SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invokations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They  call copy_[to|from]_bap() and
  66 *                       cmd_access().   These functions operate on the
  67 *                       RIDs and buffers without validation.  The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 /*================================================================*/
 114 /* System Includes */
 115 #define WLAN_DBVAR      prism2_debug
 116
 117 #include <linux/version.h>
 118
 119 #include <linux/module.h>
 120 #include <linux/kernel.h>
 121 #include <linux/sched.h>
 122 #include <linux/types.h>
 123 #include <linux/slab.h>
 124 #include <linux/wireless.h>
 125 #include <linux/netdevice.h>
 126 #include <linux/timer.h>
 127 #include <asm/io.h>
 128 #include <linux/delay.h>
 129 #include <asm/byteorder.h>
 130 #include <asm/bitops.h>
 131 #include <linux/list.h>
 132 #include <linux/usb.h>
 133 #include <linux/byteorder/generic.h>
 134
 135 #include "wlan_compat.h"
 136
 137 #define SUBMIT_URB(u,f)  usb_submit_urb(u,f)
 138
 139 /*================================================================*/
 140 /* Project Includes */
 141
 142 #include "p80211types.h"
 143 #include "p80211hdr.h"
 144 #include "p80211mgmt.h"
 145 #include "p80211conv.h"
 146 #include "p80211msg.h"
 147 #include "p80211netdev.h"
 148 #include "p80211req.h"
 149 #include "p80211metadef.h"
 150 #include "p80211metastruct.h"
 151 #include "hfa384x.h"
 152 #include "prism2mgmt.h"
 153
 154 /*================================================================*/
 155 /* Local Constants */
 156
 157 enum cmd_mode
 158 {
 159   DOWAIT = 0,
 160   DOASYNC
 161 };
 162 typedef enum cmd_mode CMD_MODE;
 163
 164 #define THROTTLE_JIFFIES        (HZ/8)
 165 #define URB_ASYNC_UNLINK 0
 166 #define USB_QUEUE_BULK 0
 167
 168 /*================================================================*/
 169 /* Local Macros */
 170
 171 #define ROUNDUP64(a) (((a)+63)&~63)
 172
 173 /*================================================================*/
 174 /* Local Types */
 175
 176 /*================================================================*/
 177 /* Local Static Definitions */
 178 extern int prism2_debug;
 179
 180 /*================================================================*/
 181 /* Local Function Declarations */
 182
 183 #ifdef DEBUG_USB
 184 static void
 185 dbprint_urb(struct urb* urb);
 186 #endif
 187
 188 static void
 189 hfa384x_int_rxmonitor(
 190         wlandevice_t *wlandev,
 191         hfa384x_usb_rxfrm_t *rxfrm);
 192
 193 static void
 194 hfa384x_usb_defer(struct work_struct *data);
 195
 196 static int
 197 submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 198
 199 static int
 200 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 201
 202 /*---------------------------------------------------*/
 203 /* Callbacks */
 204 static void
 205 hfa384x_usbout_callback(struct urb *urb);
 206 static void
 207 hfa384x_ctlxout_callback(struct urb *urb);
 208 static void
 209 hfa384x_usbin_callback(struct urb *urb);
 210
 211 static void
 212 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 213
 214 static void
 215 hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 216
 217 static void
 218 hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 219
 220 static void
 221 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 222
 223 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 224                                int urb_status);
 225
 226 /*---------------------------------------------------*/
 227 /* Functions to support the prism2 usb command queue */
 228
 229 static void
 230 hfa384x_usbctlxq_run(hfa384x_t *hw);
 231
 232 static void
 233 hfa384x_usbctlx_reqtimerfn(unsigned long data);
 234
 235 static void
 236 hfa384x_usbctlx_resptimerfn(unsigned long data);
 237
 238 static void
 239 hfa384x_usb_throttlefn(unsigned long data);
 240
 241 static void
 242 hfa384x_usbctlx_completion_task(unsigned long data);
 243
 244 static void
 245 hfa384x_usbctlx_reaper_task(unsigned long data);
 246
 247 static int
 248 hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 249
 250 static void
 251 unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 252
 253 struct usbctlx_completor
 254 {
 255         int (*complete)(struct usbctlx_completor*);
 256 };
 257 typedef struct usbctlx_completor usbctlx_completor_t;
 258
 259 static int
 260 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 261                               hfa384x_usbctlx_t *ctlx,
 262                               usbctlx_completor_t *completor);
 263
 264 static int
 265 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 266
 267 static void
 268 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 269
 270 static void
 271 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 272
 273 static int
 274 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 275                    hfa384x_cmdresult_t *result);
 276
 277 static void
 278 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 279                        hfa384x_rridresult_t *result);
 280
 281 /*---------------------------------------------------*/
 282 /* Low level req/resp CTLX formatters and submitters */
 283 static int
 284 hfa384x_docmd(
 285         hfa384x_t *hw,
 286         CMD_MODE mode,
 287         hfa384x_metacmd_t *cmd,
 288         ctlx_cmdcb_t cmdcb,
 289         ctlx_usercb_t usercb,
 290         void    *usercb_data);
 291
 292 static int
 293 hfa384x_dorrid(
 294         hfa384x_t *hw,
 295         CMD_MODE mode,
 296         u16     rid,
 297         void    *riddata,
 298         unsigned int    riddatalen,
 299         ctlx_cmdcb_t cmdcb,
 300         ctlx_usercb_t usercb,
 301         void    *usercb_data);
 302
 303 static int
 304 hfa384x_dowrid(
 305         hfa384x_t *hw,
 306         CMD_MODE mode,
 307         u16     rid,
 308         void    *riddata,
 309         unsigned int    riddatalen,
 310         ctlx_cmdcb_t cmdcb,
 311         ctlx_usercb_t usercb,
 312         void    *usercb_data);
 313
 314 static int
 315 hfa384x_dormem(
 316         hfa384x_t *hw,
 317         CMD_MODE mode,
 318         u16     page,
 319         u16     offset,
 320         void    *data,
 321         unsigned int    len,
 322         ctlx_cmdcb_t cmdcb,
 323         ctlx_usercb_t usercb,
 324         void    *usercb_data);
 325
 326 static int
 327 hfa384x_dowmem(
 328         hfa384x_t *hw,
 329         CMD_MODE mode,
 330         u16     page,
 331         u16     offset,
 332         void    *data,
 333         unsigned int    len,
 334         ctlx_cmdcb_t cmdcb,
 335         ctlx_usercb_t usercb,
 336         void    *usercb_data);
 337
 338 static int
 339 hfa384x_isgood_pdrcode(u16 pdrcode);
 340
 341 /*================================================================*/
 342 /* Function Definitions */
 343 static inline const char* ctlxstr(CTLX_STATE s)
 344 {
 345         static const char* ctlx_str[] = {
 346                 "Initial state",
 347                 "Complete",
 348                 "Request failed",
 349                 "Request pending",
 350                 "Request packet submitted",
 351                 "Request packet completed",
 352                 "Response packet completed"
 353         };
 354
 355         return ctlx_str[s];
 356 };
 357
 358
 359 static inline hfa384x_usbctlx_t*
 360 get_active_ctlx(hfa384x_t *hw)
 361 {
 362         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 363 }
 364
 365
 366 #ifdef DEBUG_USB
 367 void
 368 dbprint_urb(struct urb* urb)
 369 {
 370         WLAN_LOG_DEBUG(3,"urb->pipe=0x%08x\n", urb->pipe);
 371         WLAN_LOG_DEBUG(3,"urb->status=0x%08x\n", urb->status);
 372         WLAN_LOG_DEBUG(3,"urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 373         WLAN_LOG_DEBUG(3,"urb->transfer_buffer=0x%08x\n", (unsigned int)urb->transfer_buffer);
 374         WLAN_LOG_DEBUG(3,"urb->transfer_buffer_length=0x%08x\n", urb->transfer_buffer_length);
 375         WLAN_LOG_DEBUG(3,"urb->actual_length=0x%08x\n", urb->actual_length);
 376         WLAN_LOG_DEBUG(3,"urb->bandwidth=0x%08x\n", urb->bandwidth);
 377         WLAN_LOG_DEBUG(3,"urb->setup_packet(ctl)=0x%08x\n", (unsigned int)urb->setup_packet);
 378         WLAN_LOG_DEBUG(3,"urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 379         WLAN_LOG_DEBUG(3,"urb->interval(irq)=0x%08x\n", urb->interval);
 380         WLAN_LOG_DEBUG(3,"urb->error_count(iso)=0x%08x\n", urb->error_count);
 381         WLAN_LOG_DEBUG(3,"urb->timeout=0x%08x\n", urb->timeout);
 382         WLAN_LOG_DEBUG(3,"urb->context=0x%08x\n", (unsigned int)urb->context);
 383         WLAN_LOG_DEBUG(3,"urb->complete=0x%08x\n", (unsigned int)urb->complete);
 384 }
 385 #endif
 386
 387
 388 /*----------------------------------------------------------------
 389 * submit_rx_urb
 390 *
 391 * Listen for input data on the BULK-IN pipe. If the pipe has
 392 * stalled then schedule it to be reset.
