0;
4424         }
4425
4426         return ret;
4427 }
4428
4429
4430 /*----------------------------------------------------------------
4431 * hfa384x_usbout_tx
4432 *
4433 * At this point we have finished a send of a frame.  Mark the URB
4434 * as available and call ev_alloc to notify higher layers we're
4435 * ready for more.
4436 *
4437 * Arguments:
4438 *       wlandev         wlan device
4439 *       usbout          ptr to the usb transfer buffer
4440 *
4441 * Returns:
4442 *       nothing
4443 *
4444 * Side effects:
4445 *
4446 * Call context:
4447 *       interrupt
4448 ----------------------------------------------------------------*/
4449 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4450 {
4451         prism2sta_ev_alloc(wlandev);
4452 }
4453
4454 /*----------------------------------------------------------------
4455 * hfa384x_isgood_pdrcore
4456 *
4457 * Quick check of PDR codes.
4458 *
4459 * Arguments:
4460 *       pdrcode         PDR code number (host order)
4461 *
4462 * Returns:
4463 *       zero            not good.
4464 *       one             is good.
4465 *
4466 * Side effects:
4467 *
4468 * Call context:
4469 ----------------------------------------------------------------*/
4470 static int
4471 hfa384x_isgood_pdrcode(u16 pdrcode)
4472 {
4473         switch(pdrcode) {
4474         case HFA384x_PDR_END_OF_PDA:
4475         case HFA384x_PDR_PCB_PARTNUM:
4476         case HFA384x_PDR_PDAVER:
4477         case HFA384x_PDR_NIC_SERIAL:
4478         case HFA384x_PDR_MKK_MEASUREMENTS:
4479         case HFA384x_PDR_NIC_RAMSIZE:
4480         case HFA384x_PDR_MFISUPRANGE:
4481         case HFA384x_PDR_CFISUPRANGE:
4482         case HFA384x_PDR_NICID:
4483         case HFA384x_PDR_MAC_ADDRESS:
4484         case HFA384x_PDR_REGDOMAIN:
4485         case HFA384x_PDR_ALLOWED_CHANNEL:
4486         case HFA384x_PDR_DEFAULT_CHANNEL:
4487         case HFA384x_PDR_TEMPTYPE:
4488         case HFA384x_PDR_IFR_SETTING:
4489         case HFA384x_PDR_RFR_SETTING:
4490         case HFA384x_PDR_HFA3861_BASELINE:
4491         case HFA384x_PDR_HFA3861_SHADOW:
4492         case HFA384x_PDR_HFA3861_IFRF:
4493         case HFA384x_PDR_HFA3861_CHCALSP:
4494         case HFA384x_PDR_HFA3861_CHCALI:
4495         case HFA384x_PDR_3842_NIC_CONFIG:
4496         case HFA384x_PDR_USB_ID:
4497         case HFA384x_PDR_PCI_ID:
4498         case HFA384x_PDR_PCI_IFCONF:
4499         case HFA384x_PDR_PCI_PMCONF:
4500         case HFA384x_PDR_RFENRGY:
4501         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4502         case HFA384x_PDR_HFA3861_MANF_TESTI:
4503                 /* code is OK */
4504                 return 1;
4505                 break;
4506         default:
4507                 if ( pdrcode < 0x1000 ) {
4508                         /* code is OK, but we don't know exactly what it is */
4509                         WLAN_LOG_DEBUG(3,
4510                                 "Encountered unknown PDR#=0x%04x, "
4511                                 "assuming it's ok.\n",
4512                                 pdrcode);
4513                         return 1;
4514                 } else {
4515                         /* bad code */
4516                         WLAN_LOG_DEBUG(3,
4517                                 "Encountered unknown PDR#=0x%04x, "
4518                                 "(>=0x1000), assuming it's bad.\n",
4519                                 pdrcode);
4520                         return 0;
4521                 }
4522                 break;
4523         }
4524         return 0; /* avoid compiler warnings */
4525 }
4526