SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/net/wireless/iwlwifi/iwl3945-base.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2003 - 2008 Intel Corporation. All rights reserved.
   4  *
   5  * Portions of this file are derived from the ipw3945 project, as well
   6  * as portions of the ieee80211 subsystem header files.
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of version 2 of the GNU General Public License as
  10  * published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but WITHOUT
  13  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  15  * more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along with
  18  * this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
  20  *
  21  * The full GNU General Public License is included in this distribution in the
  22  * file called LICENSE.
  23  *
  24  * Contact Information:
  25  * James P. Ketrenos <ipw2100-admin@linux.intel.com>
  26  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  27  *
  28  *****************************************************************************/
  29
  30 #include <linux/kernel.h>
  31 #include <linux/module.h>
  32 #include <linux/version.h>
  33 #include <linux/init.h>
  34 #include <linux/pci.h>
  35 #include <linux/dma-mapping.h>
  36 #include <linux/delay.h>
  37 #include <linux/skbuff.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/wireless.h>
  40 #include <linux/firmware.h>
  41 #include <linux/etherdevice.h>
  42 #include <linux/if_arp.h>
  43
  44 #include <net/ieee80211_radiotap.h>
  45 #include <net/mac80211.h>
  46
  47 #include <asm/div64.h>
  48
  49 #include "iwl-3945-core.h"
  50 #include "iwl-3945.h"
  51 #include "iwl-helpers.h"
  52
  53 #ifdef CONFIG_IWL3945_DEBUG
  54 u32 iwl3945_debug_level;
  55 #endif
  56
  57 static int iwl3945_tx_queue_update_write_ptr(struct iwl3945_priv *priv,
  58                                   struct iwl3945_tx_queue *txq);
  59
  60 /******************************************************************************
  61  *
  62  * module boiler plate
  63  *
  64  ******************************************************************************/
  65
  66 /* module parameters */
  67 static int iwl3945_param_disable_hw_scan; /* def: 0 = use 3945's h/w scan */
  68 static int iwl3945_param_debug;    /* def: 0 = minimal debug log messages */
  69 static int iwl3945_param_disable;  /* def: 0 = enable radio */
  70 static int iwl3945_param_antenna;  /* def: 0 = both antennas (use diversity) */
  71 int iwl3945_param_hwcrypto;        /* def: 0 = use software encryption */
  72 static int iwl3945_param_qos_enable = 1; /* def: 1 = use quality of service */
  73 int iwl3945_param_queues_num = IWL_MAX_NUM_QUEUES; /* def: 8 Tx queues */
  74
  75 /*
  76  * module name, copyright, version, etc.
  77  * NOTE: DRV_NAME is defined in iwlwifi.h for use by iwl-debug.h and printk
  78  */
  79
  80 #define DRV_DESCRIPTION \
  81 "Intel(R) PRO/Wireless 3945ABG/BG Network Connection driver for Linux"
  82
  83 #ifdef CONFIG_IWL3945_DEBUG
  84 #define VD "d"
  85 #else
  86 #define VD
  87 #endif
  88
  89 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
  90 #define VS "s"
  91 #else
  92 #define VS
  93 #endif
  94
  95 #define IWLWIFI_VERSION "1.2.26k" VD VS
  96 #define DRV_COPYRIGHT   "Copyright(c) 2003-2008 Intel Corporation"
  97 #define DRV_VERSION     IWLWIFI_VERSION
  98
  99
 100 MODULE_DESCRIPTION(DRV_DESCRIPTION);
 101 MODULE_VERSION(DRV_VERSION);
 102 MODULE_AUTHOR(DRV_COPYRIGHT);
 103 MODULE_LICENSE("GPL");
 104
 105 static __le16 *ieee80211_get_qos_ctrl(struct ieee80211_hdr *hdr)
 106 {
 107         u16 fc = le16_to_cpu(hdr->frame_control);
 108         int hdr_len = ieee80211_get_hdrlen(fc);
 109
 110         if ((fc & 0x00cc) == (IEEE80211_STYPE_QOS_DATA | IEEE80211_FTYPE_DATA))
 111                 return (__le16 *) ((u8 *) hdr + hdr_len - QOS_CONTROL_LEN);
 112         return NULL;
 113 }
 114
 115 static const struct ieee80211_supported_band *iwl3945_get_band(
 116                 struct iwl3945_priv *priv, enum ieee80211_band band)
 117 {
 118         return priv->hw->wiphy->bands[band];
 119 }
 120
 121 static int iwl3945_is_empty_essid(const char *essid, int essid_len)
 122 {
 123         /* Single white space is for Linksys APs */
 124         if (essid_len == 1 && essid[0] == ' ')
 125                 return 1;
 126
 127         /* Otherwise, if the entire essid is 0, we assume it is hidden */
 128         while (essid_len) {
 129                 essid_len--;
 130                 if (essid[essid_len] != '\0')
 131                         return 0;
 132         }
 133
 134         return 1;
 135 }
 136
 137 static const char *iwl3945_escape_essid(const char *essid, u8 essid_len)
 138 {
 139         static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
 140         const char *s = essid;
 141         char *d = escaped;
 142
 143         if (iwl3945_is_empty_essid(essid, essid_len)) {
 144                 memcpy(escaped, "<hidden>", sizeof("<hidden>"));
 145                 return escaped;
 146         }
 147
 148         essid_len = min(essid_len, (u8) IW_ESSID_MAX_SIZE);
 149         while (essid_len--) {
 150                 if (*s == '\0') {
 151                         *d++ = '\\';
 152                         *d++ = '0';
 153                         s++;
 154                 } else
 155                         *d++ = *s++;
 156         }
 157         *d = '\0';
 158         return escaped;
 159 }
 160
 161 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
 162  * DMA services
 163  *
 164  * Theory of operation
 165  *
 166  * A Tx or Rx queue resides in host DRAM, and is comprised of a circular buffer
 167  * of buffer descriptors, each of which points to one or more data buffers for
 168  * the device to read from or fill.  Driver and device exchange status of each
 169  * queue via "read" and "write" pointers.  Driver keeps minimum of 2 empty
 170  * entries in each circular buffer, to protect against confusing empty and full
 171  * queue states.
 172  *
 173  * The device reads or writes the data in the queues via the device's several
 174  * DMA/FIFO channels.  Each queue is mapped to a single DMA channel.
 175  *
 176  * For Tx queue, there are low mark and high mark limits. If, after queuing
 177  * the packet for Tx, free space become < low mark, Tx queue stopped. When
 178  * reclaiming packets (on 'tx done IRQ), if free space become > high mark,
 179  * Tx queue resumed.
 180  *
 181  * The 3945 operates with six queues:  One receive queue, one transmit queue
 182  * (#4) for sending commands to the device firmware, and four transmit queues
 183  * (#0-3) for data tx via EDCA.  An additional 2 HCCA queues are unused.
 184  ***************************************************/
 185
 186 int iwl3945_queue_space(const struct iwl3945_queue *q)
 187 {
 188         int s = q->read_ptr - q->write_ptr;
 189
 190         if (q->read_ptr > q->write_ptr)
 191                 s -= q->n_bd;
 192
 193         if (s <= 0)
 194                 s += q->n_window;
 195         /* keep some reserve to not confuse empty and full situations */
 196         s -= 2;
 197         if (s < 0)
 198                 s = 0;
 199         return s;
 200 }
 201
 202 int iwl3945_x2_queue_used(const struct iwl3945_queue *q, int i)
 203 {
 204         return q->write_ptr > q->read_ptr ?
 205                 (i >= q->read_ptr && i < q->write_ptr) :
 206                 !(i < q->read_ptr && i >= q->write_ptr);
 207 }
 208
 209
 210 static inline u8 get_cmd_index(struct iwl3945_queue *q, u32 index, int is_huge)
 211 {
 212         /* This is for scan command, the big buffer at end of command array */
 213         if (is_huge)
 214                 return q->n_window;     /* must be power of 2 */
 215
 216         /* Otherwise, use normal size buffers */
 217         return index & (q->n_window - 1);
 218 }
 219
 220 /**
 221  * iwl3945_queue_init - Initialize queue's high/low-water and read/write indexes
 222  */
 223 static int iwl3945_queue_init(struct iwl3945_priv *priv, struct iwl3945_queue *q,
 224                           int count, int slots_num, u32 id)
 225 {
 226         q->n_bd = count;
 227         q->n_window = slots_num;
 228         q->id = id;
 229
 230         /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
 231          * and iwl_queue_dec_wrap are broken. */
 232         BUG_ON(!is_power_of_2(count));
 233
 234         /* slots_num must be power-of-two size, otherwise
 235          * get_cmd_index is broken. */
 236         BUG_ON(!is_power_of_2(slots_num));
 237
 238         q->low_mark = q->n_window / 4;
 239         if (q->low_mark < 4)
 240                 q->low_mark = 4;
 241
 242         q->high_mark = q->n_window / 8;
 243         if (q->high_mark < 2)
 244                 q->high_mark = 2;
 245
 246         q->write_ptr = q->read_ptr = 0;
 247
 248         return 0;
 249 }
 250
 251 /**
 252  * iwl3945_tx_queue_alloc - Alloc driver data and TFD CB for one Tx/cmd queue
 253  */
 254 static int iwl3945_tx_queue_alloc(struct iwl3945_priv *priv,
 255                               struct iwl3945_tx_queue *txq, u32 id)
 256 {
 257         struct pci_dev *dev = priv->pci_dev;
 258
 259         /* Driver private data, only for Tx (not command) queues,
 260          * not shared with device. */
 261         if (id != IWL_CMD_QUEUE_NUM) {
 262                 txq->txb = kmalloc(sizeof(txq->txb[0]) *
 263                                    TFD_QUEUE_SIZE_MAX, GFP_KERNEL);
 264                 if (!txq->txb) {
 265                         IWL_ERROR("kmalloc for auxiliary BD "
 266                                   "structures failed\n");
 267                         goto error;
 268                 }
 269         } else
 270                 txq->txb = NULL;
 271
 272         /* Circular buffer of transmit frame descriptors (TFDs),
 273          * shared with device */
 274         txq->bd = pci_alloc_consistent(dev,
 275                         sizeof(txq->bd[0]) * TFD_QUEUE_SIZE_MAX,
 276                         &txq->q.dma_addr);
 277
 278         if (!txq->bd) {
 279                 IWL_ERROR("pci_alloc_consistent(%zd) failed\n",
 280                           sizeof(txq->bd[0]) * TFD_QUEUE_SIZE_MAX);
 281                 goto error;
 282         }
 283         txq->q.id = id;
 284
 285         return 0;
 286
 287  error:
 288         if (txq->txb) {
 289                 kfree(txq->txb);
 290                 txq->txb = NULL;
 291         }
 292
 293         return -ENOMEM;
 294 }
 295
 296 /**
 297  * iwl3945_tx_queue_init - Allocate and initialize one tx/cmd queue
 298  */
 299 int iwl3945_tx_queue_init(struct iwl3945_priv *priv,
 300                       struct iwl3945_tx_queue *txq, int slots_num, u32 txq_id)
 301 {
 302         struct pci_dev *dev = priv->pci_dev;
 303         int len;
 304         int rc = 0;
 305
 306         /*
 307          * Alloc buffer array for commands (Tx or other types of commands).
 308          * For the command queue (#4), allocate command space + one big
 309          * command for scan, since scan command is very huge; the system will
 310          * not have two scans at the same time, so only one is needed.
 311          * For data Tx queues (all other queues), no super-size command
 312          * space is needed.
 313          */
 314         len = sizeof(struct iwl3945_cmd) * slots_num;
 315         if (txq_id == IWL_CMD_QUEUE_NUM)
 316                 len +=  IWL_MAX_SCAN_SIZE;
 317         txq->cmd = pci_alloc_consistent(dev, len, &txq->dma_addr_cmd);
 318         if (!txq->cmd)
 319                 return -ENOMEM;
 320
 321         /* Alloc driver data array and TFD circular buffer */
 322         rc = iwl3945_tx_queue_alloc(priv, txq, txq_id);
 323         if (rc) {
 324                 pci_free_consistent(dev, len, txq->cmd, txq->dma_addr_cmd);
 325
 326                 return -ENOMEM;
 327         }
 328         txq->need_update = 0;
 329
 330         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
 331          * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
 332         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 333
 334         /* Initialize queue high/low-water, head/tail indexes */
 335         iwl3945_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
 336
 337         /* Tell device where to find queue, enable DMA channel. */
 338         iwl3945_hw_tx_queue_init(priv, txq);
 339
 340         return 0;
 341 }
 342
 343 /**
 344  * iwl3945_tx_queue_free - Deallocate DMA queue.
 345  * @txq: Transmit queue to deallocate.
 346  *
 347  * Empty queue by removing and destroying all BD's.
 348  * Free all buffers.
 349  * 0-fill, but do not free "txq" descriptor structure.
 350  */
 351 void iwl3945_tx_queue_free(struct iwl3945_priv *priv, struct iwl3945_tx_queue *txq)
 352 {
 353         struct iwl3945_queue *q = &txq->q;
 354         struct pci_dev *dev = priv->pci_dev;
 355         int len;
 356
 357         if (q->n_bd == 0)
 358                 return;
 359
 360         /* first, empty all BD's */
 361         for (; q->write_ptr != q->read_ptr;
 362              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
 363                 iwl3945_hw_txq_free_tfd(priv, txq);
 364
 365         len = sizeof(struct iwl3945_cmd) * q->n_window;
 366         if (q->id == IWL_CMD_QUEUE_NUM)
 367                 len += IWL_MAX_SCAN_SIZE;
 368
 369         /* De-alloc array of command/tx buffers */
 370         pci_free_consistent(dev, len, txq->cmd, txq->dma_addr_cmd);
 371
 372         /* De-alloc circular buffer of TFDs */
 373         if (txq->q.n_bd)
 374                 pci_free_consistent(dev, sizeof(struct iwl3945_tfd_frame) *
 375                                     txq->q.n_bd, txq->bd, txq->q.dma_addr);
 376
 377         /* De-alloc array of per-TFD driver data */
 378         if (txq->txb) {
 379                 kfree(txq->txb);
 380                 txq->txb = NULL;
 381         }
 382
 383         /* 0-fill queue descriptor structure */
 384         memset(txq, 0, sizeof(*txq));
 385 }
 386
 387 const u8 iwl3945_broadcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 388
 389 /*************** STATION TABLE MANAGEMENT ****
 390  * mac80211 should be examined to determine if sta_info is duplicating
 391  * the functionality provided here
 392  */
 393
 394 /**************************************************************/
 395 #if 0 /* temporary disable till we add real remove station */
 396 /**
 397  * iwl3945_remove_station - Remove driver's knowledge of station.
 398  *
 399  * NOTE:  This does not remove station from device's station table.
 400  */
 401 static u8 iwl3945_remove_station(struct iwl3945_priv *priv, const u8 *addr, int is_ap)
 402 {
 403         int index = IWL_INVALID_STATION;
 404         int i;
 405         unsigned long flags;
 406
 407         spin_lock_irqsave(&priv->sta_lock, flags);
 408
 409         if (is_ap)
 410                 index = IWL_AP_ID;
 411         else if (is_broadcast_ether_addr(addr))
 412                 index = priv->hw_setting.bcast_sta_id;
 413         else
 414                 for (i = IWL_STA_ID; i < priv->hw_setting.max_stations; i++)
 415                         if (priv->stations[i].used &&
 416                             !compare_ether_addr(priv->stations[i].sta.sta.addr,
 417                                                 addr)) {
 418                                 index = i;
 419                                 break;
 420                         }
 421
 422         if (unlikely(index == IWL_INVALID_STATION))
 423                 goto out;
 424
 425         if (priv->stations[index].used) {
 426                 priv->stations[index].used = 0;
 427                 priv->num_stations--;
 428         }
 429
 430         BUG_ON(priv->num_stations < 0);
 431
 432 out:
 433         spin_unlock_irqrestore(&priv->sta_lock, flags);
 434         return 0;
 435 }
 436 #endif
 437
 438 /**
 439  * iwl3945_clear_stations_table - Clear the driver's station table
 440  *
 441  * NOTE:  This does not clear or otherwise alter the device's station table.
 442  */
 443 static void iwl3945_clear_stations_table(struct iwl3945_priv *priv)
 444 {
 445         unsigned long flags;
 446
 447         spin_lock_irqsave(&priv->sta_lock, flags);
 448
 449         priv->num_stations = 0;
 450         memset(priv->stations, 0, sizeof(priv->stations));
 451
 452         spin_unlock_irqrestore(&priv->sta_lock, flags);
 453 }
 454
 455 /**
 456  * iwl3945_add_station - Add station to station tables in driver and device
 457  */
 458 u8 iwl3945_add_station(struct iwl3945_priv *priv, const u8 *addr, int is_ap, u8 flags)
 459 {
 460         int i;
 461         int index = IWL_INVALID_STATION;
 462         struct iwl3945_station_entry *station;
 463         unsigned long flags_spin;
 464         DECLARE_MAC_BUF(mac);
 465         u8 rate;
 466
 467         spin_lock_irqsave(&priv->sta_lock, flags_spin);
 468         if (is_ap)
 469                 index = IWL_AP_ID;
 470         else if (is_broadcast_ether_addr(addr))
 471                 index = priv->hw_setting.bcast_sta_id;
 472         else
 473                 for (i = IWL_STA_ID; i < priv->hw_setting.max_stations; i++) {
 474                         if (!compare_ether_addr(priv->stations[i].sta.sta.addr,
 475                                                 addr)) {
 476                                 index = i;
 477                                 break;
 478                         }
 479
 480                         if (!priv->stations[i].used &&
 481                             index == IWL_INVALID_STATION)
 482                                 index = i;
 483                 }
 484
 485         /* These two conditions has the same outcome but keep them separate
 486           since they have different meaning */
 487         if (unlikely(index == IWL_INVALID_STATION)) {
 488                 spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 489                 return index;
 490         }
 491
 492         if (priv->stations[index].used &&
 493            !compare_ether_addr(priv->stations[index].sta.sta.addr, addr)) {
 494                 spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 495                 return index;
 496         }
 497
 498         IWL_DEBUG_ASSOC("Add STA ID %d: %s\n", index, print_mac(mac, addr));
 499         station = &priv->stations[index];
 500         station->used = 1;
 501         priv->num_stations++;
 502
 503         /* Set up the REPLY_ADD_STA command to send to device */
 504         memset(&station->sta, 0, sizeof(struct iwl3945_addsta_cmd));
 505         memcpy(station->sta.sta.addr, addr, ETH_ALEN);
 506         station->sta.mode = 0;
 507         station->sta.sta.sta_id = index;
 508         station->sta.station_flags = 0;
 509
 510         if (priv->band == IEEE80211_BAND_5GHZ)
 511                 rate = IWL_RATE_6M_PLCP;
 512         else
 513                 rate =  IWL_RATE_1M_PLCP;
 514
 515         /* Turn on both antennas for the station... */
 516         station->sta.rate_n_flags =
 517                         iwl3945_hw_set_rate_n_flags(rate, RATE_MCS_ANT_AB_MSK);
 518         station->current_rate.rate_n_flags =
 519                         le16_to_cpu(station->sta.rate_n_flags);
 520
 521         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 522
 523         /* Add station to device's station table */
 524         iwl3945_send_add_station(priv, &station->sta, flags);
 525         return index;
 526
 527 }
 528
 529 /*************** DRIVER STATUS FUNCTIONS   *****/
 530
 531 static inline int iwl3945_is_ready(struct iwl3945_priv *priv)
 532 {
 533         /* The adapter is 'ready' if READY and GEO_CONFIGURED bits are
 534          * set but EXIT_PENDING is not */
 535         return test_bit(STATUS_READY, &priv->status) &&
 536                test_bit(STATUS_GEO_CONFIGURED, &priv->status) &&
 537                !test_bit(STATUS_EXIT_PENDING, &priv->status);
 538 }
 539
 540 static inline int iwl3945_is_alive(struct iwl3945_priv *priv)
 541 {
 542         return test_bit(STATUS_ALIVE, &priv->status);
 543 }
 544
 545 static inline int iwl3945_is_init(struct iwl3945_priv *priv)
 546 {
 547         return test_bit(STATUS_INIT, &priv->status);
 548 }
 549
 550 static inline int iwl3945_is_rfkill(struct iwl3945_priv *priv)
 551 {
 552         return test_bit(STATUS_RF_KILL_HW, &priv->status) ||
 553                test_bit(STATUS_RF_KILL_SW, &priv->status);
 554 }
 555
 556 static inline int iwl3945_is_ready_rf(struct iwl3945_priv *priv)
 557 {
 558
 559         if (iwl3945_is_rfkill(priv))
 560                 return 0;
 561
 562         return iwl3945_is_ready(priv);
 563 }
 564
 565 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
 566
 567 #define IWL_CMD(x) case x : return #x
 568
 569 static const char *get_cmd_string(u8 cmd)
 570 {
 571         switch (cmd) {
 572                 IWL_CMD(REPLY_ALIVE);
 573                 IWL_CMD(REPLY_ERROR);
 574                 IWL_CMD(REPLY_RXON);
 575                 IWL_CMD(REPLY_RXON_ASSOC);
 576                 IWL_CMD(REPLY_QOS_PARAM);
 577                 IWL_CMD(REPLY_RXON_TIMING);
 578                 IWL_CMD(REPLY_ADD_STA);
 579                 IWL_CMD(REPLY_REMOVE_STA);
 580                 IWL_CMD(REPLY_REMOVE_ALL_STA);
 581                 IWL_CMD(REPLY_3945_RX);
 582                 IWL_CMD(REPLY_TX);
 583                 IWL_CMD(REPLY_RATE_SCALE);
 584                 IWL_CMD(REPLY_LEDS_CMD);
 585                 IWL_CMD(REPLY_TX_LINK_QUALITY_CMD);
 586                 IWL_CMD(RADAR_NOTIFICATION);
 587                 IWL_CMD(REPLY_QUIET_CMD);
 588                 IWL_CMD(REPLY_CHANNEL_SWITCH);
 589                 IWL_CMD(CHANNEL_SWITCH_NOTIFICATION);
 590                 IWL_CMD(REPLY_SPECTRUM_MEASUREMENT_CMD);
 591                 IWL_CMD(SPECTRUM_MEASURE_NOTIFICATION);
 592                 IWL_CMD(POWER_TABLE_CMD);
 593                 IWL_CMD(PM_SLEEP_NOTIFICATION);
 594                 IWL_CMD(PM_DEBUG_STATISTIC_NOTIFIC);
 595                 IWL_CMD(REPLY_SCAN_CMD);
 596                 IWL_CMD(REPLY_SCAN_ABORT_CMD);
 597                 IWL_CMD(SCAN_START_NOTIFICATION);
 598                 IWL_CMD(SCAN_RESULTS_NOTIFICATION);
 599                 IWL_CMD(SCAN_COMPLETE_NOTIFICATION);
 600                 IWL_CMD(BEACON_NOTIFICATION);
 601                 IWL_CMD(REPLY_TX_BEACON);
 602                 IWL_CMD(WHO_IS_AWAKE_NOTIFICATION);
 603                 IWL_CMD(QUIET_NOTIFICATION);
 604                 IWL_CMD(REPLY_TX_PWR_TABLE_CMD);
 605                 IWL_CMD(MEASURE_ABORT_NOTIFICATION);
 606                 IWL_CMD(REPLY_BT_CONFIG);
 607                 IWL_CMD(REPLY_STATISTICS_CMD);
 608                 IWL_CMD(STATISTICS_NOTIFICATION);
 609                 IWL_CMD(REPLY_CARD_STATE_CMD);
 610                 IWL_CMD(CARD_STATE_NOTIFICATION);
 611                 IWL_CMD(MISSED_BEACONS_NOTIFICATION);
 612         default:
 613                 return "UNKNOWN";
 614
 615         }
 616 }
 617
 618 #define HOST_COMPLETE_TIMEOUT (HZ / 2)
 619
 620 /**
 621  * iwl3945_enqueue_hcmd - enqueue a uCode command
 622  * @priv: device private data point
 623  * @cmd: a point to the ucode command structure
 624  *
 625  * The function returns < 0 values to indicate the operation is
 626  * failed. On success, it turns the index (> 0) of command in the
 627  * command queue.
 628  */
 629 static int iwl3945_enqueue_hcmd(struct iwl3945_priv *priv, struct iwl3945_host_cmd *cmd)
 630 {
 631         struct iwl3945_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
 632         struct iwl3945_queue *q = &txq->q;
 633         struct iwl3945_tfd_frame *tfd;
 634         u32 *control_flags;
 635         struct iwl3945_cmd *out_cmd;
 636         u32 idx;
 637         u16 fix_size = (u16)(cmd->len + sizeof(out_cmd->hdr));
 638         dma_addr_t phys_addr;
 639         int pad;
 640         u16 count;
 641         int ret;
 642         unsigned long flags;
 643
 644         /* If any of the command structures end up being larger than
 645          * the TFD_MAX_PAYLOAD_SIZE, and it sent as a 'small' command then
 646          * we will need to increase the size of the TFD entries */
 647         BUG_ON((fix_size > TFD_MAX_PAYLOAD_SIZE) &&
 648                !(cmd->meta.flags & CMD_SIZE_HUGE));
 649
 650
 651         if (iwl3945_is_rfkill(priv)) {
 652                 IWL_DEBUG_INFO("Not sending command - RF KILL");
 653                 return -EIO;
 654         }
 655
 656         if (iwl3945_queue_space(q) < ((cmd->meta.flags & CMD_ASYNC) ? 2 : 1)) {
 657                 IWL_ERROR("No space for Tx\n");
 658                 return -ENOSPC;
 659         }
 660
 661         spin_lock_irqsave(&priv->hcmd_lock, flags);
 662
 663         tfd = &txq->bd[q->write_ptr];
 664         memset(tfd, 0, sizeof(*tfd));
 665
 666         control_flags = (u32 *) tfd;
 667
 668         idx = get_cmd_index(q, q->write_ptr, cmd->meta.flags & CMD_SIZE_HUGE);
 669         out_cmd = &txq->cmd[idx];
 670
 671         out_cmd->hdr.cmd = cmd->id;
 672         memcpy(&out_cmd->meta, &cmd->meta, sizeof(cmd->meta));
 673         memcpy(&out_cmd->cmd.payload, cmd->data, cmd->len);
 674
 675         /* At this point, the out_cmd now has all of the incoming cmd
 676          * information */
 677
 678         out_cmd->hdr.flags = 0;
 679         out_cmd->hdr.sequence = cpu_to_le16(QUEUE_TO_SEQ(IWL_CMD_QUEUE_NUM) |
 680                         INDEX_TO_SEQ(q->write_ptr));
 681         if (out_cmd->meta.flags & CMD_SIZE_HUGE)
 682                 out_cmd->hdr.sequence |= cpu_to_le16(SEQ_HUGE_FRAME);
 683
 684         phys_addr = txq->dma_addr_cmd + sizeof(txq->cmd[0]) * idx +
 685                         offsetof(struct iwl3945_cmd, hdr);
 686         iwl3945_hw_txq_attach_buf_to_tfd(priv, tfd, phys_addr, fix_size);
 687
 688         pad = U32_PAD(cmd->len);
 689         count = TFD_CTL_COUNT_GET(*control_flags);
 690         *control_flags = TFD_CTL_COUNT_SET(count) | TFD_CTL_PAD_SET(pad);
 691
 692         IWL_DEBUG_HC("Sending command %s (#%x), seq: 0x%04X, "
 693                      "%d bytes at %d[%d]:%d\n",
 694                      get_cmd_string(out_cmd->hdr.cmd),
 695                      out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
 696                      fix_size, q->write_ptr, idx, IWL_CMD_QUEUE_NUM);
 697
 698         txq->need_update = 1;
 699
 700         /* Increment and update queue's write index */
 701         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
 702         ret = iwl3945_tx_queue_update_write_ptr(priv, txq);
 703
 704         spin_unlock_irqrestore(&priv->hcmd_lock, flags);
 705         return ret ? ret : idx;
 706 }
 707
 708 static int iwl3945_send_cmd_async(struct iwl3945_priv *priv, struct iwl3945_host_cmd *cmd)
 709 {
 710         int ret;
 711
 712         BUG_ON(!(cmd->meta.flags & CMD_ASYNC));
 713
 714         /* An asynchronous command can not expect an SKB to be set. */
 715         BUG_ON(cmd->meta.flags & CMD_WANT_SKB);
 716
 717         /* An asynchronous command MUST have a callback. */
 718         BUG_ON(!cmd->meta.u.callback);
 719
 720         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
 721                 return -EBUSY;
 722
 723         ret = iwl3945_enqueue_hcmd(priv, cmd);
 724         if (ret < 0) {
 725                 IWL_ERROR("Error sending %s: iwl3945_enqueue_hcmd failed: %d\n",
 726                           get_cmd_string(cmd->id), ret);
 727                 return ret;
 728         }
 729         return 0;
 730 }
 731
 732 static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_cmd *cmd)
 733 {
 734         int cmd_idx;
 735         int ret;
 736         static atomic_t entry = ATOMIC_INIT(0); /* reentrance protection */
 737
 738         BUG_ON(cmd->meta.flags & CMD_ASYNC);
 739
 740          /* A synchronous command can not have a callback set. */
 741         BUG_ON(cmd->meta.u.callback != NULL);
 742
 743         if (atomic_xchg(&entry, 1)) {
 744                 IWL_ERROR("Error sending %s: Already sending a host command\n",
 745                           get_cmd_string(cmd->id));
 746                 return -EBUSY;
 747         }
 748
 749         set_bit(STATUS_HCMD_ACTIVE, &priv->status);
 750
 751         if (cmd->meta.flags & CMD_WANT_SKB)
 752                 cmd->meta.source = &cmd->meta;
 753
 754         cmd_idx = iwl3945_enqueue_hcmd(priv, cmd);
 755         if (cmd_idx < 0) {
 756                 ret = cmd_idx;
 757                 IWL_ERROR("Error sending %s: iwl3945_enqueue_hcmd failed: %d\n",
 758                           get_cmd_string(cmd->id), ret);
 759                 goto out;
 760         }
 761
 762         ret = wait_event_interruptible_timeout(priv->wait_command_queue,
 763                         !test_bit(STATUS_HCMD_ACTIVE, &priv->status),
 764                         HOST_COMPLETE_TIMEOUT);
 765         if (!ret) {
 766                 if (test_bit(STATUS_HCMD_ACTIVE, &priv->status)) {
 767                         IWL_ERROR("Error sending %s: time out after %dms.\n",
 768                                   get_cmd_string(cmd->id),
 769                                   jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 770
 771                         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
 772                         ret = -ETIMEDOUT;
 773                         goto cancel;
 774                 }
 775         }
 776
 777         if (test_bit(STATUS_RF_KILL_HW, &priv->status)) {
 778                 IWL_DEBUG_INFO("Command %s aborted: RF KILL Switch\n",
 779                                get_cmd_string(cmd->id));
 780                 ret = -ECANCELED;
 781                 goto fail;
 782         }
 783         if (test_bit(STATUS_FW_ERROR, &priv->status)) {
 784                 IWL_DEBUG_INFO("Command %s failed: FW Error\n",
 785                                get_cmd_string(cmd->id));
 786                 ret = -EIO;
 787                 goto fail;
 788         }
 789         if ((cmd->meta.flags & CMD_WANT_SKB) && !cmd->meta.u.skb) {
 790                 IWL_ERROR("Error: Response NULL in '%s'\n",
 791                           get_cmd_string(cmd->id));
 792                 ret = -EIO;
 793                 goto out;
 794         }
 795
 796         ret = 0;
 797         goto out;
 798
 799 cancel:
 800         if (cmd->meta.flags & CMD_WANT_SKB) {
 801                 struct iwl3945_cmd *qcmd;
 802
 803                 /* Cancel the CMD_WANT_SKB flag for the cmd in the
 804                  * TX cmd queue. Otherwise in case the cmd comes
 805                  * in later, it will possibly set an invalid
 806                  * address (cmd->meta.source). */
 807                 qcmd = &priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_idx];
 808                 qcmd->meta.flags &= ~CMD_WANT_SKB;
 809         }
 810 fail:
 811         if (cmd->meta.u.skb) {
 812                 dev_kfree_skb_any(cmd->meta.u.skb);
 813                 cmd->meta.u.skb = NULL;
 814         }
 815 out:
 816         atomic_set(&entry, 0);
 817         return ret;
 818 }
 819
 820 int iwl3945_send_cmd(struct iwl3945_priv *priv, struct iwl3945_host_cmd *cmd)
 821 {
 822         if (cmd->meta.flags & CMD_ASYNC)
 823                 return iwl3945_send_cmd_async(priv, cmd);
 824
 825         return iwl3945_send_cmd_sync(priv, cmd);
 826 }
 827
 828 int iwl3945_send_cmd_pdu(struct iwl3945_priv *priv, u8 id, u16 len, const void *data)
 829 {
 830         struct iwl3945_host_cmd cmd = {
 831                 .id = id,
 832                 .len = len,
 833                 .data = data,
 834         };
 835
 836         return iwl3945_send_cmd_sync(priv, &cmd);
 837 }
 838
 839 static int __must_check iwl3945_send_cmd_u32(struct iwl3945_priv *priv, u8 id, u32 val)
 840 {
 841         struct iwl3945_host_cmd cmd = {
 842                 .id = id,
 843                 .len = sizeof(val),
 844                 .data = &val,
 845         };
 846
 847         return iwl3945_send_cmd_sync(priv, &cmd);
 848 }
 849
 850 int iwl3945_send_statistics_request(struct iwl3945_priv *priv)
 851 {
 852         return iwl3945_send_cmd_u32(priv, REPLY_STATISTICS_CMD, 0);
 853 }
 854
 855 /**
 856  * iwl3945_set_rxon_channel - Set the phymode and channel values in staging RXON
 857  * @band: 2.4 or 5 GHz band
 858  * @channel: Any channel valid for the requested band
 859
 860  * In addition to setting the staging RXON, priv->band is also set.
 861  *
 862  * NOTE:  Does not commit to the hardware; it sets appropriate bit fields
 863  * in the staging RXON flag structure based on the band
 864  */
 865 static int iwl3945_set_rxon_channel(struct iwl3945_priv *priv,
 866                                     enum ieee80211_band band,
 867                                     u16 channel)
 868 {
 869         if (!iwl3945_get_channel_info(priv, band, channel)) {
 870                 IWL_DEBUG_INFO("Could not set channel to %d [%d]\n",
 871                                channel, band);
 872                 return -EINVAL;
 873         }
 874
 875         if ((le16_to_cpu(priv->staging_rxon.channel) == channel) &&
 876             (priv->band == band))
 877                 return 0;
 878
 879         priv->staging_rxon.channel = cpu_to_le16(channel);
 880         if (band == IEEE80211_BAND_5GHZ)
 881                 priv->staging_rxon.flags &= ~RXON_FLG_BAND_24G_MSK;
 882         else
 883                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
 884
 885         priv->band = band;
 886
 887         IWL_DEBUG_INFO("Staging channel set to %d [%d]\n", channel, band);
 888
 889         return 0;
 890 }
 891
 892 /**
 893  * iwl3945_check_rxon_cmd - validate RXON structure is valid
 894  *
 895  * NOTE:  This is really only useful during development and can eventually
 896  * be #ifdef'd out once the driver is stable and folks aren't actively
 897  * making changes
 898  */
 899 static int iwl3945_check_rxon_cmd(struct iwl3945_rxon_cmd *rxon)
 900 {
 901         int error = 0;
 902         int counter = 1;
 903
 904         if (rxon->flags & RXON_FLG_BAND_24G_MSK) {
 905                 error |= le32_to_cpu(rxon->flags &
 906                                 (RXON_FLG_TGJ_NARROW_BAND_MSK |
 907                                  RXON_FLG_RADAR_DETECT_MSK));
 908                 if (error)
 909                         IWL_WARNING("check 24G fields %d | %d\n",
 910                                     counter++, error);
 911         } else {
 912                 error |= (rxon->flags & RXON_FLG_SHORT_SLOT_MSK) ?
 913                                 0 : le32_to_cpu(RXON_FLG_SHORT_SLOT_MSK);
 914                 if (error)
 915                         IWL_WARNING("check 52 fields %d | %d\n",
 916                                     counter++, error);
 917                 error |= le32_to_cpu(rxon->flags & RXON_FLG_CCK_MSK);
 918                 if (error)
 919                         IWL_WARNING("check 52 CCK %d | %d\n",
 920                                     counter++, error);
 921         }
 922         error |= (rxon->node_addr[0] | rxon->bssid_addr[0]) & 0x1;
 923         if (error)
 924                 IWL_WARNING("check mac addr %d | %d\n", counter++, error);
 925
 926         /* make sure basic rates 6Mbps and 1Mbps are supported */
 927         error |= (((rxon->ofdm_basic_rates & IWL_RATE_6M_MASK) == 0) &&
 928                   ((rxon->cck_basic_rates & IWL_RATE_1M_MASK) == 0));
 929         if (error)
 930                 IWL_WARNING("check basic rate %d | %d\n", counter++, error);
 931
 932         error |= (le16_to_cpu(rxon->assoc_id) > 2007);
 933         if (error)
 934                 IWL_WARNING("check assoc id %d | %d\n", counter++, error);
 935
 936         error |= ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK))
 937                         == (RXON_FLG_CCK_MSK | RXON_FLG_SHORT_SLOT_MSK));
 938         if (error)
 939                 IWL_WARNING("check CCK and short slot %d | %d\n",
 940                             counter++, error);
 941
 942         error |= ((rxon->flags & (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK))
 943                         == (RXON_FLG_CCK_MSK | RXON_FLG_AUTO_DETECT_MSK));
 944         if (error)
 945                 IWL_WARNING("check CCK & auto detect %d | %d\n",
 946                             counter++, error);
 947
 948         error |= ((rxon->flags & (RXON_FLG_AUTO_DETECT_MSK |
 949                         RXON_FLG_TGG_PROTECT_MSK)) == RXON_FLG_TGG_PROTECT_MSK);
 950         if (error)
 951                 IWL_WARNING("check TGG and auto detect %d | %d\n",
 952                             counter++, error);
 953
 954         if ((rxon->flags & RXON_FLG_DIS_DIV_MSK))
 955                 error |= ((rxon->flags & (RXON_FLG_ANT_B_MSK |
 956                                 RXON_FLG_ANT_A_MSK)) == 0);
 957         if (error)
 958                 IWL_WARNING("check antenna %d %d\n", counter++, error);
 959
 960         if (error)
 961                 IWL_WARNING("Tuning to channel %d\n",
 962                             le16_to_cpu(rxon->channel));
 963
 964         if (error) {
 965                 IWL_ERROR("Not a valid iwl3945_rxon_assoc_cmd field values\n");
 966                 return -1;
 967         }
 968         return 0;
 969 }
 970
 971 /**
 972  * iwl3945_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
 973  * @priv: staging_rxon is compared to active_rxon
 974  *
 975  * If the RXON structure is changing enough to require a new tune,
 976  * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
 977  * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
 978  */
 979 static int iwl3945_full_rxon_required(struct iwl3945_priv *priv)
 980 {
 981
 982         /* These items are only settable from the full RXON command */
 983         if (!(priv->active_rxon.filter_flags & RXON_FILTER_ASSOC_MSK) ||
 984             compare_ether_addr(priv->staging_rxon.bssid_addr,
 985                                priv->active_rxon.bssid_addr) ||
 986             compare_ether_addr(priv->staging_rxon.node_addr,
 987                                priv->active_rxon.node_addr) ||
 988             compare_ether_addr(priv->staging_rxon.wlap_bssid_addr,
 989                                priv->active_rxon.wlap_bssid_addr) ||
 990             (priv->staging_rxon.dev_type != priv->active_rxon.dev_type) ||
 991             (priv->staging_rxon.channel != priv->active_rxon.channel) ||
 992             (priv->staging_rxon.air_propagation !=
 993              priv->active_rxon.air_propagation) ||
 994             (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
 995                 return 1;
 996
 997         /* flags, filter_flags, ofdm_basic_rates, and cck_basic_rates can
 998          * be updated with the RXON_ASSOC command -- however only some
 999          * flag transitions are allowed using RXON_ASSOC */
1000
1001         /* Check if we are not switching bands */
1002         if ((priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) !=
1003             (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK))
1004                 return 1;
1005
1006         /* Check if we are switching association toggle */
1007         if ((priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK) !=
1008                 (priv->active_rxon.filter_flags & RXON_FILTER_ASSOC_MSK))
1009                 return 1;
1010
1011         return 0;
1012 }
1013
1014 static int iwl3945_send_rxon_assoc(struct iwl3945_priv *priv)
1015 {
1016         int rc = 0;
1017         struct iwl3945_rx_packet *res = NULL;
1018         struct iwl3945_rxon_assoc_cmd rxon_assoc;
1019         struct iwl3945_host_cmd cmd = {
1020                 .id = REPLY_RXON_ASSOC,
1021                 .len = sizeof(rxon_assoc),
1022                 .meta.flags = CMD_WANT_SKB,
1023                 .data = &rxon_assoc,
1024         };
1025         const struct iwl3945_rxon_cmd *rxon1 = &priv->staging_rxon;
1026         const struct iwl3945_rxon_cmd *rxon2 = &priv->active_rxon;
1027
1028         if ((rxon1->flags == rxon2->flags) &&
1029             (rxon1->filter_flags == rxon2->filter_flags) &&
1030             (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
1031             (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
1032                 IWL_DEBUG_INFO("Using current RXON_ASSOC.  Not resending.\n");
1033                 return 0;
1034         }
1035
1036         rxon_assoc.flags = priv->staging_rxon.flags;
1037         rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
1038         rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
1039         rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
1040         rxon_assoc.reserved = 0;
1041
1042         rc = iwl3945_send_cmd_sync(priv, &cmd);
1043         if (rc)
1044                 return rc;
1045
1046         res = (struct iwl3945_rx_packet *)cmd.meta.u.skb->data;
1047         if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
1048                 IWL_ERROR("Bad return from REPLY_RXON_ASSOC command\n");
1049                 rc = -EIO;
1050         }
1051
1052         priv->alloc_rxb_skb--;
1053         dev_kfree_skb_any(cmd.meta.u.skb);
1054
1055         return rc;
1056 }
1057
1058 /**
1059  * iwl3945_commit_rxon - commit staging_rxon to hardware
1060  *
1061  * The RXON command in staging_rxon is committed to the hardware and
1062  * the active_rxon structure is updated with the new data.  This
1063  * function correctly transitions out of the RXON_ASSOC_MSK state if
1064  * a HW tune is required based on the RXON structure changes.