 393 *
 394 * Arguments:
 395 *       hw              device struct
 396 *       memflags        memory allocation flags
 397 *
 398 * Returns:
 399 *       error code from submission
 400 *
 401 * Call context:
 402 *       Any
 403 ----------------------------------------------------------------*/
 404 static int
 405 submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 406 {
 407         struct sk_buff *skb;
 408         int result;
 409
 410         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 411         if (skb == NULL) {
 412                 result = -ENOMEM;
 413                 goto done;
 414         }
 415
 416         /* Post the IN urb */
 417         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 418                       hw->endp_in,
 419                       skb->data, sizeof(hfa384x_usbin_t),
 420                       hfa384x_usbin_callback, hw->wlandev);
 421
 422         hw->rx_urb_skb = skb;
 423
 424         result = -ENOLINK;
 425         if ( !hw->wlandev->hwremoved && !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 426                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 427
 428                 /* Check whether we need to reset the RX pipe */
 429                 if (result == -EPIPE) {
 430                         printk(KERN_WARNING "%s rx pipe stalled: requesting reset\n",
 431                                          hw->wlandev->netdev->name);
 432                         if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
 433                                 schedule_work(&hw->usb_work);
 434                 }
 435         }
 436
 437         /* Don't leak memory if anything should go wrong */
 438         if (result != 0) {
 439                 dev_kfree_skb(skb);
 440                 hw->rx_urb_skb = NULL;
 441         }
 442
 443  done:
 444         return result;
 445 }
 446
 447 /*----------------------------------------------------------------
 448 * submit_tx_urb
 449 *
 450 * Prepares and submits the URB of transmitted data. If the
 451 * submission fails then it will schedule the output pipe to
 452 * be reset.
 453 *
 454 * Arguments:
 455 *       hw              device struct
 456 *       tx_urb          URB of data for tranmission
 457 *       memflags        memory allocation flags
 458 *
 459 * Returns:
 460 *       error code from submission
 461 *
 462 * Call context:
 463 *       Any
 464 ----------------------------------------------------------------*/
 465 static int
 466 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 467 {
 468         struct net_device *netdev = hw->wlandev->netdev;
 469         int result;
 470
 471         result = -ENOLINK;
 472         if ( netif_running(netdev) ) {
 473
 474                 if ( !hw->wlandev->hwremoved && !test_bit(WORK_TX_HALT, &hw->usb_flags) ) {
 475                         result = SUBMIT_URB(tx_urb, memflags);
 476
 477                         /* Test whether we need to reset the TX pipe */
 478                         if (result == -EPIPE) {
 479                                 printk(KERN_WARNING "%s tx pipe stalled: requesting reset\n",
 480                                                  netdev->name);
 481                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 482                                 schedule_work(&hw->usb_work);
 483                         } else if (result == 0) {
 484                                 netif_stop_queue(netdev);
 485                         }
 486                 }
 487         }
 488
 489         return result;
 490 }
 491
 492 /*----------------------------------------------------------------
 493 * hfa394x_usb_defer
 494 *
 495 * There are some things that the USB stack cannot do while
 496 * in interrupt context, so we arrange this function to run
 497 * in process context.
 498 *
 499 * Arguments:
 500 *       hw      device structure
 501 *
 502 * Returns:
 503 *       nothing
 504 *
 505 * Call context:
 506 *       process (by design)
 507 ----------------------------------------------------------------*/
 508 static void
 509 hfa384x_usb_defer(struct work_struct *data)
 510 {
 511         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 512         struct net_device *netdev = hw->wlandev->netdev;
 513
 514         /* Don't bother trying to reset anything if the plug
 515          * has been pulled ...
 516          */
 517         if ( hw->wlandev->hwremoved ) {
 518                 return;
 519         }
 520
 521         /* Reception has stopped: try to reset the input pipe */
 522         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 523                 int ret;
 524
 525                 usb_kill_urb(&hw->rx_urb);  /* Cannot be holding spinlock! */
 526
 527                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 528                 if (ret != 0) {
 529                         printk(KERN_ERR
 530                                "Failed to clear rx pipe for %s: err=%d\n",
 531                                netdev->name, ret);
 532                 } else {
 533                         printk(KERN_INFO "%s rx pipe reset complete.\n",
 534                                          netdev->name);
 535                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 536                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 537                 }
 538         }
 539
 540         /* Resume receiving data back from the device. */
 541         if ( test_bit(WORK_RX_RESUME, &hw->usb_flags) ) {
 542                 int ret;
 543
 544                 ret = submit_rx_urb(hw, GFP_KERNEL);
 545                 if (ret != 0) {
 546                         printk(KERN_ERR
 547                                "Failed to resume %s rx pipe.\n", netdev->name);
 548                 } else {
 549                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 550                 }
 551         }
 552
 553         /* Transmission has stopped: try to reset the output pipe */
 554         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 555                 int ret;
 556
 557                 usb_kill_urb(&hw->tx_urb);
 558                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 559                 if (ret != 0) {
 560                         printk(KERN_ERR
 561                                "Failed to clear tx pipe for %s: err=%d\n",
 562                                netdev->name, ret);
 563                 } else {
 564                         printk(KERN_INFO "%s tx pipe reset complete.\n",
 565                                          netdev->name);
 566                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 567                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 568
 569                         /* Stopping the BULK-OUT pipe also blocked
 570                          * us from sending any more CTLX URBs, so
 571                          * we need to re-run our queue ...
 572                          */
 573                         hfa384x_usbctlxq_run(hw);
 574                 }
 575         }
 576
 577         /* Resume transmitting. */
 578         if ( test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags) ) {
 579                 netif_wake_queue(hw->wlandev->netdev);
 580         }
 581 }
 582
 583
 584 /*----------------------------------------------------------------
 585 * hfa384x_create
 586 *
 587 * Sets up the hfa384x_t data structure for use.  Note this
 588 * does _not_ intialize the actual hardware, just the data structures
 589 * we use to keep track of its state.
 590 *
 591 * Arguments:
 592 *       hw              device structure
 593 *       irq             device irq number
 594 *       iobase          i/o base address for register access
 595 *       membase         memory base address for register access
 596 *
 597 * Returns:
 598 *       nothing
 599 *
 600 * Side effects:
 601 *
 602 * Call context:
 603 *       process
 604 ----------------------------------------------------------------*/
 605 void
 606 hfa384x_create( hfa384x_t *hw, struct usb_device *usb)
 607 {
 608         memset(hw, 0, sizeof(hfa384x_t));
 609         hw->usb = usb;
 610
 611         /* set up the endpoints */
 612         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 613         hw->endp_out = usb_sndbulkpipe(usb, 2);
 614
 615         /* Set up the waitq */
 616         init_waitqueue_head(&hw->cmdq);
 617
 618         /* Initialize the command queue */
 619         spin_lock_init(&hw->ctlxq.lock);
 620         INIT_LIST_HEAD(&hw->ctlxq.pending);
 621         INIT_LIST_HEAD(&hw->ctlxq.active);
 622         INIT_LIST_HEAD(&hw->ctlxq.completing);
 623         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 624
 625         /* Initialize the authentication queue */
 626         skb_queue_head_init(&hw->authq);
 627
 628         tasklet_init(&hw->reaper_bh,
 629                      hfa384x_usbctlx_reaper_task,
 630                      (unsigned long)hw);
 631         tasklet_init(&hw->completion_bh,
 632                      hfa384x_usbctlx_completion_task,
 633                      (unsigned long)hw);
 634         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 635         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 636
 637         init_timer(&hw->throttle);
 638         hw->throttle.function = hfa384x_usb_throttlefn;
 639         hw->throttle.data = (unsigned long)hw;
 640
 641         init_timer(&hw->resptimer);
 642         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 643         hw->resptimer.data = (unsigned long)hw;
 644
 645         init_timer(&hw->reqtimer);
 646         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 647         hw->reqtimer.data = (unsigned long)hw;
 648
 649         usb_init_urb(&hw->rx_urb);
 650         usb_init_urb(&hw->tx_urb);
 651         usb_init_urb(&hw->ctlx_urb);
 652
 653         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 654         hw->state = HFA384x_STATE_INIT;
 655
 656         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 657         init_timer(&hw->commsqual_timer);
 658         hw->commsqual_timer.data = (unsigned long) hw;
 659         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 660 }
 661
 662
 663 /*----------------------------------------------------------------
 664 * hfa384x_destroy
 665 *
 666 * Partner to hfa384x_create().  This function cleans up the hw
 667 * structure so that it can be freed by the caller using a simple
 668 * kfree.  Currently, this function is just a placeholder.  If, at some
 669 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 670 * kfree, this is where it should be done.  Note that if this function
 671 * is called on a _running_ hw structure, the drvr_stop() function is
 672 * called.
 673 *
 674 * Arguments:
 675 *       hw              device structure
 676 *
 677 * Returns:
 678 *       nothing, this function is not allowed to fail.
 679 *
 680 * Side effects:
 681 *
 682 * Call context:
 683 *       process
 684 ----------------------------------------------------------------*/
 685 void
 686 hfa384x_destroy( hfa384x_t *hw)
 687 {
 688         struct sk_buff *skb;
 689
 690         if ( hw->state == HFA384x_STATE_RUNNING ) {
 691                 hfa384x_drvr_stop(hw);
 692         }
 693         hw->state = HFA384x_STATE_PREINIT;
 694
 695         if (hw->scanresults) {
 696                 kfree(hw->scanresults);
 697                 hw->scanresults = NULL;
 698         }
 699
 700         /* Now to clean out the auth queue */
 701         while ( (skb = skb_dequeue(&hw->authq)) ) {
 702                 dev_kfree_skb(skb);
 703         }
 704 }
 705
 706
 707 /*----------------------------------------------------------------
 708  */
 709 static hfa384x_usbctlx_t* usbctlx_alloc(void)
 710 {
 711         hfa384x_usbctlx_t *ctlx;
 712
 713         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 714         if (ctlx != NULL)
 715         {
 716                 memset(ctlx, 0, sizeof(*ctlx));
 717                 init_completion(&ctlx->done);
 718         }
 719
 720         return ctlx;
 721 }
 722
 723
 724 /*----------------------------------------------------------------
 725  *
 726 ----------------------------------------------------------------*/
 727 static int
 728 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 729                    hfa384x_cmdresult_t *result)
 730 {
 731         result->status = hfa384x2host_16(cmdresp->status);
 732         result->resp0 = hfa384x2host_16(cmdresp->resp0);
 733         result->resp1 = hfa384x2host_16(cmdresp->resp1);
 734         result->resp2 = hfa384x2host_16(cmdresp->resp2);
 735
 736         WLAN_LOG_DEBUG(4, "cmdresult:status=0x%04x "
 737                           "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 738                         result->status,
 739                         result->resp0,
 740                         result->resp1,
 741                         result->resp2);
 742
 743         return (result->status & HFA384x_STATUS_RESULT);
 744 }
 745
 746 static void
 747 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 748                        hfa384x_rridresult_t *result)
 749 {
 750         result->rid = hfa384x2host_16(rridresp->rid);
 751         result->riddata = rridresp->data;
 752         result->riddata_len = ((hfa384x2host_16(rridresp->frmlen) - 1) * 2);
 753
 754 }
 755
 756
 757 /*----------------------------------------------------------------
 758 * Completor object:
 759 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 760 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 761 ----------------------------------------------------------------*/
 762 struct usbctlx_cmd_completor
 763 {
 764         usbctlx_completor_t     head;
 765
 766         const hfa384x_usb_cmdresp_t     *cmdresp;
 767         hfa384x_cmdresult_t     *result;
 768 };
 769 typedef struct usbctlx_cmd_completor usbctlx_cmd_completor_t;
 770
 771 static int usbctlx_cmd_completor_fn(usbctlx_completor_t *head)
 772 {
 773         usbctlx_cmd_completor_t *complete = (usbctlx_cmd_completor_t*)head;
 774         return usbctlx_get_status(complete->cmdresp, complete->result);
 775 }
 776
 777 static inline usbctlx_completor_t*
 778 init_cmd_completor(usbctlx_cmd_completor_t *completor,
 779                    const hfa384x_usb_cmdresp_t *cmdresp,
 780                    hfa384x_cmdresult_t *result)
 781 {
 782         completor->head.complete = usbctlx_cmd_completor_fn;
 783         completor->cmdresp = cmdresp;
 784         completor->result = result;
 785         return &(completor->head);
 786 }
 787
 788 /*----------------------------------------------------------------
 789 * Completor object:
 790 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 791 * when processing a CTLX that reads a RID.