1065  */
1066 static int iwl3945_commit_rxon(struct iwl3945_priv *priv)
1067 {
1068         /* cast away the const for active_rxon in this function */
1069         struct iwl3945_rxon_cmd *active_rxon = (void *)&priv->active_rxon;
1070         int rc = 0;
1071         DECLARE_MAC_BUF(mac);
1072
1073         if (!iwl3945_is_alive(priv))
1074                 return -1;
1075
1076         /* always get timestamp with Rx frame */
1077         priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
1078
1079         /* select antenna */
1080         priv->staging_rxon.flags &=
1081             ~(RXON_FLG_DIS_DIV_MSK | RXON_FLG_ANT_SEL_MSK);
1082         priv->staging_rxon.flags |= iwl3945_get_antenna_flags(priv);
1083
1084         rc = iwl3945_check_rxon_cmd(&priv->staging_rxon);
1085         if (rc) {
1086                 IWL_ERROR("Invalid RXON configuration.  Not committing.\n");
1087                 return -EINVAL;
1088         }
1089
1090         /* If we don't need to send a full RXON, we can use
1091          * iwl3945_rxon_assoc_cmd which is used to reconfigure filter
1092          * and other flags for the current radio configuration. */
1093         if (!iwl3945_full_rxon_required(priv)) {
1094                 rc = iwl3945_send_rxon_assoc(priv);
1095                 if (rc) {
1096                         IWL_ERROR("Error setting RXON_ASSOC "
1097                                   "configuration (%d).\n", rc);
1098                         return rc;
1099                 }
1100
1101                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
1102
1103                 return 0;
1104         }
1105
1106         /* If we are currently associated and the new config requires
1107          * an RXON_ASSOC and the new config wants the associated mask enabled,
1108          * we must clear the associated from the active configuration
1109          * before we apply the new config */
1110         if (iwl3945_is_associated(priv) &&
1111             (priv->staging_rxon.filter_flags & RXON_FILTER_ASSOC_MSK)) {
1112                 IWL_DEBUG_INFO("Toggling associated bit on current RXON\n");
1113                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
1114
1115                 rc = iwl3945_send_cmd_pdu(priv, REPLY_RXON,
1116                                       sizeof(struct iwl3945_rxon_cmd),
1117                                       &priv->active_rxon);
1118
1119                 /* If the mask clearing failed then we set
1120                  * active_rxon back to what it was previously */
1121                 if (rc) {
1122                         active_rxon->filter_flags |= RXON_FILTER_ASSOC_MSK;
1123                         IWL_ERROR("Error clearing ASSOC_MSK on current "
1124                                   "configuration (%d).\n", rc);
1125                         return rc;
1126                 }
1127         }
1128
1129         IWL_DEBUG_INFO("Sending RXON\n"
1130                        "* with%s RXON_FILTER_ASSOC_MSK\n"
1131                        "* channel = %d\n"
1132                        "* bssid = %s\n",
1133                        ((priv->staging_rxon.filter_flags &
1134                          RXON_FILTER_ASSOC_MSK) ? "" : "out"),
1135                        le16_to_cpu(priv->staging_rxon.channel),
1136                        print_mac(mac, priv->staging_rxon.bssid_addr));
1137
1138         /* Apply the new configuration */
1139         rc = iwl3945_send_cmd_pdu(priv, REPLY_RXON,
1140                               sizeof(struct iwl3945_rxon_cmd), &priv->staging_rxon);
1141         if (rc) {
1142                 IWL_ERROR("Error setting new configuration (%d).\n", rc);
1143                 return rc;
1144         }
1145
1146         memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
1147
1148         iwl3945_clear_stations_table(priv);
1149
1150         /* If we issue a new RXON command which required a tune then we must
1151          * send a new TXPOWER command or we won't be able to Tx any frames */
1152         rc = iwl3945_hw_reg_send_txpower(priv);
1153         if (rc) {
1154                 IWL_ERROR("Error setting Tx power (%d).\n", rc);
1155                 return rc;
1156         }
1157
1158         /* Add the broadcast address so we can send broadcast frames */
1159         if (iwl3945_add_station(priv, iwl3945_broadcast_addr, 0, 0) ==
1160             IWL_INVALID_STATION) {
1161                 IWL_ERROR("Error adding BROADCAST address for transmit.\n");
1162                 return -EIO;
1163         }
1164
1165         /* If we have set the ASSOC_MSK and we are in BSS mode then
1166          * add the IWL_AP_ID to the station rate table */
1167         if (iwl3945_is_associated(priv) &&
1168             (priv->iw_mode == IEEE80211_IF_TYPE_STA))
1169                 if (iwl3945_add_station(priv, priv->active_rxon.bssid_addr, 1, 0)
1170                     == IWL_INVALID_STATION) {
1171                         IWL_ERROR("Error adding AP address for transmit.\n");
1172                         return -EIO;
1173                 }
1174
1175         /* Init the hardware's rate fallback order based on the band */
1176         rc = iwl3945_init_hw_rate_table(priv);
1177         if (rc) {
1178                 IWL_ERROR("Error setting HW rate table: %02X\n", rc);
1179                 return -EIO;
1180         }
1181
1182         return 0;
1183 }
1184
1185 static int iwl3945_send_bt_config(struct iwl3945_priv *priv)
1186 {
1187         struct iwl3945_bt_cmd bt_cmd = {
1188                 .flags = 3,
1189                 .lead_time = 0xAA,
1190                 .max_kill = 1,
1191                 .kill_ack_mask = 0,
1192                 .kill_cts_mask = 0,
1193         };
1194
1195         return iwl3945_send_cmd_pdu(priv, REPLY_BT_CONFIG,
1196                                 sizeof(struct iwl3945_bt_cmd), &bt_cmd);
1197 }
1198
1199 static int iwl3945_send_scan_abort(struct iwl3945_priv *priv)
1200 {
1201         int rc = 0;
1202         struct iwl3945_rx_packet *res;
1203         struct iwl3945_host_cmd cmd = {
1204                 .id = REPLY_SCAN_ABORT_CMD,
1205                 .meta.flags = CMD_WANT_SKB,
1206         };
1207
1208         /* If there isn't a scan actively going on in the hardware
1209          * then we are in between scan bands and not actually
1210          * actively scanning, so don't send the abort command */
1211         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
1212                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
1213                 return 0;
1214         }
1215
1216         rc = iwl3945_send_cmd_sync(priv, &cmd);
1217         if (rc) {
1218                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
1219                 return rc;
1220         }
1221
1222         res = (struct iwl3945_rx_packet *)cmd.meta.u.skb->data;
1223         if (res->u.status != CAN_ABORT_STATUS) {
1224                 /* The scan abort will return 1 for success or
1225                  * 2 for "failure".  A failure condition can be
1226                  * due to simply not being in an active scan which
1227                  * can occur if we send the scan abort before we
1228                  * the microcode has notified us that a scan is
1229                  * completed. */
1230                 IWL_DEBUG_INFO("SCAN_ABORT returned %d.\n", res->u.status);
1231                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
1232                 clear_bit(STATUS_SCAN_HW, &priv->status);
1233         }
1234
1235         dev_kfree_skb_any(cmd.meta.u.skb);
1236
1237         return rc;
1238 }
1239
1240 static int iwl3945_card_state_sync_callback(struct iwl3945_priv *priv,
1241                                         struct iwl3945_cmd *cmd,
1242                                         struct sk_buff *skb)
1243 {
1244         return 1;
1245 }
1246
1247 /*
1248  * CARD_STATE_CMD
1249  *
1250  * Use: Sets the device's internal card state to enable, disable, or halt
1251  *
1252  * When in the 'enable' state the card operates as normal.
1253  * When in the 'disable' state, the card enters into a low power mode.
1254  * When in the 'halt' state, the card is shut down and must be fully
1255  * restarted to come back on.
1256  */
1257 static int iwl3945_send_card_state(struct iwl3945_priv *priv, u32 flags, u8 meta_flag)
1258 {
1259         struct iwl3945_host_cmd cmd = {
1260                 .id = REPLY_CARD_STATE_CMD,
1261                 .len = sizeof(u32),
1262                 .data = &flags,
1263                 .meta.flags = meta_flag,
1264         };
1265
1266         if (meta_flag & CMD_ASYNC)
1267                 cmd.meta.u.callback = iwl3945_card_state_sync_callback;
1268
1269         return iwl3945_send_cmd(priv, &cmd);
1270 }
1271
1272 static int iwl3945_add_sta_sync_callback(struct iwl3945_priv *priv,
1273                                      struct iwl3945_cmd *cmd, struct sk_buff *skb)
1274 {
1275         struct iwl3945_rx_packet *res = NULL;
1276
1277         if (!skb) {
1278                 IWL_ERROR("Error: Response NULL in REPLY_ADD_STA.\n");
1279                 return 1;
1280         }
1281
1282         res = (struct iwl3945_rx_packet *)skb->data;
1283         if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
1284                 IWL_ERROR("Bad return from REPLY_ADD_STA (0x%08X)\n",
1285                           res->hdr.flags);
1286                 return 1;
1287         }
1288
1289         switch (res->u.add_sta.status) {
1290         case ADD_STA_SUCCESS_MSK:
1291                 break;
1292         default:
1293                 break;
1294         }
1295
1296         /* We didn't cache the SKB; let the caller free it */
1297         return 1;
1298 }
1299
1300 int iwl3945_send_add_station(struct iwl3945_priv *priv,
1301                          struct iwl3945_addsta_cmd *sta, u8 flags)
1302 {
1303         struct iwl3945_rx_packet *res = NULL;
1304         int rc = 0;
1305         struct iwl3945_host_cmd cmd = {
1306                 .id = REPLY_ADD_STA,
1307                 .len = sizeof(struct iwl3945_addsta_cmd),
1308                 .meta.flags = flags,
1309                 .data = sta,
1310         };
1311
1312         if (flags & CMD_ASYNC)
1313                 cmd.meta.u.callback = iwl3945_add_sta_sync_callback;
1314         else
1315                 cmd.meta.flags |= CMD_WANT_SKB;
1316
1317         rc = iwl3945_send_cmd(priv, &cmd);
1318
1319         if (rc || (flags & CMD_ASYNC))
1320                 return rc;
1321
1322         res = (struct iwl3945_rx_packet *)cmd.meta.u.skb->data;
1323         if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
1324                 IWL_ERROR("Bad return from REPLY_ADD_STA (0x%08X)\n",
1325                           res->hdr.flags);
1326                 rc = -EIO;
1327         }
1328
1329         if (rc == 0) {
1330                 switch (res->u.add_sta.status) {
1331                 case ADD_STA_SUCCESS_MSK:
1332                         IWL_DEBUG_INFO("REPLY_ADD_STA PASSED\n");
1333                         break;
1334                 default:
1335                         rc = -EIO;
1336                         IWL_WARNING("REPLY_ADD_STA failed\n");
1337                         break;
1338                 }
1339         }
1340
1341         priv->alloc_rxb_skb--;
1342         dev_kfree_skb_any(cmd.meta.u.skb);
1343
1344         return rc;
1345 }
1346
1347 static int iwl3945_update_sta_key_info(struct iwl3945_priv *priv,
1348                                    struct ieee80211_key_conf *keyconf,
1349                                    u8 sta_id)
1350 {
1351         unsigned long flags;
1352         __le16 key_flags = 0;
1353
1354         switch (keyconf->alg) {
1355         case ALG_CCMP:
1356                 key_flags |= STA_KEY_FLG_CCMP;
1357                 key_flags |= cpu_to_le16(
1358                                 keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
1359                 key_flags &= ~STA_KEY_FLG_INVALID;
1360                 break;
1361         case ALG_TKIP:
1362         case ALG_WEP:
1363         default:
1364                 return -EINVAL;
1365         }
1366         spin_lock_irqsave(&priv->sta_lock, flags);
1367         priv->stations[sta_id].keyinfo.alg = keyconf->alg;
1368         priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
1369         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
1370                keyconf->keylen);
1371
1372         memcpy(priv->stations[sta_id].sta.key.key, keyconf->key,
1373                keyconf->keylen);
1374         priv->stations[sta_id].sta.key.key_flags = key_flags;
1375         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
1376         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1377
1378         spin_unlock_irqrestore(&priv->sta_lock, flags);
1379
1380         IWL_DEBUG_INFO("hwcrypto: modify ucode station key info\n");
1381         iwl3945_send_add_station(priv, &priv->stations[sta_id].sta, 0);
1382         return 0;
1383 }
1384
1385 static int iwl3945_clear_sta_key_info(struct iwl3945_priv *priv, u8 sta_id)
1386 {
1387         unsigned long flags;
1388
1389         spin_lock_irqsave(&priv->sta_lock, flags);
1390         memset(&priv->stations[sta_id].keyinfo, 0, sizeof(struct iwl3945_hw_key));
1391         memset(&priv->stations[sta_id].sta.key, 0, sizeof(struct iwl3945_keyinfo));
1392         priv->stations[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
1393         priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
1394         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
1395         spin_unlock_irqrestore(&priv->sta_lock, flags);
1396
1397         IWL_DEBUG_INFO("hwcrypto: clear ucode station key info\n");
1398         iwl3945_send_add_station(priv, &priv->stations[sta_id].sta, 0);
1399         return 0;
1400 }
1401
1402 static void iwl3945_clear_free_frames(struct iwl3945_priv *priv)
1403 {
1404         struct list_head *element;
1405
1406         IWL_DEBUG_INFO("%d frames on pre-allocated heap on clear.\n",
1407                        priv->frames_count);
1408
1409         while (!list_empty(&priv->free_frames)) {
1410                 element = priv->free_frames.next;
1411                 list_del(element);
1412                 kfree(list_entry(element, struct iwl3945_frame, list));
1413                 priv->frames_count--;
1414         }
1415
1416         if (priv->frames_count) {
1417                 IWL_WARNING("%d frames still in use.  Did we lose one?\n",
1418                             priv->frames_count);
1419                 priv->frames_count = 0;
1420         }
1421 }
1422
1423 static struct iwl3945_frame *iwl3945_get_free_frame(struct iwl3945_priv *priv)
1424 {
1425         struct iwl3945_frame *frame;
1426         struct list_head *element;
1427         if (list_empty(&priv->free_frames)) {
1428                 frame = kzalloc(sizeof(*frame), GFP_KERNEL);
1429                 if (!frame) {
1430                         IWL_ERROR("Could not allocate frame!\n");
1431                         return NULL;
1432                 }
1433
1434                 priv->frames_count++;
1435                 return frame;
1436         }
1437
1438         element = priv->free_frames.next;
1439         list_del(element);
1440         return list_entry(element, struct iwl3945_frame, list);
1441 }
1442
1443 static void iwl3945_free_frame(struct iwl3945_priv *priv, struct iwl3945_frame *frame)
1444 {
1445         memset(frame, 0, sizeof(*frame));
1446         list_add(&frame->list, &priv->free_frames);
1447 }
1448
1449 unsigned int iwl3945_fill_beacon_frame(struct iwl3945_priv *priv,
1450                                 struct ieee80211_hdr *hdr,
1451                                 const u8 *dest, int left)
1452 {
1453
1454         if (!iwl3945_is_associated(priv) || !priv->ibss_beacon ||
1455             ((priv->iw_mode != IEEE80211_IF_TYPE_IBSS) &&
1456              (priv->iw_mode != IEEE80211_IF_TYPE_AP)))
1457                 return 0;
1458
1459         if (priv->ibss_beacon->len > left)
1460                 return 0;
1461
1462         memcpy(hdr, priv->ibss_beacon->data, priv->ibss_beacon->len);
1463
1464         return priv->ibss_beacon->len;
1465 }
1466
1467 static u8 iwl3945_rate_get_lowest_plcp(int rate_mask)
1468 {
1469         u8 i;
1470
1471         for (i = IWL_RATE_1M_INDEX; i != IWL_RATE_INVALID;
1472              i = iwl3945_rates[i].next_ieee) {
1473                 if (rate_mask & (1 << i))
1474                         return iwl3945_rates[i].plcp;
1475         }
1476
1477         return IWL_RATE_INVALID;
1478 }
1479
1480 static int iwl3945_send_beacon_cmd(struct iwl3945_priv *priv)
1481 {
1482         struct iwl3945_frame *frame;
1483         unsigned int frame_size;
1484         int rc;
1485         u8 rate;
1486
1487         frame = iwl3945_get_free_frame(priv);
1488
1489         if (!frame) {
1490                 IWL_ERROR("Could not obtain free frame buffer for beacon "
1491                           "command.\n");
1492                 return -ENOMEM;
1493         }
1494
1495         if (!(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)) {
1496                 rate = iwl3945_rate_get_lowest_plcp(priv->active_rate_basic &
1497                                                 0xFF0);
1498                 if (rate == IWL_INVALID_RATE)
1499                         rate = IWL_RATE_6M_PLCP;
1500         } else {
1501                 rate = iwl3945_rate_get_lowest_plcp(priv->active_rate_basic & 0xF);
1502                 if (rate == IWL_INVALID_RATE)
1503                         rate = IWL_RATE_1M_PLCP;
1504         }
1505
1506         frame_size = iwl3945_hw_get_beacon_cmd(priv, frame, rate);
1507
1508         rc = iwl3945_send_cmd_pdu(priv, REPLY_TX_BEACON, frame_size,
1509                               &frame->u.cmd[0]);
1510
1511         iwl3945_free_frame(priv, frame);
1512
1513         return rc;
1514 }
1515
1516 /******************************************************************************
1517  *
1518  * EEPROM related functions
1519  *
1520  ******************************************************************************/
1521
1522 static void get_eeprom_mac(struct iwl3945_priv *priv, u8 *mac)
1523 {
1524         memcpy(mac, priv->eeprom.mac_address, 6);
1525 }
1526
1527 /*
1528  * Clear the OWNER_MSK, to establish driver (instead of uCode running on
1529  * embedded controller) as EEPROM reader; each read is a series of pulses
1530  * to/from the EEPROM chip, not a single event, so even reads could conflict
1531  * if they weren't arbitrated by some ownership mechanism.  Here, the driver
1532  * simply claims ownership, which should be safe when this function is called
1533  * (i.e. before loading uCode!).
1534  */
1535 static inline int iwl3945_eeprom_acquire_semaphore(struct iwl3945_priv *priv)
1536 {
1537         _iwl3945_clear_bit(priv, CSR_EEPROM_GP, CSR_EEPROM_GP_IF_OWNER_MSK);
1538         return 0;
1539 }
1540
1541 /**
1542  * iwl3945_eeprom_init - read EEPROM contents
1543  *
1544  * Load the EEPROM contents from adapter into priv->eeprom
1545  *
1546  * NOTE:  This routine uses the non-debug IO access functions.
1547  */
1548 int iwl3945_eeprom_init(struct iwl3945_priv *priv)
1549 {
1550         u16 *e = (u16 *)&priv->eeprom;
1551         u32 gp = iwl3945_read32(priv, CSR_EEPROM_GP);
1552         u32 r;
1553         int sz = sizeof(priv->eeprom);
1554         int rc;
1555         int i;
1556         u16 addr;
1557
1558         /* The EEPROM structure has several padding buffers within it
1559          * and when adding new EEPROM maps is subject to programmer errors
1560          * which may be very difficult to identify without explicitly
1561          * checking the resulting size of the eeprom map. */
1562         BUILD_BUG_ON(sizeof(priv->eeprom) != IWL_EEPROM_IMAGE_SIZE);
1563
1564         if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
1565                 IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
1566                 return -ENOENT;
1567         }
1568
1569         /* Make sure driver (instead of uCode) is allowed to read EEPROM */
1570         rc = iwl3945_eeprom_acquire_semaphore(priv);
1571         if (rc < 0) {
1572                 IWL_ERROR("Failed to acquire EEPROM semaphore.\n");
1573                 return -ENOENT;
1574         }
1575
1576         /* eeprom is an array of 16bit values */
1577         for (addr = 0; addr < sz; addr += sizeof(u16)) {
1578                 _iwl3945_write32(priv, CSR_EEPROM_REG, addr << 1);
1579                 _iwl3945_clear_bit(priv, CSR_EEPROM_REG, CSR_EEPROM_REG_BIT_CMD);
1580
1581                 for (i = 0; i < IWL_EEPROM_ACCESS_TIMEOUT;
1582                                         i += IWL_EEPROM_ACCESS_DELAY) {
1583                         r = _iwl3945_read_direct32(priv, CSR_EEPROM_REG);
1584                         if (r & CSR_EEPROM_REG_READ_VALID_MSK)
1585                                 break;
1586                         udelay(IWL_EEPROM_ACCESS_DELAY);
1587                 }
1588
1589                 if (!(r & CSR_EEPROM_REG_READ_VALID_MSK)) {
1590                         IWL_ERROR("Time out reading EEPROM[%d]", addr);
1591                         return -ETIMEDOUT;
1592                 }
1593                 e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
1594         }
1595
1596         return 0;
1597 }
1598
1599 static void iwl3945_unset_hw_setting(struct iwl3945_priv *priv)
1600 {
1601         if (priv->hw_setting.shared_virt)
1602                 pci_free_consistent(priv->pci_dev,
1603                                     sizeof(struct iwl3945_shared),
1604                                     priv->hw_setting.shared_virt,
1605                                     priv->hw_setting.shared_phys);
1606 }
1607
1608 /**
1609  * iwl3945_supported_rate_to_ie - fill in the supported rate in IE field
1610  *
1611  * return : set the bit for each supported rate insert in ie
1612  */
1613 static u16 iwl3945_supported_rate_to_ie(u8 *ie, u16 supported_rate,
1614                                     u16 basic_rate, int *left)
1615 {
1616         u16 ret_rates = 0, bit;
1617         int i;
1618         u8 *cnt = ie;
1619         u8 *rates = ie + 1;
1620
1621         for (bit = 1, i = 0; i < IWL_RATE_COUNT; i++, bit <<= 1) {
1622                 if (bit & supported_rate) {
1623                         ret_rates |= bit;
1624                         rates[*cnt] = iwl3945_rates[i].ieee |
1625                                 ((bit & basic_rate) ? 0x80 : 0x00);
1626                         (*cnt)++;
1627                         (*left)--;
1628                         if ((*left <= 0) ||
1629                             (*cnt >= IWL_SUPPORTED_RATES_IE_LEN))
1630                                 break;
1631                 }
1632         }
1633
1634         return ret_rates;
1635 }
1636
1637 /**
1638  * iwl3945_fill_probe_req - fill in all required fields and IE for probe request
1639  */
1640 static u16 iwl3945_fill_probe_req(struct iwl3945_priv *priv,
1641                               struct ieee80211_mgmt *frame,
1642                               int left, int is_direct)
1643 {
1644         int len = 0;
1645         u8 *pos = NULL;
1646         u16 active_rates, ret_rates, cck_rates;
1647
1648         /* Make sure there is enough space for the probe request,
1649          * two mandatory IEs and the data */
1650         left -= 24;
1651         if (left < 0)
1652                 return 0;
1653         len += 24;
1654
1655         frame->frame_control = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
1656         memcpy(frame->da, iwl3945_broadcast_addr, ETH_ALEN);
1657         memcpy(frame->sa, priv->mac_addr, ETH_ALEN);
1658         memcpy(frame->bssid, iwl3945_broadcast_addr, ETH_ALEN);
1659         frame->seq_ctrl = 0;
1660
1661         /* fill in our indirect SSID IE */
1662         /* ...next IE... */
1663
1664         left -= 2;
1665         if (left < 0)
1666                 return 0;
1667         len += 2;
1668         pos = &(frame->u.probe_req.variable[0]);
1669         *pos++ = WLAN_EID_SSID;
1670         *pos++ = 0;
1671
1672         /* fill in our direct SSID IE... */
1673         if (is_direct) {
1674                 /* ...next IE... */
1675                 left -= 2 + priv->essid_len;
1676                 if (left < 0)
1677                         return 0;
1678                 /* ... fill it in... */
1679                 *pos++ = WLAN_EID_SSID;
1680                 *pos++ = priv->essid_len;
1681                 memcpy(pos, priv->essid, priv->essid_len);
1682                 pos += priv->essid_len;
1683                 len += 2 + priv->essid_len;
1684         }
1685
1686         /* fill in supported rate */
1687         /* ...next IE... */
1688         left -= 2;
1689         if (left < 0)
1690                 return 0;
1691
1692         /* ... fill it in... */
1693         *pos++ = WLAN_EID_SUPP_RATES;
1694         *pos = 0;
1695
1696         priv->active_rate = priv->rates_mask;
1697         active_rates = priv->active_rate;
1698         priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
1699
1700         cck_rates = IWL_CCK_RATES_MASK & active_rates;
1701         ret_rates = iwl3945_supported_rate_to_ie(pos, cck_rates,
1702                         priv->active_rate_basic, &left);
1703         active_rates &= ~ret_rates;
1704
1705         ret_rates = iwl3945_supported_rate_to_ie(pos, active_rates,
1706                                  priv->active_rate_basic, &left);
1707         active_rates &= ~ret_rates;
1708
1709         len += 2 + *pos;
1710         pos += (*pos) + 1;
1711         if (active_rates == 0)
1712                 goto fill_end;
1713
1714         /* fill in supported extended rate */
1715         /* ...next IE... */
1716         left -= 2;
1717         if (left < 0)
1718                 return 0;
1719         /* ... fill it in... */
1720         *pos++ = WLAN_EID_EXT_SUPP_RATES;
1721         *pos = 0;
1722         iwl3945_supported_rate_to_ie(pos, active_rates,
1723                                  priv->active_rate_basic, &left);
1724         if (*pos > 0)
1725                 len += 2 + *pos;
1726
1727  fill_end:
1728         return (u16)len;
1729 }
1730
1731 /*
1732  * QoS  support
1733 */
1734 static int iwl3945_send_qos_params_command(struct iwl3945_priv *priv,
1735                                        struct iwl3945_qosparam_cmd *qos)
1736 {
1737
1738         return iwl3945_send_cmd_pdu(priv, REPLY_QOS_PARAM,
1739                                 sizeof(struct iwl3945_qosparam_cmd), qos);
1740 }
1741
1742 static void iwl3945_reset_qos(struct iwl3945_priv *priv)
1743 {
1744         u16 cw_min = 15;
1745         u16 cw_max = 1023;
1746         u8 aifs = 2;
1747         u8 is_legacy = 0;
1748         unsigned long flags;
1749         int i;
1750
1751         spin_lock_irqsave(&priv->lock, flags);
1752         priv->qos_data.qos_active = 0;
1753
1754         if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS) {
1755                 if (priv->qos_data.qos_enable)
1756                         priv->qos_data.qos_active = 1;
1757                 if (!(priv->active_rate & 0xfff0)) {
1758                         cw_min = 31;
1759                         is_legacy = 1;
1760                 }
1761         } else if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
1762                 if (priv->qos_data.qos_enable)
1763                         priv->qos_data.qos_active = 1;
1764         } else if (!(priv->staging_rxon.flags & RXON_FLG_SHORT_SLOT_MSK)) {
1765                 cw_min = 31;
1766                 is_legacy = 1;
1767         }
1768
1769         if (priv->qos_data.qos_active)
1770                 aifs = 3;
1771
1772         priv->qos_data.def_qos_parm.ac[0].cw_min = cpu_to_le16(cw_min);
1773         priv->qos_data.def_qos_parm.ac[0].cw_max = cpu_to_le16(cw_max);
1774         priv->qos_data.def_qos_parm.ac[0].aifsn = aifs;
1775         priv->qos_data.def_qos_parm.ac[0].edca_txop = 0;
1776         priv->qos_data.def_qos_parm.ac[0].reserved1 = 0;
1777
1778         if (priv->qos_data.qos_active) {
1779                 i = 1;
1780                 priv->qos_data.def_qos_parm.ac[i].cw_min = cpu_to_le16(cw_min);
1781                 priv->qos_data.def_qos_parm.ac[i].cw_max = cpu_to_le16(cw_max);
1782                 priv->qos_data.def_qos_parm.ac[i].aifsn = 7;
1783                 priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
1784                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
1785
1786                 i = 2;
1787                 priv->qos_data.def_qos_parm.ac[i].cw_min =
1788                         cpu_to_le16((cw_min + 1) / 2 - 1);
1789                 priv->qos_data.def_qos_parm.ac[i].cw_max =
1790                         cpu_to_le16(cw_max);
1791                 priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
1792                 if (is_legacy)
1793                         priv->qos_data.def_qos_parm.ac[i].edca_txop =
1794                                 cpu_to_le16(6016);
1795                 else
1796                         priv->qos_data.def_qos_parm.ac[i].edca_txop =
1797                                 cpu_to_le16(3008);
1798                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
1799
1800                 i = 3;
1801                 priv->qos_data.def_qos_parm.ac[i].cw_min =
1802                         cpu_to_le16((cw_min + 1) / 4 - 1);
1803                 priv->qos_data.def_qos_parm.ac[i].cw_max =
1804                         cpu_to_le16((cw_max + 1) / 2 - 1);
1805                 priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
1806                 priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
1807                 if (is_legacy)
1808                         priv->qos_data.def_qos_parm.ac[i].edca_txop =
1809                                 cpu_to_le16(3264);
1810                 else
1811                         priv->qos_data.def_qos_parm.ac[i].edca_txop =
1812                                 cpu_to_le16(1504);
1813         } else {
1814                 for (i = 1; i < 4; i++) {
1815                         priv->qos_data.def_qos_parm.ac[i].cw_min =
1816                                 cpu_to_le16(cw_min);
1817                         priv->qos_data.def_qos_parm.ac[i].cw_max =
1818                                 cpu_to_le16(cw_max);
1819                         priv->qos_data.def_qos_parm.ac[i].aifsn = aifs;
1820                         priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
1821                         priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
1822                 }
1823         }
1824         IWL_DEBUG_QOS("set QoS to default \n");
1825
1826         spin_unlock_irqrestore(&priv->lock, flags);
1827 }
1828
1829 static void iwl3945_activate_qos(struct iwl3945_priv *priv, u8 force)
1830 {
1831         unsigned long flags;
1832
1833         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
1834                 return;
1835
1836         if (!priv->qos_data.qos_enable)
1837                 return;
1838
1839         spin_lock_irqsave(&priv->lock, flags);
1840         priv->qos_data.def_qos_parm.qos_flags = 0;
1841
1842         if (priv->qos_data.qos_cap.q_AP.queue_request &&
1843             !priv->qos_data.qos_cap.q_AP.txop_request)
1844                 priv->qos_data.def_qos_parm.qos_flags |=
1845                         QOS_PARAM_FLG_TXOP_TYPE_MSK;
1846
1847         if (priv->qos_data.qos_active)
1848                 priv->qos_data.def_qos_parm.qos_flags |=
1849                         QOS_PARAM_FLG_UPDATE_EDCA_MSK;
1850
1851         spin_unlock_irqrestore(&priv->lock, flags);
1852
1853         if (force || iwl3945_is_associated(priv)) {
1854                 IWL_DEBUG_QOS("send QoS cmd with Qos active %d \n",
1855                               priv->qos_data.qos_active);
1856
1857                 iwl3945_send_qos_params_command(priv,
1858                                 &(priv->qos_data.def_qos_parm));
1859         }
1860 }
1861
1862 /*
1863  * Power management (not Tx power!) functions
1864  */
1865 #define MSEC_TO_USEC 1024
1866
1867 #define NOSLP __constant_cpu_to_le32(0)
1868 #define SLP IWL_POWER_DRIVER_ALLOW_SLEEP_MSK
1869 #define SLP_TIMEOUT(T) __constant_cpu_to_le32((T) * MSEC_TO_USEC)
1870 #define SLP_VEC(X0, X1, X2, X3, X4) {__constant_cpu_to_le32(X0), \
1871                                      __constant_cpu_to_le32(X1), \
1872                                      __constant_cpu_to_le32(X2), \
1873                                      __constant_cpu_to_le32(X3), \
1874                                      __constant_cpu_to_le32(X4)}
1875
1876
1877 /* default power management (not Tx power) table values */
1878 /* for tim  0-10 */
1879 static struct iwl3945_power_vec_entry range_0[IWL_POWER_AC] = {
1880         {{NOSLP, SLP_TIMEOUT(0), SLP_TIMEOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
1881         {{SLP, SLP_TIMEOUT(200), SLP_TIMEOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
1882         {{SLP, SLP_TIMEOUT(200), SLP_TIMEOUT(300), SLP_VEC(2, 4, 6, 7, 7)}, 0},
1883         {{SLP, SLP_TIMEOUT(50), SLP_TIMEOUT(100), SLP_VEC(2, 6, 9, 9, 10)}, 0},
1884         {{SLP, SLP_TIMEOUT(50), SLP_TIMEOUT(25), SLP_VEC(2, 7, 9, 9, 10)}, 1},
1885         {{SLP, SLP_TIMEOUT(25), SLP_TIMEOUT(25), SLP_VEC(4, 7, 10, 10, 10)}, 1}
1886 };
1887
1888 /* for tim > 10 */
1889 static struct iwl3945_power_vec_entry range_1[IWL_POWER_AC] = {
1890         {{NOSLP, SLP_TIMEOUT(0), SLP_TIMEOUT(0), SLP_VEC(0, 0, 0, 0, 0)}, 0},
1891         {{SLP, SLP_TIMEOUT(200), SLP_TIMEOUT(500),
1892                  SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
1893         {{SLP, SLP_TIMEOUT(200), SLP_TIMEOUT(300),
1894                  SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
1895         {{SLP, SLP_TIMEOUT(50), SLP_TIMEOUT(100),
1896                  SLP_VEC(2, 6, 9, 9, 0xFF)}, 0},
1897         {{SLP, SLP_TIMEOUT(50), SLP_TIMEOUT(25), SLP_VEC(2, 7, 9, 9, 0xFF)}, 0},
1898         {{SLP, SLP_TIMEOUT(25), SLP_TIMEOUT(25),
1899                  SLP_VEC(4, 7, 10, 10, 0xFF)}, 0}
1900 };
1901
1902 int iwl3945_power_init_handle(struct iwl3945_priv *priv)
1903 {
1904         int rc = 0, i;
1905         struct iwl3945_power_mgr *pow_data;
1906         int size = sizeof(struct iwl3945_power_vec_entry) * IWL_POWER_AC;
1907         u16 pci_pm;
1908
1909         IWL_DEBUG_POWER("Initialize power \n");
1910
1911         pow_data = &(priv->power_data);
1912
1913         memset(pow_data, 0, sizeof(*pow_data));
1914
1915         pow_data->active_index = IWL_POWER_RANGE_0;
1916         pow_data->dtim_val = 0xffff;
1917
1918         memcpy(&pow_data->pwr_range_0[0], &range_0[0], size);
1919         memcpy(&pow_data->pwr_range_1[0], &range_1[0], size);
1920
1921         rc = pci_read_config_word(priv->pci_dev, PCI_LINK_CTRL, &pci_pm);
1922         if (rc != 0)
1923                 return 0;
1924         else {
1925                 struct iwl3945_powertable_cmd *cmd;
1926
1927                 IWL_DEBUG_POWER("adjust power command flags\n");
1928
1929                 for (i = 0; i < IWL_POWER_AC; i++) {
1930                         cmd = &pow_data->pwr_range_0[i].cmd;
1931
1932                         if (pci_pm & 0x1)
1933                                 cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
1934                         else
1935                                 cmd->flags |= IWL_POWER_PCI_PM_MSK;
1936                 }
1937         }
1938         return rc;
1939 }
1940
1941 static int iwl3945_update_power_cmd(struct iwl3945_priv *priv,
1942                                 struct iwl3945_powertable_cmd *cmd, u32 mode)
1943 {
1944         int rc = 0, i;
1945         u8 skip;
1946         u32 max_sleep = 0;
1947         struct iwl3945_power_vec_entry *range;
1948         u8 period = 0;
1949         struct iwl3945_power_mgr *pow_data;
1950
1951         if (mode > IWL_POWER_INDEX_5) {
1952                 IWL_DEBUG_POWER("Error invalid power mode \n");
1953                 return -1;
1954         }
1955         pow_data = &(priv->power_data);
1956
1957         if (pow_data->active_index == IWL_POWER_RANGE_0)
1958                 range = &pow_data->pwr_range_0[0];
1959         else
1960                 range = &pow_data->pwr_range_1[1];
1961
1962         memcpy(cmd, &range[mode].cmd, sizeof(struct iwl3945_powertable_cmd));
1963
1964 #ifdef IWL_MAC80211_DISABLE
1965         if (priv->assoc_network != NULL) {
1966                 unsigned long flags;
1967
1968                 period = priv->assoc_network->tim.tim_period;
1969         }
1970 #endif  /*IWL_MAC80211_DISABLE */
1971         skip = range[mode].no_dtim;
1972
1973         if (period == 0) {
1974                 period = 1;
1975                 skip = 0;
1976         }
1977
1978         if (skip == 0) {
1979                 max_sleep = period;
1980                 cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
1981         } else {
1982                 __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
1983                 max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
1984                 cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
1985         }
1986
1987         for (i = 0; i < IWL_POWER_VEC_SIZE; i++) {
1988                 if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
1989                         cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
1990         }
1991
1992         IWL_DEBUG_POWER("Flags value = 0x%08X\n", cmd->flags);
1993         IWL_DEBUG_POWER("Tx timeout = %u\n", le32_to_cpu(cmd->tx_data_timeout));
1994         IWL_DEBUG_POWER("Rx timeout = %u\n", le32_to_cpu(cmd->rx_data_timeout));
1995         IWL_DEBUG_POWER("Sleep interval vector = { %d , %d , %d , %d , %d }\n",
1996                         le32_to_cpu(cmd->sleep_interval[0]),
1997                         le32_to_cpu(cmd->sleep_interval[1]),
1998                         le32_to_cpu(cmd->sleep_interval[2]),
1999                         le32_to_cpu(cmd->sleep_interval[3]),
2000                         le32_to_cpu(cmd->sleep_interval[4]));
2001
2002         return rc;
2003 }
2004
2005 static int iwl3945_send_power_mode(struct iwl3945_priv *priv, u32 mode)
2006 {
2007         u32 uninitialized_var(final_mode);
2008         int rc;
2009         struct iwl3945_powertable_cmd cmd;
2010
2011         /* If on battery, set to 3,
2012          * if plugged into AC power, set to CAM ("continuously aware mode"),
2013          * else user level */
2014         switch (mode) {
2015         case IWL_POWER_BATTERY:
2016                 final_mode = IWL_POWER_INDEX_3;
2017                 break;
2018         case IWL_POWER_AC:
2019                 final_mode = IWL_POWER_MODE_CAM;
2020                 break;
2021         default:
2022                 final_mode = mode;
2023                 break;
2024         }
2025
2026         iwl3945_update_power_cmd(priv, &cmd, final_mode);
2027
2028         rc = iwl3945_send_cmd_pdu(priv, POWER_TABLE_CMD, sizeof(cmd), &cmd);
2029
2030         if (final_mode == IWL_POWER_MODE_CAM)
2031                 clear_bit(STATUS_POWER_PMI, &priv->status);
2032         else
2033                 set_bit(STATUS_POWER_PMI, &priv->status);
2034
2035         return rc;
2036 }
2037
2038 int iwl3945_is_network_packet(struct iwl3945_priv *priv, struct ieee80211_hdr *header)
2039 {
2040         /* Filter incoming packets to determine if they are targeted toward
2041          * this network, discarding packets coming from ourselves */
2042         switch (priv->iw_mode) {
2043         case IEEE80211_IF_TYPE_IBSS: /* Header: Dest. | Source    | BSSID */
2044                 /* packets from our adapter are dropped (echo) */
2045                 if (!compare_ether_addr(header->addr2, priv->mac_addr))
2046                         return 0;
2047                 /* {broad,multi}cast packets to our IBSS go through */
2048                 if (is_multicast_ether_addr(header->addr1))
2049                         return !compare_ether_addr(header->addr3, priv->bssid);
2050                 /* packets to our adapter go through */
2051                 return !compare_ether_addr(header->addr1, priv->mac_addr);
2052         case IEEE80211_IF_TYPE_STA: /* Header: Dest. | AP{BSSID} | Source */
2053                 /* packets from our adapter are dropped (echo) */
2054                 if (!compare_ether_addr(header->addr3, priv->mac_addr))
2055                         return 0;
2056                 /* {broad,multi}cast packets to our BSS go through */
2057                 if (is_multicast_ether_addr(header->addr1))
2058                         return !compare_ether_addr(header->addr2, priv->bssid);
2059                 /* packets to our adapter go through */
2060                 return !compare_ether_addr(header->addr1, priv->mac_addr);
2061         }
2062
2063         return 1;
2064 }
2065
2066 /**
2067  * iwl3945_scan_cancel - Cancel any currently executing HW scan
2068  *
2069  * NOTE: priv->mutex is not required before calling this function
2070  */
2071 static int iwl3945_scan_cancel(struct iwl3945_priv *priv)
2072 {
2073         if (!test_bit(STATUS_SCAN_HW, &priv->status)) {
2074                 clear_bit(STATUS_SCANNING, &priv->status);
2075                 return 0;
2076         }
2077
2078         if (test_bit(STATUS_SCANNING, &priv->status)) {
2079                 if (!test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
2080                         IWL_DEBUG_SCAN("Queuing scan abort.\n");
2081                         set_bit(STATUS_SCAN_ABORTING, &priv->status);
2082                         queue_work(priv->workqueue, &priv->abort_scan);
2083
2084                 } else
2085                         IWL_DEBUG_SCAN("Scan abort already in progress.\n");
2086
2087                 return test_bit(STATUS_SCANNING, &priv->status);
2088         }
2089
2090         return 0;
2091 }
2092
2093 /**
2094  * iwl3945_scan_cancel_timeout - Cancel any currently executing HW scan
2095  * @ms: amount of time to wait (in milliseconds) for scan to abort
2096  *
2097  * NOTE: priv->mutex must be held before calling this function
2098  */
2099 static int iwl3945_scan_cancel_timeout(struct iwl3945_priv *priv, unsigned long ms)
2100 {
2101         unsigned long now = jiffies;
2102         int ret;
2103
2104         ret = iwl3945_scan_cancel(priv);
2105         if (ret && ms) {
2106                 mutex_unlock(&priv->mutex);
2107                 while (!time_after(jiffies, now + msecs_to_jiffies(ms)) &&
2108                                 test_bit(STATUS_SCANNING, &priv->status))
2109                         msleep(1);
2110                 mutex_lock(&priv->mutex);