 792 ----------------------------------------------------------------*/
 793 struct usbctlx_rrid_completor
 794 {
 795         usbctlx_completor_t     head;
 796
 797         const hfa384x_usb_rridresp_t    *rridresp;
 798         void                    *riddata;
 799         unsigned int                    riddatalen;
 800 };
 801 typedef struct usbctlx_rrid_completor usbctlx_rrid_completor_t;
 802
 803 static int usbctlx_rrid_completor_fn(usbctlx_completor_t *head)
 804 {
 805         usbctlx_rrid_completor_t *complete = (usbctlx_rrid_completor_t*)head;
 806         hfa384x_rridresult_t rridresult;
 807
 808         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 809
 810         /* Validate the length, note body len calculation in bytes */
 811         if ( rridresult.riddata_len != complete->riddatalen ) {
 812                 printk(KERN_WARNING
 813                         "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 814                         rridresult.rid,
 815                         complete->riddatalen,
 816                         rridresult.riddata_len);
 817                 return -ENODATA;
 818         }
 819
 820         memcpy(complete->riddata,
 821                rridresult.riddata,
 822                complete->riddatalen);
 823         return 0;
 824 }
 825
 826 static inline usbctlx_completor_t*
 827 init_rrid_completor(usbctlx_rrid_completor_t *completor,
 828                     const hfa384x_usb_rridresp_t *rridresp,
 829                     void *riddata,
 830                     unsigned int riddatalen)
 831 {
 832         completor->head.complete = usbctlx_rrid_completor_fn;
 833         completor->rridresp = rridresp;
 834         completor->riddata = riddata;
 835         completor->riddatalen = riddatalen;
 836         return &(completor->head);
 837 }
 838
 839 /*----------------------------------------------------------------
 840 * Completor object:
 841 * Interprets the results of a synchronous RID-write
 842 ----------------------------------------------------------------*/
 843 typedef usbctlx_cmd_completor_t usbctlx_wrid_completor_t;
 844 #define init_wrid_completor  init_cmd_completor
 845
 846 /*----------------------------------------------------------------
 847 * Completor object:
 848 * Interprets the results of a synchronous memory-write
 849 ----------------------------------------------------------------*/
 850 typedef usbctlx_cmd_completor_t usbctlx_wmem_completor_t;
 851 #define init_wmem_completor  init_cmd_completor
 852
 853 /*----------------------------------------------------------------
 854 * Completor object:
 855 * Interprets the results of a synchronous memory-read
 856 ----------------------------------------------------------------*/
 857 struct usbctlx_rmem_completor
 858 {
 859         usbctlx_completor_t           head;
 860
 861         const hfa384x_usb_rmemresp_t  *rmemresp;
 862         void                          *data;
 863         unsigned int                          len;
 864 };
 865 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
 866
 867 static int usbctlx_rmem_completor_fn(usbctlx_completor_t *head)
 868 {
 869         usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t*)head;
 870
 871         WLAN_LOG_DEBUG(4,"rmemresp:len=%d\n", complete->rmemresp->frmlen);
 872         memcpy(complete->data, complete->rmemresp->data, complete->len);
 873         return 0;
 874 }
 875
 876 static inline usbctlx_completor_t*
 877 init_rmem_completor(usbctlx_rmem_completor_t *completor,
 878                     hfa384x_usb_rmemresp_t *rmemresp,
 879                     void *data,
 880                     unsigned int len)
 881 {
 882         completor->head.complete = usbctlx_rmem_completor_fn;
 883         completor->rmemresp = rmemresp;
 884         completor->data = data;
 885         completor->len = len;
 886         return &(completor->head);
 887 }
 888
 889 /*----------------------------------------------------------------
 890 * hfa384x_cb_status
 891 *
 892 * Ctlx_complete handler for async CMD type control exchanges.
 893 * mark the hw struct as such.
 894 *
 895 * Note: If the handling is changed here, it should probably be
 896 *       changed in docmd as well.
 897 *
 898 * Arguments:
 899 *       hw              hw struct
 900 *       ctlx            completed CTLX
 901 *
 902 * Returns:
 903 *       nothing
 904 *
 905 * Side effects:
 906 *
 907 * Call context:
 908 *       interrupt
 909 ----------------------------------------------------------------*/
 910 static void
 911 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 912 {
 913         if ( ctlx->usercb != NULL ) {
 914                 hfa384x_cmdresult_t cmdresult;
 915
 916                 if (ctlx->state != CTLX_COMPLETE) {
 917                         memset(&cmdresult, 0, sizeof(cmdresult));
 918                         cmdresult.status = HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 919                 } else {
 920                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 921                 }
 922
 923                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 924         }
 925 }
 926
 927
 928 /*----------------------------------------------------------------
 929 * hfa384x_cb_rrid
 930 *
 931 * CTLX completion handler for async RRID type control exchanges.
 932 *
 933 * Note: If the handling is changed here, it should probably be
 934 *       changed in dorrid as well.
 935 *
 936 * Arguments:
 937 *       hw              hw struct
 938 *       ctlx            completed CTLX
 939 *
 940 * Returns:
 941 *       nothing
 942 *
 943 * Side effects:
 944 *
 945 * Call context:
 946 *       interrupt
 947 ----------------------------------------------------------------*/
 948 static void
 949 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 950 {
 951         if ( ctlx->usercb != NULL ) {
 952                 hfa384x_rridresult_t rridresult;
 953
 954                 if (ctlx->state != CTLX_COMPLETE) {
 955                         memset(&rridresult, 0, sizeof(rridresult));
 956                         rridresult.rid = hfa384x2host_16(ctlx->outbuf.rridreq.rid);
 957                 } else {
 958                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp, &rridresult);
 959                 }
 960
 961                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
 962         }
 963 }
 964
 965 static inline int
 966 hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
 967 {
 968         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
 969 }
 970
 971 static inline int
 972 hfa384x_docmd_async(hfa384x_t *hw,
 973                     hfa384x_metacmd_t *cmd,
 974                     ctlx_cmdcb_t cmdcb,
 975                     ctlx_usercb_t usercb,
 976                     void *usercb_data)
 977 {
 978         return hfa384x_docmd(hw, DOASYNC, cmd,
 979                                 cmdcb, usercb, usercb_data);
 980 }
 981
 982 static inline int
 983 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
 984 {
 985         return hfa384x_dorrid(hw, DOWAIT,
 986                               rid, riddata, riddatalen,
 987                               NULL, NULL, NULL);
 988 }
 989
 990 static inline int
 991 hfa384x_dorrid_async(hfa384x_t *hw,
 992                      u16 rid, void *riddata, unsigned int riddatalen,
 993                      ctlx_cmdcb_t cmdcb,
 994                      ctlx_usercb_t usercb,
 995                      void *usercb_data)
 996 {
 997         return hfa384x_dorrid(hw, DOASYNC,
 998                               rid, riddata, riddatalen,
 999                               cmdcb, usercb, usercb_data);
1000 }
1001
1002 static inline int
1003 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1004 {
1005         return hfa384x_dowrid(hw, DOWAIT,
1006                               rid, riddata, riddatalen,
1007                               NULL, NULL, NULL);
1008 }
1009
1010 static inline int
1011 hfa384x_dowrid_async(hfa384x_t *hw,
1012                      u16 rid, void *riddata, unsigned int riddatalen,
1013                      ctlx_cmdcb_t cmdcb,
1014                      ctlx_usercb_t usercb,
1015                      void *usercb_data)
1016 {
1017         return hfa384x_dowrid(hw, DOASYNC,
1018                               rid, riddata, riddatalen,
1019                               cmdcb, usercb, usercb_data);
1020 }
1021
1022 static inline int
1023 hfa384x_dormem_wait(hfa384x_t *hw,
1024                     u16 page, u16 offset, void *data, unsigned int len)
1025 {
1026         return hfa384x_dormem(hw, DOWAIT,
1027                               page, offset, data, len,
1028                               NULL, NULL, NULL);
1029 }
1030
1031 static inline int
1032 hfa384x_dormem_async(hfa384x_t *hw,
1033                      u16 page, u16 offset, void *data, unsigned int len,
1034                      ctlx_cmdcb_t cmdcb,
1035                      ctlx_usercb_t usercb,
1036                      void *usercb_data)
1037 {
1038         return hfa384x_dormem(hw, DOASYNC,
1039                               page, offset, data, len,
1040                               cmdcb, usercb, usercb_data);
1041 }
1042
1043 static inline int
1044 hfa384x_dowmem_wait(
1045         hfa384x_t *hw,
1046         u16  page,
1047         u16  offset,
1048         void    *data,
1049         unsigned int    len)
1050 {
1051         return hfa384x_dowmem(hw, DOWAIT,
1052                                   page, offset, data, len,
1053                                   NULL, NULL, NULL);
1054 }
1055
1056 static inline int
1057 hfa384x_dowmem_async(
1058         hfa384x_t *hw,
1059         u16  page,
1060         u16  offset,
1061         void    *data,
1062         unsigned int    len,
1063         ctlx_cmdcb_t cmdcb,
1064         ctlx_usercb_t usercb,
1065         void    *usercb_data)
1066 {
1067         return hfa384x_dowmem(hw, DOASYNC,
1068                                   page, offset, data, len,
1069                                   cmdcb, usercb, usercb_data);
1070 }
1071
1072 /*----------------------------------------------------------------
1073 * hfa384x_cmd_initialize
1074 *
1075 * Issues the initialize command and sets the hw->state based
1076 * on the result.