2111
2112                 return test_bit(STATUS_SCANNING, &priv->status);
2113         }
2114
2115         return ret;
2116 }
2117
2118 static void iwl3945_sequence_reset(struct iwl3945_priv *priv)
2119 {
2120         /* Reset ieee stats */
2121
2122         /* We don't reset the net_device_stats (ieee->stats) on
2123          * re-association */
2124
2125         priv->last_seq_num = -1;
2126         priv->last_frag_num = -1;
2127         priv->last_packet_time = 0;
2128
2129         iwl3945_scan_cancel(priv);
2130 }
2131
2132 #define MAX_UCODE_BEACON_INTERVAL       1024
2133 #define INTEL_CONN_LISTEN_INTERVAL      __constant_cpu_to_le16(0xA)
2134
2135 static __le16 iwl3945_adjust_beacon_interval(u16 beacon_val)
2136 {
2137         u16 new_val = 0;
2138         u16 beacon_factor = 0;
2139
2140         beacon_factor =
2141             (beacon_val + MAX_UCODE_BEACON_INTERVAL)
2142                 / MAX_UCODE_BEACON_INTERVAL;
2143         new_val = beacon_val / beacon_factor;
2144
2145         return cpu_to_le16(new_val);
2146 }
2147
2148 static void iwl3945_setup_rxon_timing(struct iwl3945_priv *priv)
2149 {
2150         u64 interval_tm_unit;
2151         u64 tsf, result;
2152         unsigned long flags;
2153         struct ieee80211_conf *conf = NULL;
2154         u16 beacon_int = 0;
2155
2156         conf = ieee80211_get_hw_conf(priv->hw);
2157
2158         spin_lock_irqsave(&priv->lock, flags);
2159         priv->rxon_timing.timestamp.dw[1] = cpu_to_le32(priv->timestamp1);
2160         priv->rxon_timing.timestamp.dw[0] = cpu_to_le32(priv->timestamp0);
2161
2162         priv->rxon_timing.listen_interval = INTEL_CONN_LISTEN_INTERVAL;
2163
2164         tsf = priv->timestamp1;
2165         tsf = ((tsf << 32) | priv->timestamp0);
2166
2167         beacon_int = priv->beacon_int;
2168         spin_unlock_irqrestore(&priv->lock, flags);
2169
2170         if (priv->iw_mode == IEEE80211_IF_TYPE_STA) {
2171                 if (beacon_int == 0) {
2172                         priv->rxon_timing.beacon_interval = cpu_to_le16(100);
2173                         priv->rxon_timing.beacon_init_val = cpu_to_le32(102400);
2174                 } else {
2175                         priv->rxon_timing.beacon_interval =
2176                                 cpu_to_le16(beacon_int);
2177                         priv->rxon_timing.beacon_interval =
2178                             iwl3945_adjust_beacon_interval(
2179                                 le16_to_cpu(priv->rxon_timing.beacon_interval));
2180                 }
2181
2182                 priv->rxon_timing.atim_window = 0;
2183         } else {
2184                 priv->rxon_timing.beacon_interval =
2185                         iwl3945_adjust_beacon_interval(conf->beacon_int);
2186                 /* TODO: we need to get atim_window from upper stack
2187                  * for now we set to 0 */
2188                 priv->rxon_timing.atim_window = 0;
2189         }
2190
2191         interval_tm_unit =
2192                 (le16_to_cpu(priv->rxon_timing.beacon_interval) * 1024);
2193         result = do_div(tsf, interval_tm_unit);
2194         priv->rxon_timing.beacon_init_val =
2195             cpu_to_le32((u32) ((u64) interval_tm_unit - result));
2196
2197         IWL_DEBUG_ASSOC
2198             ("beacon interval %d beacon timer %d beacon tim %d\n",
2199                 le16_to_cpu(priv->rxon_timing.beacon_interval),
2200                 le32_to_cpu(priv->rxon_timing.beacon_init_val),
2201                 le16_to_cpu(priv->rxon_timing.atim_window));
2202 }
2203
2204 static int iwl3945_scan_initiate(struct iwl3945_priv *priv)
2205 {
2206         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
2207                 IWL_ERROR("APs don't scan.\n");
2208                 return 0;
2209         }
2210
2211         if (!iwl3945_is_ready_rf(priv)) {
2212                 IWL_DEBUG_SCAN("Aborting scan due to not ready.\n");
2213                 return -EIO;
2214         }
2215
2216         if (test_bit(STATUS_SCANNING, &priv->status)) {
2217                 IWL_DEBUG_SCAN("Scan already in progress.\n");
2218                 return -EAGAIN;
2219         }
2220
2221         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
2222                 IWL_DEBUG_SCAN("Scan request while abort pending.  "
2223                                "Queuing.\n");
2224                 return -EAGAIN;
2225         }
2226
2227         IWL_DEBUG_INFO("Starting scan...\n");
2228         priv->scan_bands = 2;
2229         set_bit(STATUS_SCANNING, &priv->status);
2230         priv->scan_start = jiffies;
2231         priv->scan_pass_start = priv->scan_start;
2232
2233         queue_work(priv->workqueue, &priv->request_scan);
2234
2235         return 0;
2236 }
2237
2238 static int iwl3945_set_rxon_hwcrypto(struct iwl3945_priv *priv, int hw_decrypt)
2239 {
2240         struct iwl3945_rxon_cmd *rxon = &priv->staging_rxon;
2241
2242         if (hw_decrypt)
2243                 rxon->filter_flags &= ~RXON_FILTER_DIS_DECRYPT_MSK;
2244         else
2245                 rxon->filter_flags |= RXON_FILTER_DIS_DECRYPT_MSK;
2246
2247         return 0;
2248 }
2249
2250 static void iwl3945_set_flags_for_phymode(struct iwl3945_priv *priv,
2251                                           enum ieee80211_band band)
2252 {
2253         if (band == IEEE80211_BAND_5GHZ) {
2254                 priv->staging_rxon.flags &=
2255                     ~(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK
2256                       | RXON_FLG_CCK_MSK);
2257                 priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
2258         } else {
2259                 /* Copied from iwl3945_bg_post_associate() */
2260                 if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
2261                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
2262                 else
2263                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
2264
2265                 if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS)
2266                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
2267
2268                 priv->staging_rxon.flags |= RXON_FLG_BAND_24G_MSK;
2269                 priv->staging_rxon.flags |= RXON_FLG_AUTO_DETECT_MSK;
2270                 priv->staging_rxon.flags &= ~RXON_FLG_CCK_MSK;
2271         }
2272 }
2273
2274 /*
2275  * initialize rxon structure with default values from eeprom
2276  */
2277 static void iwl3945_connection_init_rx_config(struct iwl3945_priv *priv)
2278 {
2279         const struct iwl3945_channel_info *ch_info;
2280
2281         memset(&priv->staging_rxon, 0, sizeof(priv->staging_rxon));
2282
2283         switch (priv->iw_mode) {
2284         case IEEE80211_IF_TYPE_AP:
2285                 priv->staging_rxon.dev_type = RXON_DEV_TYPE_AP;
2286                 break;
2287
2288         case IEEE80211_IF_TYPE_STA:
2289                 priv->staging_rxon.dev_type = RXON_DEV_TYPE_ESS;
2290                 priv->staging_rxon.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
2291                 break;
2292
2293         case IEEE80211_IF_TYPE_IBSS:
2294                 priv->staging_rxon.dev_type = RXON_DEV_TYPE_IBSS;
2295                 priv->staging_rxon.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
2296                 priv->staging_rxon.filter_flags = RXON_FILTER_BCON_AWARE_MSK |
2297                                                   RXON_FILTER_ACCEPT_GRP_MSK;
2298                 break;
2299
2300         case IEEE80211_IF_TYPE_MNTR:
2301                 priv->staging_rxon.dev_type = RXON_DEV_TYPE_SNIFFER;
2302                 priv->staging_rxon.filter_flags = RXON_FILTER_PROMISC_MSK |
2303                     RXON_FILTER_CTL2HOST_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
2304                 break;
2305         }
2306
2307 #if 0
2308         /* TODO:  Figure out when short_preamble would be set and cache from
2309          * that */
2310         if (!hw_to_local(priv->hw)->short_preamble)
2311                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
2312         else
2313                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
2314 #endif
2315
2316         ch_info = iwl3945_get_channel_info(priv, priv->band,
2317                                        le16_to_cpu(priv->staging_rxon.channel));
2318
2319         if (!ch_info)
2320                 ch_info = &priv->channel_info[0];
2321
2322         /*
2323          * in some case A channels are all non IBSS
2324          * in this case force B/G channel
2325          */
2326         if ((priv->iw_mode == IEEE80211_IF_TYPE_IBSS) &&
2327             !(is_channel_ibss(ch_info)))
2328                 ch_info = &priv->channel_info[0];
2329
2330         priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
2331         if (is_channel_a_band(ch_info))
2332                 priv->band = IEEE80211_BAND_5GHZ;
2333         else
2334                 priv->band = IEEE80211_BAND_2GHZ;
2335
2336         iwl3945_set_flags_for_phymode(priv, priv->band);
2337
2338         priv->staging_rxon.ofdm_basic_rates =
2339             (IWL_OFDM_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
2340         priv->staging_rxon.cck_basic_rates =
2341             (IWL_CCK_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
2342 }
2343
2344 static int iwl3945_set_mode(struct iwl3945_priv *priv, int mode)
2345 {
2346         if (mode == IEEE80211_IF_TYPE_IBSS) {
2347                 const struct iwl3945_channel_info *ch_info;
2348
2349                 ch_info = iwl3945_get_channel_info(priv,
2350                         priv->band,
2351                         le16_to_cpu(priv->staging_rxon.channel));
2352
2353                 if (!ch_info || !is_channel_ibss(ch_info)) {
2354                         IWL_ERROR("channel %d not IBSS channel\n",
2355                                   le16_to_cpu(priv->staging_rxon.channel));
2356                         return -EINVAL;
2357                 }
2358         }
2359
2360         priv->iw_mode = mode;
2361
2362         iwl3945_connection_init_rx_config(priv);
2363         memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
2364
2365         iwl3945_clear_stations_table(priv);
2366
2367         /* dont commit rxon if rf-kill is on*/
2368         if (!iwl3945_is_ready_rf(priv))
2369                 return -EAGAIN;
2370
2371         cancel_delayed_work(&priv->scan_check);
2372         if (iwl3945_scan_cancel_timeout(priv, 100)) {
2373                 IWL_WARNING("Aborted scan still in progress after 100ms\n");
2374                 IWL_DEBUG_MAC80211("leaving - scan abort failed.\n");
2375                 return -EAGAIN;
2376         }
2377
2378         iwl3945_commit_rxon(priv);
2379
2380         return 0;
2381 }
2382
2383 static void iwl3945_build_tx_cmd_hwcrypto(struct iwl3945_priv *priv,
2384                                       struct ieee80211_tx_control *ctl,
2385                                       struct iwl3945_cmd *cmd,
2386                                       struct sk_buff *skb_frag,
2387                                       int last_frag)
2388 {
2389         struct iwl3945_hw_key *keyinfo = &priv->stations[ctl->key_idx].keyinfo;
2390
2391         switch (keyinfo->alg) {
2392         case ALG_CCMP:
2393                 cmd->cmd.tx.sec_ctl = TX_CMD_SEC_CCM;
2394                 memcpy(cmd->cmd.tx.key, keyinfo->key, keyinfo->keylen);
2395                 IWL_DEBUG_TX("tx_cmd with aes hwcrypto\n");
2396                 break;
2397
2398         case ALG_TKIP:
2399 #if 0
2400                 cmd->cmd.tx.sec_ctl = TX_CMD_SEC_TKIP;
2401
2402                 if (last_frag)
2403                         memcpy(cmd->cmd.tx.tkip_mic.byte, skb_frag->tail - 8,
2404                                8);
2405                 else
2406                         memset(cmd->cmd.tx.tkip_mic.byte, 0, 8);
2407 #endif
2408                 break;
2409
2410         case ALG_WEP:
2411                 cmd->cmd.tx.sec_ctl = TX_CMD_SEC_WEP |
2412                     (ctl->key_idx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT;
2413
2414                 if (keyinfo->keylen == 13)
2415                         cmd->cmd.tx.sec_ctl |= TX_CMD_SEC_KEY128;
2416
2417                 memcpy(&cmd->cmd.tx.key[3], keyinfo->key, keyinfo->keylen);
2418
2419                 IWL_DEBUG_TX("Configuring packet for WEP encryption "
2420                              "with key %d\n", ctl->key_idx);
2421                 break;
2422
2423         default:
2424                 printk(KERN_ERR "Unknown encode alg %d\n", keyinfo->alg);
2425                 break;
2426         }
2427 }
2428
2429 /*
2430  * handle build REPLY_TX command notification.
2431  */
2432 static void iwl3945_build_tx_cmd_basic(struct iwl3945_priv *priv,
2433                                   struct iwl3945_cmd *cmd,
2434                                   struct ieee80211_tx_control *ctrl,
2435                                   struct ieee80211_hdr *hdr,
2436                                   int is_unicast, u8 std_id)
2437 {
2438         __le16 *qc;
2439         u16 fc = le16_to_cpu(hdr->frame_control);
2440         __le32 tx_flags = cmd->cmd.tx.tx_flags;
2441
2442         cmd->cmd.tx.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
2443         if (!(ctrl->flags & IEEE80211_TXCTL_NO_ACK)) {
2444                 tx_flags |= TX_CMD_FLG_ACK_MSK;
2445                 if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
2446                         tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
2447                 if (ieee80211_is_probe_response(fc) &&
2448                     !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
2449                         tx_flags |= TX_CMD_FLG_TSF_MSK;
2450         } else {
2451                 tx_flags &= (~TX_CMD_FLG_ACK_MSK);
2452                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
2453         }
2454
2455         cmd->cmd.tx.sta_id = std_id;
2456         if (ieee80211_get_morefrag(hdr))
2457                 tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
2458
2459         qc = ieee80211_get_qos_ctrl(hdr);
2460         if (qc) {
2461                 cmd->cmd.tx.tid_tspec = (u8) (le16_to_cpu(*qc) & 0xf);
2462                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
2463         } else
2464                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
2465
2466         if (ctrl->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
2467                 tx_flags |= TX_CMD_FLG_RTS_MSK;
2468                 tx_flags &= ~TX_CMD_FLG_CTS_MSK;
2469         } else if (ctrl->flags & IEEE80211_TXCTL_USE_CTS_PROTECT) {
2470                 tx_flags &= ~TX_CMD_FLG_RTS_MSK;
2471                 tx_flags |= TX_CMD_FLG_CTS_MSK;
2472         }
2473
2474         if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
2475                 tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
2476
2477         tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
2478         if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT) {
2479                 if ((fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_ASSOC_REQ ||
2480                     (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_REASSOC_REQ)
2481                         cmd->cmd.tx.timeout.pm_frame_timeout = cpu_to_le16(3);
2482                 else
2483                         cmd->cmd.tx.timeout.pm_frame_timeout = cpu_to_le16(2);
2484         } else {
2485                 cmd->cmd.tx.timeout.pm_frame_timeout = 0;
2486 #ifdef CONFIG_IWL3945_LEDS
2487                 priv->rxtxpackets += le16_to_cpu(cmd->cmd.tx.len);
2488 #endif
2489         }
2490
2491         cmd->cmd.tx.driver_txop = 0;
2492         cmd->cmd.tx.tx_flags = tx_flags;
2493         cmd->cmd.tx.next_frame_len = 0;
2494 }
2495
2496 /**
2497  * iwl3945_get_sta_id - Find station's index within station table
2498  */
2499 static int iwl3945_get_sta_id(struct iwl3945_priv *priv, struct ieee80211_hdr *hdr)
2500 {
2501         int sta_id;
2502         u16 fc = le16_to_cpu(hdr->frame_control);
2503
2504         /* If this frame is broadcast or management, use broadcast station id */
2505         if (((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) ||
2506             is_multicast_ether_addr(hdr->addr1))
2507                 return priv->hw_setting.bcast_sta_id;
2508
2509         switch (priv->iw_mode) {
2510
2511         /* If we are a client station in a BSS network, use the special
2512          * AP station entry (that's the only station we communicate with) */
2513         case IEEE80211_IF_TYPE_STA:
2514                 return IWL_AP_ID;
2515
2516         /* If we are an AP, then find the station, or use BCAST */
2517         case IEEE80211_IF_TYPE_AP:
2518                 sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
2519                 if (sta_id != IWL_INVALID_STATION)
2520                         return sta_id;
2521                 return priv->hw_setting.bcast_sta_id;
2522
2523         /* If this frame is going out to an IBSS network, find the station,
2524          * or create a new station table entry */
2525         case IEEE80211_IF_TYPE_IBSS: {
2526                 DECLARE_MAC_BUF(mac);
2527
2528                 /* Create new station table entry */
2529                 sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
2530                 if (sta_id != IWL_INVALID_STATION)
2531                         return sta_id;
2532
2533                 sta_id = iwl3945_add_station(priv, hdr->addr1, 0, CMD_ASYNC);
2534
2535                 if (sta_id != IWL_INVALID_STATION)
2536                         return sta_id;
2537
2538                 IWL_DEBUG_DROP("Station %s not in station map. "
2539                                "Defaulting to broadcast...\n",
2540                                print_mac(mac, hdr->addr1));
2541                 iwl3945_print_hex_dump(IWL_DL_DROP, (u8 *) hdr, sizeof(*hdr));
2542                 return priv->hw_setting.bcast_sta_id;
2543         }
2544         default:
2545                 IWL_WARNING("Unknown mode of operation: %d", priv->iw_mode);
2546                 return priv->hw_setting.bcast_sta_id;
2547         }
2548 }
2549
2550 /*
2551  * start REPLY_TX command process
2552  */
2553 static int iwl3945_tx_skb(struct iwl3945_priv *priv,
2554                       struct sk_buff *skb, struct ieee80211_tx_control *ctl)
2555 {
2556         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2557         struct iwl3945_tfd_frame *tfd;
2558         u32 *control_flags;
2559         int txq_id = ctl->queue;
2560         struct iwl3945_tx_queue *txq = NULL;
2561         struct iwl3945_queue *q = NULL;
2562         dma_addr_t phys_addr;
2563         dma_addr_t txcmd_phys;
2564         struct iwl3945_cmd *out_cmd = NULL;
2565         u16 len, idx, len_org;
2566         u8 id, hdr_len, unicast;
2567         u8 sta_id;
2568         u16 seq_number = 0;
2569         u16 fc;
2570         __le16 *qc;
2571         u8 wait_write_ptr = 0;
2572         unsigned long flags;
2573         int rc;
2574
2575         spin_lock_irqsave(&priv->lock, flags);
2576         if (iwl3945_is_rfkill(priv)) {
2577                 IWL_DEBUG_DROP("Dropping - RF KILL\n");
2578                 goto drop_unlock;
2579         }
2580
2581         if (!priv->vif) {
2582                 IWL_DEBUG_DROP("Dropping - !priv->vif\n");
2583                 goto drop_unlock;
2584         }
2585
2586         if ((ctl->tx_rate->hw_value & 0xFF) == IWL_INVALID_RATE) {
2587                 IWL_ERROR("ERROR: No TX rate available.\n");
2588                 goto drop_unlock;
2589         }
2590
2591         unicast = !is_multicast_ether_addr(hdr->addr1);
2592         id = 0;
2593
2594         fc = le16_to_cpu(hdr->frame_control);
2595
2596 #ifdef CONFIG_IWL3945_DEBUG
2597         if (ieee80211_is_auth(fc))
2598                 IWL_DEBUG_TX("Sending AUTH frame\n");
2599         else if (ieee80211_is_assoc_request(fc))
2600                 IWL_DEBUG_TX("Sending ASSOC frame\n");
2601         else if (ieee80211_is_reassoc_request(fc))
2602                 IWL_DEBUG_TX("Sending REASSOC frame\n");
2603 #endif
2604
2605         /* drop all data frame if we are not associated */
2606         if ((!iwl3945_is_associated(priv) ||
2607              ((priv->iw_mode == IEEE80211_IF_TYPE_STA) && !priv->assoc_id)) &&
2608             ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)) {
2609                 IWL_DEBUG_DROP("Dropping - !iwl3945_is_associated\n");
2610                 goto drop_unlock;
2611         }
2612
2613         spin_unlock_irqrestore(&priv->lock, flags);
2614
2615         hdr_len = ieee80211_get_hdrlen(fc);
2616
2617         /* Find (or create) index into station table for destination station */
2618         sta_id = iwl3945_get_sta_id(priv, hdr);
2619         if (sta_id == IWL_INVALID_STATION) {
2620                 DECLARE_MAC_BUF(mac);
2621
2622                 IWL_DEBUG_DROP("Dropping - INVALID STATION: %s\n",
2623                                print_mac(mac, hdr->addr1));
2624                 goto drop;
2625         }
2626
2627         IWL_DEBUG_RATE("station Id %d\n", sta_id);
2628
2629         qc = ieee80211_get_qos_ctrl(hdr);
2630         if (qc) {
2631                 u8 tid = (u8)(le16_to_cpu(*qc) & 0xf);
2632                 seq_number = priv->stations[sta_id].tid[tid].seq_number &
2633                                 IEEE80211_SCTL_SEQ;
2634                 hdr->seq_ctrl = cpu_to_le16(seq_number) |
2635                         (hdr->seq_ctrl &
2636                                 __constant_cpu_to_le16(IEEE80211_SCTL_FRAG));
2637                 seq_number += 0x10;
2638         }
2639
2640         /* Descriptor for chosen Tx queue */
2641         txq = &priv->txq[txq_id];
2642         q = &txq->q;
2643
2644         spin_lock_irqsave(&priv->lock, flags);
2645
2646         /* Set up first empty TFD within this queue's circular TFD buffer */
2647         tfd = &txq->bd[q->write_ptr];
2648         memset(tfd, 0, sizeof(*tfd));
2649         control_flags = (u32 *) tfd;
2650         idx = get_cmd_index(q, q->write_ptr, 0);
2651
2652         /* Set up driver data for this TFD */
2653         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl3945_tx_info));
2654         txq->txb[q->write_ptr].skb[0] = skb;
2655         memcpy(&(txq->txb[q->write_ptr].status.control),
2656                ctl, sizeof(struct ieee80211_tx_control));
2657
2658         /* Init first empty entry in queue's array of Tx/cmd buffers */
2659         out_cmd = &txq->cmd[idx];
2660         memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
2661         memset(&out_cmd->cmd.tx, 0, sizeof(out_cmd->cmd.tx));
2662
2663         /*
2664          * Set up the Tx-command (not MAC!) header.
2665          * Store the chosen Tx queue and TFD index within the sequence field;
2666          * after Tx, uCode's Tx response will return this value so driver can
2667          * locate the frame within the tx queue and do post-tx processing.
2668          */
2669         out_cmd->hdr.cmd = REPLY_TX;
2670         out_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
2671                                 INDEX_TO_SEQ(q->write_ptr)));
2672
2673         /* Copy MAC header from skb into command buffer */
2674         memcpy(out_cmd->cmd.tx.hdr, hdr, hdr_len);
2675
2676         /*
2677          * Use the first empty entry in this queue's command buffer array
2678          * to contain the Tx command and MAC header concatenated together
2679          * (payload data will be in another buffer).
2680          * Size of this varies, due to varying MAC header length.
2681          * If end is not dword aligned, we'll have 2 extra bytes at the end
2682          * of the MAC header (device reads on dword boundaries).
2683          * We'll tell device about this padding later.
2684          */
2685         len = priv->hw_setting.tx_cmd_len +
2686                 sizeof(struct iwl3945_cmd_header) + hdr_len;
2687
2688         len_org = len;
2689         len = (len + 3) & ~3;
2690
2691         if (len_org != len)
2692                 len_org = 1;
2693         else
2694                 len_org = 0;
2695
2696         /* Physical address of this Tx command's header (not MAC header!),
2697          * within command buffer array. */
2698         txcmd_phys = txq->dma_addr_cmd + sizeof(struct iwl3945_cmd) * idx +
2699                      offsetof(struct iwl3945_cmd, hdr);
2700
2701         /* Add buffer containing Tx command and MAC(!) header to TFD's
2702          * first entry */
2703         iwl3945_hw_txq_attach_buf_to_tfd(priv, tfd, txcmd_phys, len);
2704
2705         if (!(ctl->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT))
2706                 iwl3945_build_tx_cmd_hwcrypto(priv, ctl, out_cmd, skb, 0);
2707
2708         /* Set up TFD's 2nd entry to point directly to remainder of skb,
2709          * if any (802.11 null frames have no payload). */
2710         len = skb->len - hdr_len;
2711         if (len) {
2712                 phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
2713                                            len, PCI_DMA_TODEVICE);
2714                 iwl3945_hw_txq_attach_buf_to_tfd(priv, tfd, phys_addr, len);
2715         }
2716
2717         if (!len)
2718                 /* If there is no payload, then we use only one Tx buffer */
2719                 *control_flags = TFD_CTL_COUNT_SET(1);
2720         else
2721                 /* Else use 2 buffers.
2722                  * Tell 3945 about any padding after MAC header */
2723                 *control_flags = TFD_CTL_COUNT_SET(2) |
2724                         TFD_CTL_PAD_SET(U32_PAD(len));
2725
2726         /* Total # bytes to be transmitted */
2727         len = (u16)skb->len;
2728         out_cmd->cmd.tx.len = cpu_to_le16(len);
2729
2730         /* TODO need this for burst mode later on */
2731         iwl3945_build_tx_cmd_basic(priv, out_cmd, ctl, hdr, unicast, sta_id);
2732
2733         /* set is_hcca to 0; it probably will never be implemented */
2734         iwl3945_hw_build_tx_cmd_rate(priv, out_cmd, ctl, hdr, sta_id, 0);
2735
2736         out_cmd->cmd.tx.tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
2737         out_cmd->cmd.tx.tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
2738
2739         if (!ieee80211_get_morefrag(hdr)) {
2740                 txq->need_update = 1;
2741                 if (qc) {
2742                         u8 tid = (u8)(le16_to_cpu(*qc) & 0xf);
2743                         priv->stations[sta_id].tid[tid].seq_number = seq_number;
2744                 }
2745         } else {
2746                 wait_write_ptr = 1;
2747                 txq->need_update = 0;
2748         }
2749
2750         iwl3945_print_hex_dump(IWL_DL_TX, out_cmd->cmd.payload,
2751                            sizeof(out_cmd->cmd.tx));
2752
2753         iwl3945_print_hex_dump(IWL_DL_TX, (u8 *)out_cmd->cmd.tx.hdr,
2754                            ieee80211_get_hdrlen(fc));
2755
2756         /* Tell device the write index *just past* this latest filled TFD */
2757         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
2758         rc = iwl3945_tx_queue_update_write_ptr(priv, txq);
2759         spin_unlock_irqrestore(&priv->lock, flags);
2760
2761         if (rc)
2762                 return rc;
2763
2764         if ((iwl3945_queue_space(q) < q->high_mark)
2765             && priv->mac80211_registered) {
2766                 if (wait_write_ptr) {
2767                         spin_lock_irqsave(&priv->lock, flags);
2768                         txq->need_update = 1;
2769                         iwl3945_tx_queue_update_write_ptr(priv, txq);
2770                         spin_unlock_irqrestore(&priv->lock, flags);
2771                 }
2772
2773                 ieee80211_stop_queue(priv->hw, ctl->queue);
2774         }
2775
2776         return 0;
2777
2778 drop_unlock:
2779         spin_unlock_irqrestore(&priv->lock, flags);
2780 drop:
2781         return -1;
2782 }
2783
2784 static void iwl3945_set_rate(struct iwl3945_priv *priv)
2785 {
2786         const struct ieee80211_supported_band *sband = NULL;
2787         struct ieee80211_rate *rate;
2788         int i;
2789
2790         sband = iwl3945_get_band(priv, priv->band);
2791         if (!sband) {
2792                 IWL_ERROR("Failed to set rate: unable to get hw mode\n");
2793                 return;
2794         }
2795
2796         priv->active_rate = 0;
2797         priv->active_rate_basic = 0;
2798
2799         IWL_DEBUG_RATE("Setting rates for %s GHz\n",
2800                        sband->band == IEEE80211_BAND_2GHZ ? "2.4" : "5");
2801
2802         for (i = 0; i < sband->n_bitrates; i++) {
2803                 rate = &sband->bitrates[i];
2804                 if ((rate->hw_value < IWL_RATE_COUNT) &&
2805                     !(rate->flags & IEEE80211_CHAN_DISABLED)) {
2806                         IWL_DEBUG_RATE("Adding rate index %d (plcp %d)\n",
2807                                        rate->hw_value, iwl3945_rates[rate->hw_value].plcp);
2808                         priv->active_rate |= (1 << rate->hw_value);
2809                 }
2810         }
2811
2812         IWL_DEBUG_RATE("Set active_rate = %0x, active_rate_basic = %0x\n",
2813                        priv->active_rate, priv->active_rate_basic);
2814
2815         /*
2816          * If a basic rate is configured, then use it (adding IWL_RATE_1M_MASK)
2817          * otherwise set it to the default of all CCK rates and 6, 12, 24 for
2818          * OFDM
2819          */
2820         if (priv->active_rate_basic & IWL_CCK_BASIC_RATES_MASK)
2821                 priv->staging_rxon.cck_basic_rates =
2822                     ((priv->active_rate_basic &
2823                       IWL_CCK_RATES_MASK) >> IWL_FIRST_CCK_RATE) & 0xF;
2824         else
2825                 priv->staging_rxon.cck_basic_rates =
2826                     (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
2827
2828         if (priv->active_rate_basic & IWL_OFDM_BASIC_RATES_MASK)
2829                 priv->staging_rxon.ofdm_basic_rates =
2830                     ((priv->active_rate_basic &
2831                       (IWL_OFDM_BASIC_RATES_MASK | IWL_RATE_6M_MASK)) >>
2832                       IWL_FIRST_OFDM_RATE) & 0xFF;
2833         else
2834                 priv->staging_rxon.ofdm_basic_rates =
2835                    (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
2836 }
2837
2838 static void iwl3945_radio_kill_sw(struct iwl3945_priv *priv, int disable_radio)
2839 {
2840         unsigned long flags;
2841
2842         if (!!disable_radio == test_bit(STATUS_RF_KILL_SW, &priv->status))
2843                 return;
2844
2845         IWL_DEBUG_RF_KILL("Manual SW RF KILL set to: RADIO %s\n",
2846                           disable_radio ? "OFF" : "ON");
2847
2848         if (disable_radio) {
2849                 iwl3945_scan_cancel(priv);
2850                 /* FIXME: This is a workaround for AP */
2851                 if (priv->iw_mode != IEEE80211_IF_TYPE_AP) {
2852                         spin_lock_irqsave(&priv->lock, flags);
2853                         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_SET,
2854                                     CSR_UCODE_SW_BIT_RFKILL);
2855                         spin_unlock_irqrestore(&priv->lock, flags);
2856                         iwl3945_send_card_state(priv, CARD_STATE_CMD_DISABLE, 0);
2857                         set_bit(STATUS_RF_KILL_SW, &priv->status);
2858                 }
2859                 return;
2860         }
2861
2862         spin_lock_irqsave(&priv->lock, flags);
2863         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
2864
2865         clear_bit(STATUS_RF_KILL_SW, &priv->status);
2866         spin_unlock_irqrestore(&priv->lock, flags);
2867
2868         /* wake up ucode */
2869         msleep(10);
2870
2871         spin_lock_irqsave(&priv->lock, flags);
2872         iwl3945_read32(priv, CSR_UCODE_DRV_GP1);
2873         if (!iwl3945_grab_nic_access(priv))
2874                 iwl3945_release_nic_access(priv);
2875         spin_unlock_irqrestore(&priv->lock, flags);
2876
2877         if (test_bit(STATUS_RF_KILL_HW, &priv->status)) {
2878                 IWL_DEBUG_RF_KILL("Can not turn radio back on - "
2879                                   "disabled by HW switch\n");
2880                 return;
2881         }
2882
2883         queue_work(priv->workqueue, &priv->restart);
2884         return;
2885 }
2886
2887 void iwl3945_set_decrypted_flag(struct iwl3945_priv *priv, struct sk_buff *skb,
2888                             u32 decrypt_res, struct ieee80211_rx_status *stats)
2889 {
2890         u16 fc =
2891             le16_to_cpu(((struct ieee80211_hdr *)skb->data)->frame_control);
2892
2893         if (priv->active_rxon.filter_flags & RXON_FILTER_DIS_DECRYPT_MSK)
2894                 return;
2895
2896         if (!(fc & IEEE80211_FCTL_PROTECTED))
2897                 return;
2898
2899         IWL_DEBUG_RX("decrypt_res:0x%x\n", decrypt_res);
2900         switch (decrypt_res & RX_RES_STATUS_SEC_TYPE_MSK) {
2901         case RX_RES_STATUS_SEC_TYPE_TKIP:
2902                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
2903                     RX_RES_STATUS_BAD_ICV_MIC)
2904                         stats->flag |= RX_FLAG_MMIC_ERROR;
2905         case RX_RES_STATUS_SEC_TYPE_WEP:
2906         case RX_RES_STATUS_SEC_TYPE_CCMP:
2907                 if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_MSK) ==
2908                     RX_RES_STATUS_DECRYPT_OK) {
2909                         IWL_DEBUG_RX("hw decrypt successfully!!!\n");
2910                         stats->flag |= RX_FLAG_DECRYPTED;
2911                 }
2912                 break;
2913
2914         default:
2915                 break;
2916         }
2917 }
2918
2919 #define IWL_PACKET_RETRY_TIME HZ
2920
2921 int iwl3945_is_duplicate_packet(struct iwl3945_priv *priv, struct ieee80211_hdr *header)
2922 {
2923         u16 sc = le16_to_cpu(header->seq_ctrl);
2924         u16 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2925         u16 frag = sc & IEEE80211_SCTL_FRAG;
2926         u16 *last_seq, *last_frag;
2927         unsigned long *last_time;
2928
2929         switch (priv->iw_mode) {
2930         case IEEE80211_IF_TYPE_IBSS:{
2931                 struct list_head *p;
2932                 struct iwl3945_ibss_seq *entry = NULL;
2933                 u8 *mac = header->addr2;
2934                 int index = mac[5] & (IWL_IBSS_MAC_HASH_SIZE - 1);
2935
2936                 __list_for_each(p, &priv->ibss_mac_hash[index]) {
2937                         entry = list_entry(p, struct iwl3945_ibss_seq, list);
2938                         if (!compare_ether_addr(entry->mac, mac))
2939                                 break;
2940                 }
2941                 if (p == &priv->ibss_mac_hash[index]) {
2942                         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
2943                         if (!entry) {
2944                                 IWL_ERROR("Cannot malloc new mac entry\n");
2945                                 return 0;
2946                         }
2947                         memcpy(entry->mac, mac, ETH_ALEN);
2948                         entry->seq_num = seq;
2949                         entry->frag_num = frag;
2950                         entry->packet_time = jiffies;
2951                         list_add(&entry->list, &priv->ibss_mac_hash[index]);
2952                         return 0;
2953                 }
2954                 last_seq = &entry->seq_num;
2955                 last_frag = &entry->frag_num;
2956                 last_time = &entry->packet_time;
2957                 break;
2958         }
2959         case IEEE80211_IF_TYPE_STA:
2960                 last_seq = &priv->last_seq_num;
2961                 last_frag = &priv->last_frag_num;
2962                 last_time = &priv->last_packet_time;
2963                 break;
2964         default:
2965                 return 0;
2966         }
2967         if ((*last_seq == seq) &&
2968             time_after(*last_time + IWL_PACKET_RETRY_TIME, jiffies)) {
2969                 if (*last_frag == frag)
2970                         goto drop;
2971                 if (*last_frag + 1 != frag)
2972                         /* out-of-order fragment */
2973                         goto drop;
2974         } else
2975                 *last_seq = seq;
2976
2977         *last_frag = frag;
2978         *last_time = jiffies;
2979         return 0;
2980
2981  drop:
2982         return 1;
2983 }
2984
2985 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
2986
2987 #include "iwl-spectrum.h"
2988
2989 #define BEACON_TIME_MASK_LOW    0x00FFFFFF
2990 #define BEACON_TIME_MASK_HIGH   0xFF000000
2991 #define TIME_UNIT               1024
2992
2993 /*
2994  * extended beacon time format
2995  * time in usec will be changed into a 32-bit value in 8:24 format
2996  * the high 1 byte is the beacon counts
2997  * the lower 3 bytes is the time in usec within one beacon interval
2998  */
2999
3000 static u32 iwl3945_usecs_to_beacons(u32 usec, u32 beacon_interval)
3001 {
3002         u32 quot;
3003         u32 rem;
3004         u32 interval = beacon_interval * 1024;
3005
3006         if (!interval || !usec)
3007                 return 0;
3008
3009         quot = (usec / interval) & (BEACON_TIME_MASK_HIGH >> 24);
3010         rem = (usec % interval) & BEACON_TIME_MASK_LOW;
3011
3012         return (quot << 24) + rem;
3013 }
3014
3015 /* base is usually what we get from ucode with each received frame,
3016  * the same as HW timer counter counting down
3017  */
3018
3019 static __le32 iwl3945_add_beacon_time(u32 base, u32 addon, u32 beacon_interval)
3020 {
3021         u32 base_low = base & BEACON_TIME_MASK_LOW;
3022         u32 addon_low = addon & BEACON_TIME_MASK_LOW;
3023         u32 interval = beacon_interval * TIME_UNIT;
3024         u32 res = (base & BEACON_TIME_MASK_HIGH) +
3025             (addon & BEACON_TIME_MASK_HIGH);
3026
3027         if (base_low > addon_low)
3028                 res += base_low - addon_low;
3029         else if (base_low < addon_low) {
3030                 res += interval + base_low - addon_low;
3031                 res += (1 << 24);
3032         } else
3033                 res += (1 << 24);
3034
3035         return cpu_to_le32(res);
3036 }
3037
3038 static int iwl3945_get_measurement(struct iwl3945_priv *priv,
3039                                struct ieee80211_measurement_params *params,
3040                                u8 type)
3041 {
3042         struct iwl3945_spectrum_cmd spectrum;
3043         struct iwl3945_rx_packet *res;
3044         struct iwl3945_host_cmd cmd = {
3045                 .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
3046                 .data = (void *)&spectrum,
3047                 .meta.flags = CMD_WANT_SKB,
3048         };
3049         u32 add_time = le64_to_cpu(params->start_time);
3050         int rc;
3051         int spectrum_resp_status;
3052         int duration = le16_to_cpu(params->duration);
3053
3054         if (iwl3945_is_associated(priv))
3055                 add_time =
3056                     iwl3945_usecs_to_beacons(
3057                         le64_to_cpu(params->start_time) - priv->last_tsf,
3058                         le16_to_cpu(priv->rxon_timing.beacon_interval));
3059
3060         memset(&spectrum, 0, sizeof(spectrum));
3061
3062         spectrum.channel_count = cpu_to_le16(1);
3063         spectrum.flags =
3064             RXON_FLG_TSF2HOST_MSK | RXON_FLG_ANT_A_MSK | RXON_FLG_DIS_DIV_MSK;
3065         spectrum.filter_flags = MEASUREMENT_FILTER_FLAG;
3066         cmd.len = sizeof(spectrum);
3067         spectrum.len = cpu_to_le16(cmd.len - sizeof(spectrum.len));
3068
3069         if (iwl3945_is_associated(priv))
3070                 spectrum.start_time =
3071                     iwl3945_add_beacon_time(priv->last_beacon_time,
3072                                 add_time,
3073                                 le16_to_cpu(priv->rxon_timing.beacon_interval));
3074         else
3075                 spectrum.start_time = 0;
3076
3077         spectrum.channels[0].duration = cpu_to_le32(duration * TIME_UNIT);
3078         spectrum.channels[0].channel = params->channel;
3079         spectrum.channels[0].type = type;
3080         if (priv->active_rxon.flags & RXON_FLG_BAND_24G_MSK)
3081                 spectrum.flags |= RXON_FLG_BAND_24G_MSK |
3082                     RXON_FLG_AUTO_DETECT_MSK | RXON_FLG_TGG_PROTECT_MSK;
3083
3084         rc = iwl3945_send_cmd_sync(priv, &cmd);
3085         if (rc)
3086                 return rc;
3087
3088         res = (struct iwl3945_rx_packet *)cmd.meta.u.skb->data;
3089         if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
3090                 IWL_ERROR("Bad return from REPLY_RX_ON_ASSOC command\n");
3091                 rc = -EIO;
3092         }
3093
3094         spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
3095         switch (spectrum_resp_status) {
3096         case 0:         /* Command will be handled */
3097                 if (res->u.spectrum.id != 0xff) {
3098                         IWL_DEBUG_INFO("Replaced existing measurement: %d\n",
3099                                                 res->u.spectrum.id);
3100                         priv->measurement_status &= ~MEASUREMENT_READY;
3101                 }
3102                 priv->measurement_status |= MEASUREMENT_ACTIVE;
3103                 rc = 0;
3104                 break;
3105
3106         case 1:         /* Command will not be handled */
3107                 rc = -EAGAIN;
3108                 break;
3109         }
3110
3111         dev_kfree_skb_any(cmd.meta.u.skb);
3112
3113         return rc;
3114 }
3115 #endif
3116
3117 static void iwl3945_rx_reply_alive(struct iwl3945_priv *priv,
3118                                struct iwl3945_rx_mem_buffer *rxb)
3119 {
3120         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3121         struct iwl3945_alive_resp *palive;
3122         struct delayed_work *pwork;
3123
3124         palive = &pkt->u.alive_frame;
3125
3126         IWL_DEBUG_INFO("Alive ucode status 0x%08X revision "
3127                        "0x%01X 0x%01X\n",
3128                        palive->is_valid, palive->ver_type,
3129                        palive->ver_subtype);
3130
3131         if (palive->ver_subtype == INITIALIZE_SUBTYPE) {
3132                 IWL_DEBUG_INFO("Initialization Alive received.\n");
3133                 memcpy(&priv->card_alive_init,
3134                        &pkt->u.alive_frame,
3135                        sizeof(struct iwl3945_init_alive_resp));
3136                 pwork = &priv->init_alive_start;
3137         } else {
3138                 IWL_DEBUG_INFO("Runtime Alive received.\n");
3139                 memcpy(&priv->card_alive, &pkt->u.alive_frame,
3140                        sizeof(struct iwl3945_alive_resp));
3141                 pwork = &priv->alive_start;
3142                 iwl3945_disable_events(priv);
3143         }
3144
3145         /* We delay the ALIVE response by 5ms to
3146          * give the HW RF Kill time to activate... */
3147         if (palive->is_valid == UCODE_VALID_OK)
3148                 queue_delayed_work(priv->workqueue, pwork,
3149                                    msecs_to_jiffies(5));
3150         else
3151                 IWL_WARNING("uCode did not respond OK.\n");
3152 }
3153
3154 static void iwl3945_rx_reply_add_sta(struct iwl3945_priv *priv,
3155                                  struct iwl3945_rx_mem_buffer *rxb)
3156 {
3157         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3158
3159         IWL_DEBUG_RX("Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
3160         return;
3161 }
3162
3163 static void iwl3945_rx_reply_error(struct iwl3945_priv *priv,
3164                                struct iwl3945_rx_mem_buffer *rxb)
3165 {
3166         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3167
3168         IWL_ERROR("Error Reply type 0x%08X cmd %s (0x%02X) "
3169                 "seq 0x%04X ser 0x%08X\n",
3170                 le32_to_cpu(pkt->u.err_resp.error_type),
3171                 get_cmd_string(pkt->u.err_resp.cmd_id),
3172                 pkt->u.err_resp.cmd_id,
3173                 le16_to_cpu(pkt->u.err_resp.bad_cmd_seq_num),
3174                 le32_to_cpu(pkt->u.err_resp.error_info));
3175 }
3176
3177 #define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
3178
3179 static void iwl3945_rx_csa(struct iwl3945_priv *priv, struct iwl3945_rx_mem_buffer *rxb)
3180 {
3181         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3182         struct iwl3945_rxon_cmd *rxon = (void *)&priv->active_rxon;
3183         struct iwl3945_csa_notification *csa = &(pkt->u.csa_notif);
3184         IWL_DEBUG_11H("CSA notif: channel %d, status %d\n",
3185                       le16_to_cpu(csa->channel), le32_to_cpu(csa->status));
3186         rxon->channel = csa->channel;
3187         priv->staging_rxon.channel = csa->channel;
3188 }
3189
3190 static void iwl3945_rx_spectrum_measure_notif(struct iwl3945_priv *priv,
3191                                           struct iwl3945_rx_mem_buffer *rxb)
3192 {
3193 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
3194         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3195         struct iwl3945_spectrum_notification *report = &(pkt->u.spectrum_notif);
3196
3197         if (!report->state) {
3198                 IWL_DEBUG(IWL_DL_11H | IWL_DL_INFO,
3199                           "Spectrum Measure Notification: Start\n");
3200                 return;
3201         }
3202
3203         memcpy(&priv->measure_report, report, sizeof(*report));
3204         priv->measurement_status |= MEASUREMENT_READY;
3205 #endif
3206 }
3207
3208 static void iwl3945_rx_pm_sleep_notif(struct iwl3945_priv *priv,
3209                                   struct iwl3945_rx_mem_buffer *rxb)
3210 {
3211 #ifdef CONFIG_IWL3945_DEBUG
3212         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3213         struct iwl3945_sleep_notification *sleep = &(pkt->u.sleep_notif);
3214         IWL_DEBUG_RX("sleep mode: %d, src: %d\n",
3215                      sleep->pm_sleep_mode, sleep->pm_wakeup_src);
3216 #endif
3217 }
3218
3219 static void iwl3945_rx_pm_debug_statistics_notif(struct iwl3945_priv *priv,
3220                                              struct iwl3945_rx_mem_buffer *rxb)
3221 {
3222         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3223         IWL_DEBUG_RADIO("Dumping %d bytes of unhandled "
3224                         "notification for %s:\n",
3225                         le32_to_cpu(pkt->len), get_cmd_string(pkt->hdr.cmd));
3226         iwl3945_print_hex_dump(IWL_DL_RADIO, pkt->u.raw, le32_to_cpu(pkt->len));
3227 }
3228
3229 static void iwl3945_bg_beacon_update(struct work_struct *work)
3230 {
3231         struct iwl3945_priv *priv =
3232                 container_of(work, struct iwl3945_priv, beacon_update);
3233         struct sk_buff *beacon;
3234
3235         /* Pull updated AP beacon from mac80211. will fail if not in AP mode */
3236         beacon = ieee80211_beacon_get(priv->hw, priv->vif, NULL);
3237
3238         if (!beacon) {
3239                 IWL_ERROR("update beacon failed\n");
3240                 return;
3241         }
3242
3243         mutex_lock(&priv->mutex);
3244         /* new beacon skb is allocated every time; dispose previous.*/
3245         if (priv->ibss_beacon)
3246                 dev_kfree_skb(priv->ibss_beacon);
3247
3248         priv->ibss_beacon = beacon;
3249         mutex_unlock(&priv->mutex);
3250
3251         iwl3945_send_beacon_cmd(priv);
3252 }
3253
3254 static void iwl3945_rx_beacon_notif(struct iwl3945_priv *priv,
3255                                 struct iwl3945_rx_mem_buffer *rxb)
3256 {
3257 #ifdef CONFIG_IWL3945_DEBUG
3258         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3259         struct iwl3945_beacon_notif *beacon = &(pkt->u.beacon_status);
3260         u8 rate = beacon->beacon_notify_hdr.rate;
3261
3262         IWL_DEBUG_RX("beacon status %x retries %d iss %d "
3263                 "tsf %d %d rate %d\n",
3264                 le32_to_cpu(beacon->beacon_notify_hdr.status) & TX_STATUS_MSK,
3265                 beacon->beacon_notify_hdr.failure_frame,
3266                 le32_to_cpu(beacon->ibss_mgr_status),
3267                 le32_to_cpu(beacon->high_tsf),
3268                 le32_to_cpu(beacon->low_tsf), rate);
3269 #endif
3270
3271         if ((priv->iw_mode == IEEE80211_IF_TYPE_AP) &&
3272             (!test_bit(STATUS_EXIT_PENDING, &priv->status)))
3273                 queue_work(priv->workqueue, &priv->beacon_update);
3274 }
3275
3276 /* Service response to REPLY_SCAN_CMD (0x80) */
3277 static void iwl3945_rx_reply_scan(struct iwl3945_priv *priv,
3278                               struct iwl3945_rx_mem_buffer *rxb)
3279 {
3280 #ifdef CONFIG_IWL3945_DEBUG
3281         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3282         struct iwl3945_scanreq_notification *notif =
3283             (struct iwl3945_scanreq_notification *)pkt->u.raw;
3284
3285         IWL_DEBUG_RX("Scan request status = 0x%x\n", notif->status);
3286 #endif
3287 }
3288
3289 /* Service SCAN_START_NOTIFICATION (0x82) */
3290 static void iwl3945_rx_scan_start_notif(struct iwl3945_priv *priv,
3291                                     struct iwl3945_rx_mem_buffer *rxb)
3292 {
3293         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3294         struct iwl3945_scanstart_notification *notif =
3295             (struct iwl3945_scanstart_notification *)pkt->u.raw;
3296         priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
3297         IWL_DEBUG_SCAN("Scan start: "
3298                        "%d [802.11%s] "
3299                        "(TSF: 0x%08X:%08X) - %d (beacon timer %u)\n",
3300                        notif->channel,
3301                        notif->band ? "bg" : "a",
3302                        notif->tsf_high,
3303                        notif->tsf_low, notif->status, notif->beacon_timer);
3304 }
3305
3306 /* Service SCAN_RESULTS_NOTIFICATION (0x83) */
3307 static void iwl3945_rx_scan_results_notif(struct iwl3945_priv *priv,
3308                                       struct iwl3945_rx_mem_buffer *rxb)
3309 {
3310         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3311         struct iwl3945_scanresults_notification *notif =
3312             (struct iwl3945_scanresults_notification *)pkt->u.raw;
3313
3314         IWL_DEBUG_SCAN("Scan ch.res: "
3315                        "%d [802.11%s] "
3316                        "(TSF: 0x%08X:%08X) - %d "
3317                        "elapsed=%lu usec (%dms since last)\n",
3318                        notif->channel,
3319                        notif->band ? "bg" : "a",
3320                        le32_to_cpu(notif->tsf_high),
3321                        le32_to_cpu(notif->tsf_low),
3322                        le32_to_cpu(notif->statistics[0]),
3323                        le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf,
3324                        jiffies_to_msecs(elapsed_jiffies
3325                                         (priv->last_scan_jiffies, jiffies)));
3326
3327         priv->last_scan_jiffies = jiffies;
3328         priv->next_scan_jiffies = 0;
3329 }
3330
3331 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
3332 static void iwl3945_rx_scan_complete_notif(struct iwl3945_priv *priv,
3333                                        struct iwl3945_rx_mem_buffer *rxb)
3334 {
3335         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3336         struct iwl3945_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
3337
3338         IWL_DEBUG_SCAN("Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
3339                        scan_notif->scanned_channels,
3340                        scan_notif->tsf_low,
3341                        scan_notif->tsf_high, scan_notif->status);
3342
3343         /* The HW is no longer scanning */
3344         clear_bit(STATUS_SCAN_HW, &priv->status);
3345
3346         /* The scan completion notification came in, so kill that timer... */
3347         cancel_delayed_work(&priv->scan_check);
3348
3349         IWL_DEBUG_INFO("Scan pass on %sGHz took %dms\n",
3350                        (priv->scan_bands == 2) ? "2.4" : "5.2",
3351                        jiffies_to_msecs(elapsed_jiffies
3352                                         (priv->scan_pass_start, jiffies)));
3353
3354         /* Remove this scanned band from the list
3355          * of pending bands to scan */
3356         priv->scan_bands--;
3357
3358         /* If a request to abort was given, or the scan did not succeed
3359          * then we reset the scan state machine and terminate,
3360          * re-queuing another scan if one has been requested */
3361         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
3362                 IWL_DEBUG_INFO("Aborted scan completed.\n");
3363                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
3364         } else {
3365                 /* If there are more bands on this scan pass reschedule */
3366                 if (priv->scan_bands > 0)
3367                         goto reschedule;
3368         }
3369
3370         priv->last_scan_jiffies = jiffies;
3371         priv->next_scan_jiffies = 0;
3372         IWL_DEBUG_INFO("Setting scan to off\n");
3373
3374         clear_bit(STATUS_SCANNING, &priv->status);
3375
3376         IWL_DEBUG_INFO("Scan took %dms\n",
3377                 jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
3378
3379         queue_work(priv->workqueue, &priv->scan_completed);
3380
3381         return;
3382
3383 reschedule:
3384         priv->scan_pass_start = jiffies;
3385         queue_work(priv->workqueue, &priv->request_scan);
3386 }
3387
3388 /* Handle notification from uCode that card's power state is changing
3389  * due to software, hardware, or critical temperature RFKILL */
3390 static void iwl3945_rx_card_state_notif(struct iwl3945_priv *priv,
3391                                     struct iwl3945_rx_mem_buffer *rxb)
3392 {
3393         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
3394         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
3395         unsigned long status = priv->status;
3396
3397         IWL_DEBUG_RF_KILL("Card state received: HW:%s SW:%s\n",
3398                           (flags & HW_CARD_DISABLED) ? "Kill" : "On",
3399                           (flags & SW_CARD_DISABLED) ? "Kill" : "On");
3400
3401         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_SET,
3402                     CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
3403
3404         if (flags & HW_CARD_DISABLED)
3405                 set_bit(STATUS_RF_KILL_HW, &priv->status);
3406         else
3407                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
3408
3409
3410         if (flags & SW_CARD_DISABLED)
3411                 set_bit(STATUS_RF_KILL_SW, &priv->status);
3412         else
3413                 clear_bit(STATUS_RF_KILL_SW, &priv->status);
3414
3415         iwl3945_scan_cancel(priv);
3416
3417         if ((test_bit(STATUS_RF_KILL_HW, &status) !=
3418              test_bit(STATUS_RF_KILL_HW, &priv->status)) ||
3419             (test_bit(STATUS_RF_KILL_SW, &status) !=
3420              test_bit(STATUS_RF_KILL_SW, &priv->status)))
3421                 queue_work(priv->workqueue, &priv->rf_kill);
3422         else
3423                 wake_up_interruptible(&priv->wait_command_queue);
3424 }
3425
3426 /**
3427  * iwl3945_setup_rx_handlers - Initialize Rx handler callbacks
3428  *
3429  * Setup the RX handlers for each of the reply types sent from the uCode
3430  * to the host.
3431  *
3432  * This function chains into the hardware specific files for them to setup
3433  * any hardware specific handlers as well.
3434  */
3435 static void iwl3945_setup_rx_handlers(struct iwl3945_priv *priv)
3436 {
3437         priv->rx_handlers[REPLY_ALIVE] = iwl3945_rx_reply_alive;
3438         priv->rx_handlers[REPLY_ADD_STA] = iwl3945_rx_reply_add_sta;
3439         priv->rx_handlers[REPLY_ERROR] = iwl3945_rx_reply_error;
3440         priv->rx_handlers[CHANNEL_SWITCH_NOTIFICATION] = iwl3945_rx_csa;
3441         priv->rx_handlers[SPECTRUM_MEASURE_NOTIFICATION] =
3442             iwl3945_rx_spectrum_measure_notif;
3443         priv->rx_handlers[PM_SLEEP_NOTIFICATION] = iwl3945_rx_pm_sleep_notif;
3444         priv->rx_handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
3445             iwl3945_rx_pm_debug_statistics_notif;
3446         priv->rx_handlers[BEACON_NOTIFICATION] = iwl3945_rx_beacon_notif;
3447
3448         /*
3449          * The same handler is used for both the REPLY to a discrete
3450          * statistics request from the host as well as for the periodic
3451          * statistics notifications (after received beacons) from the uCode.
3452          */
3453         priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
3454         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
3455
3456         priv->rx_handlers[REPLY_SCAN_CMD] = iwl3945_rx_reply_scan;
3457         priv->rx_handlers[SCAN_START_NOTIFICATION] = iwl3945_rx_scan_start_notif;
3458         priv->rx_handlers[SCAN_RESULTS_NOTIFICATION] =
3459             iwl3945_rx_scan_results_notif;
3460         priv->rx_handlers[SCAN_COMPLETE_NOTIFICATION] =
3461             iwl3945_rx_scan_complete_notif;
3462         priv->rx_handlers[CARD_STATE_NOTIFICATION] = iwl3945_rx_card_state_notif;
3463
3464         /* Set up hardware specific Rx handlers */
3465         iwl3945_hw_rx_handler_setup(priv);
3466 }
3467
3468 /**
3469  * iwl3945_cmd_queue_reclaim - Reclaim CMD queue entries
3470  * When FW advances 'R' index, all entries between old and new 'R' index
3471  * need to be reclaimed.
3472  */
3473 static void iwl3945_cmd_queue_reclaim(struct iwl3945_priv *priv,
3474                                       int txq_id, int index)
3475 {
3476         struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
3477         struct iwl3945_queue *q = &txq->q;
3478         int nfreed = 0;
3479
3480         if ((index >= q->n_bd) || (iwl3945_x2_queue_used(q, index) == 0)) {
3481                 IWL_ERROR("Read index for DMA queue txq id (%d), index %d, "
3482                           "is out of range [0-%d] %d %d.\n", txq_id,
3483                           index, q->n_bd, q->write_ptr, q->read_ptr);
3484                 return;
3485         }
3486
3487         for (index = iwl_queue_inc_wrap(index, q->n_bd); q->read_ptr != index;
3488                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
3489                 if (nfreed > 1) {
3490                         IWL_ERROR("HCMD skipped: index (%d) %d %d\n", index,
3491                                         q->write_ptr, q->read_ptr);
3492                         queue_work(priv->workqueue, &priv->restart);
3493                         break;
3494                 }
3495                 nfreed++;
3496         }
3497 }
3498
3499
3500 /**
3501  * iwl3945_tx_cmd_complete - Pull unused buffers off the queue and reclaim them
3502  * @rxb: Rx buffer to reclaim
3503  *
3504  * If an Rx buffer has an async callback associated with it the callback
3505  * will be executed.  The attached skb (if present) will only be freed
3506  * if the callback returns 1
3507  */
3508 static void iwl3945_tx_cmd_complete(struct iwl3945_priv *priv,
3509                                 struct iwl3945_rx_mem_buffer *rxb)
3510 {
3511         struct iwl3945_rx_packet *pkt = (struct iwl3945_rx_packet *)rxb->skb->data;
3512         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
3513         int txq_id = SEQ_TO_QUEUE(sequence);
3514         int index = SEQ_TO_INDEX(sequence);
3515         int huge = sequence & SEQ_HUGE_FRAME;
3516         int cmd_index;
3517         struct iwl3945_cmd *cmd;
3518
3519         BUG_ON(txq_id != IWL_CMD_QUEUE_NUM);
3520
3521         cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
3522         cmd = &priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
3523
3524         /* Input error checking is done when commands are added to queue. */
3525         if (cmd->meta.flags & CMD_WANT_SKB) {
3526                 cmd->meta.source->u.skb = rxb->skb;
3527                 rxb->skb = NULL;
3528         } else if (cmd->meta.u.callback &&
3529                    !cmd->meta.u.callback(priv, cmd, rxb->skb))
3530                 rxb->skb = NULL;
3531
3532         iwl3945_cmd_queue_reclaim(priv, txq_id, index);
3533
3534         if (!(cmd->meta.flags & CMD_ASYNC)) {
3535                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
3536                 wake_up_interruptible(&priv->wait_command_queue);
3537         }
3538 }
3539
3540 /************************** RX-FUNCTIONS ****************************/
3541 /*
3542  * Rx theory of operation
3543  *
3544  * The host allocates 32 DMA target addresses and passes the host address
3545  * to the firmware at register IWL_RFDS_TABLE_LOWER + N * RFD_SIZE where N is
3546  * 0 to 31
3547  *
3548  * Rx Queue Indexes
3549  * The host/firmware share two index registers for managing the Rx buffers.
3550  *
3551  * The READ index maps to the first position that the firmware may be writing
3552  * to -- the driver can read up to (but not including) this position and get
3553  * good data.
3554  * The READ index is managed by the firmware once the card is enabled.
3555  *
3556  * The WRITE index maps to the last position the driver has read from -- the
3557  * position preceding WRITE is the last slot the firmware can place a packet.
3558  *
3559  * The queue is empty (no good data) if WRITE = READ - 1, and is full if
3560  * WRITE = READ.
3561  *
3562  * During initialization, the host sets up the READ queue position to the first
3563  * INDEX position, and WRITE to the last (READ - 1 wrapped)
3564  *
3565  * When the firmware places a packet in a buffer, it will advance the READ index
3566  * and fire the RX interrupt.  The driver can then query the READ index and
3567  * process as many packets as possible, moving the WRITE index forward as it
3568  * resets the Rx queue buffers with new memory.
3569  *
3570  * The management in the driver is as follows:
3571  * + A list of pre-allocated SKBs is stored in iwl->rxq->rx_free.  When
3572  *   iwl->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
3573  *   to replenish the iwl->rxq->rx_free.
3574  * + In iwl3945_rx_replenish (scheduled) if 'processed' != 'read' then the
3575  *   iwl->rxq is replenished and the READ INDEX is updated (updating the
3576  *   'processed' and 'read' driver indexes as well)
3577  * + A received packet is processed and handed to the kernel network stack,
3578  *   detached from the iwl->rxq.  The driver 'processed' index is updated.
3579  * + The Host/Firmware iwl->rxq is replenished at tasklet time from the rx_free
3580  *   list. If there are no allocated buffers in iwl->rxq->rx_free, the READ
3581  *   INDEX is not incremented and iwl->status(RX_STALLED) is set.  If there
3582  *   were enough free buffers and RX_STALLED is set it is cleared.
3583  *
3584  *
3585  * Driver sequence:
3586  *
3587  * iwl3945_rx_queue_alloc()   Allocates rx_free
3588  * iwl3945_rx_replenish()     Replenishes rx_free list from rx_used, and calls
3589  *                            iwl3945_rx_queue_restock
3590  * iwl3945_rx_queue_restock() Moves available buffers from rx_free into Rx
3591  *                            queue, updates firmware pointers, and updates
3592  *                            the WRITE index.  If insufficient rx_free buffers
3593  *                            are available, schedules iwl3945_rx_replenish
3594  *
3595  * -- enable interrupts --
3596  * ISR - iwl3945_rx()         Detach iwl3945_rx_mem_buffers from pool up to the
3597  *                            READ INDEX, detaching the SKB from the pool.
3598  *                            Moves the packet buffer from queue to rx_used.
3599  *                            Calls iwl3945_rx_queue_restock to refill any empty
3600  *                            slots.
3601  * ...
3602  *
3603  */
3604
3605 /**
3606  * iwl3945_rx_queue_space - Return number of free slots available in queue.
3607  */
3608 static int iwl3945_rx_queue_space(const struct iwl3945_rx_queue *q)
3609 {
3610         int s = q->read - q->write;
3611         if (s <= 0)
3612                 s += RX_QUEUE_SIZE;
3613         /* keep some buffer to not confuse full and empty queue */
3614         s -= 2;
3615         if (s < 0)
3616                 s = 0;
3617         return s;
3618 }
3619
3620 /**
3621  * iwl3945_rx_queue_update_write_ptr - Update the write pointer for the RX queue
3622  */
3623 int iwl3945_rx_queue_update_write_ptr(struct iwl3945_priv *priv, struct iwl3945_rx_queue *q)
3624 {
3625         u32 reg = 0;
3626         int rc = 0;
3627         unsigned long flags;
3628
3629         spin_lock_irqsave(&q->lock, flags);
3630
3631         if (q->need_update == 0)
3632                 goto exit_unlock;
3633
3634         /* If power-saving is in use, make sure device is awake */
3635         if (test_bit(STATUS_POWER_PMI, &priv->status)) {
3636                 reg = iwl3945_read32(priv, CSR_UCODE_DRV_GP1);
3637
3638                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
3639                         iwl3945_set_bit(priv, CSR_GP_CNTRL,
3640                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
3641                         goto exit_unlock;
3642                 }
3643
3644                 rc = iwl3945_grab_nic_access(priv);
3645                 if (rc)
3646                         goto exit_unlock;
3647
3648                 /* Device expects a multiple of 8 */
3649                 iwl3945_write_direct32(priv, FH_RSCSR_CHNL0_WPTR,
3650                                      q->write & ~0x7);
3651                 iwl3945_release_nic_access(priv);
3652
3653         /* Else device is assumed to be awake */
3654         } else
3655                 /* Device expects a multiple of 8 */
3656                 iwl3945_write32(priv, FH_RSCSR_CHNL0_WPTR, q->write & ~0x7);
3657
3658
3659         q->need_update = 0;
3660
3661  exit_unlock:
3662         spin_unlock_irqrestore(&q->lock, flags);
3663         return rc;
3664 }
3665
3666 /**
3667  * iwl3945_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
3668  */
3669 static inline __le32 iwl3945_dma_addr2rbd_ptr(struct iwl3945_priv *priv,
3670                                           dma_addr_t dma_addr)
3671 {
3672         return cpu_to_le32((u32)dma_addr);
3673 }
3674
3675 /**
3676  * iwl3945_rx_queue_restock - refill RX queue from pre-allocated pool
3677  *
3678  * If there are slots in the RX queue that need to be restocked,
3679  * and we have free pre-allocated buffers, fill the ranks as much
3680  * as we can, pulling from rx_free.
3681  *
3682  * This moves the 'write' index forward to catch up with 'processed', and
3683  * also updates the memory address in the firmware to reference the new
3684  * target buffer.
3685  */
3686 static int iwl3945_rx_queue_restock(struct iwl3945_priv *priv)
3687 {
3688         struct iwl3945_rx_queue *rxq = &priv->rxq;
3689         struct list_head *element;
3690         struct iwl3945_rx_mem_buffer *rxb;
3691         unsigned long flags;
3692         int write, rc;
3693
3694         spin_lock_irqsave(&rxq->lock, flags);
3695         write = rxq->write & ~0x7;
3696         while ((iwl3945_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
3697                 /* Get next free Rx buffer, remove from free list */
3698                 element = rxq->rx_free.next;
3699                 rxb = list_entry(element, struct iwl3945_rx_mem_buffer, list);
3700                 list_del(element);
3701
3702                 /* Point to Rx buffer via next RBD in circular buffer */
3703                 rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->dma_addr);
3704                 rxq->queue[rxq->write] = rxb;
3705                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
3706                 rxq->free_count--;
3707         }
3708         spin_unlock_irqrestore(&rxq->lock, flags);
3709         /* If the pre-allocated buffer pool is dropping low, schedule to
3710          * refill it */
3711         if (rxq->free_count <= RX_LOW_WATERMARK)
3712                 queue_work(priv->workqueue, &priv->rx_replenish);
3713
3714
3715         /* If we've added more space for the firmware to place data, tell it.
3716          * Increment device's write pointer in multiples of 8. */
3717         if ((write != (rxq->write & ~0x7))
3718             || (abs(rxq->write - rxq->read) > 7)) {
3719                 spin_lock_irqsave(&rxq->lock, flags);
3720                 rxq->need_update = 1;
3721                 spin_unlock_irqrestore(&rxq->lock, flags);
3722                 rc = iwl3945_rx_queue_update_write_ptr(priv, rxq);
3723                 if (rc)
3724                         return rc;
3725         }
3726
3727         return 0;
3728 }
3729
3730 /**
3731  * iwl3945_rx_replenish - Move all used packet from rx_used to rx_free
3732  *
3733  * When moving to rx_free an SKB is allocated for the slot.
3734  *
3735  * Also restock the Rx queue via iwl3945_rx_queue_restock.
3736  * This is called as a scheduled work item (except for during initialization)
3737  */
3738 static void iwl3945_rx_allocate(struct iwl3945_priv *priv)
3739 {
3740         struct iwl3945_rx_queue *rxq = &priv->rxq;
3741         struct list_head *element;
3742         struct iwl3945_rx_mem_buffer *rxb;
3743         unsigned long flags;
3744         spin_lock_irqsave(&rxq->lock, flags);
3745         while (!list_empty(&rxq->rx_used)) {
3746                 element = rxq->rx_used.next;
3747                 rxb = list_entry(element, struct iwl3945_rx_mem_buffer, list);
3748
3749                 /* Alloc a new receive buffer */
3750                 rxb->skb =
3751                     alloc_skb(IWL_RX_BUF_SIZE, __GFP_NOWARN | GFP_ATOMIC);
3752                 if (!rxb->skb) {
3753                         if (net_ratelimit())
3754                                 printk(KERN_CRIT DRV_NAME
3755                                        ": Can not allocate SKB buffers\n");
3756                         /* We don't reschedule replenish work here -- we will
3757                          * call the restock method and if it still needs
3758                          * more buffers it will schedule replenish */
3759                         break;
3760                 }
3761
3762                 /* If radiotap head is required, reserve some headroom here.
3763                  * The physical head count is a variable rx_stats->phy_count.
3764                  * We reserve 4 bytes here. Plus these extra bytes, the
3765                  * headroom of the physical head should be enough for the
3766                  * radiotap head that iwl3945 supported. See iwl3945_rt.
3767                  */
3768                 skb_reserve(rxb->skb, 4);
3769
3770                 priv->alloc_rxb_skb++;
3771                 list_del(element);
3772
3773                 /* Get physical address of RB/SKB */
3774                 rxb->dma_addr =
3775                     pci_map_single(priv->pci_dev, rxb->skb->data,
3776                                    IWL_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3777                 list_add_tail(&rxb->list, &rxq->rx_free);
3778                 rxq->free_count++;
3779         }
3780         spin_unlock_irqrestore(&rxq->lock, flags);
3781 }
3782
3783 /*
3784  * this should be called while priv->lock is locked
3785  */
3786 static void __iwl3945_rx_replenish(void *data)
3787 {
3788         struct iwl3945_priv *priv = data;
3789
3790         iwl3945_rx_allocate(priv);
3791         iwl3945_rx_queue_restock(priv);
3792 }
3793
3794
3795 void iwl3945_rx_replenish(void *data)
3796 {
3797         struct iwl3945_priv *priv = data;
3798         unsigned long flags;
3799
3800         iwl3945_rx_allocate(priv);
3801
3802         spin_lock_irqsave(&priv->lock, flags);
3803         iwl3945_rx_queue_restock(priv);
3804         spin_unlock_irqrestore(&priv->lock, flags);
3805 }
3806
3807 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
3808  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
3809  * This free routine walks the list of POOL entries and if SKB is set to
3810  * non NULL it is unmapped and freed
3811  */
3812 static void iwl3945_rx_queue_free(struct iwl3945_priv *priv, struct iwl3945_rx_queue *rxq)
3813 {
3814         int i;
3815         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
3816                 if (rxq->pool[i].skb != NULL) {
3817                         pci_unmap_single(priv->pci_dev,
3818                                          rxq->pool[i].dma_addr,
3819                                          IWL_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3820                         dev_kfree_skb(rxq->pool[i].skb);
3821                 }
3822         }
3823
3824         pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
3825                             rxq->dma_addr);
3826         rxq->bd = NULL;
3827 }
3828
3829 int iwl3945_rx_queue_alloc(struct iwl3945_priv *priv)
3830 {
3831         struct iwl3945_rx_queue *rxq = &priv->rxq;
3832         struct pci_dev *dev = priv->pci_dev;
3833         int i;
3834
3835         spin_lock_init(&rxq->lock);
3836         INIT_LIST_HEAD(&rxq->rx_free);
3837         INIT_LIST_HEAD(&rxq->rx_used);
3838
3839         /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
3840         rxq->bd = pci_alloc_consistent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr);
3841         if (!rxq->bd)
3842                 return -ENOMEM;
3843
3844         /* Fill the rx_used queue with _all_ of the Rx buffers */
3845         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
3846                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3847
3848         /* Set us so that we have processed and used all buffers, but have
3849          * not restocked the Rx queue with fresh buffers */
3850         rxq->read = rxq->write = 0;
3851         rxq->free_count = 0;
3852         rxq->need_update = 0;
3853         return 0;
3854 }
3855
3856 void iwl3945_rx_queue_reset(struct iwl3945_priv *priv, struct iwl3945_rx_queue *rxq)
3857 {
3858         unsigned long flags;
3859         int i;
3860         spin_lock_irqsave(&rxq->lock, flags);
3861         INIT_LIST_HEAD(&rxq->rx_free);
3862         INIT_LIST_HEAD(&rxq->rx_used);
3863         /* Fill the rx_used queue with _all_ of the Rx buffers */
3864         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
3865                 /* In the reset function, these buffers may have been allocated
3866                  * to an SKB, so we need to unmap and free potential storage */
3867                 if (rxq->pool[i].skb != NULL) {
3868                         pci_unmap_single(priv->pci_dev,
3869                                          rxq->pool[i].dma_addr,
3870                                          IWL_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
3871                         priv->alloc_rxb_skb--;
3872                         dev_kfree_skb(rxq->pool[i].skb);
3873                         rxq->pool[i].skb = NULL;
3874                 }
3875                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
3876         }
3877
3878         /* Set us so that we have processed and used all buffers, but have
3879          * not restocked the Rx queue with fresh buffers */
3880         rxq->read = rxq->write = 0;
3881         rxq->free_count = 0;
3882         spin_unlock_irqrestore(&rxq->lock, flags);
3883 }
3884
3885 /* Convert linear signal-to-noise ratio into dB */
3886 static u8 ratio2dB[100] = {
3887 /*       0   1   2   3   4   5   6   7   8   9 */
3888          0,  0,  6, 10, 12, 14, 16, 17, 18, 19, /* 00 - 09 */
3889         20, 21, 22, 22, 23, 23, 24, 25, 26, 26, /* 10 - 19 */
3890         26, 26, 26, 27, 27, 28, 28, 28, 29, 29, /* 20 - 29 */
3891         29, 30, 30, 30, 31, 31, 31, 31, 32, 32, /* 30 - 39 */
3892         32, 32, 32, 33, 33, 33, 33, 33, 34, 34, /* 40 - 49 */
3893         34, 34, 34, 34, 35, 35, 35, 35, 35, 35, /* 50 - 59 */
3894         36, 36, 36, 36, 36, 36, 36, 37, 37, 37, /* 60 - 69 */
3895         37, 37, 37, 37, 37, 38, 38, 38, 38, 38, /* 70 - 79 */
3896         38, 38, 38, 38, 38, 39, 39, 39, 39, 39, /* 80 - 89 */
3897         39, 39, 39, 39, 39, 40, 40, 40, 40, 40  /* 90 - 99 */
3898 };
3899
3900 /* Calculates a relative dB value from a ratio of linear
3901  *   (i.e. not dB) signal levels.
3902  * Conversion assumes that levels are voltages (20*log), not powers (10*log). */
3903 int iwl3945_calc_db_from_ratio(int sig_ratio)
3904 {
3905         /* 1000:1 or higher just report as 60 dB */
3906         if (sig_ratio >= 1000)
3907                 return 60;
3908
3909         /* 100:1 or higher, divide by 10 and use table,
3910          *   add 20 dB to make up for divide by 10 */
3911         if (sig_ratio >= 100)
3912                 return (20 + (int)ratio2dB[sig_ratio/10]);
3913
3914         /* We shouldn't see this */
3915         if (sig_ratio < 1)
3916                 return 0;
3917
3918         /* Use table for ratios 1:1 - 99:1 */
3919         return (int)ratio2dB[sig_ratio];
3920 }
3921
3922 #define PERFECT_RSSI (-20) /* dBm */
3923 #define WORST_RSSI (-95)   /* dBm */
3924 #define RSSI_RANGE (PERFECT_RSSI - WORST_RSSI)
3925
3926 /* Calculate an indication of rx signal quality (a percentage, not dBm!).
3927  * See http://www.ces.clemson.edu/linux/signal_quality.shtml for info
3928  *   about formulas used below. */
3929 int iwl3945_calc_sig_qual(int rssi_dbm, int noise_dbm)
3930 {
3931         int sig_qual;
3932         int degradation = PERFECT_RSSI - rssi_dbm;
3933
3934         /* If we get a noise measurement, use signal-to-noise ratio (SNR)
3935          * as indicator; formula is (signal dbm - noise dbm).
3936          * SNR at or above 40 is a great signal (100%).
3937          * Below that, scale to fit SNR of 0 - 40 dB within 0 - 100% indicator.
3938          * Weakest usable signal is usually 10 - 15 dB SNR. */
3939         if (noise_dbm) {
3940                 if (rssi_dbm - noise_dbm >= 40)
3941                         return 100;
3942                 else if (rssi_dbm < noise_dbm)
3943                         return 0;
3944                 sig_qual = ((rssi_dbm - noise_dbm) * 5) / 2;
3945
3946         /* Else use just the signal level.
3947          * This formula is a least squares fit of data points collected and
3948          *   compared with a reference system that had a percentage (%) display
3949          *   for signal quality. */
3950         } else
3951                 sig_qual = (100 * (RSSI_RANGE * RSSI_RANGE) - degradation *
3952                             (15 * RSSI_RANGE + 62 * degradation)) /
3953                            (RSSI_RANGE * RSSI_RANGE);
3954
3955         if (sig_qual > 100)
3956                 sig_qual = 100;
3957         else if (sig_qual < 1)
3958                 sig_qual = 0;
3959
3960         return sig_qual;
3961 }
3962
3963 /**
3964  * iwl3945_rx_handle - Main entry function for receiving responses from uCode
3965  *
3966  * Uses the priv->rx_handlers callback function array to invoke
3967  * the appropriate handlers, including command responses,
3968  * frame-received notifications, and other notifications.
3969  */
3970 static void iwl3945_rx_handle(struct iwl3945_priv *priv)
3971 {
3972         struct iwl3945_rx_mem_buffer *rxb;
3973         struct iwl3945_rx_packet *pkt;
3974         struct iwl3945_rx_queue *rxq = &priv->rxq;
3975         u32 r, i;
3976         int reclaim;
3977         unsigned long flags;
3978         u8 fill_rx = 0;
3979         u32 count = 8;
3980
3981         /* uCode's read index (stored in shared DRAM) indicates the last Rx
3982          * buffer that the driver may process (last buffer filled by ucode). */
3983         r = iwl3945_hw_get_rx_read(priv);
3984         i = rxq->read;
3985
3986         if (iwl3945_rx_queue_space(rxq) > (RX_QUEUE_SIZE / 2))
3987                 fill_rx = 1;
3988         /* Rx interrupt, but nothing sent from uCode */
3989         if (i == r)
3990                 IWL_DEBUG(IWL_DL_RX | IWL_DL_ISR, "r = %d, i = %d\n", r, i);
3991
3992         while (i != r) {
3993                 rxb = rxq->queue[i];
3994
3995                 /* If an RXB doesn't have a Rx queue slot associated with it,
3996                  * then a bug has been introduced in the queue refilling
3997                  * routines -- catch it here */
3998                 BUG_ON(rxb == NULL);
3999
4000                 rxq->queue[i] = NULL;
4001
4002                 pci_dma_sync_single_for_cpu(priv->pci_dev, rxb->dma_addr,
4003                                             IWL_RX_BUF_SIZE,
4004                                             PCI_DMA_FROMDEVICE);
4005                 pkt = (struct iwl3945_rx_packet *)rxb->skb->data;
4006
4007                 /* Reclaim a command buffer only if this packet is a response
4008                  *   to a (driver-originated) command.
4009                  * If the packet (e.g. Rx frame) originated from uCode,
4010                  *   there is no command buffer to reclaim.
4011                  * Ucode should set SEQ_RX_FRAME bit if ucode-originated,
4012                  *   but apparently a few don't get set; catch them here. */
4013                 reclaim = !(pkt->hdr.sequence & SEQ_RX_FRAME) &&
4014                         (pkt->hdr.cmd != STATISTICS_NOTIFICATION) &&
4015                         (pkt->hdr.cmd != REPLY_TX);
4016
4017                 /* Based on type of command response or notification,
4018                  *   handle those that need handling via function in
4019                  *   rx_handlers table.  See iwl3945_setup_rx_handlers() */
4020                 if (priv->rx_handlers[pkt->hdr.cmd]) {
4021                         IWL_DEBUG(IWL_DL_HOST_COMMAND | IWL_DL_RX | IWL_DL_ISR,
4022                                 "r = %d, i = %d, %s, 0x%02x\n", r, i,
4023                                 get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
4024                         priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
4025                 } else {
4026                         /* No handling needed */
4027                         IWL_DEBUG(IWL_DL_HOST_COMMAND | IWL_DL_RX | IWL_DL_ISR,
4028                                 "r %d i %d No handler needed for %s, 0x%02x\n",
4029                                 r, i, get_cmd_string(pkt->hdr.cmd),
4030                                 pkt->hdr.cmd);
4031                 }
4032
4033                 if (reclaim) {
4034                         /* Invoke any callbacks, transfer the skb to caller, and
4035                          * fire off the (possibly) blocking iwl3945_send_cmd()
4036                          * as we reclaim the driver command queue */
4037                         if (rxb && rxb->skb)
4038                                 iwl3945_tx_cmd_complete(priv, rxb);
4039                         else
4040                                 IWL_WARNING("Claim null rxb?\n");
4041                 }
4042
4043                 /* For now we just don't re-use anything.  We can tweak this
4044                  * later to try and re-use notification packets and SKBs that
4045                  * fail to Rx correctly */
4046                 if (rxb->skb != NULL) {
4047                         priv->alloc_rxb_skb--;
4048                         dev_kfree_skb_any(rxb->skb);
4049                         rxb->skb = NULL;
4050                 }
4051
4052                 pci_unmap_single(priv->pci_dev, rxb->dma_addr,
4053                                  IWL_RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
4054                 spin_lock_irqsave(&rxq->lock, flags);
4055                 list_add_tail(&rxb->list, &priv->rxq.rx_used);
4056                 spin_unlock_irqrestore(&rxq->lock, flags);
4057                 i = (i + 1) & RX_QUEUE_MASK;
4058                 /* If there are a lot of unused frames,
4059                  * restock the Rx queue so ucode won't assert. */
4060                 if (fill_rx) {
4061                         count++;
4062                         if (count >= 8) {
4063                                 priv->rxq.read = i;
4064                                 __iwl3945_rx_replenish(priv);
4065                                 count = 0;
4066                         }
4067                 }
4068         }
4069
4070         /* Backtrack one entry */
4071         priv->rxq.read = i;
4072         iwl3945_rx_queue_restock(priv);
4073 }
4074
4075 /**
4076  * iwl3945_tx_queue_update_write_ptr - Send new write index to hardware
4077  */
4078 static int iwl3945_tx_queue_update_write_ptr(struct iwl3945_priv *priv,
4079                                   struct iwl3945_tx_queue *txq)
4080 {
4081         u32 reg = 0;
4082         int rc = 0;
4083         int txq_id = txq->q.id;
4084
4085         if (txq->need_update == 0)
4086                 return rc;
4087
4088         /* if we're trying to save power */
4089         if (test_bit(STATUS_POWER_PMI, &priv->status)) {
4090                 /* wake up nic if it's powered down ...