1077 *
1078 * Arguments:
1079 *       hw              device structure
1080 *
1081 * Returns:
1082 *       0               success
1083 *       >0              f/w reported error - f/w status code
1084 *       <0              driver reported error
1085 *
1086 * Side effects:
1087 *
1088 * Call context:
1089 *       process
1090 ----------------------------------------------------------------*/
1091 int
1092 hfa384x_cmd_initialize(hfa384x_t *hw)
1093 {
1094         int     result = 0;
1095         int     i;
1096         hfa384x_metacmd_t cmd;
1097
1098         cmd.cmd = HFA384x_CMDCODE_INIT;
1099         cmd.parm0 = 0;
1100         cmd.parm1 = 0;
1101         cmd.parm2 = 0;
1102
1103         result = hfa384x_docmd_wait(hw, &cmd);
1104
1105
1106         WLAN_LOG_DEBUG(3,"cmdresp.init: "
1107                 "status=0x%04x, resp0=0x%04x, "
1108                 "resp1=0x%04x, resp2=0x%04x\n",
1109                 cmd.result.status,
1110                 cmd.result.resp0,
1111                 cmd.result.resp1,
1112                 cmd.result.resp2);
1113         if ( result == 0 ) {
1114                 for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
1115                         hw->port_enabled[i] = 0;
1116                 }
1117         }
1118
1119         hw->link_status = HFA384x_LINK_NOTCONNECTED;
1120
1121         return result;
1122 }
1123
1124
1125 /*----------------------------------------------------------------
1126 * hfa384x_cmd_disable
1127 *
1128 * Issues the disable command to stop communications on one of
1129 * the MACs 'ports'.
1130 *
1131 * Arguments:
1132 *       hw              device structure
1133 *       macport         MAC port number (host order)
1134 *
1135 * Returns:
1136 *       0               success
1137 *       >0              f/w reported failure - f/w status code
1138 *       <0              driver reported error (timeout|bad arg)
1139 *
1140 * Side effects:
1141 *
1142 * Call context:
1143 *       process
1144 ----------------------------------------------------------------*/
1145 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1146 {
1147         int     result = 0;
1148         hfa384x_metacmd_t cmd;
1149
1150         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1151                   HFA384x_CMD_MACPORT_SET(macport);
1152         cmd.parm0 = 0;
1153         cmd.parm1 = 0;
1154         cmd.parm2 = 0;
1155
1156         result = hfa384x_docmd_wait(hw, &cmd);
1157
1158         return result;
1159 }
1160
1161
1162 /*----------------------------------------------------------------
1163 * hfa384x_cmd_enable
1164 *
1165 * Issues the enable command to enable communications on one of
1166 * the MACs 'ports'.
1167 *
1168 * Arguments:
1169 *       hw              device structure
1170 *       macport         MAC port number
1171 *
1172 * Returns:
1173 *       0               success
1174 *       >0              f/w reported failure - f/w status code
1175 *       <0              driver reported error (timeout|bad arg)
1176 *
1177 * Side effects:
1178 *
1179 * Call context:
1180 *       process
1181 ----------------------------------------------------------------*/
1182 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1183 {
1184         int     result = 0;
1185         hfa384x_metacmd_t cmd;
1186
1187         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1188                   HFA384x_CMD_MACPORT_SET(macport);
1189         cmd.parm0 = 0;
1190         cmd.parm1 = 0;
1191         cmd.parm2 = 0;
1192
1193         result = hfa384x_docmd_wait(hw, &cmd);
1194
1195         return result;
1196 }
1197
1198 /*----------------------------------------------------------------
1199 * hfa384x_cmd_monitor
1200 *
1201 * Enables the 'monitor mode' of the MAC.  Here's the description of
1202 * monitor mode that I've received thus far:
1203 *
1204 *  "The "monitor mode" of operation is that the MAC passes all
1205 *  frames for which the PLCP checks are correct. All received
1206 *  MPDUs are passed to the host with MAC Port = 7, with a
1207 *  receive status of good, FCS error, or undecryptable. Passing
1208 *  certain MPDUs is a violation of the 802.11 standard, but useful
1209 *  for a debugging tool."  Normal communication is not possible
1210 *  while monitor mode is enabled.
1211 *
1212 * Arguments:
1213 *       hw              device structure
1214 *       enable          a code (0x0b|0x0f) that enables/disables
1215 *                       monitor mode. (host order)
1216 *
1217 * Returns:
1218 *       0               success
1219 *       >0              f/w reported failure - f/w status code
1220 *       <0              driver reported error (timeout|bad arg)
1221 *
1222 * Side effects:
1223 *
1224 * Call context:
1225 *       process
1226 ----------------------------------------------------------------*/
1227 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1228 {
1229         int     result = 0;
1230         hfa384x_metacmd_t cmd;
1231
1232         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1233                 HFA384x_CMD_AINFO_SET(enable);
1234         cmd.parm0 = 0;
1235         cmd.parm1 = 0;
1236         cmd.parm2 = 0;
1237
1238         result = hfa384x_docmd_wait(hw, &cmd);
1239
1240         return result;
1241 }
1242
1243
1244 /*----------------------------------------------------------------
1245 * hfa384x_cmd_download
1246 *
1247 * Sets the controls for the MAC controller code/data download
1248 * process.  The arguments set the mode and address associated
1249 * with a download.  Note that the aux registers should be enabled
1250 * prior to setting one of the download enable modes.
1251 *
1252 * Arguments:
1253 *       hw              device structure
1254 *       mode            0 - Disable programming and begin code exec
1255 *                       1 - Enable volatile mem programming
1256 *                       2 - Enable non-volatile mem programming
1257 *                       3 - Program non-volatile section from NV download
1258 *                           buffer.
1259 *                       (host order)
1260 *       lowaddr
1261 *       highaddr        For mode 1, sets the high & low order bits of
1262 *                       the "destination address".  This address will be
1263 *                       the execution start address when download is
1264 *                       subsequently disabled.
1265 *                       For mode 2, sets the high & low order bits of
1266 *                       the destination in NV ram.
1267 *                       For modes 0 & 3, should be zero. (host order)
1268 *                       NOTE: these are CMD format.
1269 *       codelen         Length of the data to write in mode 2,
1270 *                       zero otherwise. (host order)
1271 *
1272 * Returns:
1273 *       0               success
1274 *       >0              f/w reported failure - f/w status code
1275 *       <0              driver reported error (timeout|bad arg)
1276 *
1277 * Side effects:
1278 *
1279 * Call context:
1280 *       process
1281 ----------------------------------------------------------------*/
1282 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1283                                 u16 highaddr, u16 codelen)
1284 {
1285         int     result = 0;
1286         hfa384x_metacmd_t cmd;
1287
1288         WLAN_LOG_DEBUG(5,
1289                 "mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1290                 mode, lowaddr, highaddr, codelen);
1291
1292         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1293                    HFA384x_CMD_PROGMODE_SET(mode));
1294
1295         cmd.parm0 = lowaddr;
1296         cmd.parm1 = highaddr;
1297         cmd.parm2 = codelen;
1298
1299         result = hfa384x_docmd_wait(hw, &cmd);
1300
1301         return result;
1302 }
1303
1304
1305 /*----------------------------------------------------------------
1306 * hfa384x_copy_from_aux
1307 *
1308 * Copies a collection of bytes from the controller memory.  The
1309 * Auxiliary port MUST be enabled prior to calling this function.
1310 * We _might_ be in a download state.
1311 *
1312 * Arguments:
1313 *       hw              device structure
1314 *       cardaddr        address in hfa384x data space to read
1315 *       auxctl          address space select
1316 *       buf             ptr to destination host buffer
1317 *       len             length of data to transfer (in bytes)
1318 *
1319 * Returns:
1320 *       nothing
1321 *
1322 * Side effects:
1323 *       buf contains the data copied
1324 *
1325 * Call context:
1326 *       process
1327 *       interrupt
1328 ----------------------------------------------------------------*/
1329 void
1330 hfa384x_copy_from_aux(
1331         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1332 {
1333         printk(KERN_ERR "not used in USB.\n");
1334 }
1335
1336
1337 /*----------------------------------------------------------------
1338 * hfa384x_copy_to_aux
1339 *
1340 * Copies a collection of bytes to the controller memory.  The
1341 * Auxiliary port MUST be enabled prior to calling this function.
1342 * We _might_ be in a download state.