4091                  * uCode will wake up, and interrupt us again, so next
4092                  * time we'll skip this part. */
4093                 reg = iwl3945_read32(priv, CSR_UCODE_DRV_GP1);
4094
4095                 if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
4096                         IWL_DEBUG_INFO("Requesting wakeup, GP1 = 0x%x\n", reg);
4097                         iwl3945_set_bit(priv, CSR_GP_CNTRL,
4098                                     CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
4099                         return rc;
4100                 }
4101
4102                 /* restore this queue's parameters in nic hardware. */
4103                 rc = iwl3945_grab_nic_access(priv);
4104                 if (rc)
4105                         return rc;
4106                 iwl3945_write_direct32(priv, HBUS_TARG_WRPTR,
4107                                      txq->q.write_ptr | (txq_id << 8));
4108                 iwl3945_release_nic_access(priv);
4109
4110         /* else not in power-save mode, uCode will never sleep when we're
4111          * trying to tx (during RFKILL, we're not trying to tx). */
4112         } else
4113                 iwl3945_write32(priv, HBUS_TARG_WRPTR,
4114                             txq->q.write_ptr | (txq_id << 8));
4115
4116         txq->need_update = 0;
4117
4118         return rc;
4119 }
4120
4121 #ifdef CONFIG_IWL3945_DEBUG
4122 static void iwl3945_print_rx_config_cmd(struct iwl3945_rxon_cmd *rxon)
4123 {
4124         DECLARE_MAC_BUF(mac);
4125
4126         IWL_DEBUG_RADIO("RX CONFIG:\n");
4127         iwl3945_print_hex_dump(IWL_DL_RADIO, (u8 *) rxon, sizeof(*rxon));
4128         IWL_DEBUG_RADIO("u16 channel: 0x%x\n", le16_to_cpu(rxon->channel));
4129         IWL_DEBUG_RADIO("u32 flags: 0x%08X\n", le32_to_cpu(rxon->flags));
4130         IWL_DEBUG_RADIO("u32 filter_flags: 0x%08x\n",
4131                         le32_to_cpu(rxon->filter_flags));
4132         IWL_DEBUG_RADIO("u8 dev_type: 0x%x\n", rxon->dev_type);
4133         IWL_DEBUG_RADIO("u8 ofdm_basic_rates: 0x%02x\n",
4134                         rxon->ofdm_basic_rates);
4135         IWL_DEBUG_RADIO("u8 cck_basic_rates: 0x%02x\n", rxon->cck_basic_rates);
4136         IWL_DEBUG_RADIO("u8[6] node_addr: %s\n",
4137                         print_mac(mac, rxon->node_addr));
4138         IWL_DEBUG_RADIO("u8[6] bssid_addr: %s\n",
4139                         print_mac(mac, rxon->bssid_addr));
4140         IWL_DEBUG_RADIO("u16 assoc_id: 0x%x\n", le16_to_cpu(rxon->assoc_id));
4141 }
4142 #endif
4143
4144 static void iwl3945_enable_interrupts(struct iwl3945_priv *priv)
4145 {
4146         IWL_DEBUG_ISR("Enabling interrupts\n");
4147         set_bit(STATUS_INT_ENABLED, &priv->status);
4148         iwl3945_write32(priv, CSR_INT_MASK, CSR_INI_SET_MASK);
4149 }
4150
4151 static inline void iwl3945_disable_interrupts(struct iwl3945_priv *priv)
4152 {
4153         clear_bit(STATUS_INT_ENABLED, &priv->status);
4154
4155         /* disable interrupts from uCode/NIC to host */
4156         iwl3945_write32(priv, CSR_INT_MASK, 0x00000000);
4157
4158         /* acknowledge/clear/reset any interrupts still pending
4159          * from uCode or flow handler (Rx/Tx DMA) */
4160         iwl3945_write32(priv, CSR_INT, 0xffffffff);
4161         iwl3945_write32(priv, CSR_FH_INT_STATUS, 0xffffffff);
4162         IWL_DEBUG_ISR("Disabled interrupts\n");
4163 }
4164
4165 static const char *desc_lookup(int i)
4166 {
4167         switch (i) {
4168         case 1:
4169                 return "FAIL";
4170         case 2:
4171                 return "BAD_PARAM";
4172         case 3:
4173                 return "BAD_CHECKSUM";
4174         case 4:
4175                 return "NMI_INTERRUPT";
4176         case 5:
4177                 return "SYSASSERT";
4178         case 6:
4179                 return "FATAL_ERROR";
4180         }
4181
4182         return "UNKNOWN";
4183 }
4184
4185 #define ERROR_START_OFFSET  (1 * sizeof(u32))
4186 #define ERROR_ELEM_SIZE     (7 * sizeof(u32))
4187
4188 static void iwl3945_dump_nic_error_log(struct iwl3945_priv *priv)
4189 {
4190         u32 i;
4191         u32 desc, time, count, base, data1;
4192         u32 blink1, blink2, ilink1, ilink2;
4193         int rc;
4194
4195         base = le32_to_cpu(priv->card_alive.error_event_table_ptr);
4196
4197         if (!iwl3945_hw_valid_rtc_data_addr(base)) {
4198                 IWL_ERROR("Not valid error log pointer 0x%08X\n", base);
4199                 return;
4200         }
4201
4202         rc = iwl3945_grab_nic_access(priv);
4203         if (rc) {
4204                 IWL_WARNING("Can not read from adapter at this time.\n");
4205                 return;
4206         }
4207
4208         count = iwl3945_read_targ_mem(priv, base);
4209
4210         if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
4211                 IWL_ERROR("Start IWL Error Log Dump:\n");
4212                 IWL_ERROR("Status: 0x%08lX, count: %d\n", priv->status, count);
4213         }
4214
4215         IWL_ERROR("Desc       Time       asrtPC  blink2 "
4216                   "ilink1  nmiPC   Line\n");
4217         for (i = ERROR_START_OFFSET;
4218              i < (count * ERROR_ELEM_SIZE) + ERROR_START_OFFSET;
4219              i += ERROR_ELEM_SIZE) {
4220                 desc = iwl3945_read_targ_mem(priv, base + i);
4221                 time =
4222                     iwl3945_read_targ_mem(priv, base + i + 1 * sizeof(u32));
4223                 blink1 =
4224                     iwl3945_read_targ_mem(priv, base + i + 2 * sizeof(u32));
4225                 blink2 =
4226                     iwl3945_read_targ_mem(priv, base + i + 3 * sizeof(u32));
4227                 ilink1 =
4228                     iwl3945_read_targ_mem(priv, base + i + 4 * sizeof(u32));
4229                 ilink2 =
4230                     iwl3945_read_targ_mem(priv, base + i + 5 * sizeof(u32));
4231                 data1 =
4232                     iwl3945_read_targ_mem(priv, base + i + 6 * sizeof(u32));
4233
4234                 IWL_ERROR
4235                     ("%-13s (#%d) %010u 0x%05X 0x%05X 0x%05X 0x%05X %u\n\n",
4236                      desc_lookup(desc), desc, time, blink1, blink2,
4237                      ilink1, ilink2, data1);
4238         }
4239
4240         iwl3945_release_nic_access(priv);
4241
4242 }
4243
4244 #define EVENT_START_OFFSET  (6 * sizeof(u32))
4245
4246 /**
4247  * iwl3945_print_event_log - Dump error event log to syslog
4248  *
4249  * NOTE: Must be called with iwl3945_grab_nic_access() already obtained!
4250  */
4251 static void iwl3945_print_event_log(struct iwl3945_priv *priv, u32 start_idx,
4252                                 u32 num_events, u32 mode)
4253 {
4254         u32 i;
4255         u32 base;       /* SRAM byte address of event log header */
4256         u32 event_size; /* 2 u32s, or 3 u32s if timestamp recorded */
4257         u32 ptr;        /* SRAM byte address of log data */
4258         u32 ev, time, data; /* event log data */
4259
4260         if (num_events == 0)
4261                 return;
4262
4263         base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
4264
4265         if (mode == 0)
4266                 event_size = 2 * sizeof(u32);
4267         else
4268                 event_size = 3 * sizeof(u32);
4269
4270         ptr = base + EVENT_START_OFFSET + (start_idx * event_size);
4271
4272         /* "time" is actually "data" for mode 0 (no timestamp).
4273          * place event id # at far right for easier visual parsing. */
4274         for (i = 0; i < num_events; i++) {
4275                 ev = iwl3945_read_targ_mem(priv, ptr);
4276                 ptr += sizeof(u32);
4277                 time = iwl3945_read_targ_mem(priv, ptr);
4278                 ptr += sizeof(u32);
4279                 if (mode == 0)
4280                         IWL_ERROR("0x%08x\t%04u\n", time, ev); /* data, ev */
4281                 else {
4282                         data = iwl3945_read_targ_mem(priv, ptr);
4283                         ptr += sizeof(u32);
4284                         IWL_ERROR("%010u\t0x%08x\t%04u\n", time, data, ev);
4285                 }
4286         }
4287 }
4288
4289 static void iwl3945_dump_nic_event_log(struct iwl3945_priv *priv)
4290 {
4291         int rc;
4292         u32 base;       /* SRAM byte address of event log header */
4293         u32 capacity;   /* event log capacity in # entries */
4294         u32 mode;       /* 0 - no timestamp, 1 - timestamp recorded */
4295         u32 num_wraps;  /* # times uCode wrapped to top of log */
4296         u32 next_entry; /* index of next entry to be written by uCode */
4297         u32 size;       /* # entries that we'll print */
4298
4299         base = le32_to_cpu(priv->card_alive.log_event_table_ptr);
4300         if (!iwl3945_hw_valid_rtc_data_addr(base)) {
4301                 IWL_ERROR("Invalid event log pointer 0x%08X\n", base);
4302                 return;
4303         }
4304
4305         rc = iwl3945_grab_nic_access(priv);
4306         if (rc) {
4307                 IWL_WARNING("Can not read from adapter at this time.\n");
4308                 return;
4309         }
4310
4311         /* event log header */
4312         capacity = iwl3945_read_targ_mem(priv, base);
4313         mode = iwl3945_read_targ_mem(priv, base + (1 * sizeof(u32)));
4314         num_wraps = iwl3945_read_targ_mem(priv, base + (2 * sizeof(u32)));
4315         next_entry = iwl3945_read_targ_mem(priv, base + (3 * sizeof(u32)));
4316
4317         size = num_wraps ? capacity : next_entry;
4318
4319         /* bail out if nothing in log */
4320         if (size == 0) {
4321                 IWL_ERROR("Start IWL Event Log Dump: nothing in log\n");
4322                 iwl3945_release_nic_access(priv);
4323                 return;
4324         }
4325
4326         IWL_ERROR("Start IWL Event Log Dump: display count %d, wraps %d\n",
4327                   size, num_wraps);
4328
4329         /* if uCode has wrapped back to top of log, start at the oldest entry,
4330          * i.e the next one that uCode would fill. */
4331         if (num_wraps)
4332                 iwl3945_print_event_log(priv, next_entry,
4333                                     capacity - next_entry, mode);
4334
4335         /* (then/else) start at top of log */
4336         iwl3945_print_event_log(priv, 0, next_entry, mode);
4337
4338         iwl3945_release_nic_access(priv);
4339 }
4340
4341 /**
4342  * iwl3945_irq_handle_error - called for HW or SW error interrupt from card
4343  */
4344 static void iwl3945_irq_handle_error(struct iwl3945_priv *priv)
4345 {
4346         /* Set the FW error flag -- cleared on iwl3945_down */
4347         set_bit(STATUS_FW_ERROR, &priv->status);
4348
4349         /* Cancel currently queued command. */
4350         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
4351
4352 #ifdef CONFIG_IWL3945_DEBUG
4353         if (iwl3945_debug_level & IWL_DL_FW_ERRORS) {
4354                 iwl3945_dump_nic_error_log(priv);
4355                 iwl3945_dump_nic_event_log(priv);
4356                 iwl3945_print_rx_config_cmd(&priv->staging_rxon);
4357         }
4358 #endif
4359
4360         wake_up_interruptible(&priv->wait_command_queue);
4361
4362         /* Keep the restart process from trying to send host
4363          * commands by clearing the INIT status bit */
4364         clear_bit(STATUS_READY, &priv->status);
4365
4366         if (!test_bit(STATUS_EXIT_PENDING, &priv->status)) {
4367                 IWL_DEBUG(IWL_DL_INFO | IWL_DL_FW_ERRORS,
4368                           "Restarting adapter due to uCode error.\n");
4369
4370                 if (iwl3945_is_associated(priv)) {
4371                         memcpy(&priv->recovery_rxon, &priv->active_rxon,
4372                                sizeof(priv->recovery_rxon));
4373                         priv->error_recovering = 1;
4374                 }
4375                 queue_work(priv->workqueue, &priv->restart);
4376         }
4377 }
4378
4379 static void iwl3945_error_recovery(struct iwl3945_priv *priv)
4380 {
4381         unsigned long flags;
4382
4383         memcpy(&priv->staging_rxon, &priv->recovery_rxon,
4384                sizeof(priv->staging_rxon));
4385         priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
4386         iwl3945_commit_rxon(priv);
4387
4388         iwl3945_add_station(priv, priv->bssid, 1, 0);
4389
4390         spin_lock_irqsave(&priv->lock, flags);
4391         priv->assoc_id = le16_to_cpu(priv->staging_rxon.assoc_id);
4392         priv->error_recovering = 0;
4393         spin_unlock_irqrestore(&priv->lock, flags);
4394 }
4395
4396 static void iwl3945_irq_tasklet(struct iwl3945_priv *priv)
4397 {
4398         u32 inta, handled = 0;
4399         u32 inta_fh;
4400         unsigned long flags;
4401 #ifdef CONFIG_IWL3945_DEBUG
4402         u32 inta_mask;
4403 #endif
4404
4405         spin_lock_irqsave(&priv->lock, flags);
4406
4407         /* Ack/clear/reset pending uCode interrupts.
4408          * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
4409          *  and will clear only when CSR_FH_INT_STATUS gets cleared. */
4410         inta = iwl3945_read32(priv, CSR_INT);
4411         iwl3945_write32(priv, CSR_INT, inta);
4412
4413         /* Ack/clear/reset pending flow-handler (DMA) interrupts.
4414          * Any new interrupts that happen after this, either while we're
4415          * in this tasklet, or later, will show up in next ISR/tasklet. */
4416         inta_fh = iwl3945_read32(priv, CSR_FH_INT_STATUS);
4417         iwl3945_write32(priv, CSR_FH_INT_STATUS, inta_fh);
4418
4419 #ifdef CONFIG_IWL3945_DEBUG
4420         if (iwl3945_debug_level & IWL_DL_ISR) {
4421                 /* just for debug */
4422                 inta_mask = iwl3945_read32(priv, CSR_INT_MASK);
4423                 IWL_DEBUG_ISR("inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
4424                               inta, inta_mask, inta_fh);
4425         }
4426 #endif
4427
4428         /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
4429          * atomic, make sure that inta covers all the interrupts that
4430          * we've discovered, even if FH interrupt came in just after
4431          * reading CSR_INT. */
4432         if (inta_fh & CSR39_FH_INT_RX_MASK)
4433                 inta |= CSR_INT_BIT_FH_RX;
4434         if (inta_fh & CSR39_FH_INT_TX_MASK)
4435                 inta |= CSR_INT_BIT_FH_TX;
4436
4437         /* Now service all interrupt bits discovered above. */
4438         if (inta & CSR_INT_BIT_HW_ERR) {
4439                 IWL_ERROR("Microcode HW error detected.  Restarting.\n");
4440
4441                 /* Tell the device to stop sending interrupts */
4442                 iwl3945_disable_interrupts(priv);
4443
4444                 iwl3945_irq_handle_error(priv);
4445
4446                 handled |= CSR_INT_BIT_HW_ERR;
4447
4448                 spin_unlock_irqrestore(&priv->lock, flags);
4449
4450                 return;
4451         }
4452
4453 #ifdef CONFIG_IWL3945_DEBUG
4454         if (iwl3945_debug_level & (IWL_DL_ISR)) {
4455                 /* NIC fires this, but we don't use it, redundant with WAKEUP */
4456                 if (inta & CSR_INT_BIT_SCD)
4457                         IWL_DEBUG_ISR("Scheduler finished to transmit "
4458                                       "the frame/frames.\n");
4459
4460                 /* Alive notification via Rx interrupt will do the real work */
4461                 if (inta & CSR_INT_BIT_ALIVE)
4462                         IWL_DEBUG_ISR("Alive interrupt\n");
4463         }
4464 #endif
4465         /* Safely ignore these bits for debug checks below */
4466         inta &= ~(CSR_INT_BIT_SCD | CSR_INT_BIT_ALIVE);
4467
4468         /* HW RF KILL switch toggled (4965 only) */
4469         if (inta & CSR_INT_BIT_RF_KILL) {
4470                 int hw_rf_kill = 0;
4471                 if (!(iwl3945_read32(priv, CSR_GP_CNTRL) &
4472                                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW))
4473                         hw_rf_kill = 1;
4474
4475                 IWL_DEBUG(IWL_DL_INFO | IWL_DL_RF_KILL | IWL_DL_ISR,
4476                                 "RF_KILL bit toggled to %s.\n",
4477                                 hw_rf_kill ? "disable radio":"enable radio");
4478
4479                 /* Queue restart only if RF_KILL switch was set to "kill"
4480                  *   when we loaded driver, and is now set to "enable".
4481                  * After we're Alive, RF_KILL gets handled by
4482                  *   iwl3945_rx_card_state_notif() */
4483                 if (!hw_rf_kill && !test_bit(STATUS_ALIVE, &priv->status)) {
4484                         clear_bit(STATUS_RF_KILL_HW, &priv->status);
4485                         queue_work(priv->workqueue, &priv->restart);
4486                 }
4487
4488                 handled |= CSR_INT_BIT_RF_KILL;
4489         }
4490
4491         /* Chip got too hot and stopped itself (4965 only) */
4492         if (inta & CSR_INT_BIT_CT_KILL) {
4493                 IWL_ERROR("Microcode CT kill error detected.\n");
4494                 handled |= CSR_INT_BIT_CT_KILL;
4495         }
4496
4497         /* Error detected by uCode */
4498         if (inta & CSR_INT_BIT_SW_ERR) {
4499                 IWL_ERROR("Microcode SW error detected.  Restarting 0x%X.\n",
4500                           inta);
4501                 iwl3945_irq_handle_error(priv);
4502                 handled |= CSR_INT_BIT_SW_ERR;
4503         }
4504
4505         /* uCode wakes up after power-down sleep */
4506         if (inta & CSR_INT_BIT_WAKEUP) {
4507                 IWL_DEBUG_ISR("Wakeup interrupt\n");
4508                 iwl3945_rx_queue_update_write_ptr(priv, &priv->rxq);
4509                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[0]);
4510                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[1]);
4511                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[2]);
4512                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[3]);
4513                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[4]);
4514                 iwl3945_tx_queue_update_write_ptr(priv, &priv->txq[5]);
4515
4516                 handled |= CSR_INT_BIT_WAKEUP;
4517         }
4518
4519         /* All uCode command responses, including Tx command responses,
4520          * Rx "responses" (frame-received notification), and other
4521          * notifications from uCode come through here*/
4522         if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
4523                 iwl3945_rx_handle(priv);
4524                 handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
4525         }
4526
4527         if (inta & CSR_INT_BIT_FH_TX) {
4528                 IWL_DEBUG_ISR("Tx interrupt\n");
4529
4530                 iwl3945_write32(priv, CSR_FH_INT_STATUS, (1 << 6));
4531                 if (!iwl3945_grab_nic_access(priv)) {
4532                         iwl3945_write_direct32(priv,
4533                                              FH_TCSR_CREDIT
4534                                              (ALM_FH_SRVC_CHNL), 0x0);
4535                         iwl3945_release_nic_access(priv);
4536                 }
4537                 handled |= CSR_INT_BIT_FH_TX;
4538         }
4539
4540         if (inta & ~handled)
4541                 IWL_ERROR("Unhandled INTA bits 0x%08x\n", inta & ~handled);
4542
4543         if (inta & ~CSR_INI_SET_MASK) {
4544                 IWL_WARNING("Disabled INTA bits 0x%08x were pending\n",
4545                          inta & ~CSR_INI_SET_MASK);
4546                 IWL_WARNING("   with FH_INT = 0x%08x\n", inta_fh);
4547         }
4548
4549         /* Re-enable all interrupts */
4550         iwl3945_enable_interrupts(priv);
4551
4552 #ifdef CONFIG_IWL3945_DEBUG
4553         if (iwl3945_debug_level & (IWL_DL_ISR)) {
4554                 inta = iwl3945_read32(priv, CSR_INT);
4555                 inta_mask = iwl3945_read32(priv, CSR_INT_MASK);
4556                 inta_fh = iwl3945_read32(priv, CSR_FH_INT_STATUS);
4557                 IWL_DEBUG_ISR("End inta 0x%08x, enabled 0x%08x, fh 0x%08x, "
4558                         "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
4559         }
4560 #endif
4561         spin_unlock_irqrestore(&priv->lock, flags);
4562 }
4563
4564 static irqreturn_t iwl3945_isr(int irq, void *data)
4565 {
4566         struct iwl3945_priv *priv = data;
4567         u32 inta, inta_mask;
4568         u32 inta_fh;
4569         if (!priv)
4570                 return IRQ_NONE;
4571
4572         spin_lock(&priv->lock);
4573
4574         /* Disable (but don't clear!) interrupts here to avoid
4575          *    back-to-back ISRs and sporadic interrupts from our NIC.
4576          * If we have something to service, the tasklet will re-enable ints.
4577          * If we *don't* have something, we'll re-enable before leaving here. */
4578         inta_mask = iwl3945_read32(priv, CSR_INT_MASK);  /* just for debug */
4579         iwl3945_write32(priv, CSR_INT_MASK, 0x00000000);
4580
4581         /* Discover which interrupts are active/pending */
4582         inta = iwl3945_read32(priv, CSR_INT);
4583         inta_fh = iwl3945_read32(priv, CSR_FH_INT_STATUS);
4584
4585         /* Ignore interrupt if there's nothing in NIC to service.
4586          * This may be due to IRQ shared with another device,
4587          * or due to sporadic interrupts thrown from our NIC. */
4588         if (!inta && !inta_fh) {
4589                 IWL_DEBUG_ISR("Ignore interrupt, inta == 0, inta_fh == 0\n");
4590                 goto none;
4591         }
4592
4593         if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
4594                 /* Hardware disappeared */
4595                 IWL_WARNING("HARDWARE GONE?? INTA == 0x%080x\n", inta);
4596                 goto unplugged;
4597         }
4598
4599         IWL_DEBUG_ISR("ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
4600                       inta, inta_mask, inta_fh);
4601
4602         inta &= ~CSR_INT_BIT_SCD;
4603
4604         /* iwl3945_irq_tasklet() will service interrupts and re-enable them */
4605         if (likely(inta || inta_fh))
4606                 tasklet_schedule(&priv->irq_tasklet);
4607 unplugged:
4608         spin_unlock(&priv->lock);
4609
4610         return IRQ_HANDLED;
4611
4612  none:
4613         /* re-enable interrupts here since we don't have anything to service. */
4614         iwl3945_enable_interrupts(priv);
4615         spin_unlock(&priv->lock);
4616         return IRQ_NONE;
4617 }
4618
4619 /************************** EEPROM BANDS ****************************
4620  *
4621  * The iwl3945_eeprom_band definitions below provide the mapping from the
4622  * EEPROM contents to the specific channel number supported for each
4623  * band.
4624  *
4625  * For example, iwl3945_priv->eeprom.band_3_channels[4] from the band_3
4626  * definition below maps to physical channel 42 in the 5.2GHz spectrum.
4627  * The specific geography and calibration information for that channel
4628  * is contained in the eeprom map itself.
4629  *
4630  * During init, we copy the eeprom information and channel map
4631  * information into priv->channel_info_24/52 and priv->channel_map_24/52
4632  *
4633  * channel_map_24/52 provides the index in the channel_info array for a
4634  * given channel.  We have to have two separate maps as there is channel
4635  * overlap with the 2.4GHz and 5.2GHz spectrum as seen in band_1 and
4636  * band_2
4637  *
4638  * A value of 0xff stored in the channel_map indicates that the channel
4639  * is not supported by the hardware at all.
4640  *
4641  * A value of 0xfe in the channel_map indicates that the channel is not
4642  * valid for Tx with the current hardware.  This means that
4643  * while the system can tune and receive on a given channel, it may not
4644  * be able to associate or transmit any frames on that
4645  * channel.  There is no corresponding channel information for that
4646  * entry.
4647  *
4648  *********************************************************************/
4649
4650 /* 2.4 GHz */
4651 static const u8 iwl3945_eeprom_band_1[14] = {
4652         1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
4653 };
4654
4655 /* 5.2 GHz bands */
4656 static const u8 iwl3945_eeprom_band_2[] = {     /* 4915-5080MHz */
4657         183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16
4658 };
4659
4660 static const u8 iwl3945_eeprom_band_3[] = {     /* 5170-5320MHz */
4661         34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
4662 };
4663
4664 static const u8 iwl3945_eeprom_band_4[] = {     /* 5500-5700MHz */
4665         100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
4666 };
4667
4668 static const u8 iwl3945_eeprom_band_5[] = {     /* 5725-5825MHz */
4669         145, 149, 153, 157, 161, 165
4670 };
4671
4672 static void iwl3945_init_band_reference(const struct iwl3945_priv *priv, int band,
4673                                     int *eeprom_ch_count,
4674                                     const struct iwl3945_eeprom_channel
4675                                     **eeprom_ch_info,
4676                                     const u8 **eeprom_ch_index)
4677 {
4678         switch (band) {
4679         case 1:         /* 2.4GHz band */
4680                 *eeprom_ch_count = ARRAY_SIZE(iwl3945_eeprom_band_1);
4681                 *eeprom_ch_info = priv->eeprom.band_1_channels;
4682                 *eeprom_ch_index = iwl3945_eeprom_band_1;
4683                 break;
4684         case 2:         /* 4.9GHz band */
4685                 *eeprom_ch_count = ARRAY_SIZE(iwl3945_eeprom_band_2);
4686                 *eeprom_ch_info = priv->eeprom.band_2_channels;
4687                 *eeprom_ch_index = iwl3945_eeprom_band_2;
4688                 break;
4689         case 3:         /* 5.2GHz band */
4690                 *eeprom_ch_count = ARRAY_SIZE(iwl3945_eeprom_band_3);
4691                 *eeprom_ch_info = priv->eeprom.band_3_channels;
4692                 *eeprom_ch_index = iwl3945_eeprom_band_3;
4693                 break;
4694         case 4:         /* 5.5GHz band */
4695                 *eeprom_ch_count = ARRAY_SIZE(iwl3945_eeprom_band_4);
4696                 *eeprom_ch_info = priv->eeprom.band_4_channels;
4697                 *eeprom_ch_index = iwl3945_eeprom_band_4;
4698                 break;
4699         case 5:         /* 5.7GHz band */
4700                 *eeprom_ch_count = ARRAY_SIZE(iwl3945_eeprom_band_5);
4701                 *eeprom_ch_info = priv->eeprom.band_5_channels;
4702                 *eeprom_ch_index = iwl3945_eeprom_band_5;
4703                 break;
4704         default:
4705                 BUG();
4706                 return;
4707         }
4708 }
4709
4710 /**
4711  * iwl3945_get_channel_info - Find driver's private channel info
4712  *
4713  * Based on band and channel number.
4714  */
4715 const struct iwl3945_channel_info *iwl3945_get_channel_info(const struct iwl3945_priv *priv,
4716                                                     enum ieee80211_band band, u16 channel)
4717 {
4718         int i;
4719
4720         switch (band) {
4721         case IEEE80211_BAND_5GHZ:
4722                 for (i = 14; i < priv->channel_count; i++) {
4723                         if (priv->channel_info[i].channel == channel)
4724                                 return &priv->channel_info[i];
4725                 }
4726                 break;
4727
4728         case IEEE80211_BAND_2GHZ:
4729                 if (channel >= 1 && channel <= 14)
4730                         return &priv->channel_info[channel - 1];
4731                 break;
4732         case IEEE80211_NUM_BANDS:
4733                 WARN_ON(1);
4734         }
4735
4736         return NULL;
4737 }
4738
4739 #define CHECK_AND_PRINT(x) ((eeprom_ch_info[ch].flags & EEPROM_CHANNEL_##x) \
4740                             ? # x " " : "")
4741
4742 /**
4743  * iwl3945_init_channel_map - Set up driver's info for all possible channels
4744  */
4745 static int iwl3945_init_channel_map(struct iwl3945_priv *priv)
4746 {
4747         int eeprom_ch_count = 0;
4748         const u8 *eeprom_ch_index = NULL;
4749         const struct iwl3945_eeprom_channel *eeprom_ch_info = NULL;
4750         int band, ch;
4751         struct iwl3945_channel_info *ch_info;
4752
4753         if (priv->channel_count) {
4754                 IWL_DEBUG_INFO("Channel map already initialized.\n");
4755                 return 0;
4756         }
4757
4758         if (priv->eeprom.version < 0x2f) {
4759                 IWL_WARNING("Unsupported EEPROM version: 0x%04X\n",
4760                             priv->eeprom.version);
4761                 return -EINVAL;
4762         }
4763
4764         IWL_DEBUG_INFO("Initializing regulatory info from EEPROM\n");
4765
4766         priv->channel_count =
4767             ARRAY_SIZE(iwl3945_eeprom_band_1) +
4768             ARRAY_SIZE(iwl3945_eeprom_band_2) +
4769             ARRAY_SIZE(iwl3945_eeprom_band_3) +
4770             ARRAY_SIZE(iwl3945_eeprom_band_4) +
4771             ARRAY_SIZE(iwl3945_eeprom_band_5);
4772
4773         IWL_DEBUG_INFO("Parsing data for %d channels.\n", priv->channel_count);
4774
4775         priv->channel_info = kzalloc(sizeof(struct iwl3945_channel_info) *
4776                                      priv->channel_count, GFP_KERNEL);
4777         if (!priv->channel_info) {
4778                 IWL_ERROR("Could not allocate channel_info\n");
4779                 priv->channel_count = 0;
4780                 return -ENOMEM;
4781         }
4782
4783         ch_info = priv->channel_info;
4784
4785         /* Loop through the 5 EEPROM bands adding them in order to the
4786          * channel map we maintain (that contains additional information than
4787          * what just in the EEPROM) */
4788         for (band = 1; band <= 5; band++) {
4789
4790                 iwl3945_init_band_reference(priv, band, &eeprom_ch_count,
4791                                         &eeprom_ch_info, &eeprom_ch_index);
4792
4793                 /* Loop through each band adding each of the channels */
4794                 for (ch = 0; ch < eeprom_ch_count; ch++) {
4795                         ch_info->channel = eeprom_ch_index[ch];
4796                         ch_info->band = (band == 1) ? IEEE80211_BAND_2GHZ :
4797                             IEEE80211_BAND_5GHZ;
4798
4799                         /* permanently store EEPROM's channel regulatory flags
4800                          *   and max power in channel info database. */
4801                         ch_info->eeprom = eeprom_ch_info[ch];
4802
4803                         /* Copy the run-time flags so they are there even on
4804                          * invalid channels */
4805                         ch_info->flags = eeprom_ch_info[ch].flags;
4806
4807                         if (!(is_channel_valid(ch_info))) {
4808                                 IWL_DEBUG_INFO("Ch. %d Flags %x [%sGHz] - "
4809                                                "No traffic\n",
4810                                                ch_info->channel,
4811                                                ch_info->flags,
4812                                                is_channel_a_band(ch_info) ?
4813                                                "5.2" : "2.4");
4814                                 ch_info++;
4815                                 continue;
4816                         }
4817
4818                         /* Initialize regulatory-based run-time data */
4819                         ch_info->max_power_avg = ch_info->curr_txpow =
4820                             eeprom_ch_info[ch].max_power_avg;
4821                         ch_info->scan_power = eeprom_ch_info[ch].max_power_avg;
4822                         ch_info->min_power = 0;
4823
4824                         IWL_DEBUG_INFO("Ch. %d [%sGHz] %s%s%s%s%s%s%s(0x%02x"
4825                                        " %ddBm): Ad-Hoc %ssupported\n",
4826                                        ch_info->channel,
4827                                        is_channel_a_band(ch_info) ?
4828                                        "5.2" : "2.4",
4829                                        CHECK_AND_PRINT(VALID),
4830                                        CHECK_AND_PRINT(IBSS),
4831                                        CHECK_AND_PRINT(ACTIVE),
4832                                        CHECK_AND_PRINT(RADAR),
4833                                        CHECK_AND_PRINT(WIDE),
4834                                        CHECK_AND_PRINT(NARROW),
4835                                        CHECK_AND_PRINT(DFS),
4836                                        eeprom_ch_info[ch].flags,
4837                                        eeprom_ch_info[ch].max_power_avg,
4838                                        ((eeprom_ch_info[ch].
4839                                          flags & EEPROM_CHANNEL_IBSS)
4840                                         && !(eeprom_ch_info[ch].
4841                                              flags & EEPROM_CHANNEL_RADAR))
4842                                        ? "" : "not ");
4843
4844                         /* Set the user_txpower_limit to the highest power
4845                          * supported by any channel */
4846                         if (eeprom_ch_info[ch].max_power_avg >
4847                             priv->user_txpower_limit)
4848                                 priv->user_txpower_limit =
4849                                     eeprom_ch_info[ch].max_power_avg;
4850
4851                         ch_info++;
4852                 }
4853         }
4854
4855         /* Set up txpower settings in driver for all channels */
4856         if (iwl3945_txpower_set_from_eeprom(priv))
4857                 return -EIO;
4858
4859         return 0;
4860 }
4861
4862 /*
4863  * iwl3945_free_channel_map - undo allocations in iwl3945_init_channel_map
4864  */
4865 static void iwl3945_free_channel_map(struct iwl3945_priv *priv)
4866 {
4867         kfree(priv->channel_info);
4868         priv->channel_count = 0;
4869 }
4870
4871 /* For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
4872  * sending probe req.  This should be set long enough to hear probe responses
4873  * from more than one AP.  */
4874 #define IWL_ACTIVE_DWELL_TIME_24    (20)        /* all times in msec */
4875 #define IWL_ACTIVE_DWELL_TIME_52    (10)
4876
4877 /* For faster active scanning, scan will move to the next channel if fewer than
4878  * PLCP_QUIET_THRESH packets are heard on this channel within
4879  * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
4880  * time if it's a quiet channel (nothing responded to our probe, and there's
4881  * no other traffic).
4882  * Disable "quiet" feature by setting PLCP_QUIET_THRESH to 0. */
4883 #define IWL_PLCP_QUIET_THRESH       __constant_cpu_to_le16(1)   /* packets */
4884 #define IWL_ACTIVE_QUIET_TIME       __constant_cpu_to_le16(5)   /* msec */
4885
4886 /* For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
4887  * Must be set longer than active dwell time.
4888  * For the most reliable scan, set > AP beacon interval (typically 100msec). */
4889 #define IWL_PASSIVE_DWELL_TIME_24   (20)        /* all times in msec */
4890 #define IWL_PASSIVE_DWELL_TIME_52   (10)
4891 #define IWL_PASSIVE_DWELL_BASE      (100)
4892 #define IWL_CHANNEL_TUNE_TIME       5
4893
4894 static inline u16 iwl3945_get_active_dwell_time(struct iwl3945_priv *priv,
4895                                                 enum ieee80211_band band)
4896 {
4897         if (band == IEEE80211_BAND_5GHZ)
4898                 return IWL_ACTIVE_DWELL_TIME_52;
4899         else
4900                 return IWL_ACTIVE_DWELL_TIME_24;
4901 }
4902
4903 static u16 iwl3945_get_passive_dwell_time(struct iwl3945_priv *priv,
4904                                           enum ieee80211_band band)
4905 {
4906         u16 active = iwl3945_get_active_dwell_time(priv, band);
4907         u16 passive = (band == IEEE80211_BAND_2GHZ) ?
4908             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_24 :
4909             IWL_PASSIVE_DWELL_BASE + IWL_PASSIVE_DWELL_TIME_52;
4910
4911         if (iwl3945_is_associated(priv)) {
4912                 /* If we're associated, we clamp the maximum passive
4913                  * dwell time to be 98% of the beacon interval (minus
4914                  * 2 * channel tune time) */
4915                 passive = priv->beacon_int;
4916                 if ((passive > IWL_PASSIVE_DWELL_BASE) || !passive)
4917                         passive = IWL_PASSIVE_DWELL_BASE;
4918                 passive = (passive * 98) / 100 - IWL_CHANNEL_TUNE_TIME * 2;
4919         }
4920
4921         if (passive <= active)
4922                 passive = active + 1;
4923
4924         return passive;
4925 }
4926
4927 static int iwl3945_get_channels_for_scan(struct iwl3945_priv *priv,
4928                                          enum ieee80211_band band,
4929                                      u8 is_active, u8 direct_mask,
4930                                      struct iwl3945_scan_channel *scan_ch)
4931 {
4932         const struct ieee80211_channel *channels = NULL;
4933         const struct ieee80211_supported_band *sband;
4934         const struct iwl3945_channel_info *ch_info;
4935         u16 passive_dwell = 0;
4936         u16 active_dwell = 0;
4937         int added, i;
4938
4939         sband = iwl3945_get_band(priv, band);
4940         if (!sband)
4941                 return 0;
4942
4943         channels = sband->channels;
4944
4945         active_dwell = iwl3945_get_active_dwell_time(priv, band);
4946         passive_dwell = iwl3945_get_passive_dwell_time(priv, band);
4947
4948         for (i = 0, added = 0; i < sband->n_channels; i++) {
4949                 if (channels[i].hw_value ==
4950                     le16_to_cpu(priv->active_rxon.channel)) {
4951                         if (iwl3945_is_associated(priv)) {
4952                                 IWL_DEBUG_SCAN
4953                                     ("Skipping current channel %d\n",
4954                                      le16_to_cpu(priv->active_rxon.channel));
4955                                 continue;
4956                         }
4957                 } else if (priv->only_active_channel)
4958                         continue;
4959
4960                 scan_ch->channel = channels[i].hw_value;
4961
4962                 ch_info = iwl3945_get_channel_info(priv, band, scan_ch->channel);
4963                 if (!is_channel_valid(ch_info)) {
4964                         IWL_DEBUG_SCAN("Channel %d is INVALID for this SKU.\n",
4965                                        scan_ch->channel);
4966                         continue;
4967                 }
4968
4969                 if (!is_active || is_channel_passive(ch_info) ||
4970                     (channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
4971                         scan_ch->type = 0;      /* passive */
4972                 else
4973                         scan_ch->type = 1;      /* active */
4974
4975                 if (scan_ch->type & 1)
4976                         scan_ch->type |= (direct_mask << 1);
4977
4978                 if (is_channel_narrow(ch_info))
4979                         scan_ch->type |= (1 << 7);
4980
4981                 scan_ch->active_dwell = cpu_to_le16(active_dwell);
4982                 scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
4983
4984                 /* Set txpower levels to defaults */
4985                 scan_ch->tpc.dsp_atten = 110;
4986                 /* scan_pwr_info->tpc.dsp_atten; */
4987
4988                 /*scan_pwr_info->tpc.tx_gain; */
4989                 if (band == IEEE80211_BAND_5GHZ)
4990                         scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
4991                 else {
4992                         scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
4993                         /* NOTE: if we were doing 6Mb OFDM for scans we'd use
4994                          * power level:
4995                          * scan_ch->tpc.tx_gain = ((1 << 5) | (2 << 3)) | 3;
4996                          */
4997                 }
4998
4999                 IWL_DEBUG_SCAN("Scanning %d [%s %d]\n",
5000                                scan_ch->channel,
5001                                (scan_ch->type & 1) ? "ACTIVE" : "PASSIVE",
5002                                (scan_ch->type & 1) ?
5003                                active_dwell : passive_dwell);
5004
5005                 scan_ch++;
5006                 added++;
5007         }
5008
5009         IWL_DEBUG_SCAN("total channels to scan %d \n", added);
5010         return added;
5011 }
5012
5013 static void iwl3945_init_hw_rates(struct iwl3945_priv *priv,
5014                               struct ieee80211_rate *rates)
5015 {
5016         int i;
5017
5018         for (i = 0; i < IWL_RATE_COUNT; i++) {
5019                 rates[i].bitrate = iwl3945_rates[i].ieee * 5;
5020                 rates[i].hw_value = i; /* Rate scaling will work on indexes */
5021                 rates[i].hw_value_short = i;
5022                 rates[i].flags = 0;
5023                 if ((i > IWL_LAST_OFDM_RATE) || (i < IWL_FIRST_OFDM_RATE)) {
5024                         /*
5025                          * If CCK != 1M then set short preamble rate flag.
5026                          */
5027                         rates[i].flags |= (iwl3945_rates[i].plcp == 10) ?