1343 *
1344 * Arguments:
1345 *       hw              device structure
1346 *       cardaddr        address in hfa384x data space to read
1347 *       auxctl          address space select
1348 *       buf             ptr to destination host buffer
1349 *       len             length of data to transfer (in bytes)
1350 *
1351 * Returns:
1352 *       nothing
1353 *
1354 * Side effects:
1355 *       Controller memory now contains a copy of buf
1356 *
1357 * Call context:
1358 *       process
1359 *       interrupt
1360 ----------------------------------------------------------------*/
1361 void
1362 hfa384x_copy_to_aux(
1363         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1364 {
1365         printk(KERN_ERR "not used in USB.\n");
1366 }
1367
1368
1369 /*----------------------------------------------------------------
1370 * hfa384x_corereset
1371 *
1372 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1373 * structure is in its "created" state.  That is, it is initialized
1374 * with proper values.  Note that if a reset is done after the
1375 * device has been active for awhile, the caller might have to clean
1376 * up some leftover cruft in the hw structure.
1377 *
1378 * Arguments:
1379 *       hw              device structure
1380 *       holdtime        how long (in ms) to hold the reset
1381 *       settletime      how long (in ms) to wait after releasing
1382 *                       the reset
1383 *
1384 * Returns:
1385 *       nothing
1386 *
1387 * Side effects:
1388 *
1389 * Call context:
1390 *       process
1391 ----------------------------------------------------------------*/
1392 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1393 {
1394         int                     result = 0;
1395
1396         result=usb_reset_device(hw->usb);
1397         if(result<0) {
1398                 printk(KERN_ERR "usb_reset_device() failed, result=%d.\n",result);
1399         }
1400
1401         return result;
1402 }
1403
1404
1405 /*----------------------------------------------------------------
1406 * hfa384x_usbctlx_complete_sync
1407 *
1408 * Waits for a synchronous CTLX object to complete,
1409 * and then handles the response.
1410 *
1411 * Arguments:
1412 *       hw              device structure
1413 *       ctlx            CTLX ptr
1414 *       completor       functor object to decide what to
1415 *                       do with the CTLX's result.
1416 *
1417 * Returns:
1418 *       0               Success
1419 *       -ERESTARTSYS    Interrupted by a signal
1420 *       -EIO            CTLX failed
1421 *       -ENODEV         Adapter was unplugged
1422 *       ???             Result from completor
1423 *
1424 * Side effects:
1425 *
1426 * Call context:
1427 *       process
1428 ----------------------------------------------------------------*/
1429 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1430                                          hfa384x_usbctlx_t *ctlx,
1431                                          usbctlx_completor_t *completor)
1432 {
1433         unsigned long flags;
1434         int result;
1435
1436         result = wait_for_completion_interruptible(&ctlx->done);
1437
1438         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1439
1440         /*
1441          * We can only handle the CTLX if the USB disconnect
1442          * function has not run yet ...
1443          */
1444         cleanup:
1445         if ( hw->wlandev->hwremoved )
1446         {
1447                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1448                 result = -ENODEV;
1449         }
1450         else if ( result != 0 )
1451         {
1452                 int runqueue = 0;
1453
1454                 /*
1455                  * We were probably interrupted, so delete
1456                  * this CTLX asynchronously, kill the timers
1457                  * and the URB, and then start the next
1458                  * pending CTLX.
1459                  *
1460                  * NOTE: We can only delete the timers and
1461                  *       the URB if this CTLX is active.
1462                  */
1463                 if (ctlx == get_active_ctlx(hw))
1464                 {
1465                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1466
1467                         del_singleshot_timer_sync(&hw->reqtimer);
1468                         del_singleshot_timer_sync(&hw->resptimer);
1469                         hw->req_timer_done = 1;
1470                         hw->resp_timer_done = 1;
1471                         usb_kill_urb(&hw->ctlx_urb);
1472
1473                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1474
1475                         runqueue = 1;
1476
1477                         /*
1478                          * This scenario is so unlikely that I'm
1479                          * happy with a grubby "goto" solution ...
1480                          */
1481                         if ( hw->wlandev->hwremoved )
1482                                 goto cleanup;
1483                 }
1484
1485                 /*
1486                  * The completion task will send this CTLX
1487                  * to the reaper the next time it runs. We
1488                  * are no longer in a hurry.
1489                  */
1490                 ctlx->reapable = 1;
1491                 ctlx->state = CTLX_REQ_FAILED;
1492                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1493
1494                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1495
1496                 if (runqueue)
1497                         hfa384x_usbctlxq_run(hw);
1498         } else {
1499                 if (ctlx->state == CTLX_COMPLETE) {
1500                         result = completor->complete(completor);
1501                 } else {
1502                         printk(KERN_WARNING "CTLX[%d] error: state(%s)\n",
1503                                          hfa384x2host_16(ctlx->outbuf.type),
1504                                          ctlxstr(ctlx->state));
1505                         result = -EIO;
1506                 }
1507
1508                 list_del(&ctlx->list);
1509                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1510                 kfree(ctlx);
1511         }
1512
1513         return result;
1514 }
1515
1516 /*----------------------------------------------------------------
1517 * hfa384x_docmd
1518 *
1519 * Constructs a command CTLX and submits it.
1520 *
1521 * NOTE: Any changes to the 'post-submit' code in this function
1522 *       need to be carried over to hfa384x_cbcmd() since the handling
1523 *       is virtually identical.
1524 *
1525 * Arguments:
1526 *       hw              device structure
1527 *       mode            DOWAIT or DOASYNC
1528 *       cmd             cmd structure.  Includes all arguments and result
1529 *                       data points.  All in host order. in host order
1530 *       cmdcb           command-specific callback
1531 *       usercb          user callback for async calls, NULL for DOWAIT calls
1532 *       usercb_data     user supplied data pointer for async calls, NULL
1533 *                       for DOASYNC calls
1534 *
1535 * Returns:
1536 *       0               success
1537 *       -EIO            CTLX failure
1538 *       -ERESTARTSYS    Awakened on signal
1539 *       >0              command indicated error, Status and Resp0-2 are
1540 *                       in hw structure.
1541 *
1542 * Side effects:
1543 *
1544 *
1545 * Call context:
1546 *       process
1547 ----------------------------------------------------------------*/
1548 static int
1549 hfa384x_docmd(
1550         hfa384x_t *hw,
1551         CMD_MODE mode,
1552         hfa384x_metacmd_t *cmd,
1553         ctlx_cmdcb_t    cmdcb,
1554         ctlx_usercb_t   usercb,
1555         void    *usercb_data)
1556 {
1557         int                     result;
1558         hfa384x_usbctlx_t       *ctlx;
1559
1560         ctlx = usbctlx_alloc();
1561         if ( ctlx == NULL ) {
1562                 result = -ENOMEM;
1563                 goto done;
1564         }
1565
1566         /* Initialize the command */
1567         ctlx->outbuf.cmdreq.type =      host2hfa384x_16(HFA384x_USB_CMDREQ);
1568         ctlx->outbuf.cmdreq.cmd =       host2hfa384x_16(cmd->cmd);
1569         ctlx->outbuf.cmdreq.parm0 =     host2hfa384x_16(cmd->parm0);
1570         ctlx->outbuf.cmdreq.parm1 =     host2hfa384x_16(cmd->parm1);
1571         ctlx->outbuf.cmdreq.parm2 =     host2hfa384x_16(cmd->parm2);
1572
1573         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1574
1575         WLAN_LOG_DEBUG(4, "cmdreq: cmd=0x%04x "
1576                 "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1577                 cmd->cmd,
1578                 cmd->parm0,
1579                 cmd->parm1,
1580                 cmd->parm2);
1581
1582         ctlx->reapable = mode;
1583         ctlx->cmdcb = cmdcb;
1584         ctlx->usercb = usercb;
1585         ctlx->usercb_data = usercb_data;
1586
1587         result = hfa384x_usbctlx_submit(hw, ctlx);
1588         if (result != 0) {
1589                 kfree(ctlx);
1590         } else if (mode == DOWAIT) {
1591                 usbctlx_cmd_completor_t completor;
1592
1593                 result = hfa384x_usbctlx_complete_sync(
1594                              hw, ctlx, init_cmd_completor(&completor,
1595                                                           &ctlx->inbuf.cmdresp,
1596                                                           &cmd->result) );
1597         }
1598
1599 done:
1600         return result;
1601 }
1602
1603
1604 /*----------------------------------------------------------------
1605 * hfa384x_dorrid
1606 *
1607 * Constructs a read rid CTLX and issues it.
1608 *
1609 * NOTE: Any changes to the 'post-submit' code in this function
1610 *       need to be carried over to hfa384x_cbrrid() since the handling
1611 *       is virtually identical.
1612 *
1613 * Arguments:
1614 *       hw              device structure
1615 *       mode            DOWAIT or DOASYNC
1616 *       rid             Read RID number (host order)
1617 *       riddata         Caller supplied buffer that MAC formatted RID.data
1618 *                       record will be written to for DOWAIT calls. Should
1619 *                       be NULL for DOASYNC calls.
1620 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1621 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1622 *       usercb          user callback for async calls, NULL for DOWAIT calls
1623 *       usercb_data     user supplied data pointer for async calls, NULL
1624 *                       for DOWAIT calls
1625 *
1626 * Returns:
1627 *       0               success
1628 *       -EIO            CTLX failure
1629 *       -ERESTARTSYS    Awakened on signal
1630 *       -ENODATA        riddatalen != macdatalen
1631 *       >0              command indicated error, Status and Resp0-2 are
1632 *                       in hw structure.
1633 *
1634 * Side effects:
1635 *
1636 * Call context:
1637 *       interrupt (DOASYNC)
1638 *       process (DOWAIT or DOASYNC)
1639 ----------------------------------------------------------------*/
1640 static int
1641 hfa384x_dorrid(
1642         hfa384x_t *hw,
1643         CMD_MODE mode,
1644         u16     rid,
1645         void    *riddata,
1646         unsigned int    riddatalen,
1647         ctlx_cmdcb_t cmdcb,
1648         ctlx_usercb_t usercb,
1649         void    *usercb_data)
1650 {
1651         int                     result;
1652         hfa384x_usbctlx_t       *ctlx;
1653
1654         ctlx = usbctlx_alloc();
1655         if ( ctlx == NULL ) {
1656                 result = -ENOMEM;
1657                 goto done;
1658         }
1659
1660         /* Initialize the command */
1661         ctlx->outbuf.rridreq.type =   host2hfa384x_16(HFA384x_USB_RRIDREQ);
1662         ctlx->outbuf.rridreq.frmlen =
1663                 host2hfa384x_16(sizeof(ctlx->outbuf.rridreq.rid));
1664         ctlx->outbuf.rridreq.rid =    host2hfa384x_16(rid);
1665
1666         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1667
1668         ctlx->reapable = mode;
1669         ctlx->cmdcb = cmdcb;
1670         ctlx->usercb = usercb;
1671         ctlx->usercb_data = usercb_data;
1672
1673         /* Submit the CTLX */
1674         result = hfa384x_usbctlx_submit(hw, ctlx);
1675         if (result != 0) {
1676                 kfree(ctlx);
1677         } else if (mode == DOWAIT) {
1678                 usbctlx_rrid_completor_t completor;
1679
1680                 result = hfa384x_usbctlx_complete_sync(
1681                            hw, ctlx, init_rrid_completor(&completor,
1682                                                          &ctlx->inbuf.rridresp,
1683                                                          riddata,
1684                                                          riddatalen) );
1685         }
1686
1687 done:
1688         return result;
1689 }
1690
1691
1692 /*----------------------------------------------------------------
1693 * hfa384x_dowrid
1694 *
1695 * Constructs a write rid CTLX and issues it.
1696 *
1697 * NOTE: Any changes to the 'post-submit' code in this function
1698 *       need to be carried over to hfa384x_cbwrid() since the handling
1699 *       is virtually identical.
1700 *
1701 * Arguments:
1702 *       hw              device structure
1703 *       CMD_MODE        DOWAIT or DOASYNC
1704 *       rid             RID code
1705 *       riddata         Data portion of RID formatted for MAC
1706 *       riddatalen      Length of the data portion in bytes
1707 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1708 *       usercb          user callback for async calls, NULL for DOWAIT calls
1709 *       usercb_data     user supplied data pointer for async calls
1710 *
1711 * Returns:
1712 *       0               success
1713 *       -ETIMEDOUT      timed out waiting for register ready or
1714 *                       command completion
1715 *       >0              command indicated error, Status and Resp0-2 are
1716 *                       in hw structure.
1717 *
1718 * Side effects:
1719 *
1720 * Call context:
1721 *       interrupt (DOASYNC)
1722 *       process (DOWAIT or DOASYNC)
1723 ----------------------------------------------------------------*/
1724 static int
1725 hfa384x_dowrid(
1726         hfa384x_t *hw,
1727         CMD_MODE mode,
1728         u16     rid,
1729         void    *riddata,
1730         unsigned int    riddatalen,
1731         ctlx_cmdcb_t cmdcb,
1732         ctlx_usercb_t usercb,
1733         void    *usercb_data)
1734 {
1735         int                     result;
1736         hfa384x_usbctlx_t       *ctlx;
1737
1738         ctlx = usbctlx_alloc();
1739         if ( ctlx == NULL ) {
1740                 result = -ENOMEM;
1741                 goto done;
1742         }
1743
1744         /* Initialize the command */
1745         ctlx->outbuf.wridreq.type =   host2hfa384x_16(HFA384x_USB_WRIDREQ);
1746         ctlx->outbuf.wridreq.frmlen = host2hfa384x_16(
1747                                         (sizeof(ctlx->outbuf.wridreq.rid) +
1748                                         riddatalen + 1) / 2);
1749         ctlx->outbuf.wridreq.rid =    host2hfa384x_16(rid);
1750         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1751
1752         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1753                            sizeof(ctlx->outbuf.wridreq.frmlen) +
1754                            sizeof(ctlx->outbuf.wridreq.rid) +
1755                            riddatalen;
1756
1757         ctlx->reapable = mode;
1758         ctlx->cmdcb = cmdcb;
1759         ctlx->usercb = usercb;
1760         ctlx->usercb_data = usercb_data;
1761
1762         /* Submit the CTLX */
1763         result = hfa384x_usbctlx_submit(hw, ctlx);
1764         if (result != 0) {
1765                 kfree(ctlx);
1766         } else if (mode == DOWAIT) {
1767                 usbctlx_wrid_completor_t completor;
1768                 hfa384x_cmdresult_t wridresult;
1769
1770                 result = hfa384x_usbctlx_complete_sync(
1771                                hw,
1772                                ctlx,
1773                                init_wrid_completor(&completor,
1774                                                    &ctlx->inbuf.wridresp,
1775                                                    &wridresult) );
1776         }
1777
1778 done:
1779         return result;
1780 }
1781
1782 /*----------------------------------------------------------------
1783 * hfa384x_dormem
1784 *
1785 * Constructs a readmem CTLX and issues it.
1786 *
1787 * NOTE: Any changes to the 'post-submit' code in this function
1788 *       need to be carried over to hfa384x_cbrmem() since the handling
1789 *       is virtually identical.
1790 *
1791 * Arguments:
1792 *       hw              device structure
1793 *       mode            DOWAIT or DOASYNC
1794 *       page            MAC address space page (CMD format)
1795 *       offset          MAC address space offset
1796 *       data            Ptr to data buffer to receive read
1797 *       len             Length of the data to read (max == 2048)
1798 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1799 *       usercb          user callback for async calls, NULL for DOWAIT calls
1800 *       usercb_data     user supplied data pointer for async calls
1801 *
1802 * Returns:
1803 *       0               success
1804 *       -ETIMEDOUT      timed out waiting for register ready or
1805 *                       command completion
1806 *       >0              command indicated error, Status and Resp0-2 are
1807 *                       in hw structure.
1808 *
1809 * Side effects:
1810 *
1811 * Call context:
1812 *       interrupt (DOASYNC)
1813 *       process (DOWAIT or DOASYNC)
1814 ----------------------------------------------------------------*/
1815 static int
1816 hfa384x_dormem(
1817         hfa384x_t *hw,
1818         CMD_MODE mode,
1819         u16     page,
1820         u16     offset,
1821         void    *data,
1822         unsigned int    len,
1823         ctlx_cmdcb_t cmdcb,
1824         ctlx_usercb_t usercb,
1825         void    *usercb_data)
1826 {
1827         int                     result;
1828         hfa384x_usbctlx_t       *ctlx;
1829
1830         ctlx = usbctlx_alloc();
1831         if ( ctlx == NULL ) {
1832                 result = -ENOMEM;
1833                 goto done;
1834         }
1835
1836         /* Initialize the command */
1837         ctlx->outbuf.rmemreq.type =    host2hfa384x_16(HFA384x_USB_RMEMREQ);
1838         ctlx->outbuf.rmemreq.frmlen =  host2hfa384x_16(
1839                                         sizeof(ctlx->outbuf.rmemreq.offset) +
1840                                         sizeof(ctlx->outbuf.rmemreq.page) +
1841                                         len);
1842         ctlx->outbuf.rmemreq.offset =   host2hfa384x_16(offset);
1843         ctlx->outbuf.rmemreq.page =     host2hfa384x_16(page);
1844
1845         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1846
1847         WLAN_LOG_DEBUG(4,
1848                 "type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1849                 ctlx->outbuf.rmemreq.type,
1850                 ctlx->outbuf.rmemreq.frmlen,
1851                 ctlx->outbuf.rmemreq.offset,
1852                 ctlx->outbuf.rmemreq.page);
1853
1854         WLAN_LOG_DEBUG(4,"pktsize=%zd\n",
1855                 ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1856
1857         ctlx->reapable = mode;
1858         ctlx->cmdcb = cmdcb;
1859         ctlx->usercb = usercb;
1860         ctlx->usercb_data = usercb_data;
1861
1862         result = hfa384x_usbctlx_submit(hw, ctlx);
1863         if (result != 0) {
1864                 kfree(ctlx);
1865         } else if ( mode == DOWAIT ) {
1866                 usbctlx_rmem_completor_t completor;
1867
1868                 result = hfa384x_usbctlx_complete_sync(
1869                            hw, ctlx, init_rmem_completor(&completor,
1870                                                          &ctlx->inbuf.rmemresp,
1871                                                          data,
1872                                                          len) );
1873         }
1874
1875 done:
1876         return result;
1877 }
1878
1879
1880
1881 /*----------------------------------------------------------------
1882 * hfa384x_dowmem
1883 *
1884 * Constructs a writemem CTLX and issues it.
1885 *
1886 * NOTE: Any changes to the 'post-submit' code in this function
1887 *       need to be carried over to hfa384x_cbwmem() since the handling
1888 *       is virtually identical.
1889 *
1890 * Arguments:
1891 *       hw              device structure
1892 *       mode            DOWAIT or DOASYNC
1893 *       page            MAC address space page (CMD format)
1894 *       offset          MAC address space offset
1895 *       data            Ptr to data buffer containing write data
1896 *       len             Length of the data to read (max == 2048)
1897 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1898 *       usercb          user callback for async calls, NULL for DOWAIT calls
1899 *       usercb_data     user supplied data pointer for async calls.
1900 *
1901 * Returns:
1902 *       0               success
1903 *       -ETIMEDOUT      timed out waiting for register ready or
1904 *                       command completion
1905 *       >0              command indicated error, Status and Resp0-2 are
1906 *                       in hw structure.