5028                                 0 : IEEE80211_RATE_SHORT_PREAMBLE;
5029                 }
5030         }
5031 }
5032
5033 /**
5034  * iwl3945_init_geos - Initialize mac80211's geo/channel info based from eeprom
5035  */
5036 static int iwl3945_init_geos(struct iwl3945_priv *priv)
5037 {
5038         struct iwl3945_channel_info *ch;
5039         struct ieee80211_supported_band *sband;
5040         struct ieee80211_channel *channels;
5041         struct ieee80211_channel *geo_ch;
5042         struct ieee80211_rate *rates;
5043         int i = 0;
5044
5045         if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
5046             priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
5047                 IWL_DEBUG_INFO("Geography modes already initialized.\n");
5048                 set_bit(STATUS_GEO_CONFIGURED, &priv->status);
5049                 return 0;
5050         }
5051
5052         channels = kzalloc(sizeof(struct ieee80211_channel) *
5053                            priv->channel_count, GFP_KERNEL);
5054         if (!channels)
5055                 return -ENOMEM;
5056
5057         rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_RATE_COUNT + 1)),
5058                         GFP_KERNEL);
5059         if (!rates) {
5060                 kfree(channels);
5061                 return -ENOMEM;
5062         }
5063
5064         /* 5.2GHz channels start after the 2.4GHz channels */
5065         sband = &priv->bands[IEEE80211_BAND_5GHZ];
5066         sband->channels = &channels[ARRAY_SIZE(iwl3945_eeprom_band_1)];
5067         /* just OFDM */
5068         sband->bitrates = &rates[IWL_FIRST_OFDM_RATE];
5069         sband->n_bitrates = IWL_RATE_COUNT - IWL_FIRST_OFDM_RATE;
5070
5071         sband = &priv->bands[IEEE80211_BAND_2GHZ];
5072         sband->channels = channels;
5073         /* OFDM & CCK */
5074         sband->bitrates = rates;
5075         sband->n_bitrates = IWL_RATE_COUNT;
5076
5077         priv->ieee_channels = channels;
5078         priv->ieee_rates = rates;
5079
5080         iwl3945_init_hw_rates(priv, rates);
5081
5082         for (i = 0;  i < priv->channel_count; i++) {
5083                 ch = &priv->channel_info[i];
5084
5085                 /* FIXME: might be removed if scan is OK*/
5086                 if (!is_channel_valid(ch))
5087                         continue;
5088
5089                 if (is_channel_a_band(ch))
5090                         sband =  &priv->bands[IEEE80211_BAND_5GHZ];
5091                 else
5092                         sband =  &priv->bands[IEEE80211_BAND_2GHZ];
5093
5094                 geo_ch = &sband->channels[sband->n_channels++];
5095
5096                 geo_ch->center_freq = ieee80211_channel_to_frequency(ch->channel);
5097                 geo_ch->max_power = ch->max_power_avg;
5098                 geo_ch->max_antenna_gain = 0xff;
5099                 geo_ch->hw_value = ch->channel;
5100
5101                 if (is_channel_valid(ch)) {
5102                         if (!(ch->flags & EEPROM_CHANNEL_IBSS))
5103                                 geo_ch->flags |= IEEE80211_CHAN_NO_IBSS;
5104
5105                         if (!(ch->flags & EEPROM_CHANNEL_ACTIVE))
5106                                 geo_ch->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
5107
5108                         if (ch->flags & EEPROM_CHANNEL_RADAR)
5109                                 geo_ch->flags |= IEEE80211_CHAN_RADAR;
5110
5111                         if (ch->max_power_avg > priv->max_channel_txpower_limit)
5112                                 priv->max_channel_txpower_limit =
5113                                     ch->max_power_avg;
5114                 } else {
5115                         geo_ch->flags |= IEEE80211_CHAN_DISABLED;
5116                 }
5117
5118                 /* Save flags for reg domain usage */
5119                 geo_ch->orig_flags = geo_ch->flags;
5120
5121                 IWL_DEBUG_INFO("Channel %d Freq=%d[%sGHz] %s flag=0%X\n",
5122                                 ch->channel, geo_ch->center_freq,
5123                                 is_channel_a_band(ch) ?  "5.2" : "2.4",
5124                                 geo_ch->flags & IEEE80211_CHAN_DISABLED ?
5125                                 "restricted" : "valid",
5126                                  geo_ch->flags);
5127         }
5128
5129         if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
5130              priv->cfg->sku & IWL_SKU_A) {
5131                 printk(KERN_INFO DRV_NAME
5132                        ": Incorrectly detected BG card as ABG.  Please send "
5133                        "your PCI ID 0x%04X:0x%04X to maintainer.\n",
5134                        priv->pci_dev->device, priv->pci_dev->subsystem_device);
5135                  priv->cfg->sku &= ~IWL_SKU_A;
5136         }
5137
5138         printk(KERN_INFO DRV_NAME
5139                ": Tunable channels: %d 802.11bg, %d 802.11a channels\n",
5140                priv->bands[IEEE80211_BAND_2GHZ].n_channels,
5141                priv->bands[IEEE80211_BAND_5GHZ].n_channels);
5142
5143         if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
5144                 priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
5145                         &priv->bands[IEEE80211_BAND_2GHZ];
5146         if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
5147                 priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
5148                         &priv->bands[IEEE80211_BAND_5GHZ];
5149
5150         set_bit(STATUS_GEO_CONFIGURED, &priv->status);
5151
5152         return 0;
5153 }
5154
5155 /*
5156  * iwl3945_free_geos - undo allocations in iwl3945_init_geos
5157  */
5158 static void iwl3945_free_geos(struct iwl3945_priv *priv)
5159 {
5160         kfree(priv->ieee_channels);
5161         kfree(priv->ieee_rates);
5162         clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
5163 }
5164
5165 /******************************************************************************
5166  *
5167  * uCode download functions
5168  *
5169  ******************************************************************************/
5170
5171 static void iwl3945_dealloc_ucode_pci(struct iwl3945_priv *priv)
5172 {
5173         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_code);
5174         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_data);
5175         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
5176         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_init);
5177         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_init_data);
5178         iwl_free_fw_desc(priv->pci_dev, &priv->ucode_boot);
5179 }
5180
5181 /**
5182  * iwl3945_verify_inst_full - verify runtime uCode image in card vs. host,
5183  *     looking at all data.
5184  */
5185 static int iwl3945_verify_inst_full(struct iwl3945_priv *priv, __le32 * image, u32 len)
5186 {
5187         u32 val;
5188         u32 save_len = len;
5189         int rc = 0;
5190         u32 errcnt;
5191
5192         IWL_DEBUG_INFO("ucode inst image size is %u\n", len);
5193
5194         rc = iwl3945_grab_nic_access(priv);
5195         if (rc)
5196                 return rc;
5197
5198         iwl3945_write_direct32(priv, HBUS_TARG_MEM_RADDR, RTC_INST_LOWER_BOUND);
5199
5200         errcnt = 0;
5201         for (; len > 0; len -= sizeof(u32), image++) {
5202                 /* read data comes through single port, auto-incr addr */
5203                 /* NOTE: Use the debugless read so we don't flood kernel log
5204                  * if IWL_DL_IO is set */
5205                 val = _iwl3945_read_direct32(priv, HBUS_TARG_MEM_RDAT);
5206                 if (val != le32_to_cpu(*image)) {
5207                         IWL_ERROR("uCode INST section is invalid at "
5208                                   "offset 0x%x, is 0x%x, s/b 0x%x\n",
5209                                   save_len - len, val, le32_to_cpu(*image));
5210                         rc = -EIO;
5211                         errcnt++;
5212                         if (errcnt >= 20)
5213                                 break;
5214                 }
5215         }
5216
5217         iwl3945_release_nic_access(priv);
5218
5219         if (!errcnt)
5220                 IWL_DEBUG_INFO("ucode image in INSTRUCTION memory is good\n");
5221
5222         return rc;
5223 }
5224
5225
5226 /**
5227  * iwl3945_verify_inst_sparse - verify runtime uCode image in card vs. host,
5228  *   using sample data 100 bytes apart.  If these sample points are good,
5229  *   it's a pretty good bet that everything between them is good, too.
5230  */
5231 static int iwl3945_verify_inst_sparse(struct iwl3945_priv *priv, __le32 *image, u32 len)
5232 {
5233         u32 val;
5234         int rc = 0;
5235         u32 errcnt = 0;
5236         u32 i;
5237
5238         IWL_DEBUG_INFO("ucode inst image size is %u\n", len);
5239
5240         rc = iwl3945_grab_nic_access(priv);
5241         if (rc)
5242                 return rc;
5243
5244         for (i = 0; i < len; i += 100, image += 100/sizeof(u32)) {
5245                 /* read data comes through single port, auto-incr addr */
5246                 /* NOTE: Use the debugless read so we don't flood kernel log
5247                  * if IWL_DL_IO is set */
5248                 iwl3945_write_direct32(priv, HBUS_TARG_MEM_RADDR,
5249                         i + RTC_INST_LOWER_BOUND);
5250                 val = _iwl3945_read_direct32(priv, HBUS_TARG_MEM_RDAT);
5251                 if (val != le32_to_cpu(*image)) {
5252 #if 0 /* Enable this if you want to see details */
5253                         IWL_ERROR("uCode INST section is invalid at "
5254                                   "offset 0x%x, is 0x%x, s/b 0x%x\n",
5255                                   i, val, *image);
5256 #endif
5257                         rc = -EIO;
5258                         errcnt++;
5259                         if (errcnt >= 3)
5260                                 break;
5261                 }
5262         }
5263
5264         iwl3945_release_nic_access(priv);
5265
5266         return rc;
5267 }
5268
5269
5270 /**
5271  * iwl3945_verify_ucode - determine which instruction image is in SRAM,
5272  *    and verify its contents
5273  */
5274 static int iwl3945_verify_ucode(struct iwl3945_priv *priv)
5275 {
5276         __le32 *image;
5277         u32 len;
5278         int rc = 0;
5279
5280         /* Try bootstrap */
5281         image = (__le32 *)priv->ucode_boot.v_addr;
5282         len = priv->ucode_boot.len;
5283         rc = iwl3945_verify_inst_sparse(priv, image, len);
5284         if (rc == 0) {
5285                 IWL_DEBUG_INFO("Bootstrap uCode is good in inst SRAM\n");
5286                 return 0;
5287         }
5288
5289         /* Try initialize */
5290         image = (__le32 *)priv->ucode_init.v_addr;
5291         len = priv->ucode_init.len;
5292         rc = iwl3945_verify_inst_sparse(priv, image, len);
5293         if (rc == 0) {
5294                 IWL_DEBUG_INFO("Initialize uCode is good in inst SRAM\n");
5295                 return 0;
5296         }
5297
5298         /* Try runtime/protocol */
5299         image = (__le32 *)priv->ucode_code.v_addr;
5300         len = priv->ucode_code.len;
5301         rc = iwl3945_verify_inst_sparse(priv, image, len);
5302         if (rc == 0) {
5303                 IWL_DEBUG_INFO("Runtime uCode is good in inst SRAM\n");
5304                 return 0;
5305         }
5306
5307         IWL_ERROR("NO VALID UCODE IMAGE IN INSTRUCTION SRAM!!\n");
5308
5309         /* Since nothing seems to match, show first several data entries in
5310          * instruction SRAM, so maybe visual inspection will give a clue.
5311          * Selection of bootstrap image (vs. other images) is arbitrary. */
5312         image = (__le32 *)priv->ucode_boot.v_addr;
5313         len = priv->ucode_boot.len;
5314         rc = iwl3945_verify_inst_full(priv, image, len);
5315
5316         return rc;
5317 }
5318
5319
5320 /* check contents of special bootstrap uCode SRAM */
5321 static int iwl3945_verify_bsm(struct iwl3945_priv *priv)
5322 {
5323         __le32 *image = priv->ucode_boot.v_addr;
5324         u32 len = priv->ucode_boot.len;
5325         u32 reg;
5326         u32 val;
5327
5328         IWL_DEBUG_INFO("Begin verify bsm\n");
5329
5330         /* verify BSM SRAM contents */
5331         val = iwl3945_read_prph(priv, BSM_WR_DWCOUNT_REG);
5332         for (reg = BSM_SRAM_LOWER_BOUND;
5333              reg < BSM_SRAM_LOWER_BOUND + len;
5334              reg += sizeof(u32), image ++) {
5335                 val = iwl3945_read_prph(priv, reg);
5336                 if (val != le32_to_cpu(*image)) {
5337                         IWL_ERROR("BSM uCode verification failed at "
5338                                   "addr 0x%08X+%u (of %u), is 0x%x, s/b 0x%x\n",
5339                                   BSM_SRAM_LOWER_BOUND,
5340                                   reg - BSM_SRAM_LOWER_BOUND, len,
5341                                   val, le32_to_cpu(*image));
5342                         return -EIO;
5343                 }
5344         }
5345
5346         IWL_DEBUG_INFO("BSM bootstrap uCode image OK\n");
5347
5348         return 0;
5349 }
5350
5351 /**
5352  * iwl3945_load_bsm - Load bootstrap instructions
5353  *
5354  * BSM operation:
5355  *
5356  * The Bootstrap State Machine (BSM) stores a short bootstrap uCode program
5357  * in special SRAM that does not power down during RFKILL.  When powering back
5358  * up after power-saving sleeps (or during initial uCode load), the BSM loads
5359  * the bootstrap program into the on-board processor, and starts it.
5360  *
5361  * The bootstrap program loads (via DMA) instructions and data for a new
5362  * program from host DRAM locations indicated by the host driver in the
5363  * BSM_DRAM_* registers.  Once the new program is loaded, it starts
5364  * automatically.
5365  *
5366  * When initializing the NIC, the host driver points the BSM to the
5367  * "initialize" uCode image.  This uCode sets up some internal data, then
5368  * notifies host via "initialize alive" that it is complete.
5369  *
5370  * The host then replaces the BSM_DRAM_* pointer values to point to the
5371  * normal runtime uCode instructions and a backup uCode data cache buffer
5372  * (filled initially with starting data values for the on-board processor),
5373  * then triggers the "initialize" uCode to load and launch the runtime uCode,
5374  * which begins normal operation.
5375  *
5376  * When doing a power-save shutdown, runtime uCode saves data SRAM into
5377  * the backup data cache in DRAM before SRAM is powered down.
5378  *
5379  * When powering back up, the BSM loads the bootstrap program.  This reloads
5380  * the runtime uCode instructions and the backup data cache into SRAM,
5381  * and re-launches the runtime uCode from where it left off.
5382  */
5383 static int iwl3945_load_bsm(struct iwl3945_priv *priv)
5384 {
5385         __le32 *image = priv->ucode_boot.v_addr;
5386         u32 len = priv->ucode_boot.len;
5387         dma_addr_t pinst;
5388         dma_addr_t pdata;
5389         u32 inst_len;
5390         u32 data_len;
5391         int rc;
5392         int i;
5393         u32 done;
5394         u32 reg_offset;
5395
5396         IWL_DEBUG_INFO("Begin load bsm\n");
5397
5398         /* make sure bootstrap program is no larger than BSM's SRAM size */
5399         if (len > IWL_MAX_BSM_SIZE)
5400                 return -EINVAL;
5401
5402         /* Tell bootstrap uCode where to find the "Initialize" uCode
5403          *   in host DRAM ... host DRAM physical address bits 31:0 for 3945.
5404          * NOTE:  iwl3945_initialize_alive_start() will replace these values,
5405          *        after the "initialize" uCode has run, to point to
5406          *        runtime/protocol instructions and backup data cache. */
5407         pinst = priv->ucode_init.p_addr;
5408         pdata = priv->ucode_init_data.p_addr;
5409         inst_len = priv->ucode_init.len;
5410         data_len = priv->ucode_init_data.len;
5411
5412         rc = iwl3945_grab_nic_access(priv);
5413         if (rc)
5414                 return rc;
5415
5416         iwl3945_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
5417         iwl3945_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
5418         iwl3945_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG, inst_len);
5419         iwl3945_write_prph(priv, BSM_DRAM_DATA_BYTECOUNT_REG, data_len);
5420
5421         /* Fill BSM memory with bootstrap instructions */
5422         for (reg_offset = BSM_SRAM_LOWER_BOUND;
5423              reg_offset < BSM_SRAM_LOWER_BOUND + len;
5424              reg_offset += sizeof(u32), image++)
5425                 _iwl3945_write_prph(priv, reg_offset,
5426                                           le32_to_cpu(*image));
5427
5428         rc = iwl3945_verify_bsm(priv);
5429         if (rc) {
5430                 iwl3945_release_nic_access(priv);
5431                 return rc;
5432         }
5433
5434         /* Tell BSM to copy from BSM SRAM into instruction SRAM, when asked */
5435         iwl3945_write_prph(priv, BSM_WR_MEM_SRC_REG, 0x0);
5436         iwl3945_write_prph(priv, BSM_WR_MEM_DST_REG,
5437                                  RTC_INST_LOWER_BOUND);
5438         iwl3945_write_prph(priv, BSM_WR_DWCOUNT_REG, len / sizeof(u32));
5439
5440         /* Load bootstrap code into instruction SRAM now,
5441          *   to prepare to load "initialize" uCode */
5442         iwl3945_write_prph(priv, BSM_WR_CTRL_REG,
5443                 BSM_WR_CTRL_REG_BIT_START);
5444
5445         /* Wait for load of bootstrap uCode to finish */
5446         for (i = 0; i < 100; i++) {
5447                 done = iwl3945_read_prph(priv, BSM_WR_CTRL_REG);
5448                 if (!(done & BSM_WR_CTRL_REG_BIT_START))
5449                         break;
5450                 udelay(10);
5451         }
5452         if (i < 100)
5453                 IWL_DEBUG_INFO("BSM write complete, poll %d iterations\n", i);
5454         else {
5455                 IWL_ERROR("BSM write did not complete!\n");
5456                 return -EIO;
5457         }
5458
5459         /* Enable future boot loads whenever power management unit triggers it
5460          *   (e.g. when powering back up after power-save shutdown) */
5461         iwl3945_write_prph(priv, BSM_WR_CTRL_REG,
5462                 BSM_WR_CTRL_REG_BIT_START_EN);
5463
5464         iwl3945_release_nic_access(priv);
5465
5466         return 0;
5467 }
5468
5469 static void iwl3945_nic_start(struct iwl3945_priv *priv)
5470 {
5471         /* Remove all resets to allow NIC to operate */
5472         iwl3945_write32(priv, CSR_RESET, 0);
5473 }
5474
5475 /**
5476  * iwl3945_read_ucode - Read uCode images from disk file.
5477  *
5478  * Copy into buffers for card to fetch via bus-mastering
5479  */
5480 static int iwl3945_read_ucode(struct iwl3945_priv *priv)
5481 {
5482         struct iwl3945_ucode *ucode;
5483         int ret = 0;
5484         const struct firmware *ucode_raw;
5485         /* firmware file name contains uCode/driver compatibility version */
5486         const char *name = priv->cfg->fw_name;
5487         u8 *src;
5488         size_t len;
5489         u32 ver, inst_size, data_size, init_size, init_data_size, boot_size;
5490
5491         /* Ask kernel firmware_class module to get the boot firmware off disk.
5492          * request_firmware() is synchronous, file is in memory on return. */
5493         ret = request_firmware(&ucode_raw, name, &priv->pci_dev->dev);
5494         if (ret < 0) {
5495                 IWL_ERROR("%s firmware file req failed: Reason %d\n",
5496                                 name, ret);
5497                 goto error;
5498         }
5499
5500         IWL_DEBUG_INFO("Got firmware '%s' file (%zd bytes) from disk\n",
5501                        name, ucode_raw->size);
5502
5503         /* Make sure that we got at least our header! */
5504         if (ucode_raw->size < sizeof(*ucode)) {
5505                 IWL_ERROR("File size way too small!\n");
5506                 ret = -EINVAL;
5507                 goto err_release;
5508         }
5509
5510         /* Data from ucode file:  header followed by uCode images */
5511         ucode = (void *)ucode_raw->data;
5512
5513         ver = le32_to_cpu(ucode->ver);
5514         inst_size = le32_to_cpu(ucode->inst_size);
5515         data_size = le32_to_cpu(ucode->data_size);
5516         init_size = le32_to_cpu(ucode->init_size);
5517         init_data_size = le32_to_cpu(ucode->init_data_size);
5518         boot_size = le32_to_cpu(ucode->boot_size);
5519
5520         IWL_DEBUG_INFO("f/w package hdr ucode version = 0x%x\n", ver);
5521         IWL_DEBUG_INFO("f/w package hdr runtime inst size = %u\n", inst_size);
5522         IWL_DEBUG_INFO("f/w package hdr runtime data size = %u\n", data_size);
5523         IWL_DEBUG_INFO("f/w package hdr init inst size = %u\n", init_size);
5524         IWL_DEBUG_INFO("f/w package hdr init data size = %u\n", init_data_size);
5525         IWL_DEBUG_INFO("f/w package hdr boot inst size = %u\n", boot_size);
5526
5527         /* Verify size of file vs. image size info in file's header */
5528         if (ucode_raw->size < sizeof(*ucode) +
5529                 inst_size + data_size + init_size +
5530                 init_data_size + boot_size) {
5531
5532                 IWL_DEBUG_INFO("uCode file size %d too small\n",
5533                                (int)ucode_raw->size);
5534                 ret = -EINVAL;
5535                 goto err_release;
5536         }
5537
5538         /* Verify that uCode images will fit in card's SRAM */
5539         if (inst_size > IWL_MAX_INST_SIZE) {
5540                 IWL_DEBUG_INFO("uCode instr len %d too large to fit in\n",
5541                                inst_size);
5542                 ret = -EINVAL;
5543                 goto err_release;
5544         }
5545
5546         if (data_size > IWL_MAX_DATA_SIZE) {
5547                 IWL_DEBUG_INFO("uCode data len %d too large to fit in\n",
5548                                data_size);
5549                 ret = -EINVAL;
5550                 goto err_release;
5551         }
5552         if (init_size > IWL_MAX_INST_SIZE) {
5553                 IWL_DEBUG_INFO("uCode init instr len %d too large to fit in\n",
5554                                 init_size);
5555                 ret = -EINVAL;
5556                 goto err_release;
5557         }
5558         if (init_data_size > IWL_MAX_DATA_SIZE) {
5559                 IWL_DEBUG_INFO("uCode init data len %d too large to fit in\n",
5560                                 init_data_size);
5561                 ret = -EINVAL;
5562                 goto err_release;
5563         }
5564         if (boot_size > IWL_MAX_BSM_SIZE) {
5565                 IWL_DEBUG_INFO("uCode boot instr len %d too large to fit in\n",
5566                                 boot_size);
5567                 ret = -EINVAL;
5568                 goto err_release;
5569         }
5570
5571         /* Allocate ucode buffers for card's bus-master loading ... */
5572
5573         /* Runtime instructions and 2 copies of data:
5574          * 1) unmodified from disk
5575          * 2) backup cache for save/restore during power-downs */
5576         priv->ucode_code.len = inst_size;
5577         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_code);
5578
5579         priv->ucode_data.len = data_size;
5580         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data);
5581
5582         priv->ucode_data_backup.len = data_size;
5583         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
5584
5585         if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
5586             !priv->ucode_data_backup.v_addr)
5587                 goto err_pci_alloc;
5588
5589         /* Initialization instructions and data */
5590         if (init_size && init_data_size) {
5591                 priv->ucode_init.len = init_size;
5592                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init);
5593
5594                 priv->ucode_init_data.len = init_data_size;
5595                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_init_data);
5596
5597                 if (!priv->ucode_init.v_addr || !priv->ucode_init_data.v_addr)
5598                         goto err_pci_alloc;
5599         }
5600
5601         /* Bootstrap (instructions only, no data) */
5602         if (boot_size) {
5603                 priv->ucode_boot.len = boot_size;
5604                 iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_boot);
5605
5606                 if (!priv->ucode_boot.v_addr)
5607                         goto err_pci_alloc;
5608         }
5609
5610         /* Copy images into buffers for card's bus-master reads ... */
5611
5612         /* Runtime instructions (first block of data in file) */
5613         src = &ucode->data[0];
5614         len = priv->ucode_code.len;
5615         IWL_DEBUG_INFO("Copying (but not loading) uCode instr len %Zd\n", len);
5616         memcpy(priv->ucode_code.v_addr, src, len);
5617         IWL_DEBUG_INFO("uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
5618                 priv->ucode_code.v_addr, (u32)priv->ucode_code.p_addr);
5619
5620         /* Runtime data (2nd block)
5621          * NOTE:  Copy into backup buffer will be done in iwl3945_up()  */
5622         src = &ucode->data[inst_size];
5623         len = priv->ucode_data.len;
5624         IWL_DEBUG_INFO("Copying (but not loading) uCode data len %Zd\n", len);
5625         memcpy(priv->ucode_data.v_addr, src, len);
5626         memcpy(priv->ucode_data_backup.v_addr, src, len);
5627
5628         /* Initialization instructions (3rd block) */
5629         if (init_size) {
5630                 src = &ucode->data[inst_size + data_size];
5631                 len = priv->ucode_init.len;
5632                 IWL_DEBUG_INFO("Copying (but not loading) init instr len %Zd\n",
5633                                len);
5634                 memcpy(priv->ucode_init.v_addr, src, len);
5635         }
5636
5637         /* Initialization data (4th block) */
5638         if (init_data_size) {
5639                 src = &ucode->data[inst_size + data_size + init_size];
5640                 len = priv->ucode_init_data.len;
5641                 IWL_DEBUG_INFO("Copying (but not loading) init data len %d\n",
5642                                (int)len);
5643                 memcpy(priv->ucode_init_data.v_addr, src, len);
5644         }
5645
5646         /* Bootstrap instructions (5th block) */
5647         src = &ucode->data[inst_size + data_size + init_size + init_data_size];
5648         len = priv->ucode_boot.len;
5649         IWL_DEBUG_INFO("Copying (but not loading) boot instr len %d\n",
5650                        (int)len);
5651         memcpy(priv->ucode_boot.v_addr, src, len);
5652
5653         /* We have our copies now, allow OS release its copies */
5654         release_firmware(ucode_raw);
5655         return 0;
5656
5657  err_pci_alloc:
5658         IWL_ERROR("failed to allocate pci memory\n");
5659         ret = -ENOMEM;
5660         iwl3945_dealloc_ucode_pci(priv);
5661
5662  err_release:
5663         release_firmware(ucode_raw);
5664
5665  error:
5666         return ret;
5667 }
5668
5669
5670 /**
5671  * iwl3945_set_ucode_ptrs - Set uCode address location
5672  *
5673  * Tell initialization uCode where to find runtime uCode.
5674  *
5675  * BSM registers initially contain pointers to initialization uCode.
5676  * We need to replace them to load runtime uCode inst and data,
5677  * and to save runtime data when powering down.
5678  */
5679 static int iwl3945_set_ucode_ptrs(struct iwl3945_priv *priv)
5680 {
5681         dma_addr_t pinst;
5682         dma_addr_t pdata;
5683         int rc = 0;
5684         unsigned long flags;
5685
5686         /* bits 31:0 for 3945 */
5687         pinst = priv->ucode_code.p_addr;
5688         pdata = priv->ucode_data_backup.p_addr;
5689
5690         spin_lock_irqsave(&priv->lock, flags);
5691         rc = iwl3945_grab_nic_access(priv);
5692         if (rc) {
5693                 spin_unlock_irqrestore(&priv->lock, flags);
5694                 return rc;
5695         }
5696
5697         /* Tell bootstrap uCode where to find image to load */
5698         iwl3945_write_prph(priv, BSM_DRAM_INST_PTR_REG, pinst);
5699         iwl3945_write_prph(priv, BSM_DRAM_DATA_PTR_REG, pdata);
5700         iwl3945_write_prph(priv, BSM_DRAM_DATA_BYTECOUNT_REG,
5701                                  priv->ucode_data.len);
5702
5703         /* Inst bytecount must be last to set up, bit 31 signals uCode
5704          *   that all new ptr/size info is in place */
5705         iwl3945_write_prph(priv, BSM_DRAM_INST_BYTECOUNT_REG,
5706                                  priv->ucode_code.len | BSM_DRAM_INST_LOAD);
5707
5708         iwl3945_release_nic_access(priv);
5709
5710         spin_unlock_irqrestore(&priv->lock, flags);
5711
5712         IWL_DEBUG_INFO("Runtime uCode pointers are set.\n");
5713
5714         return rc;
5715 }
5716
5717 /**
5718  * iwl3945_init_alive_start - Called after REPLY_ALIVE notification received
5719  *
5720  * Called after REPLY_ALIVE notification received from "initialize" uCode.
5721  *
5722  * Tell "initialize" uCode to go ahead and load the runtime uCode.
5723  */
5724 static void iwl3945_init_alive_start(struct iwl3945_priv *priv)
5725 {
5726         /* Check alive response for "valid" sign from uCode */
5727         if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
5728                 /* We had an error bringing up the hardware, so take it
5729                  * all the way back down so we can try again */
5730                 IWL_DEBUG_INFO("Initialize Alive failed.\n");
5731                 goto restart;
5732         }
5733
5734         /* Bootstrap uCode has loaded initialize uCode ... verify inst image.
5735          * This is a paranoid check, because we would not have gotten the
5736          * "initialize" alive if code weren't properly loaded.  */
5737         if (iwl3945_verify_ucode(priv)) {
5738                 /* Runtime instruction load was bad;
5739                  * take it all the way back down so we can try again */
5740                 IWL_DEBUG_INFO("Bad \"initialize\" uCode load.\n");
5741                 goto restart;
5742         }
5743
5744         /* Send pointers to protocol/runtime uCode image ... init code will
5745          * load and launch runtime uCode, which will send us another "Alive"
5746          * notification. */
5747         IWL_DEBUG_INFO("Initialization Alive received.\n");
5748         if (iwl3945_set_ucode_ptrs(priv)) {
5749                 /* Runtime instruction load won't happen;
5750                  * take it all the way back down so we can try again */
5751                 IWL_DEBUG_INFO("Couldn't set up uCode pointers.\n");
5752                 goto restart;
5753         }
5754         return;
5755
5756  restart:
5757         queue_work(priv->workqueue, &priv->restart);
5758 }
5759
5760
5761 /**
5762  * iwl3945_alive_start - called after REPLY_ALIVE notification received
5763  *                   from protocol/runtime uCode (initialization uCode's
5764  *                   Alive gets handled by iwl3945_init_alive_start()).
5765  */
5766 static void iwl3945_alive_start(struct iwl3945_priv *priv)
5767 {
5768         int rc = 0;
5769         int thermal_spin = 0;
5770         u32 rfkill;
5771
5772         IWL_DEBUG_INFO("Runtime Alive received.\n");
5773
5774         if (priv->card_alive.is_valid != UCODE_VALID_OK) {
5775                 /* We had an error bringing up the hardware, so take it
5776                  * all the way back down so we can try again */
5777                 IWL_DEBUG_INFO("Alive failed.\n");
5778                 goto restart;
5779         }
5780
5781         /* Initialize uCode has loaded Runtime uCode ... verify inst image.
5782          * This is a paranoid check, because we would not have gotten the
5783          * "runtime" alive if code weren't properly loaded.  */
5784         if (iwl3945_verify_ucode(priv)) {
5785                 /* Runtime instruction load was bad;
5786                  * take it all the way back down so we can try again */
5787                 IWL_DEBUG_INFO("Bad runtime uCode load.\n");
5788                 goto restart;
5789         }
5790
5791         iwl3945_clear_stations_table(priv);
5792
5793         rc = iwl3945_grab_nic_access(priv);
5794         if (rc) {
5795                 IWL_WARNING("Can not read rfkill status from adapter\n");
5796                 return;
5797         }
5798
5799         rfkill = iwl3945_read_prph(priv, APMG_RFKILL_REG);
5800         IWL_DEBUG_INFO("RFKILL status: 0x%x\n", rfkill);
5801         iwl3945_release_nic_access(priv);
5802
5803         if (rfkill & 0x1) {
5804                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
5805                 /* if rfkill is not on, then wait for thermal
5806                  * sensor in adapter to kick in */
5807                 while (iwl3945_hw_get_temperature(priv) == 0) {
5808                         thermal_spin++;
5809                         udelay(10);
5810                 }
5811
5812                 if (thermal_spin)
5813                         IWL_DEBUG_INFO("Thermal calibration took %dus\n",
5814                                        thermal_spin * 10);
5815         } else
5816                 set_bit(STATUS_RF_KILL_HW, &priv->status);
5817
5818         /* After the ALIVE response, we can send commands to 3945 uCode */
5819         set_bit(STATUS_ALIVE, &priv->status);
5820
5821         /* Clear out the uCode error bit if it is set */
5822         clear_bit(STATUS_FW_ERROR, &priv->status);
5823
5824         if (iwl3945_is_rfkill(priv))
5825                 return;
5826
5827         ieee80211_start_queues(priv->hw);
5828
5829         priv->active_rate = priv->rates_mask;
5830         priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
5831
5832         iwl3945_send_power_mode(priv, IWL_POWER_LEVEL(priv->power_mode));
5833
5834         if (iwl3945_is_associated(priv)) {
5835                 struct iwl3945_rxon_cmd *active_rxon =
5836                                 (struct iwl3945_rxon_cmd *)(&priv->active_rxon);
5837
5838                 memcpy(&priv->staging_rxon, &priv->active_rxon,
5839                        sizeof(priv->staging_rxon));
5840                 active_rxon->filter_flags &= ~RXON_FILTER_ASSOC_MSK;
5841         } else {
5842                 /* Initialize our rx_config data */
5843                 iwl3945_connection_init_rx_config(priv);
5844                 memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
5845         }
5846
5847         /* Configure Bluetooth device coexistence support */
5848         iwl3945_send_bt_config(priv);
5849
5850         /* Configure the adapter for unassociated operation */
5851         iwl3945_commit_rxon(priv);
5852
5853         /* At this point, the NIC is initialized and operational */
5854         priv->notif_missed_beacons = 0;
5855         set_bit(STATUS_READY, &priv->status);
5856
5857         iwl3945_reg_txpower_periodic(priv);
5858
5859         IWL_DEBUG_INFO("ALIVE processing complete.\n");
5860         wake_up_interruptible(&priv->wait_command_queue);
5861
5862         iwl3945_led_register(priv);
5863
5864         if (priv->error_recovering)
5865                 iwl3945_error_recovery(priv);
5866
5867         return;
5868
5869  restart:
5870         queue_work(priv->workqueue, &priv->restart);
5871 }
5872
5873 static void iwl3945_cancel_deferred_work(struct iwl3945_priv *priv);
5874
5875 static void __iwl3945_down(struct iwl3945_priv *priv)
5876 {
5877         unsigned long flags;
5878         int exit_pending = test_bit(STATUS_EXIT_PENDING, &priv->status);
5879         struct ieee80211_conf *conf = NULL;
5880
5881         IWL_DEBUG_INFO(DRV_NAME " is going down\n");
5882
5883         conf = ieee80211_get_hw_conf(priv->hw);
5884
5885         if (!exit_pending)
5886                 set_bit(STATUS_EXIT_PENDING, &priv->status);
5887
5888         iwl3945_led_unregister(priv);
5889         iwl3945_clear_stations_table(priv);
5890
5891         /* Unblock any waiting calls */
5892         wake_up_interruptible_all(&priv->wait_command_queue);
5893
5894         /* Wipe out the EXIT_PENDING status bit if we are not actually
5895          * exiting the module */
5896         if (!exit_pending)
5897                 clear_bit(STATUS_EXIT_PENDING, &priv->status);
5898
5899         /* stop and reset the on-board processor */
5900         iwl3945_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
5901
5902         /* tell the device to stop sending interrupts */
5903         iwl3945_disable_interrupts(priv);
5904
5905         if (priv->mac80211_registered)
5906                 ieee80211_stop_queues(priv->hw);
5907
5908         /* If we have not previously called iwl3945_init() then
5909          * clear all bits but the RF Kill and SUSPEND bits and return */
5910         if (!iwl3945_is_init(priv)) {
5911                 priv->status = test_bit(STATUS_RF_KILL_HW, &priv->status) <<
5912                                         STATUS_RF_KILL_HW |
5913                                test_bit(STATUS_RF_KILL_SW, &priv->status) <<
5914                                         STATUS_RF_KILL_SW |
5915                                test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
5916                                         STATUS_GEO_CONFIGURED |
5917                                test_bit(STATUS_IN_SUSPEND, &priv->status) <<
5918                                         STATUS_IN_SUSPEND;
5919                 goto exit;
5920         }
5921
5922         /* ...otherwise clear out all the status bits but the RF Kill and
5923          * SUSPEND bits and continue taking the NIC down. */
5924         priv->status &= test_bit(STATUS_RF_KILL_HW, &priv->status) <<
5925                                 STATUS_RF_KILL_HW |
5926                         test_bit(STATUS_RF_KILL_SW, &priv->status) <<
5927                                 STATUS_RF_KILL_SW |
5928                         test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
5929                                 STATUS_GEO_CONFIGURED |
5930                         test_bit(STATUS_IN_SUSPEND, &priv->status) <<
5931                                 STATUS_IN_SUSPEND |
5932                         test_bit(STATUS_FW_ERROR, &priv->status) <<
5933                                 STATUS_FW_ERROR;
5934
5935         spin_lock_irqsave(&priv->lock, flags);
5936         iwl3945_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
5937         spin_unlock_irqrestore(&priv->lock, flags);
5938
5939         iwl3945_hw_txq_ctx_stop(priv);
5940         iwl3945_hw_rxq_stop(priv);
5941
5942         spin_lock_irqsave(&priv->lock, flags);
5943         if (!iwl3945_grab_nic_access(priv)) {
5944                 iwl3945_write_prph(priv, APMG_CLK_DIS_REG,
5945                                          APMG_CLK_VAL_DMA_CLK_RQT);
5946                 iwl3945_release_nic_access(priv);
5947         }
5948         spin_unlock_irqrestore(&priv->lock, flags);
5949
5950         udelay(5);
5951
5952         iwl3945_hw_nic_stop_master(priv);
5953         iwl3945_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
5954         iwl3945_hw_nic_reset(priv);
5955
5956  exit:
5957         memset(&priv->card_alive, 0, sizeof(struct iwl3945_alive_resp));
5958
5959         if (priv->ibss_beacon)
5960                 dev_kfree_skb(priv->ibss_beacon);
5961         priv->ibss_beacon = NULL;
5962
5963         /* clear out any free frames */
5964         iwl3945_clear_free_frames(priv);
5965 }
5966
5967 static void iwl3945_down(struct iwl3945_priv *priv)
5968 {
5969         mutex_lock(&priv->mutex);
5970         __iwl3945_down(priv);
5971         mutex_unlock(&priv->mutex);
5972
5973         iwl3945_cancel_deferred_work(priv);
5974 }
5975
5976 #define MAX_HW_RESTARTS 5
5977
5978 static int __iwl3945_up(struct iwl3945_priv *priv)
5979 {
5980         int rc, i;
5981
5982         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
5983                 IWL_WARNING("Exit pending; will not bring the NIC up\n");
5984                 return -EIO;
5985         }
5986
5987         if (test_bit(STATUS_RF_KILL_SW, &priv->status)) {
5988                 IWL_WARNING("Radio disabled by SW RF kill (module "
5989                             "parameter)\n");
5990                 return -ENODEV;
5991         }
5992
5993         if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
5994                 IWL_ERROR("ucode not available for device bringup\n");
5995                 return -EIO;
5996         }
5997
5998         /* If platform's RF_KILL switch is NOT set to KILL */
5999         if (iwl3945_read32(priv, CSR_GP_CNTRL) &
6000                                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
6001                 clear_bit(STATUS_RF_KILL_HW, &priv->status);
6002         else {
6003                 set_bit(STATUS_RF_KILL_HW, &priv->status);
6004                 if (!test_bit(STATUS_IN_SUSPEND, &priv->status)) {
6005                         IWL_WARNING("Radio disabled by HW RF Kill switch\n");
6006                         return -ENODEV;
6007                 }
6008         }
6009
6010         iwl3945_write32(priv, CSR_INT, 0xFFFFFFFF);
6011
6012         rc = iwl3945_hw_nic_init(priv);
6013         if (rc) {
6014                 IWL_ERROR("Unable to int nic\n");
6015                 return rc;
6016         }
6017
6018         /* make sure rfkill handshake bits are cleared */
6019         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
6020         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_CLR,
6021                     CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
6022
6023         /* clear (again), then enable host interrupts */
6024         iwl3945_write32(priv, CSR_INT, 0xFFFFFFFF);
6025         iwl3945_enable_interrupts(priv);
6026
6027         /* really make sure rfkill handshake bits are cleared */
6028         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
6029         iwl3945_write32(priv, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
6030
6031         /* Copy original ucode data image from disk into backup cache.