1907 *
1908 * Side effects:
1909 *
1910 * Call context:
1911 *       interrupt (DOWAIT)
1912 *       process (DOWAIT or DOASYNC)
1913 ----------------------------------------------------------------*/
1914 static int
1915 hfa384x_dowmem(
1916         hfa384x_t *hw,
1917         CMD_MODE mode,
1918         u16     page,
1919         u16     offset,
1920         void    *data,
1921         unsigned int    len,
1922         ctlx_cmdcb_t cmdcb,
1923         ctlx_usercb_t usercb,
1924         void    *usercb_data)
1925 {
1926         int                     result;
1927         hfa384x_usbctlx_t       *ctlx;
1928
1929         WLAN_LOG_DEBUG(5, "page=0x%04x offset=0x%04x len=%d\n",
1930                 page,offset,len);
1931
1932         ctlx = usbctlx_alloc();
1933         if ( ctlx == NULL ) {
1934                 result = -ENOMEM;
1935                 goto done;
1936         }
1937
1938         /* Initialize the command */
1939         ctlx->outbuf.wmemreq.type =   host2hfa384x_16(HFA384x_USB_WMEMREQ);
1940         ctlx->outbuf.wmemreq.frmlen = host2hfa384x_16(
1941                                         sizeof(ctlx->outbuf.wmemreq.offset) +
1942                                         sizeof(ctlx->outbuf.wmemreq.page) +
1943                                         len);
1944         ctlx->outbuf.wmemreq.offset = host2hfa384x_16(offset);
1945         ctlx->outbuf.wmemreq.page =   host2hfa384x_16(page);
1946         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1947
1948         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1949                            sizeof(ctlx->outbuf.wmemreq.frmlen) +
1950                            sizeof(ctlx->outbuf.wmemreq.offset) +
1951                            sizeof(ctlx->outbuf.wmemreq.page) +
1952                            len;
1953
1954         ctlx->reapable = mode;
1955         ctlx->cmdcb = cmdcb;
1956         ctlx->usercb = usercb;
1957         ctlx->usercb_data = usercb_data;
1958
1959         result = hfa384x_usbctlx_submit(hw, ctlx);
1960         if (result != 0) {
1961                 kfree(ctlx);
1962         } else if ( mode == DOWAIT ) {
1963                 usbctlx_wmem_completor_t completor;
1964                 hfa384x_cmdresult_t wmemresult;
1965
1966                 result = hfa384x_usbctlx_complete_sync(
1967                                hw,
1968                                ctlx,
1969                                init_wmem_completor(&completor,
1970                                                    &ctlx->inbuf.wmemresp,
1971                                                    &wmemresult) );
1972         }
1973
1974 done:
1975         return result;
1976 }
1977
1978
1979 /*----------------------------------------------------------------
1980 * hfa384x_drvr_commtallies
1981 *
1982 * Send a commtallies inquiry to the MAC.  Note that this is an async
1983 * call that will result in an info frame arriving sometime later.
1984 *
1985 * Arguments:
1986 *       hw              device structure
1987 *
1988 * Returns:
1989 *       zero            success.
1990 *
1991 * Side effects:
1992 *
1993 * Call context:
1994 *       process
1995 ----------------------------------------------------------------*/
1996 int hfa384x_drvr_commtallies( hfa384x_t *hw )
1997 {
1998         hfa384x_metacmd_t cmd;
1999
2000         cmd.cmd = HFA384x_CMDCODE_INQ;
2001         cmd.parm0 = HFA384x_IT_COMMTALLIES;
2002         cmd.parm1 = 0;
2003         cmd.parm2 = 0;
2004
2005         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
2006
2007         return 0;
2008 }
2009
2010
2011 /*----------------------------------------------------------------
2012 * hfa384x_drvr_disable
2013 *
2014 * Issues the disable command to stop communications on one of
2015 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2016 * APs may also disable macports 1-6.  Only ports that have been
2017 * previously enabled may be disabled.
2018 *
2019 * Arguments:
2020 *       hw              device structure
2021 *       macport         MAC port number (host order)
2022 *
2023 * Returns:
2024 *       0               success
2025 *       >0              f/w reported failure - f/w status code
2026 *       <0              driver reported error (timeout|bad arg)
2027 *
2028 * Side effects:
2029 *
2030 * Call context:
2031 *       process
2032 ----------------------------------------------------------------*/
2033 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
2034 {
2035         int     result = 0;
2036
2037         if ((!hw->isap && macport != 0) ||
2038             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2039             !(hw->port_enabled[macport]) ){
2040                 result = -EINVAL;
2041         } else {
2042                 result = hfa384x_cmd_disable(hw, macport);
2043                 if ( result == 0 ) {
2044                         hw->port_enabled[macport] = 0;
2045                 }
2046         }
2047         return result;
2048 }
2049
2050
2051 /*----------------------------------------------------------------
2052 * hfa384x_drvr_enable
2053 *
2054 * Issues the enable command to enable communications on one of
2055 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2056 * APs may also enable macports 1-6.  Only ports that are currently
2057 * disabled may be enabled.
2058 *
2059 * Arguments:
2060 *       hw              device structure
2061 *       macport         MAC port number
2062 *
2063 * Returns:
2064 *       0               success
2065 *       >0              f/w reported failure - f/w status code
2066 *       <0              driver reported error (timeout|bad arg)
2067 *
2068 * Side effects:
2069 *
2070 * Call context:
2071 *       process
2072 ----------------------------------------------------------------*/
2073 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
2074 {
2075         int     result = 0;
2076
2077         if ((!hw->isap && macport != 0) ||
2078             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2079             (hw->port_enabled[macport]) ){
2080                 result = -EINVAL;
2081         } else {
2082                 result = hfa384x_cmd_enable(hw, macport);
2083                 if ( result == 0 ) {
2084                         hw->port_enabled[macport] = 1;
2085                 }
2086         }
2087         return result;
2088 }
2089
2090
2091 /*----------------------------------------------------------------
2092 * hfa384x_drvr_flashdl_enable
2093 *
2094 * Begins the flash download state.  Checks to see that we're not
2095 * already in a download state and that a port isn't enabled.
2096 * Sets the download state and retrieves the flash download
2097 * buffer location, buffer size, and timeout length.
2098 *
2099 * Arguments:
2100 *       hw              device structure
2101 *
2102 * Returns:
2103 *       0               success
2104 *       >0              f/w reported error - f/w status code
2105 *       <0              driver reported error
2106 *
2107 * Side effects:
2108 *
2109 * Call context:
2110 *       process
2111 ----------------------------------------------------------------*/
2112 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
2113 {
2114         int             result = 0;
2115         int             i;
2116
2117         /* Check that a port isn't active */
2118         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2119                 if ( hw->port_enabled[i] ) {
2120                         WLAN_LOG_DEBUG(1,"called when port enabled.\n");
2121                         return -EINVAL;
2122                 }
2123         }
2124
2125         /* Check that we're not already in a download state */
2126         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2127                 return -EINVAL;
2128         }
2129
2130         /* Retrieve the buffer loc&size and timeout */
2131         if ( (result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
2132                                 &(hw->bufinfo), sizeof(hw->bufinfo))) ) {
2133                 return result;
2134         }
2135         hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
2136         hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
2137         hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
2138         if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
2139                                 &(hw->dltimeout))) ) {
2140                 return result;
2141         }
2142         hw->dltimeout = hfa384x2host_16(hw->dltimeout);
2143
2144         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2145
2146         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
2147
2148         return result;
2149 }
2150
2151
2152 /*----------------------------------------------------------------
2153 * hfa384x_drvr_flashdl_disable
2154 *
2155 * Ends the flash download state.  Note that this will cause the MAC
2156 * firmware to restart.
2157 *
2158 * Arguments:
2159 *       hw              device structure
2160 *
2161 * Returns:
2162 *       0               success
2163 *       >0              f/w reported error - f/w status code
2164 *       <0              driver reported error
2165 *
2166 * Side effects:
2167 *
2168 * Call context:
2169 *       process
2170 ----------------------------------------------------------------*/
2171 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
2172 {
2173         /* Check that we're already in the download state */
2174         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2175                 return -EINVAL;
2176         }
2177
2178         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2179
2180         /* There isn't much we can do at this point, so I don't */
2181         /*  bother  w/ the return value */
2182         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2183         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2184
2185         return 0;
2186 }
2187
2188
2189 /*----------------------------------------------------------------
2190 * hfa384x_drvr_flashdl_write
2191 *
2192 * Performs a FLASH download of a chunk of data. First checks to see
2193 * that we're in the FLASH download state, then sets the download
2194 * mode, uses the aux functions to 1) copy the data to the flash
2195 * buffer, 2) sets the download 'write flash' mode, 3) readback and
2196 * compare.  Lather rinse, repeat as many times an necessary to get
2197 * all the given data into flash.
2198 * When all data has been written using this function (possibly
2199 * repeatedly), call drvr_flashdl_disable() to end the download state
2200 * and restart the MAC.
2201 *
2202 * Arguments:
2203 *       hw              device structure
2204 *       daddr           Card address to write to. (host order)
2205 *       buf             Ptr to data to write.
2206 *       len             Length of data (host order).
2207 *
2208 * Returns:
2209 *       0               success
2210 *       >0              f/w reported error - f/w status code
2211 *       <0              driver reported error
2212 *
2213 * Side effects:
2214 *
2215 * Call context:
2216 *       process
2217 ----------------------------------------------------------------*/
2218 int
2219 hfa384x_drvr_flashdl_write(
2220         hfa384x_t       *hw,
2221         u32             daddr,
2222         void            *buf,
2223         u32             len)
2224 {
2225         int             result = 0;
2226         u32             dlbufaddr;
2227         int             nburns;
2228         u32             burnlen;
2229         u32             burndaddr;
2230         u16             burnlo;
2231         u16             burnhi;
2232         int             nwrites;
2233         u8              *writebuf;
2234         u16             writepage;
2235         u16             writeoffset;
2236         u32             writelen;
2237         int             i;
2238         int             j;
2239
2240         WLAN_LOG_DEBUG(5,"daddr=0x%08x len=%d\n", daddr, len);
2241
2242         /* Check that we're in the flash download state */
2243         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2244                 return -EINVAL;
2245         }
2246
2247         printk(KERN_INFO "Download %d bytes to flash @0x%06x\n", len, daddr);
2248
2249         /* Convert to flat address for arithmetic */
2250         /* NOTE: dlbuffer RID stores the address in AUX format */
2251         dlbufaddr = HFA384x_ADDR_AUX_MKFLAT(
2252                         hw->bufinfo.page, hw->bufinfo.offset);
2253         WLAN_LOG_DEBUG(5,
2254                 "dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2255                 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2256
2257 #if 0
2258 printk(KERN_WARNING "dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
2259 #endif
2260         /* Calculations to determine how many fills of the dlbuffer to do
2261          * and how many USB wmemreq's to do for each fill.  At this point
2262          * in time, the dlbuffer size and the wmemreq size are the same.