6032          * This will be used to initialize the on-board processor's
6033          * data SRAM for a clean start when the runtime program first loads. */
6034         memcpy(priv->ucode_data_backup.v_addr, priv->ucode_data.v_addr,
6035                priv->ucode_data.len);
6036
6037         /* We return success when we resume from suspend and rf_kill is on. */
6038         if (test_bit(STATUS_RF_KILL_HW, &priv->status))
6039                 return 0;
6040
6041         for (i = 0; i < MAX_HW_RESTARTS; i++) {
6042
6043                 iwl3945_clear_stations_table(priv);
6044
6045                 /* load bootstrap state machine,
6046                  * load bootstrap program into processor's memory,
6047                  * prepare to load the "initialize" uCode */
6048                 rc = iwl3945_load_bsm(priv);
6049
6050                 if (rc) {
6051                         IWL_ERROR("Unable to set up bootstrap uCode: %d\n", rc);
6052                         continue;
6053                 }
6054
6055                 /* start card; "initialize" will load runtime ucode */
6056                 iwl3945_nic_start(priv);
6057
6058                 IWL_DEBUG_INFO(DRV_NAME " is coming up\n");
6059
6060                 return 0;
6061         }
6062
6063         set_bit(STATUS_EXIT_PENDING, &priv->status);
6064         __iwl3945_down(priv);
6065
6066         /* tried to restart and config the device for as long as our
6067          * patience could withstand */
6068         IWL_ERROR("Unable to initialize device after %d attempts.\n", i);
6069         return -EIO;
6070 }
6071
6072
6073 /*****************************************************************************
6074  *
6075  * Workqueue callbacks
6076  *
6077  *****************************************************************************/
6078
6079 static void iwl3945_bg_init_alive_start(struct work_struct *data)
6080 {
6081         struct iwl3945_priv *priv =
6082             container_of(data, struct iwl3945_priv, init_alive_start.work);
6083
6084         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6085                 return;
6086
6087         mutex_lock(&priv->mutex);
6088         iwl3945_init_alive_start(priv);
6089         mutex_unlock(&priv->mutex);
6090 }
6091
6092 static void iwl3945_bg_alive_start(struct work_struct *data)
6093 {
6094         struct iwl3945_priv *priv =
6095             container_of(data, struct iwl3945_priv, alive_start.work);
6096
6097         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6098                 return;
6099
6100         mutex_lock(&priv->mutex);
6101         iwl3945_alive_start(priv);
6102         mutex_unlock(&priv->mutex);
6103 }
6104
6105 static void iwl3945_bg_rf_kill(struct work_struct *work)
6106 {
6107         struct iwl3945_priv *priv = container_of(work, struct iwl3945_priv, rf_kill);
6108
6109         wake_up_interruptible(&priv->wait_command_queue);
6110
6111         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6112                 return;
6113
6114         mutex_lock(&priv->mutex);
6115
6116         if (!iwl3945_is_rfkill(priv)) {
6117                 IWL_DEBUG(IWL_DL_INFO | IWL_DL_RF_KILL,
6118                           "HW and/or SW RF Kill no longer active, restarting "
6119                           "device\n");
6120                 if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
6121                         queue_work(priv->workqueue, &priv->restart);
6122         } else {
6123
6124                 if (!test_bit(STATUS_RF_KILL_HW, &priv->status))
6125                         IWL_DEBUG_RF_KILL("Can not turn radio back on - "
6126                                           "disabled by SW switch\n");
6127                 else
6128                         IWL_WARNING("Radio Frequency Kill Switch is On:\n"
6129                                     "Kill switch must be turned off for "
6130                                     "wireless networking to work.\n");
6131         }
6132         mutex_unlock(&priv->mutex);
6133 }
6134
6135 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
6136
6137 static void iwl3945_bg_scan_check(struct work_struct *data)
6138 {
6139         struct iwl3945_priv *priv =
6140             container_of(data, struct iwl3945_priv, scan_check.work);
6141
6142         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6143                 return;
6144
6145         mutex_lock(&priv->mutex);
6146         if (test_bit(STATUS_SCANNING, &priv->status) ||
6147             test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
6148                 IWL_DEBUG(IWL_DL_INFO | IWL_DL_SCAN,
6149                           "Scan completion watchdog resetting adapter (%dms)\n",
6150                           jiffies_to_msecs(IWL_SCAN_CHECK_WATCHDOG));
6151
6152                 if (!test_bit(STATUS_EXIT_PENDING, &priv->status))
6153                         iwl3945_send_scan_abort(priv);
6154         }
6155         mutex_unlock(&priv->mutex);
6156 }
6157
6158 static void iwl3945_bg_request_scan(struct work_struct *data)
6159 {
6160         struct iwl3945_priv *priv =
6161             container_of(data, struct iwl3945_priv, request_scan);
6162         struct iwl3945_host_cmd cmd = {
6163                 .id = REPLY_SCAN_CMD,
6164                 .len = sizeof(struct iwl3945_scan_cmd),
6165                 .meta.flags = CMD_SIZE_HUGE,
6166         };
6167         int rc = 0;
6168         struct iwl3945_scan_cmd *scan;
6169         struct ieee80211_conf *conf = NULL;
6170         u8 direct_mask;
6171         enum ieee80211_band band;
6172
6173         conf = ieee80211_get_hw_conf(priv->hw);
6174
6175         mutex_lock(&priv->mutex);
6176
6177         if (!iwl3945_is_ready(priv)) {
6178                 IWL_WARNING("request scan called when driver not ready.\n");
6179                 goto done;
6180         }
6181
6182         /* Make sure the scan wasn't cancelled before this queued work
6183          * was given the chance to run... */
6184         if (!test_bit(STATUS_SCANNING, &priv->status))
6185                 goto done;
6186
6187         /* This should never be called or scheduled if there is currently
6188          * a scan active in the hardware. */
6189         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
6190                 IWL_DEBUG_INFO("Multiple concurrent scan requests in parallel. "
6191                                "Ignoring second request.\n");
6192                 rc = -EIO;
6193                 goto done;
6194         }
6195
6196         if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
6197                 IWL_DEBUG_SCAN("Aborting scan due to device shutdown\n");
6198                 goto done;
6199         }
6200
6201         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
6202                 IWL_DEBUG_HC("Scan request while abort pending.  Queuing.\n");
6203                 goto done;
6204         }
6205
6206         if (iwl3945_is_rfkill(priv)) {
6207                 IWL_DEBUG_HC("Aborting scan due to RF Kill activation\n");
6208                 goto done;
6209         }
6210
6211         if (!test_bit(STATUS_READY, &priv->status)) {
6212                 IWL_DEBUG_HC("Scan request while uninitialized.  Queuing.\n");
6213                 goto done;
6214         }
6215
6216         if (!priv->scan_bands) {
6217                 IWL_DEBUG_HC("Aborting scan due to no requested bands\n");
6218                 goto done;
6219         }
6220
6221         if (!priv->scan) {
6222                 priv->scan = kmalloc(sizeof(struct iwl3945_scan_cmd) +
6223                                      IWL_MAX_SCAN_SIZE, GFP_KERNEL);
6224                 if (!priv->scan) {
6225                         rc = -ENOMEM;
6226                         goto done;
6227                 }
6228         }
6229         scan = priv->scan;
6230         memset(scan, 0, sizeof(struct iwl3945_scan_cmd) + IWL_MAX_SCAN_SIZE);
6231
6232         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
6233         scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
6234
6235         if (iwl3945_is_associated(priv)) {
6236                 u16 interval = 0;
6237                 u32 extra;
6238                 u32 suspend_time = 100;
6239                 u32 scan_suspend_time = 100;
6240                 unsigned long flags;
6241
6242                 IWL_DEBUG_INFO("Scanning while associated...\n");
6243
6244                 spin_lock_irqsave(&priv->lock, flags);
6245                 interval = priv->beacon_int;
6246                 spin_unlock_irqrestore(&priv->lock, flags);
6247
6248                 scan->suspend_time = 0;
6249                 scan->max_out_time = cpu_to_le32(200 * 1024);
6250                 if (!interval)
6251                         interval = suspend_time;
6252                 /*
6253                  * suspend time format:
6254                  *  0-19: beacon interval in usec (time before exec.)
6255                  * 20-23: 0
6256                  * 24-31: number of beacons (suspend between channels)
6257                  */
6258
6259                 extra = (suspend_time / interval) << 24;
6260                 scan_suspend_time = 0xFF0FFFFF &
6261                     (extra | ((suspend_time % interval) * 1024));
6262
6263                 scan->suspend_time = cpu_to_le32(scan_suspend_time);
6264                 IWL_DEBUG_SCAN("suspend_time 0x%X beacon interval %d\n",
6265                                scan_suspend_time, interval);
6266         }
6267
6268         /* We should add the ability for user to lock to PASSIVE ONLY */
6269         if (priv->one_direct_scan) {
6270                 IWL_DEBUG_SCAN
6271                     ("Kicking off one direct scan for '%s'\n",
6272                      iwl3945_escape_essid(priv->direct_ssid,
6273                                       priv->direct_ssid_len));
6274                 scan->direct_scan[0].id = WLAN_EID_SSID;
6275                 scan->direct_scan[0].len = priv->direct_ssid_len;
6276                 memcpy(scan->direct_scan[0].ssid,
6277                        priv->direct_ssid, priv->direct_ssid_len);
6278                 direct_mask = 1;
6279         } else if (!iwl3945_is_associated(priv) && priv->essid_len) {
6280                 scan->direct_scan[0].id = WLAN_EID_SSID;
6281                 scan->direct_scan[0].len = priv->essid_len;
6282                 memcpy(scan->direct_scan[0].ssid, priv->essid, priv->essid_len);
6283                 direct_mask = 1;
6284         } else
6285                 direct_mask = 0;
6286
6287         /* We don't build a direct scan probe request; the uCode will do
6288          * that based on the direct_mask added to each channel entry */
6289         scan->tx_cmd.len = cpu_to_le16(
6290                 iwl3945_fill_probe_req(priv, (struct ieee80211_mgmt *)scan->data,
6291                         IWL_MAX_SCAN_SIZE - sizeof(*scan), 0));
6292         scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
6293         scan->tx_cmd.sta_id = priv->hw_setting.bcast_sta_id;
6294         scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
6295
6296         /* flags + rate selection */
6297
6298         switch (priv->scan_bands) {
6299         case 2:
6300                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
6301                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
6302                 scan->good_CRC_th = 0;
6303                 band = IEEE80211_BAND_2GHZ;
6304                 break;
6305
6306         case 1:
6307                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
6308                 scan->good_CRC_th = IWL_GOOD_CRC_TH;
6309                 band = IEEE80211_BAND_5GHZ;
6310                 break;
6311
6312         default:
6313                 IWL_WARNING("Invalid scan band count\n");
6314                 goto done;
6315         }
6316
6317         /* select Rx antennas */
6318         scan->flags |= iwl3945_get_antenna_flags(priv);
6319
6320         if (priv->iw_mode == IEEE80211_IF_TYPE_MNTR)
6321                 scan->filter_flags = RXON_FILTER_PROMISC_MSK;
6322
6323         if (direct_mask) {
6324                 IWL_DEBUG_SCAN
6325                     ("Initiating direct scan for %s.\n",
6326                      iwl3945_escape_essid(priv->essid, priv->essid_len));
6327                 scan->channel_count =
6328                         iwl3945_get_channels_for_scan(
6329                                 priv, band, 1, /* active */
6330                                 direct_mask,
6331                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
6332         } else {
6333                 IWL_DEBUG_SCAN("Initiating indirect scan.\n");
6334                 scan->channel_count =
6335                         iwl3945_get_channels_for_scan(
6336                                 priv, band, 0, /* passive */
6337                                 direct_mask,
6338                                 (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
6339         }
6340
6341         cmd.len += le16_to_cpu(scan->tx_cmd.len) +
6342             scan->channel_count * sizeof(struct iwl3945_scan_channel);
6343         cmd.data = scan;
6344         scan->len = cpu_to_le16(cmd.len);
6345
6346         set_bit(STATUS_SCAN_HW, &priv->status);
6347         rc = iwl3945_send_cmd_sync(priv, &cmd);
6348         if (rc)
6349                 goto done;
6350
6351         queue_delayed_work(priv->workqueue, &priv->scan_check,
6352                            IWL_SCAN_CHECK_WATCHDOG);
6353
6354         mutex_unlock(&priv->mutex);
6355         return;
6356
6357  done:
6358         /* inform mac80211 scan aborted */
6359         queue_work(priv->workqueue, &priv->scan_completed);
6360         mutex_unlock(&priv->mutex);
6361 }
6362
6363 static void iwl3945_bg_up(struct work_struct *data)
6364 {
6365         struct iwl3945_priv *priv = container_of(data, struct iwl3945_priv, up);
6366
6367         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6368                 return;
6369
6370         mutex_lock(&priv->mutex);
6371         __iwl3945_up(priv);
6372         mutex_unlock(&priv->mutex);
6373 }
6374
6375 static void iwl3945_bg_restart(struct work_struct *data)
6376 {
6377         struct iwl3945_priv *priv = container_of(data, struct iwl3945_priv, restart);
6378
6379         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6380                 return;
6381
6382         iwl3945_down(priv);
6383         queue_work(priv->workqueue, &priv->up);
6384 }
6385
6386 static void iwl3945_bg_rx_replenish(struct work_struct *data)
6387 {
6388         struct iwl3945_priv *priv =
6389             container_of(data, struct iwl3945_priv, rx_replenish);
6390
6391         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6392                 return;
6393
6394         mutex_lock(&priv->mutex);
6395         iwl3945_rx_replenish(priv);
6396         mutex_unlock(&priv->mutex);
6397 }
6398
6399 #define IWL_DELAY_NEXT_SCAN (HZ*2)
6400
6401 static void iwl3945_bg_post_associate(struct work_struct *data)
6402 {
6403         struct iwl3945_priv *priv = container_of(data, struct iwl3945_priv,
6404                                              post_associate.work);
6405
6406         int rc = 0;
6407         struct ieee80211_conf *conf = NULL;
6408         DECLARE_MAC_BUF(mac);
6409
6410         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
6411                 IWL_ERROR("%s Should not be called in AP mode\n", __FUNCTION__);
6412                 return;
6413         }
6414
6415
6416         IWL_DEBUG_ASSOC("Associated as %d to: %s\n",
6417                         priv->assoc_id,
6418                         print_mac(mac, priv->active_rxon.bssid_addr));
6419
6420         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6421                 return;
6422
6423         mutex_lock(&priv->mutex);
6424
6425         if (!priv->vif || !priv->is_open) {
6426                 mutex_unlock(&priv->mutex);
6427                 return;
6428         }
6429         iwl3945_scan_cancel_timeout(priv, 200);
6430
6431         conf = ieee80211_get_hw_conf(priv->hw);
6432
6433         priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
6434         iwl3945_commit_rxon(priv);
6435
6436         memset(&priv->rxon_timing, 0, sizeof(struct iwl3945_rxon_time_cmd));
6437         iwl3945_setup_rxon_timing(priv);
6438         rc = iwl3945_send_cmd_pdu(priv, REPLY_RXON_TIMING,
6439                               sizeof(priv->rxon_timing), &priv->rxon_timing);
6440         if (rc)
6441                 IWL_WARNING("REPLY_RXON_TIMING failed - "
6442                             "Attempting to continue.\n");
6443
6444         priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
6445
6446         priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
6447
6448         IWL_DEBUG_ASSOC("assoc id %d beacon interval %d\n",
6449                         priv->assoc_id, priv->beacon_int);
6450
6451         if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
6452                 priv->staging_rxon.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
6453         else
6454                 priv->staging_rxon.flags &= ~RXON_FLG_SHORT_PREAMBLE_MSK;
6455
6456         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
6457                 if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
6458                         priv->staging_rxon.flags |= RXON_FLG_SHORT_SLOT_MSK;
6459                 else
6460                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
6461
6462                 if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS)
6463                         priv->staging_rxon.flags &= ~RXON_FLG_SHORT_SLOT_MSK;
6464
6465         }
6466
6467         iwl3945_commit_rxon(priv);
6468
6469         switch (priv->iw_mode) {
6470         case IEEE80211_IF_TYPE_STA:
6471                 iwl3945_rate_scale_init(priv->hw, IWL_AP_ID);
6472                 break;
6473
6474         case IEEE80211_IF_TYPE_IBSS:
6475
6476                 /* clear out the station table */
6477                 iwl3945_clear_stations_table(priv);
6478
6479                 iwl3945_add_station(priv, iwl3945_broadcast_addr, 0, 0);
6480                 iwl3945_add_station(priv, priv->bssid, 0, 0);
6481                 iwl3945_sync_sta(priv, IWL_STA_ID,
6482                                  (priv->band == IEEE80211_BAND_5GHZ) ?
6483                                  IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
6484                                  CMD_ASYNC);
6485                 iwl3945_rate_scale_init(priv->hw, IWL_STA_ID);
6486                 iwl3945_send_beacon_cmd(priv);
6487
6488                 break;
6489
6490         default:
6491                  IWL_ERROR("%s Should not be called in %d mode\n",
6492                            __FUNCTION__, priv->iw_mode);
6493                 break;
6494         }
6495
6496         iwl3945_sequence_reset(priv);
6497
6498         iwl3945_activate_qos(priv, 0);
6499
6500         /* we have just associated, don't start scan too early */
6501         priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
6502         mutex_unlock(&priv->mutex);
6503 }
6504
6505 static void iwl3945_bg_abort_scan(struct work_struct *work)
6506 {
6507         struct iwl3945_priv *priv = container_of(work, struct iwl3945_priv, abort_scan);
6508
6509         if (!iwl3945_is_ready(priv))
6510                 return;
6511
6512         mutex_lock(&priv->mutex);
6513
6514         set_bit(STATUS_SCAN_ABORTING, &priv->status);
6515         iwl3945_send_scan_abort(priv);
6516
6517         mutex_unlock(&priv->mutex);
6518 }
6519
6520 static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf);
6521
6522 static void iwl3945_bg_scan_completed(struct work_struct *work)
6523 {
6524         struct iwl3945_priv *priv =
6525             container_of(work, struct iwl3945_priv, scan_completed);
6526
6527         IWL_DEBUG(IWL_DL_INFO | IWL_DL_SCAN, "SCAN complete scan\n");
6528
6529         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6530                 return;
6531
6532         if (test_bit(STATUS_CONF_PENDING, &priv->status))
6533                 iwl3945_mac_config(priv->hw, ieee80211_get_hw_conf(priv->hw));
6534
6535         ieee80211_scan_completed(priv->hw);
6536
6537         /* Since setting the TXPOWER may have been deferred while
6538          * performing the scan, fire one off */
6539         mutex_lock(&priv->mutex);
6540         iwl3945_hw_reg_send_txpower(priv);
6541         mutex_unlock(&priv->mutex);
6542 }
6543
6544 /*****************************************************************************
6545  *
6546  * mac80211 entry point functions
6547  *
6548  *****************************************************************************/
6549
6550 #define UCODE_READY_TIMEOUT     (2 * HZ)
6551
6552 static int iwl3945_mac_start(struct ieee80211_hw *hw)
6553 {
6554         struct iwl3945_priv *priv = hw->priv;
6555         int ret;
6556
6557         IWL_DEBUG_MAC80211("enter\n");
6558
6559         if (pci_enable_device(priv->pci_dev)) {
6560                 IWL_ERROR("Fail to pci_enable_device\n");
6561                 return -ENODEV;
6562         }
6563         pci_restore_state(priv->pci_dev);
6564         pci_enable_msi(priv->pci_dev);
6565
6566         ret = request_irq(priv->pci_dev->irq, iwl3945_isr, IRQF_SHARED,
6567                           DRV_NAME, priv);
6568         if (ret) {
6569                 IWL_ERROR("Error allocating IRQ %d\n", priv->pci_dev->irq);
6570                 goto out_disable_msi;
6571         }
6572
6573         /* we should be verifying the device is ready to be opened */
6574         mutex_lock(&priv->mutex);
6575
6576         memset(&priv->staging_rxon, 0, sizeof(struct iwl3945_rxon_cmd));
6577         /* fetch ucode file from disk, alloc and copy to bus-master buffers ...
6578          * ucode filename and max sizes are card-specific. */
6579
6580         if (!priv->ucode_code.len) {
6581                 ret = iwl3945_read_ucode(priv);
6582                 if (ret) {
6583                         IWL_ERROR("Could not read microcode: %d\n", ret);
6584                         mutex_unlock(&priv->mutex);
6585                         goto out_release_irq;
6586                 }
6587         }
6588
6589         ret = __iwl3945_up(priv);
6590
6591         mutex_unlock(&priv->mutex);
6592
6593         if (ret)
6594                 goto out_release_irq;
6595
6596         IWL_DEBUG_INFO("Start UP work.\n");
6597
6598         if (test_bit(STATUS_IN_SUSPEND, &priv->status))
6599                 return 0;
6600
6601         /* Wait for START_ALIVE from ucode. Otherwise callbacks from
6602          * mac80211 will not be run successfully. */
6603         ret = wait_event_interruptible_timeout(priv->wait_command_queue,
6604                         test_bit(STATUS_READY, &priv->status),
6605                         UCODE_READY_TIMEOUT);
6606         if (!ret) {
6607                 if (!test_bit(STATUS_READY, &priv->status)) {
6608                         IWL_ERROR("Wait for START_ALIVE timeout after %dms.\n",
6609                                   jiffies_to_msecs(UCODE_READY_TIMEOUT));
6610                         ret = -ETIMEDOUT;
6611                         goto out_release_irq;
6612                 }
6613         }
6614
6615         priv->is_open = 1;
6616         IWL_DEBUG_MAC80211("leave\n");
6617         return 0;
6618
6619 out_release_irq:
6620         free_irq(priv->pci_dev->irq, priv);
6621 out_disable_msi:
6622         pci_disable_msi(priv->pci_dev);
6623         pci_disable_device(priv->pci_dev);
6624         priv->is_open = 0;
6625         IWL_DEBUG_MAC80211("leave - failed\n");
6626         return ret;
6627 }
6628
6629 static void iwl3945_mac_stop(struct ieee80211_hw *hw)
6630 {
6631         struct iwl3945_priv *priv = hw->priv;
6632
6633         IWL_DEBUG_MAC80211("enter\n");
6634
6635         if (!priv->is_open) {
6636                 IWL_DEBUG_MAC80211("leave - skip\n");
6637                 return;
6638         }
6639
6640         priv->is_open = 0;
6641
6642         if (iwl3945_is_ready_rf(priv)) {
6643                 /* stop mac, cancel any scan request and clear
6644                  * RXON_FILTER_ASSOC_MSK BIT
6645                  */
6646                 mutex_lock(&priv->mutex);
6647                 iwl3945_scan_cancel_timeout(priv, 100);
6648                 cancel_delayed_work(&priv->post_associate);
6649                 mutex_unlock(&priv->mutex);
6650         }
6651
6652         iwl3945_down(priv);
6653
6654         flush_workqueue(priv->workqueue);
6655         free_irq(priv->pci_dev->irq, priv);
6656         pci_disable_msi(priv->pci_dev);
6657         pci_save_state(priv->pci_dev);
6658         pci_disable_device(priv->pci_dev);
6659
6660         IWL_DEBUG_MAC80211("leave\n");
6661 }
6662
6663 static int iwl3945_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb,
6664                       struct ieee80211_tx_control *ctl)
6665 {
6666         struct iwl3945_priv *priv = hw->priv;
6667
6668         IWL_DEBUG_MAC80211("enter\n");
6669
6670         if (priv->iw_mode == IEEE80211_IF_TYPE_MNTR) {
6671                 IWL_DEBUG_MAC80211("leave - monitor\n");
6672                 return -1;
6673         }
6674
6675         IWL_DEBUG_TX("dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
6676                      ctl->tx_rate->bitrate);
6677
6678         if (iwl3945_tx_skb(priv, skb, ctl))
6679                 dev_kfree_skb_any(skb);
6680
6681         IWL_DEBUG_MAC80211("leave\n");
6682         return 0;
6683 }
6684
6685 static int iwl3945_mac_add_interface(struct ieee80211_hw *hw,
6686                                  struct ieee80211_if_init_conf *conf)
6687 {
6688         struct iwl3945_priv *priv = hw->priv;
6689         unsigned long flags;
6690         DECLARE_MAC_BUF(mac);
6691
6692         IWL_DEBUG_MAC80211("enter: type %d\n", conf->type);
6693
6694         if (priv->vif) {
6695                 IWL_DEBUG_MAC80211("leave - vif != NULL\n");
6696                 return -EOPNOTSUPP;
6697         }
6698
6699         spin_lock_irqsave(&priv->lock, flags);
6700         priv->vif = conf->vif;
6701
6702         spin_unlock_irqrestore(&priv->lock, flags);
6703
6704         mutex_lock(&priv->mutex);
6705
6706         if (conf->mac_addr) {
6707                 IWL_DEBUG_MAC80211("Set: %s\n", print_mac(mac, conf->mac_addr));
6708                 memcpy(priv->mac_addr, conf->mac_addr, ETH_ALEN);
6709         }
6710
6711         if (iwl3945_is_ready(priv))
6712                 iwl3945_set_mode(priv, conf->type);
6713
6714         mutex_unlock(&priv->mutex);
6715
6716         IWL_DEBUG_MAC80211("leave\n");
6717         return 0;
6718 }
6719
6720 /**
6721  * iwl3945_mac_config - mac80211 config callback
6722  *
6723  * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
6724  * be set inappropriately and the driver currently sets the hardware up to
6725  * use it whenever needed.
6726  */
6727 static int iwl3945_mac_config(struct ieee80211_hw *hw, struct ieee80211_conf *conf)
6728 {
6729         struct iwl3945_priv *priv = hw->priv;
6730         const struct iwl3945_channel_info *ch_info;
6731         unsigned long flags;
6732         int ret = 0;
6733
6734         mutex_lock(&priv->mutex);
6735         IWL_DEBUG_MAC80211("enter to channel %d\n", conf->channel->hw_value);
6736
6737         priv->add_radiotap = !!(conf->flags & IEEE80211_CONF_RADIOTAP);
6738
6739         if (!iwl3945_is_ready(priv)) {
6740                 IWL_DEBUG_MAC80211("leave - not ready\n");
6741                 ret = -EIO;
6742                 goto out;
6743         }
6744
6745         if (unlikely(!iwl3945_param_disable_hw_scan &&
6746                      test_bit(STATUS_SCANNING, &priv->status))) {
6747                 IWL_DEBUG_MAC80211("leave - scanning\n");
6748                 set_bit(STATUS_CONF_PENDING, &priv->status);
6749                 mutex_unlock(&priv->mutex);
6750                 return 0;
6751         }
6752
6753         spin_lock_irqsave(&priv->lock, flags);
6754
6755         ch_info = iwl3945_get_channel_info(priv, conf->channel->band,
6756                                            conf->channel->hw_value);
6757         if (!is_channel_valid(ch_info)) {
6758                 IWL_DEBUG_SCAN("Channel %d [%d] is INVALID for this SKU.\n",
6759                                conf->channel->hw_value, conf->channel->band);
6760                 IWL_DEBUG_MAC80211("leave - invalid channel\n");
6761                 spin_unlock_irqrestore(&priv->lock, flags);
6762                 ret = -EINVAL;
6763                 goto out;
6764         }
6765
6766         iwl3945_set_rxon_channel(priv, conf->channel->band, conf->channel->hw_value);
6767
6768         iwl3945_set_flags_for_phymode(priv, conf->channel->band);
6769
6770         /* The list of supported rates and rate mask can be different
6771          * for each phymode; since the phymode may have changed, reset
6772          * the rate mask to what mac80211 lists */
6773         iwl3945_set_rate(priv);
6774
6775         spin_unlock_irqrestore(&priv->lock, flags);
6776
6777 #ifdef IEEE80211_CONF_CHANNEL_SWITCH
6778         if (conf->flags & IEEE80211_CONF_CHANNEL_SWITCH) {
6779                 iwl3945_hw_channel_switch(priv, conf->channel);
6780                 goto out;
6781         }
6782 #endif
6783
6784         iwl3945_radio_kill_sw(priv, !conf->radio_enabled);
6785
6786         if (!conf->radio_enabled) {
6787                 IWL_DEBUG_MAC80211("leave - radio disabled\n");
6788                 goto out;
6789         }
6790
6791         if (iwl3945_is_rfkill(priv)) {
6792                 IWL_DEBUG_MAC80211("leave - RF kill\n");
6793                 ret = -EIO;
6794                 goto out;
6795         }
6796
6797         iwl3945_set_rate(priv);
6798
6799         if (memcmp(&priv->active_rxon,
6800                    &priv->staging_rxon, sizeof(priv->staging_rxon)))
6801                 iwl3945_commit_rxon(priv);
6802         else
6803                 IWL_DEBUG_INFO("No re-sending same RXON configuration.\n");
6804
6805         IWL_DEBUG_MAC80211("leave\n");
6806
6807 out:
6808         clear_bit(STATUS_CONF_PENDING, &priv->status);
6809         mutex_unlock(&priv->mutex);
6810         return ret;
6811 }
6812
6813 static void iwl3945_config_ap(struct iwl3945_priv *priv)
6814 {
6815         int rc = 0;
6816
6817         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
6818                 return;
6819
6820         /* The following should be done only at AP bring up */
6821         if ((priv->active_rxon.filter_flags & RXON_FILTER_ASSOC_MSK) == 0) {
6822
6823                 /* RXON - unassoc (to set timing command) */
6824                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
6825                 iwl3945_commit_rxon(priv);
6826
6827                 /* RXON Timing */
6828                 memset(&priv->rxon_timing, 0, sizeof(struct iwl3945_rxon_time_cmd));
6829                 iwl3945_setup_rxon_timing(priv);
6830                 rc = iwl3945_send_cmd_pdu(priv, REPLY_RXON_TIMING,
6831                                 sizeof(priv->rxon_timing), &priv->rxon_timing);
6832                 if (rc)
6833                         IWL_WARNING("REPLY_RXON_TIMING failed - "
6834                                         "Attempting to continue.\n");
6835
6836                 /* FIXME: what should be the assoc_id for AP? */
6837                 priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id);
6838                 if (priv->assoc_capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
6839                         priv->staging_rxon.flags |=
6840                                 RXON_FLG_SHORT_PREAMBLE_MSK;
6841                 else
6842                         priv->staging_rxon.flags &=
6843                                 ~RXON_FLG_SHORT_PREAMBLE_MSK;
6844
6845                 if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) {
6846                         if (priv->assoc_capability &
6847                                 WLAN_CAPABILITY_SHORT_SLOT_TIME)
6848                                 priv->staging_rxon.flags |=
6849                                         RXON_FLG_SHORT_SLOT_MSK;
6850                         else
6851                                 priv->staging_rxon.flags &=
6852                                         ~RXON_FLG_SHORT_SLOT_MSK;
6853
6854                         if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS)
6855                                 priv->staging_rxon.flags &=
6856                                         ~RXON_FLG_SHORT_SLOT_MSK;
6857                 }
6858                 /* restore RXON assoc */
6859                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
6860                 iwl3945_commit_rxon(priv);
6861                 iwl3945_add_station(priv, iwl3945_broadcast_addr, 0, 0);
6862         }
6863         iwl3945_send_beacon_cmd(priv);
6864
6865         /* FIXME - we need to add code here to detect a totally new
6866          * configuration, reset the AP, unassoc, rxon timing, assoc,
6867          * clear sta table, add BCAST sta... */
6868 }
6869
6870 static int iwl3945_mac_config_interface(struct ieee80211_hw *hw,
6871                                         struct ieee80211_vif *vif,
6872                                     struct ieee80211_if_conf *conf)
6873 {
6874         struct iwl3945_priv *priv = hw->priv;
6875         DECLARE_MAC_BUF(mac);
6876         unsigned long flags;
6877         int rc;
6878
6879         if (conf == NULL)
6880                 return -EIO;
6881
6882         if (priv->vif != vif) {
6883                 IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
6884                 mutex_unlock(&priv->mutex);
6885                 return 0;
6886         }
6887
6888         /* XXX: this MUST use conf->mac_addr */
6889
6890         if ((priv->iw_mode == IEEE80211_IF_TYPE_AP) &&
6891             (!conf->beacon || !conf->ssid_len)) {
6892                 IWL_DEBUG_MAC80211
6893                     ("Leaving in AP mode because HostAPD is not ready.\n");
6894                 return 0;
6895         }
6896
6897         if (!iwl3945_is_alive(priv))
6898                 return -EAGAIN;
6899
6900         mutex_lock(&priv->mutex);
6901
6902         if (conf->bssid)
6903                 IWL_DEBUG_MAC80211("bssid: %s\n",
6904                                    print_mac(mac, conf->bssid));
6905
6906 /*
6907  * very dubious code was here; the probe filtering flag is never set:
6908  *
6909         if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
6910             !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
6911  */
6912
6913         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
6914                 if (!conf->bssid) {
6915                         conf->bssid = priv->mac_addr;
6916                         memcpy(priv->bssid, priv->mac_addr, ETH_ALEN);
6917                         IWL_DEBUG_MAC80211("bssid was set to: %s\n",
6918                                            print_mac(mac, conf->bssid));
6919                 }
6920                 if (priv->ibss_beacon)
6921                         dev_kfree_skb(priv->ibss_beacon);
6922
6923                 priv->ibss_beacon = conf->beacon;
6924         }
6925
6926         if (iwl3945_is_rfkill(priv))
6927                 goto done;
6928
6929         if (conf->bssid && !is_zero_ether_addr(conf->bssid) &&
6930             !is_multicast_ether_addr(conf->bssid)) {
6931                 /* If there is currently a HW scan going on in the background
6932                  * then we need to cancel it else the RXON below will fail. */
6933                 if (iwl3945_scan_cancel_timeout(priv, 100)) {
6934                         IWL_WARNING("Aborted scan still in progress "
6935                                     "after 100ms\n");
6936                         IWL_DEBUG_MAC80211("leaving - scan abort failed.\n");
6937                         mutex_unlock(&priv->mutex);
6938                         return -EAGAIN;
6939                 }
6940                 memcpy(priv->staging_rxon.bssid_addr, conf->bssid, ETH_ALEN);
6941
6942                 /* TODO: Audit driver for usage of these members and see
6943                  * if mac80211 deprecates them (priv->bssid looks like it
6944                  * shouldn't be there, but I haven't scanned the IBSS code
6945                  * to verify) - jpk */
6946                 memcpy(priv->bssid, conf->bssid, ETH_ALEN);
6947
6948                 if (priv->iw_mode == IEEE80211_IF_TYPE_AP)
6949                         iwl3945_config_ap(priv);
6950                 else {
6951                         rc = iwl3945_commit_rxon(priv);
6952                         if ((priv->iw_mode == IEEE80211_IF_TYPE_STA) && rc)
6953                                 iwl3945_add_station(priv,
6954                                         priv->active_rxon.bssid_addr, 1, 0);
6955                 }
6956
6957         } else {
6958                 iwl3945_scan_cancel_timeout(priv, 100);
6959                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
6960                 iwl3945_commit_rxon(priv);
6961         }
6962
6963  done:
6964         spin_lock_irqsave(&priv->lock, flags);
6965         if (!conf->ssid_len)
6966                 memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
6967         else
6968                 memcpy(priv->essid, conf->ssid, conf->ssid_len);
6969
6970         priv->essid_len = conf->ssid_len;
6971         spin_unlock_irqrestore(&priv->lock, flags);
6972
6973         IWL_DEBUG_MAC80211("leave\n");
6974         mutex_unlock(&priv->mutex);
6975
6976         return 0;
6977 }
6978
6979 static void iwl3945_configure_filter(struct ieee80211_hw *hw,
6980                                  unsigned int changed_flags,
6981                                  unsigned int *total_flags,
6982                                  int mc_count, struct dev_addr_list *mc_list)
6983 {
6984         /*
6985          * XXX: dummy
6986          * see also iwl3945_connection_init_rx_config
6987          */
6988         *total_flags = 0;
6989 }
6990
6991 static void iwl3945_mac_remove_interface(struct ieee80211_hw *hw,
6992                                      struct ieee80211_if_init_conf *conf)
6993 {
6994         struct iwl3945_priv *priv = hw->priv;
6995
6996         IWL_DEBUG_MAC80211("enter\n");
6997
6998         mutex_lock(&priv->mutex);
6999
7000         if (iwl3945_is_ready_rf(priv)) {
7001                 iwl3945_scan_cancel_timeout(priv, 100);
7002                 cancel_delayed_work(&priv->post_associate);
7003                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
7004                 iwl3945_commit_rxon(priv);
7005         }
7006         if (priv->vif == conf->vif) {
7007                 priv->vif = NULL;
7008                 memset(priv->bssid, 0, ETH_ALEN);
7009                 memset(priv->essid, 0, IW_ESSID_MAX_SIZE);
7010                 priv->essid_len = 0;
7011         }
7012         mutex_unlock(&priv->mutex);
7013
7014         IWL_DEBUG_MAC80211("leave\n");
7015 }
7016
7017 static int iwl3945_mac_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
7018 {
7019         int rc = 0;
7020         unsigned long flags;
7021         struct iwl3945_priv *priv = hw->priv;
7022
7023         IWL_DEBUG_MAC80211("enter\n");
7024
7025         mutex_lock(&priv->mutex);
7026         spin_lock_irqsave(&priv->lock, flags);
7027
7028         if (!iwl3945_is_ready_rf(priv)) {
7029                 rc = -EIO;
7030                 IWL_DEBUG_MAC80211("leave - not ready or exit pending\n");
7031                 goto out_unlock;
7032         }
7033
7034         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {    /* APs don't scan */
7035                 rc = -EIO;
7036                 IWL_ERROR("ERROR: APs don't scan\n");
7037                 goto out_unlock;
7038         }
7039
7040         /* we don't schedule scan within next_scan_jiffies period */
7041         if (priv->next_scan_jiffies &&
7042                         time_after(priv->next_scan_jiffies, jiffies)) {
7043                 rc = -EAGAIN;
7044                 goto out_unlock;
7045         }
7046         /* if we just finished scan ask for delay */
7047         if (priv->last_scan_jiffies && time_after(priv->last_scan_jiffies +
7048                                 IWL_DELAY_NEXT_SCAN, jiffies)) {
7049                 rc = -EAGAIN;
7050                 goto out_unlock;
7051         }
7052         if (len) {
7053                 IWL_DEBUG_SCAN("direct scan for %s [%d]\n ",
7054                                iwl3945_escape_essid(ssid, len), (int)len);
7055
7056                 priv->one_direct_scan = 1;
7057                 priv->direct_ssid_len = (u8)
7058                     min((u8) len, (u8) IW_ESSID_MAX_SIZE);
7059                 memcpy(priv->direct_ssid, ssid, priv->direct_ssid_len);
7060         } else
7061                 priv->one_direct_scan = 0;
7062
7063         rc = iwl3945_scan_initiate(priv);
7064
7065         IWL_DEBUG_MAC80211("leave\n");
7066
7067 out_unlock:
7068         spin_unlock_irqrestore(&priv->lock, flags);
7069         mutex_unlock(&priv->mutex);
7070
7071         return rc;
7072 }
7073
7074 static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
7075                            const u8 *local_addr, const u8 *addr,
7076                            struct ieee80211_key_conf *key)
7077 {
7078         struct iwl3945_priv *priv = hw->priv;
7079         int rc = 0;
7080         u8 sta_id;
7081
7082         IWL_DEBUG_MAC80211("enter\n");
7083
7084         if (!iwl3945_param_hwcrypto) {
7085                 IWL_DEBUG_MAC80211("leave - hwcrypto disabled\n");
7086                 return -EOPNOTSUPP;
7087         }
7088
7089         if (is_zero_ether_addr(addr))
7090                 /* only support pairwise keys */
7091                 return -EOPNOTSUPP;
7092
7093         sta_id = iwl3945_hw_find_station(priv, addr);
7094         if (sta_id == IWL_INVALID_STATION) {
7095                 DECLARE_MAC_BUF(mac);
7096
7097                 IWL_DEBUG_MAC80211("leave - %s not in station map.\n",
7098                                    print_mac(mac, addr));
7099                 return -EINVAL;
7100         }
7101
7102         mutex_lock(&priv->mutex);
7103
7104         iwl3945_scan_cancel_timeout(priv, 100);
7105
7106         switch (cmd) {
7107         case  SET_KEY:
7108                 rc = iwl3945_update_sta_key_info(priv, key, sta_id);
7109                 if (!rc) {
7110                         iwl3945_set_rxon_hwcrypto(priv, 1);
7111                         iwl3945_commit_rxon(priv);
7112                         key->hw_key_idx = sta_id;
7113                         IWL_DEBUG_MAC80211("set_key success, using hwcrypto\n");
7114                         key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
7115                 }
7116                 break;
7117         case DISABLE_KEY:
7118                 rc = iwl3945_clear_sta_key_info(priv, sta_id);
7119                 if (!rc) {
7120                         iwl3945_set_rxon_hwcrypto(priv, 0);
7121                         iwl3945_commit_rxon(priv);
7122                         IWL_DEBUG_MAC80211("disable hwcrypto key\n");
7123                 }
7124                 break;
7125         default:
7126                 rc = -EINVAL;
7127         }
7128
7129         IWL_DEBUG_MAC80211("leave\n");
7130         mutex_unlock(&priv->mutex);
7131
7132         return rc;
7133 }
7134
7135 static int iwl3945_mac_conf_tx(struct ieee80211_hw *hw, int queue,
7136                            const struct ieee80211_tx_queue_params *params)
7137 {
7138         struct iwl3945_priv *priv = hw->priv;
7139         unsigned long flags;
7140         int q;
7141
7142         IWL_DEBUG_MAC80211("enter\n");
7143
7144         if (!iwl3945_is_ready_rf(priv)) {
7145                 IWL_DEBUG_MAC80211("leave - RF not ready\n");
7146                 return -EIO;
7147         }
7148
7149         if (queue >= AC_NUM) {
7150                 IWL_DEBUG_MAC80211("leave - queue >= AC_NUM %d\n", queue);
7151                 return 0;
7152         }
7153
7154         if (!priv->qos_data.qos_enable) {
7155                 priv->qos_data.qos_active = 0;
7156                 IWL_DEBUG_MAC80211("leave - qos not enabled\n");
7157                 return 0;
7158         }
7159         q = AC_NUM - 1 - queue;
7160
7161         spin_lock_irqsave(&priv->lock, flags);
7162
7163         priv->qos_data.def_qos_parm.ac[q].cw_min = cpu_to_le16(params->cw_min);
7164         priv->qos_data.def_qos_parm.ac[q].cw_max = cpu_to_le16(params->cw_max);
7165         priv->qos_data.def_qos_parm.ac[q].aifsn = params->aifs;
7166         priv->qos_data.def_qos_parm.ac[q].edca_txop =
7167                         cpu_to_le16((params->txop * 32));
7168
7169         priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
7170         priv->qos_data.qos_active = 1;
7171
7172         spin_unlock_irqrestore(&priv->lock, flags);
7173
7174         mutex_lock(&priv->mutex);
7175         if (priv->iw_mode == IEEE80211_IF_TYPE_AP)
7176                 iwl3945_activate_qos(priv, 1);
7177         else if (priv->assoc_id && iwl3945_is_associated(priv))
7178                 iwl3945_activate_qos(priv, 0);
7179
7180         mutex_unlock(&priv->mutex);
7181
7182         IWL_DEBUG_MAC80211("leave\n");
7183         return 0;
7184 }
7185
7186 static int iwl3945_mac_get_tx_stats(struct ieee80211_hw *hw,
7187                                 struct ieee80211_tx_queue_stats *stats)
7188 {
7189         struct iwl3945_priv *priv = hw->priv;
7190         int i, avail;
7191         struct iwl3945_tx_queue *txq;
7192         struct iwl3945_queue *q;
7193         unsigned long flags;
7194
7195         IWL_DEBUG_MAC80211("enter\n");
7196
7197         if (!iwl3945_is_ready_rf(priv)) {
7198                 IWL_DEBUG_MAC80211("leave - RF not ready\n");
7199                 return -EIO;
7200         }
7201
7202         spin_lock_irqsave(&priv->lock, flags);
7203
7204         for (i = 0; i < AC_NUM; i++) {
7205                 txq = &priv->txq[i];
7206                 q = &txq->q;
7207                 avail = iwl3945_queue_space(q);
7208
7209                 stats->data[i].len = q->n_window - avail;
7210                 stats->data[i].limit = q->n_window - q->high_mark;
7211                 stats->data[i].count = q->n_window;
7212
7213         }
7214         spin_unlock_irqrestore(&priv->lock, flags);
7215
7216         IWL_DEBUG_MAC80211("leave\n");
7217
7218         return 0;
7219 }
7220
7221 static int iwl3945_mac_get_stats(struct ieee80211_hw *hw,
7222                              struct ieee80211_low_level_stats *stats)
7223 {
7224         IWL_DEBUG_MAC80211("enter\n");
7225         IWL_DEBUG_MAC80211("leave\n");
7226
7227         return 0;
7228 }
7229
7230 static u64 iwl3945_mac_get_tsf(struct ieee80211_hw *hw)
7231 {
7232         IWL_DEBUG_MAC80211("enter\n");
7233         IWL_DEBUG_MAC80211("leave\n");
7234
7235         return 0;
7236 }
7237
7238 static void iwl3945_mac_reset_tsf(struct ieee80211_hw *hw)
7239 {
7240         struct iwl3945_priv *priv = hw->priv;
7241         unsigned long flags;
7242
7243         mutex_lock(&priv->mutex);
7244         IWL_DEBUG_MAC80211("enter\n");
7245
7246         iwl3945_reset_qos(priv);
7247
7248         cancel_delayed_work(&priv->post_associate);
7249
7250         spin_lock_irqsave(&priv->lock, flags);
7251         priv->assoc_id = 0;
7252         priv->assoc_capability = 0;
7253         priv->call_post_assoc_from_beacon = 0;
7254
7255         /* new association get rid of ibss beacon skb */
7256         if (priv->ibss_beacon)
7257                 dev_kfree_skb(priv->ibss_beacon);
7258
7259         priv->ibss_beacon = NULL;
7260
7261         priv->beacon_int = priv->hw->conf.beacon_int;
7262         priv->timestamp1 = 0;
7263         priv->timestamp0 = 0;
7264         if ((priv->iw_mode == IEEE80211_IF_TYPE_STA))
7265                 priv->beacon_int = 0;
7266
7267         spin_unlock_irqrestore(&priv->lock, flags);
7268
7269         if (!iwl3945_is_ready_rf(priv)) {
7270                 IWL_DEBUG_MAC80211("leave - not ready\n");
7271                 mutex_unlock(&priv->mutex);
7272                 return;
7273         }
7274
7275         /* we are restarting association process
7276          * clear RXON_FILTER_ASSOC_MSK bit
7277         */
7278         if (priv->iw_mode != IEEE80211_IF_TYPE_AP) {
7279                 iwl3945_scan_cancel_timeout(priv, 100);
7280                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
7281                 iwl3945_commit_rxon(priv);
7282         }
7283
7284         /* Per mac80211.h: This is only used in IBSS mode... */
7285         if (priv->iw_mode != IEEE80211_IF_TYPE_IBSS) {
7286
7287                 IWL_DEBUG_MAC80211("leave - not in IBSS\n");
7288                 mutex_unlock(&priv->mutex);
7289                 return;
7290         }
7291
7292         priv->only_active_channel = 0;
7293
7294         iwl3945_set_rate(priv);
7295
7296         mutex_unlock(&priv->mutex);
7297
7298         IWL_DEBUG_MAC80211("leave\n");
7299
7300 }
7301
7302 static int iwl3945_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb,
7303                                  struct ieee80211_tx_control *control)
7304 {
7305         struct iwl3945_priv *priv = hw->priv;
7306         unsigned long flags;
7307
7308         mutex_lock(&priv->mutex);
7309         IWL_DEBUG_MAC80211("enter\n");
7310
7311         if (!iwl3945_is_ready_rf(priv)) {
7312                 IWL_DEBUG_MAC80211("leave - RF not ready\n");
7313                 mutex_unlock(&priv->mutex);
7314                 return -EIO;
7315         }
7316
7317         if (priv->iw_mode != IEEE80211_IF_TYPE_IBSS) {
7318                 IWL_DEBUG_MAC80211("leave - not IBSS\n");
7319                 mutex_unlock(&priv->mutex);
7320                 return -EIO;
7321         }
7322
7323         spin_lock_irqsave(&priv->lock, flags);
7324
7325         if (priv->ibss_beacon)
7326                 dev_kfree_skb(priv->ibss_beacon);
7327
7328         priv->ibss_beacon = skb;
7329
7330         priv->assoc_id = 0;
7331
7332         IWL_DEBUG_MAC80211("leave\n");
7333         spin_unlock_irqrestore(&priv->lock, flags);
7334
7335         iwl3945_reset_qos(priv);
7336
7337         queue_work(priv->workqueue, &priv->post_associate.work);
7338
7339         mutex_unlock(&priv->mutex);
7340
7341         return 0;
7342 }
7343
7344 /*****************************************************************************
7345  *
7346  * sysfs attributes
7347  *
7348  *****************************************************************************/
7349
7350 #ifdef CONFIG_IWL3945_DEBUG
7351
7352 /*
7353  * The following adds a new attribute to the sysfs representation
7354  * of this device driver (i.e. a new file in /sys/bus/pci/drivers/iwl/)
7355  * used for controlling the debug level.
7356  *
7357  * See the level definitions in iwl for details.
7358  */
7359
7360 static ssize_t show_debug_level(struct device_driver *d, char *buf)
7361 {
7362         return sprintf(buf, "0x%08X\n", iwl3945_debug_level);
7363 }
7364 static ssize_t store_debug_level(struct device_driver *d,
7365                                  const char *buf, size_t count)
7366 {
7367         char *p = (char *)buf;
7368         u32 val;
7369
7370         val = simple_strtoul(p, &p, 0);
7371         if (p == buf)
7372                 printk(KERN_INFO DRV_NAME
7373                        ": %s is not in hex or decimal form.\n", buf);
7374         else
7375                 iwl3945_debug_level = val;
7376
7377         return strnlen(buf, count);
7378 }
7379
7380 static DRIVER_ATTR(debug_level, S_IWUSR | S_IRUGO,
7381                    show_debug_level, store_debug_level);
7382
7383 #endif /* CONFIG_IWL3945_DEBUG */
7384
7385 static ssize_t show_rf_kill(struct device *d,
7386                             struct device_attribute *attr, char *buf)
7387 {
7388         /*
7389          * 0 - RF kill not enabled
7390          * 1 - SW based RF kill active (sysfs)
7391          * 2 - HW based RF kill active
7392          * 3 - Both HW and SW based RF kill active
7393          */
7394         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7395         int val = (test_bit(STATUS_RF_KILL_SW, &priv->status) ? 0x1 : 0x0) |
7396                   (test_bit(STATUS_RF_KILL_HW, &priv->status) ? 0x2 : 0x0);
7397
7398         return sprintf(buf, "%i\n", val);
7399 }
7400
7401 static ssize_t store_rf_kill(struct device *d,
7402                              struct device_attribute *attr,
7403                              const char *buf, size_t count)
7404 {
7405         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7406
7407         mutex_lock(&priv->mutex);
7408         iwl3945_radio_kill_sw(priv, buf[0] == '1');
7409         mutex_unlock(&priv->mutex);
7410
7411         return count;
7412 }
7413
7414 static DEVICE_ATTR(rf_kill, S_IWUSR | S_IRUGO, show_rf_kill, store_rf_kill);
7415
7416 static ssize_t show_temperature(struct device *d,
7417                                 struct device_attribute *attr, char *buf)
7418 {
7419         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7420
7421         if (!iwl3945_is_alive(priv))
7422                 return -EAGAIN;
7423
7424         return sprintf(buf, "%d\n", iwl3945_hw_get_temperature(priv));
7425 }
7426
7427 static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
7428
7429 static ssize_t show_rs_window(struct device *d,
7430                               struct device_attribute *attr,
7431                               char *buf)
7432 {
7433         struct iwl3945_priv *priv = d->driver_data;
7434         return iwl3945_fill_rs_info(priv->hw, buf, IWL_AP_ID);
7435 }
7436 static DEVICE_ATTR(rs_window, S_IRUGO, show_rs_window, NULL);
7437
7438 static ssize_t show_tx_power(struct device *d,
7439                              struct device_attribute *attr, char *buf)
7440 {
7441         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7442         return sprintf(buf, "%d\n", priv->user_txpower_limit);
7443 }
7444
7445 static ssize_t store_tx_power(struct device *d,
7446                               struct device_attribute *attr,
7447                               const char *buf, size_t count)
7448 {
7449         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7450         char *p = (char *)buf;
7451         u32 val;
7452
7453         val = simple_strtoul(p, &p, 10);
7454         if (p == buf)
7455                 printk(KERN_INFO DRV_NAME
7456                        ": %s is not in decimal form.\n", buf);
7457         else
7458                 iwl3945_hw_reg_set_txpower(priv, val);
7459
7460         return count;
7461 }
7462
7463 static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
7464
7465 static ssize_t show_flags(struct device *d,
7466                           struct device_attribute *attr, char *buf)
7467 {
7468         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7469
7470         return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
7471 }
7472
7473 static ssize_t store_flags(struct device *d,
7474                            struct device_attribute *attr,
7475                            const char *buf, size_t count)
7476 {
7477         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7478         u32 flags = simple_strtoul(buf, NULL, 0);
7479
7480         mutex_lock(&priv->mutex);
7481         if (le32_to_cpu(priv->staging_rxon.flags) != flags) {
7482                 /* Cancel any currently running scans... */
7483                 if (iwl3945_scan_cancel_timeout(priv, 100))
7484                         IWL_WARNING("Could not cancel scan.\n");
7485                 else {
7486                         IWL_DEBUG_INFO("Committing rxon.flags = 0x%04X\n",
7487                                        flags);
7488                         priv->staging_rxon.flags = cpu_to_le32(flags);
7489                         iwl3945_commit_rxon(priv);
7490                 }
7491         }
7492         mutex_unlock(&priv->mutex);
7493
7494         return count;
7495 }
7496
7497 static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
7498
7499 static ssize_t show_filter_flags(struct device *d,
7500                                  struct device_attribute *attr, char *buf)
7501 {
7502         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7503
7504         return sprintf(buf, "0x%04X\n",
7505                 le32_to_cpu(priv->active_rxon.filter_flags));
7506 }
7507
7508 static ssize_t store_filter_flags(struct device *d,
7509                                   struct device_attribute *attr,
7510                                   const char *buf, size_t count)
7511 {
7512         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7513         u32 filter_flags = simple_strtoul(buf, NULL, 0);
7514
7515         mutex_lock(&priv->mutex);
7516         if (le32_to_cpu(priv->staging_rxon.filter_flags) != filter_flags) {
7517                 /* Cancel any currently running scans... */
7518                 if (iwl3945_scan_cancel_timeout(priv, 100))
7519                         IWL_WARNING("Could not cancel scan.\n");
7520                 else {
7521                         IWL_DEBUG_INFO("Committing rxon.filter_flags = "
7522                                        "0x%04X\n", filter_flags);
7523                         priv->staging_rxon.filter_flags =
7524                                 cpu_to_le32(filter_flags);
7525                         iwl3945_commit_rxon(priv);
7526                 }
7527         }
7528         mutex_unlock(&priv->mutex);
7529
7530         return count;
7531 }
7532
7533 static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
7534                    store_filter_flags);
7535
7536 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
7537
7538 static ssize_t show_measurement(struct device *d,
7539                                 struct device_attribute *attr, char *buf)
7540 {
7541         struct iwl3945_priv *priv = dev_get_drvdata(d);
7542         struct iwl3945_spectrum_notification measure_report;
7543         u32 size = sizeof(measure_report), len = 0, ofs = 0;
7544         u8 *data = (u8 *) & measure_report;
7545         unsigned long flags;
7546
7547         spin_lock_irqsave(&priv->lock, flags);
7548         if (!(priv->measurement_status & MEASUREMENT_READY)) {
7549                 spin_unlock_irqrestore(&priv->lock, flags);
7550                 return 0;
7551         }
7552         memcpy(&measure_report, &priv->measure_report, size);
7553         priv->measurement_status = 0;
7554         spin_unlock_irqrestore(&priv->lock, flags);
7555
7556         while (size && (PAGE_SIZE - len)) {
7557                 hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
7558                                    PAGE_SIZE - len, 1);
7559                 len = strlen(buf);
7560                 if (PAGE_SIZE - len)
7561                         buf[len++] = '\n';
7562
7563                 ofs += 16;
7564                 size -= min(size, 16U);
7565         }
7566
7567         return len;
7568 }
7569
7570 static ssize_t store_measurement(struct device *d,
7571                                  struct device_attribute *attr,
7572                                  const char *buf, size_t count)
7573 {
7574         struct iwl3945_priv *priv = dev_get_drvdata(d);
7575         struct ieee80211_measurement_params params = {
7576                 .channel = le16_to_cpu(priv->active_rxon.channel),
7577                 .start_time = cpu_to_le64(priv->last_tsf),
7578                 .duration = cpu_to_le16(1),
7579         };
7580         u8 type = IWL_MEASURE_BASIC;
7581         u8 buffer[32];
7582         u8 channel;
7583
7584         if (count) {
7585                 char *p = buffer;
7586                 strncpy(buffer, buf, min(sizeof(buffer), count));
7587                 channel = simple_strtoul(p, NULL, 0);
7588                 if (channel)
7589                         params.channel = channel;
7590
7591                 p = buffer;
7592                 while (*p && *p != ' ')
7593                         p++;
7594                 if (*p)
7595                         type = simple_strtoul(p + 1, NULL, 0);
7596         }
7597
7598         IWL_DEBUG_INFO("Invoking measurement of type %d on "
7599                        "channel %d (for '%s')\n", type, params.channel, buf);
7600         iwl3945_get_measurement(priv, &params, type);
7601
7602         return count;
7603 }
7604
7605 static DEVICE_ATTR(measurement, S_IRUSR | S_IWUSR,
7606                    show_measurement, store_measurement);
7607 #endif /* CONFIG_IWL3945_SPECTRUM_MEASUREMENT */
7608
7609 static ssize_t store_retry_rate(struct device *d,
7610                                 struct device_attribute *attr,
7611                                 const char *buf, size_t count)
7612 {
7613         struct iwl3945_priv *priv = dev_get_drvdata(d);
7614
7615         priv->retry_rate = simple_strtoul(buf, NULL, 0);
7616         if (priv->retry_rate <= 0)
7617                 priv->retry_rate = 1;
7618
7619         return count;
7620 }
7621
7622 static ssize_t show_retry_rate(struct device *d,
7623                                struct device_attribute *attr, char *buf)
7624 {
7625         struct iwl3945_priv *priv = dev_get_drvdata(d);
7626         return sprintf(buf, "%d", priv->retry_rate);
7627 }
7628
7629 static DEVICE_ATTR(retry_rate, S_IWUSR | S_IRUSR, show_retry_rate,
7630                    store_retry_rate);
7631
7632 static ssize_t store_power_level(struct device *d,
7633                                  struct device_attribute *attr,
7634                                  const char *buf, size_t count)
7635 {
7636         struct iwl3945_priv *priv = dev_get_drvdata(d);
7637         int rc;
7638         int mode;
7639
7640         mode = simple_strtoul(buf, NULL, 0);
7641         mutex_lock(&priv->mutex);
7642
7643         if (!iwl3945_is_ready(priv)) {
7644                 rc = -EAGAIN;
7645                 goto out;
7646         }
7647
7648         if ((mode < 1) || (mode > IWL_POWER_LIMIT) || (mode == IWL_POWER_AC))
7649                 mode = IWL_POWER_AC;
7650         else
7651                 mode |= IWL_POWER_ENABLED;
7652
7653         if (mode != priv->power_mode) {
7654                 rc = iwl3945_send_power_mode(priv, IWL_POWER_LEVEL(mode));
7655                 if (rc) {
7656                         IWL_DEBUG_MAC80211("failed setting power mode.\n");
7657                         goto out;
7658                 }
7659                 priv->power_mode = mode;
7660         }
7661
7662         rc = count;
7663
7664  out:
7665         mutex_unlock(&priv->mutex);
7666         return rc;
7667 }
7668
7669 #define MAX_WX_STRING 80
7670
7671 /* Values are in microsecond */
7672 static const s32 timeout_duration[] = {
7673         350000,
7674         250000,
7675         75000,
7676         37000,
7677         25000,
7678 };
7679 static const s32 period_duration[] = {
7680         400000,
7681         700000,
7682         1000000,
7683         1000000,
7684         1000000
7685 };
7686
7687 static ssize_t show_power_level(struct device *d,
7688                                 struct device_attribute *attr, char *buf)
7689 {
7690         struct iwl3945_priv *priv = dev_get_drvdata(d);
7691         int level = IWL_POWER_LEVEL(priv->power_mode);
7692         char *p = buf;
7693
7694         p += sprintf(p, "%d ", level);
7695         switch (level) {
7696         case IWL_POWER_MODE_CAM:
7697         case IWL_POWER_AC:
7698                 p += sprintf(p, "(AC)");
7699                 break;
7700         case IWL_POWER_BATTERY:
7701                 p += sprintf(p, "(BATTERY)");
7702                 break;
7703         default:
7704                 p += sprintf(p,
7705                              "(Timeout %dms, Period %dms)",
7706                              timeout_duration[level - 1] / 1000,
7707                              period_duration[level - 1] / 1000);
7708         }
7709
7710         if (!(priv->power_mode & IWL_POWER_ENABLED))
7711                 p += sprintf(p, " OFF\n");
7712         else
7713                 p += sprintf(p, " \n");
7714
7715         return (p - buf + 1);
7716
7717 }
7718
7719 static DEVICE_ATTR(power_level, S_IWUSR | S_IRUSR, show_power_level,
7720                    store_power_level);
7721
7722 static ssize_t show_channels(struct device *d,
7723                              struct device_attribute *attr, char *buf)
7724 {
7725         /* all this shit doesn't belong into sysfs anyway */
7726         return 0;
7727 }
7728
7729 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
7730
7731 static ssize_t show_statistics(struct device *d,
7732                                struct device_attribute *attr, char *buf)
7733 {
7734         struct iwl3945_priv *priv = dev_get_drvdata(d);
7735         u32 size = sizeof(struct iwl3945_notif_statistics);
7736         u32 len = 0, ofs = 0;
7737         u8 *data = (u8 *) & priv->statistics;
7738         int rc = 0;
7739
7740         if (!iwl3945_is_alive(priv))
7741                 return -EAGAIN;
7742
7743         mutex_lock(&priv->mutex);
7744         rc = iwl3945_send_statistics_request(priv);
7745         mutex_unlock(&priv->mutex);
7746
7747         if (rc) {
7748                 len = sprintf(buf,
7749                               "Error sending statistics request: 0x%08X\n", rc);
7750                 return len;
7751         }
7752
7753         while (size && (PAGE_SIZE - len)) {
7754                 hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
7755                                    PAGE_SIZE - len, 1);
7756                 len = strlen(buf);
7757                 if (PAGE_SIZE - len)
7758                         buf[len++] = '\n';
7759
7760                 ofs += 16;
7761                 size -= min(size, 16U);
7762         }
7763
7764         return len;
7765 }
7766
7767 static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
7768
7769 static ssize_t show_antenna(struct device *d,
7770                             struct device_attribute *attr, char *buf)
7771 {
7772         struct iwl3945_priv *priv = dev_get_drvdata(d);
7773
7774         if (!iwl3945_is_alive(priv))
7775                 return -EAGAIN;
7776
7777         return sprintf(buf, "%d\n", priv->antenna);
7778 }
7779
7780 static ssize_t store_antenna(struct device *d,
7781                              struct device_attribute *attr,
7782                              const char *buf, size_t count)
7783 {
7784         int ant;
7785         struct iwl3945_priv *priv = dev_get_drvdata(d);
7786
7787         if (count == 0)
7788                 return 0;
7789
7790         if (sscanf(buf, "%1i", &ant) != 1) {
7791                 IWL_DEBUG_INFO("not in hex or decimal form.\n");
7792                 return count;
7793         }
7794
7795         if ((ant >= 0) && (ant <= 2)) {
7796                 IWL_DEBUG_INFO("Setting antenna select to %d.\n", ant);
7797                 priv->antenna = (enum iwl3945_antenna)ant;
7798         } else
7799                 IWL_DEBUG_INFO("Bad antenna select value %d.\n", ant);
7800
7801
7802         return count;
7803 }
7804
7805 static DEVICE_ATTR(antenna, S_IWUSR | S_IRUGO, show_antenna, store_antenna);
7806
7807 static ssize_t show_status(struct device *d,
7808                            struct device_attribute *attr, char *buf)
7809 {
7810         struct iwl3945_priv *priv = (struct iwl3945_priv *)d->driver_data;
7811         if (!iwl3945_is_alive(priv))
7812                 return -EAGAIN;
7813         return sprintf(buf, "0x%08x\n", (int)priv->status);
7814 }
7815
7816 static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
7817
7818 static ssize_t dump_error_log(struct device *d,
7819                               struct device_attribute *attr,
7820                               const char *buf, size_t count)
7821 {
7822         char *p = (char *)buf;
7823
7824         if (p[0] == '1')
7825                 iwl3945_dump_nic_error_log((struct iwl3945_priv *)d->driver_data);
7826
7827         return strnlen(buf, count);
7828 }
7829
7830 static DEVICE_ATTR(dump_errors, S_IWUSR, NULL, dump_error_log);
7831
7832 static ssize_t dump_event_log(struct device *d,
7833                               struct device_attribute *attr,
7834                               const char *buf, size_t count)
7835 {
7836         char *p = (char *)buf;
7837
7838         if (p[0] == '1')
7839                 iwl3945_dump_nic_event_log((struct iwl3945_priv *)d->driver_data);
7840
7841         return strnlen(buf, count);
7842 }
7843
7844 static DEVICE_ATTR(dump_events, S_IWUSR, NULL, dump_event_log);
7845
7846 /*****************************************************************************
7847  *
7848  * driver setup and teardown
7849  *
7850  *****************************************************************************/
7851
7852 static void iwl3945_setup_deferred_work(struct iwl3945_priv *priv)
7853 {
7854         priv->workqueue = create_workqueue(DRV_NAME);
7855
7856         init_waitqueue_head(&priv->wait_command_queue);
7857
7858         INIT_WORK(&priv->up, iwl3945_bg_up);
7859         INIT_WORK(&priv->restart, iwl3945_bg_restart);
7860         INIT_WORK(&priv->rx_replenish, iwl3945_bg_rx_replenish);
7861         INIT_WORK(&priv->scan_completed, iwl3945_bg_scan_completed);
7862         INIT_WORK(&priv->request_scan, iwl3945_bg_request_scan);
7863         INIT_WORK(&priv->abort_scan, iwl3945_bg_abort_scan);
7864         INIT_WORK(&priv->rf_kill, iwl3945_bg_rf_kill);
7865         INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
7866         INIT_DELAYED_WORK(&priv->post_associate, iwl3945_bg_post_associate);
7867         INIT_DELAYED_WORK(&priv->init_alive_start, iwl3945_bg_init_alive_start);
7868         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
7869         INIT_DELAYED_WORK(&priv->scan_check, iwl3945_bg_scan_check);
7870
7871         iwl3945_hw_setup_deferred_work(priv);
7872
7873         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
7874                      iwl3945_irq_tasklet, (unsigned long)priv);
7875 }
7876
7877 static void iwl3945_cancel_deferred_work(struct iwl3945_priv *priv)
7878 {
7879         iwl3945_hw_cancel_deferred_work(priv);
7880
7881         cancel_delayed_work_sync(&priv->init_alive_start);
7882         cancel_delayed_work(&priv->scan_check);
7883         cancel_delayed_work(&priv->alive_start);
7884         cancel_delayed_work(&priv->post_associate);
7885         cancel_work_sync(&priv->beacon_update);
7886 }
7887
7888 static struct attribute *iwl3945_sysfs_entries[] = {
7889         &dev_attr_antenna.attr,
7890         &dev_attr_channels.attr,
7891         &dev_attr_dump_errors.attr,
7892         &dev_attr_dump_events.attr,
7893         &dev_attr_flags.attr,
7894         &dev_attr_filter_flags.attr,
7895 #ifdef CONFIG_IWL3945_SPECTRUM_MEASUREMENT
7896         &dev_attr_measurement.attr,
7897 #endif
7898         &dev_attr_power_level.attr,
7899         &dev_attr_retry_rate.attr,
7900         &dev_attr_rf_kill.attr,
7901         &dev_attr_rs_window.attr,
7902         &dev_attr_statistics.attr,
7903         &dev_attr_status.attr,
7904         &dev_attr_temperature.attr,
7905         &dev_attr_tx_power.attr,
7906
7907         NULL
7908 };
7909
7910 static struct attribute_group iwl3945_attribute_group = {
7911         .name = NULL,           /* put in device directory */
7912         .attrs = iwl3945_sysfs_entries,
7913 };
7914
7915 static struct ieee80211_ops iwl3945_hw_ops = {
7916         .tx = iwl3945_mac_tx,
7917         .start = iwl3945_mac_start,
7918         .stop = iwl3945_mac_stop,
7919         .add_interface = iwl3945_mac_add_interface,
7920         .remove_interface = iwl3945_mac_remove_interface,
7921         .config = iwl3945_mac_config,
7922         .config_interface = iwl3945_mac_config_interface,
7923         .configure_filter = iwl3945_configure_filter,
7924         .set_key = iwl3945_mac_set_key,
7925         .get_stats = iwl3945_mac_get_stats,
7926         .get_tx_stats = iwl3945_mac_get_tx_stats,
7927         .conf_tx = iwl3945_mac_conf_tx,
7928         .get_tsf = iwl3945_mac_get_tsf,
7929         .reset_tsf = iwl3945_mac_reset_tsf,
7930         .beacon_update = iwl3945_mac_beacon_update,
7931         .hw_scan = iwl3945_mac_hw_scan
7932 };
7933
7934 static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
7935 {
7936         int err = 0;
7937         struct iwl3945_priv *priv;
7938         struct ieee80211_hw *hw;
7939         struct iwl_3945_cfg *cfg = (struct iwl_3945_cfg *)(ent->driver_data);
7940         int i;
7941         DECLARE_MAC_BUF(mac);
7942
7943         /* Disabling hardware scan means that mac80211 will perform scans
7944          * "the hard way", rather than using device's scan. */
7945         if (iwl3945_param_disable_hw_scan) {
7946                 IWL_DEBUG_INFO("Disabling hw_scan\n");
7947                 iwl3945_hw_ops.hw_scan = NULL;
7948         }
7949
7950         if ((iwl3945_param_queues_num > IWL_MAX_NUM_QUEUES) ||
7951             (iwl3945_param_queues_num < IWL_MIN_NUM_QUEUES)) {
7952                 IWL_ERROR("invalid queues_num, should be between %d and %d\n",
7953                           IWL_MIN_NUM_QUEUES, IWL_MAX_NUM_QUEUES);
7954                 err = -EINVAL;
7955                 goto out;
7956         }
7957
7958         /* mac80211 allocates memory for this device instance, including
7959          *   space for this driver's private structure */
7960         hw = ieee80211_alloc_hw(sizeof(struct iwl3945_priv), &iwl3945_hw_ops);
7961         if (hw == NULL) {
7962                 IWL_ERROR("Can not allocate network device\n");
7963                 err = -ENOMEM;
7964                 goto out;
7965         }
7966         SET_IEEE80211_DEV(hw, &pdev->dev);
7967
7968         hw->rate_control_algorithm = "iwl-3945-rs";
7969
7970         IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
7971         priv = hw->priv;
7972         priv->hw = hw;
7973
7974         priv->pci_dev = pdev;
7975         priv->cfg = cfg;
7976
7977         /* Select antenna (may be helpful if only one antenna is connected) */
7978         priv->antenna = (enum iwl3945_antenna)iwl3945_param_antenna;
7979 #ifdef CONFIG_IWL3945_DEBUG
7980         iwl3945_debug_level = iwl3945_param_debug;
7981         atomic_set(&priv->restrict_refcnt, 0);
7982 #endif
7983         priv->retry_rate = 1;
7984
7985         priv->ibss_beacon = NULL;
7986
7987         /* Tell mac80211 and its clients (e.g. Wireless Extensions)
7988          *   the range of signal quality values that we'll provide.
7989          * Negative values for level/noise indicate that we'll provide dBm.
7990          * For WE, at least, non-0 values here *enable* display of values
7991          *   in app (iwconfig). */
7992         hw->max_rssi = -20;     /* signal level, negative indicates dBm */
7993         hw->max_noise = -20;    /* noise level, negative indicates dBm */
7994         hw->max_signal = 100;   /* link quality indication (%) */
7995
7996         /* Tell mac80211 our Tx characteristics */
7997         hw->flags = IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE;
7998
7999         /* 4 EDCA QOS priorities */
8000         hw->queues = 4;
8001
8002         spin_lock_init(&priv->lock);
8003         spin_lock_init(&priv->power_data.lock);
8004         spin_lock_init(&priv->sta_lock);
8005         spin_lock_init(&priv->hcmd_lock);
8006
8007         for (i = 0; i < IWL_IBSS_MAC_HASH_SIZE; i++)
8008                 INIT_LIST_HEAD(&priv->ibss_mac_hash[i]);
8009
8010         INIT_LIST_HEAD(&priv->free_frames);
8011
8012         mutex_init(&priv->mutex);
8013         if (pci_enable_device(pdev)) {
8014                 err = -ENODEV;
8015                 goto out_ieee80211_free_hw;
8016         }
8017
8018         pci_set_master(pdev);
8019
8020         /* Clear the driver's (not device's) station table */
8021         iwl3945_clear_stations_table(priv);
8022
8023         priv->data_retry_limit = -1;
8024         priv->ieee_channels = NULL;
8025         priv->ieee_rates = NULL;
8026         priv->band = IEEE80211_BAND_2GHZ;
8027
8028         err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
8029         if (!err)
8030                 err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
8031         if (err) {
8032                 printk(KERN_WARNING DRV_NAME ": No suitable DMA available.\n");
8033                 goto out_pci_disable_device;
8034         }
8035
8036         pci_set_drvdata(pdev, priv);
8037         err = pci_request_regions(pdev, DRV_NAME);
8038         if (err)
8039                 goto out_pci_disable_device;
8040
8041         /* We disable the RETRY_TIMEOUT register (0x41) to keep
8042          * PCI Tx retries from interfering with C3 CPU state */
8043         pci_write_config_byte(pdev, 0x41, 0x00);
8044
8045         priv->hw_base = pci_iomap(pdev, 0, 0);
8046         if (!priv->hw_base) {
8047                 err = -ENODEV;
8048                 goto out_pci_release_regions;
8049         }
8050
8051         IWL_DEBUG_INFO("pci_resource_len = 0x%08llx\n",
8052                         (unsigned long long) pci_resource_len(pdev, 0));
8053         IWL_DEBUG_INFO("pci_resource_base = %p\n", priv->hw_base);
8054
8055         /* Initialize module parameter values here */
8056
8057         /* Disable radio (SW RF KILL) via parameter when loading driver */
8058         if (iwl3945_param_disable) {
8059                 set_bit(STATUS_RF_KILL_SW, &priv->status);
8060                 IWL_DEBUG_INFO("Radio disabled.\n");
8061         }
8062
8063         priv->iw_mode = IEEE80211_IF_TYPE_STA;
8064
8065         printk(KERN_INFO DRV_NAME
8066                 ": Detected Intel Wireless WiFi Link %s\n", priv->cfg->name);
8067
8068         /* Device-specific setup */
8069         if (iwl3945_hw_set_hw_setting(priv)) {
8070                 IWL_ERROR("failed to set hw settings\n");
8071                 goto out_iounmap;
8072         }
8073
8074         if (iwl3945_param_qos_enable)
8075                 priv->qos_data.qos_enable = 1;
8076
8077         iwl3945_reset_qos(priv);
8078
8079         priv->qos_data.qos_active = 0;
8080         priv->qos_data.qos_cap.val = 0;
8081
8082         iwl3945_set_rxon_channel(priv, IEEE80211_BAND_2GHZ, 6);
8083         iwl3945_setup_deferred_work(priv);
8084         iwl3945_setup_rx_handlers(priv);
8085
8086         priv->rates_mask = IWL_RATES_MASK;
8087         /* If power management is turned on, default to AC mode */
8088         priv->power_mode = IWL_POWER_AC;
8089         priv->user_txpower_limit = IWL_DEFAULT_TX_POWER;
8090
8091         iwl3945_disable_interrupts(priv);
8092
8093         err = sysfs_create_group(&pdev->dev.kobj, &iwl3945_attribute_group);
8094         if (err) {
8095                 IWL_ERROR("failed to create sysfs device attributes\n");
8096                 goto out_release_irq;
8097         }
8098
8099         /* nic init */
8100         iwl3945_set_bit(priv, CSR_GIO_CHICKEN_BITS,
8101                     CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
8102
8103         iwl3945_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
8104         err = iwl3945_poll_bit(priv, CSR_GP_CNTRL,
8105                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
8106                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
8107         if (err < 0) {
8108                 IWL_DEBUG_INFO("Failed to init the card\n");
8109                 goto out_remove_sysfs;
8110         }
8111         /* Read the EEPROM */
8112         err = iwl3945_eeprom_init(priv);
8113         if (err) {
8114                 IWL_ERROR("Unable to init EEPROM\n");
8115                 goto out_remove_sysfs;
8116         }
8117         /* MAC Address location in EEPROM same for 3945/4965 */
8118         get_eeprom_mac(priv, priv->mac_addr);
8119         IWL_DEBUG_INFO("MAC address: %s\n", print_mac(mac, priv->mac_addr));
8120         SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
8121
8122         err = iwl3945_init_channel_map(priv);
8123         if (err) {
8124                 IWL_ERROR("initializing regulatory failed: %d\n", err);
8125                 goto out_remove_sysfs;
8126         }
8127
8128         err = iwl3945_init_geos(priv);
8129         if (err) {
8130                 IWL_ERROR("initializing geos failed: %d\n", err);
8131                 goto out_free_channel_map;
8132         }
8133
8134         iwl3945_rate_control_register(priv->hw);
8135         err = ieee80211_register_hw(priv->hw);
8136         if (err) {
8137                 IWL_ERROR("Failed to register network device (error %d)\n", err);
8138                 goto out_free_geos;
8139         }
8140
8141         priv->hw->conf.beacon_int = 100;
8142         priv->mac80211_registered = 1;
8143         pci_save_state(pdev);
8144         pci_disable_device(pdev);
8145
8146         return 0;
8147
8148  out_free_geos:
8149         iwl3945_free_geos(priv);
8150  out_free_channel_map:
8151         iwl3945_free_channel_map(priv);
8152  out_remove_sysfs:
8153         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
8154
8155  out_release_irq:
8156         destroy_workqueue(priv->workqueue);
8157         priv->workqueue = NULL;
8158         iwl3945_unset_hw_setting(priv);
8159
8160  out_iounmap:
8161         pci_iounmap(pdev, priv->hw_base);
8162  out_pci_release_regions:
8163         pci_release_regions(pdev);
8164  out_pci_disable_device:
8165         pci_disable_device(pdev);
8166         pci_set_drvdata(pdev, NULL);
8167  out_ieee80211_free_hw:
8168         ieee80211_free_hw(priv->hw);
8169  out:
8170         return err;
8171 }
8172
8173 static void iwl3945_pci_remove(struct pci_dev *pdev)
8174 {
8175         struct iwl3945_priv *priv = pci_get_drvdata(pdev);
8176         struct list_head *p, *q;
8177         int i;
8178
8179         if (!priv)
8180                 return;
8181
8182         IWL_DEBUG_INFO("*** UNLOAD DRIVER ***\n");
8183
8184         set_bit(STATUS_EXIT_PENDING, &priv->status);
8185
8186         iwl3945_down(priv);
8187
8188         /* Free MAC hash list for ADHOC */
8189         for (i = 0; i < IWL_IBSS_MAC_HASH_SIZE; i++) {
8190                 list_for_each_safe(p, q, &priv->ibss_mac_hash[i]) {
8191                         list_del(p);
8192                         kfree(list_entry(p, struct iwl3945_ibss_seq, list));
8193                 }
8194         }
8195
8196         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
8197
8198         iwl3945_dealloc_ucode_pci(priv);
8199
8200         if (priv->rxq.bd)
8201                 iwl3945_rx_queue_free(priv, &priv->rxq);
8202         iwl3945_hw_txq_ctx_free(priv);
8203
8204         iwl3945_unset_hw_setting(priv);
8205         iwl3945_clear_stations_table(priv);
8206
8207         if (priv->mac80211_registered) {
8208                 ieee80211_unregister_hw(priv->hw);
8209                 iwl3945_rate_control_unregister(priv->hw);
8210         }
8211
8212         /*netif_stop_queue(dev); */
8213         flush_workqueue(priv->workqueue);
8214
8215         /* ieee80211_unregister_hw calls iwl3945_mac_stop, which flushes
8216          * priv->workqueue... so we can't take down the workqueue
8217          * until now... */
8218         destroy_workqueue(priv->workqueue);
8219         priv->workqueue = NULL;
8220
8221         pci_iounmap(pdev, priv->hw_base);
8222         pci_release_regions(pdev);
8223         pci_disable_device(pdev);
8224         pci_set_drvdata(pdev, NULL);
8225
8226         iwl3945_free_channel_map(priv);
8227         iwl3945_free_geos(priv);
8228
8229         if (priv->ibss_beacon)
8230                 dev_kfree_skb(priv->ibss_beacon);
8231
8232         ieee80211_free_hw(priv->hw);
8233 }
8234
8235 #ifdef CONFIG_PM
8236
8237 static int iwl3945_pci_suspend(struct pci_dev *pdev, pm_message_t state)
8238 {
8239         struct iwl3945_priv *priv = pci_get_drvdata(pdev);
8240
8241         if (priv->is_open) {
8242                 set_bit(STATUS_IN_SUSPEND, &priv->status);
8243                 iwl3945_mac_stop(priv->hw);
8244                 priv->is_open = 1;
8245         }
8246
8247         pci_set_power_state(pdev, PCI_D3hot);
8248
8249         return 0;
8250 }
8251
8252 static int iwl3945_pci_resume(struct pci_dev *pdev)
8253 {
8254         struct iwl3945_priv *priv = pci_get_drvdata(pdev);
8255
8256         pci_set_power_state(pdev, PCI_D0);
8257
8258         if (priv->is_open)
8259                 iwl3945_mac_start(priv->hw);
8260
8261         clear_bit(STATUS_IN_SUSPEND, &priv->status);
8262         return 0;
8263 }
8264
8265 #endif /* CONFIG_PM */
8266
8267 /*****************************************************************************
8268  *
8269  * driver and module entry point
8270  *
8271  *****************************************************************************/
8272
8273 static struct pci_driver iwl3945_driver = {
8274         .name = DRV_NAME,
8275         .id_table = iwl3945_hw_card_ids,
8276         .probe = iwl3945_pci_probe,
8277         .remove = __devexit_p(iwl3945_pci_remove),
8278 #ifdef CONFIG_PM
8279         .suspend = iwl3945_pci_suspend,
8280         .resume = iwl3945_pci_resume,
8281 #endif
8282 };
8283
8284 static int __init iwl3945_init(void)
8285 {
8286
8287         int ret;
8288         printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", " DRV_VERSION "\n");
8289         printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
8290         ret = pci_register_driver(&iwl3945_driver);
8291         if (ret) {
8292                 IWL_ERROR("Unable to initialize PCI module\n");
8293                 return ret;
8294         }
8295 #ifdef CONFIG_IWL3945_DEBUG
8296         ret = driver_create_file(&iwl3945_driver.driver, &driver_attr_debug_level);
8297         if (ret) {
8298                 IWL_ERROR("Unable to create driver sysfs file\n");
8299                 pci_unregister_driver(&iwl3945_driver);
8300                 return ret;
8301         }
8302 #endif
8303
8304         return ret;
8305 }
8306
8307 static void __exit iwl3945_exit(void)
8308 {
8309 #ifdef CONFIG_IWL3945_DEBUG
8310         driver_remove_file(&iwl3945_driver.driver, &driver_attr_debug_level);
8311 #endif
8312         pci_unregister_driver(&iwl3945_driver);
8313 }
8314
8315 module_param_named(antenna, iwl3945_param_antenna, int, 0444);
8316 MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
8317 module_param_named(disable, iwl3945_param_disable, int, 0444);
8318 MODULE_PARM_DESC(disable, "manually disable the radio (default 0 [radio on])");
8319 module_param_named(hwcrypto, iwl3945_param_hwcrypto, int, 0444);
8320 MODULE_PARM_DESC(hwcrypto,
8321                  "using hardware crypto engine (default 0 [software])\n");
8322 module_param_named(debug, iwl3945_param_debug, int, 0444);
8323 MODULE_PARM_DESC(debug, "debug output mask");
8324 module_param_named(disable_hw_scan, iwl3945_param_disable_hw_scan, int, 0444);
8325 MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
8326
8327 module_param_named(queues_num, iwl3945_param_queues_num, int, 0444);
8328 MODULE_PARM_DESC(queues_num, "number of hw queues.");
8329
8330 /* QoS */
8331 module_param_named(qos_enable, iwl3945_param_qos_enable, int, 0444);
8332 MODULE_PARM_DESC(qos_enable, "enable all QoS functionality");
8333
8334 module_exit(iwl3945_exit);
8335 module_init(iwl3945_init);