2263          * Therefore, nwrites should always be 1.  The extra complexity
2264          * here is a hedge against future changes.
2265          */
2266
2267         /* Figure out how many times to do the flash programming */
2268         nburns = len / hw->bufinfo.len;
2269         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2270
2271         /* For each flash program cycle, how many USB wmemreq's are needed? */
2272         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2273         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2274
2275         /* For each burn */
2276         for ( i = 0; i < nburns; i++) {
2277                 /* Get the dest address and len */
2278                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2279                                 hw->bufinfo.len :
2280                                 (len - (hw->bufinfo.len * i));
2281                 burndaddr = daddr + (hw->bufinfo.len * i);
2282                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2283                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2284
2285                 printk(KERN_INFO "Writing %d bytes to flash @0x%06x\n",
2286                         burnlen, burndaddr);
2287
2288                 /* Set the download mode */
2289                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2290                                 burnlo, burnhi, burnlen);
2291                 if ( result ) {
2292                         printk(KERN_ERR "download(NV,lo=%x,hi=%x,len=%x) "
2293                                 "cmd failed, result=%d. Aborting d/l\n",
2294                                 burnlo, burnhi, burnlen, result);
2295                         goto exit_proc;
2296                 }
2297
2298                 /* copy the data to the flash download buffer */
2299                 for ( j=0; j < nwrites; j++) {
2300                         writebuf = buf +
2301                                 (i*hw->bufinfo.len) +
2302                                 (j*HFA384x_USB_RWMEM_MAXLEN);
2303
2304                         writepage = HFA384x_ADDR_CMD_MKPAGE(
2305                                         dlbufaddr +
2306                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2307                         writeoffset = HFA384x_ADDR_CMD_MKOFF(
2308                                         dlbufaddr +
2309                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2310
2311                         writelen = burnlen-(j*HFA384x_USB_RWMEM_MAXLEN);
2312                         writelen = writelen  > HFA384x_USB_RWMEM_MAXLEN ?
2313                                         HFA384x_USB_RWMEM_MAXLEN :
2314                                         writelen;
2315
2316                         result = hfa384x_dowmem_wait( hw,
2317                                         writepage,
2318                                         writeoffset,
2319                                         writebuf,
2320                                         writelen );
2321                 }
2322
2323                 /* set the download 'write flash' mode */
2324                 result = hfa384x_cmd_download(hw,
2325                                 HFA384x_PROGMODE_NVWRITE,
2326                                 0,0,0);
2327                 if ( result ) {
2328                         printk(KERN_ERR
2329                                 "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2330                                 "cmd failed, result=%d. Aborting d/l\n",
2331                                 burnlo, burnhi, burnlen, result);
2332                         goto exit_proc;
2333                 }
2334
2335                 /* TODO: We really should do a readback and compare. */
2336         }
2337
2338 exit_proc:
2339
2340         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2341         /*  actually disable programming mode.  Remember, that will cause the */
2342         /*  the firmware to effectively reset itself. */
2343
2344         return result;
2345 }
2346
2347
2348 /*----------------------------------------------------------------
2349 * hfa384x_drvr_getconfig
2350 *
2351 * Performs the sequence necessary to read a config/info item.
2352 *
2353 * Arguments:
2354 *       hw              device structure
2355 *       rid             config/info record id (host order)
2356 *       buf             host side record buffer.  Upon return it will
2357 *                       contain the body portion of the record (minus the
2358 *                       RID and len).
2359 *       len             buffer length (in bytes, should match record length)
2360 *
2361 * Returns:
2362 *       0               success
2363 *       >0              f/w reported error - f/w status code
2364 *       <0              driver reported error
2365 *       -ENODATA        length mismatch between argument and retrieved
2366 *                       record.
2367 *
2368 * Side effects:
2369 *
2370 * Call context:
2371 *       process
2372 ----------------------------------------------------------------*/
2373 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2374 {
2375         int                     result;
2376
2377         result = hfa384x_dorrid_wait(hw, rid, buf, len);
2378
2379         return result;
2380 }
2381
2382 /*----------------------------------------------------------------
2383  * hfa384x_drvr_getconfig_async
2384  *
2385  * Performs the sequence necessary to perform an async read of
2386  * of a config/info item.
2387  *
2388  * Arguments:
2389  *       hw              device structure
2390  *       rid             config/info record id (host order)
2391  *       buf             host side record buffer.  Upon return it will
2392  *                       contain the body portion of the record (minus the
2393  *                       RID and len).
2394  *       len             buffer length (in bytes, should match record length)
2395  *       cbfn            caller supplied callback, called when the command
2396  *                       is done (successful or not).
2397  *       cbfndata        pointer to some caller supplied data that will be
2398  *                       passed in as an argument to the cbfn.
2399  *
2400  * Returns:
2401  *       nothing         the cbfn gets a status argument identifying if
2402  *                       any errors occur.
2403  * Side effects:
2404  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2405  *
2406  * Call context:
2407  *       Any
2408  ----------------------------------------------------------------*/
2409 int
2410 hfa384x_drvr_getconfig_async(
2411          hfa384x_t               *hw,
2412          u16                  rid,
2413          ctlx_usercb_t           usercb,
2414          void                    *usercb_data)
2415 {
2416          return hfa384x_dorrid_async(hw, rid, NULL, 0,
2417                                      hfa384x_cb_rrid, usercb, usercb_data);
2418 }
2419
2420 /*----------------------------------------------------------------
2421  * hfa384x_drvr_setconfig_async
2422  *
2423  * Performs the sequence necessary to write a config/info item.
2424  *
2425  * Arguments:
2426  *       hw              device structure
2427  *       rid             config/info record id (in host order)
2428  *       buf             host side record buffer
2429  *       len             buffer length (in bytes)
2430  *       usercb          completion callback
2431  *       usercb_data     completion callback argument
2432  *
2433  * Returns:
2434  *       0               success
2435  *       >0              f/w reported error - f/w status code
2436  *       <0              driver reported error
2437  *
2438  * Side effects:
2439  *
2440  * Call context:
2441  *       process
2442  ----------------------------------------------------------------*/
2443 int
2444 hfa384x_drvr_setconfig_async(
2445          hfa384x_t       *hw,
2446          u16          rid,
2447          void            *buf,
2448          u16          len,
2449          ctlx_usercb_t   usercb,
2450          void            *usercb_data)
2451 {
2452         return hfa384x_dowrid_async(hw, rid, buf, len,
2453                                     hfa384x_cb_status, usercb, usercb_data);
2454 }
2455
2456 /*----------------------------------------------------------------
2457 * hfa384x_drvr_handover
2458 *
2459 * Sends a handover notification to the MAC.
2460 *
2461 * Arguments:
2462 *       hw              device structure
2463 *       addr            address of station that's left
2464 *
2465 * Returns:
2466 *       zero            success.
2467 *       -ERESTARTSYS    received signal while waiting for semaphore.
2468 *       -EIO            failed to write to bap, or failed in cmd.
2469 *
2470 * Side effects:
2471 *
2472 * Call context:
2473 *       process
2474 ----------------------------------------------------------------*/
2475 int hfa384x_drvr_handover( hfa384x_t *hw, u8 *addr)
2476 {
2477         printk(KERN_ERR "Not currently supported in USB!\n");
2478         return -EIO;
2479 }
2480
2481 /*----------------------------------------------------------------
2482 * hfa384x_drvr_ramdl_disable
2483 *
2484 * Ends the ram download state.
2485 *
2486 * Arguments:
2487 *       hw              device structure
2488 *
2489 * Returns:
2490 *       0               success
2491 *       >0              f/w reported error - f/w status code
2492 *       <0              driver reported error
2493 *
2494 * Side effects:
2495 *
2496 * Call context:
2497 *       process
2498 ----------------------------------------------------------------*/
2499 int
2500 hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2501 {
2502         /* Check that we're already in the download state */
2503         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2504                 return -EINVAL;
2505         }
2506
2507         WLAN_LOG_DEBUG(3,"ramdl_disable()\n");
2508
2509         /* There isn't much we can do at this point, so I don't */
2510         /*  bother  w/ the return value */
2511         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2512         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2513
2514         return 0;
2515 }
2516
2517
2518 /*----------------------------------------------------------------
2519 * hfa384x_drvr_ramdl_enable
2520 *
2521 * Begins the ram download state.  Checks to see that we're not
2522 * already in a download state and that a port isn't enabled.
2523 * Sets the download state and calls cmd_download with the
2524 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2525 *
2526 * Arguments:
2527 *       hw              device structure
2528 *       exeaddr         the card execution address that will be
2529 *                       jumped to when ramdl_disable() is called
2530 *                       (host order).
2531 *
2532 * Returns:
2533 *       0               success
2534 *       >0              f/w reported error - f/w status code
2535 *       <0              driver reported error
2536 *
2537 * Side effects:
2538 *
2539 * Call context:
2540 *       process
2541 ----------------------------------------------------------------*/
2542 int
2543 hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2544 {
2545         int             result = 0;
2546         u16             lowaddr;
2547         u16             hiaddr;
2548         int             i;
2549
2550         /* Check that a port isn't active */
2551         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2552                 if ( hw->port_enabled[i] ) {
2553                         printk(KERN_ERR
2554                                 "Can't download with a macport enabled.\n");
2555                         return -EINVAL;
2556                 }
2557         }
2558
2559         /* Check that we're not already in a download state */
2560         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2561                 printk(KERN_ERR
2562                         "Download state not disabled.\n");
2563                 return -EINVAL;
2564         }
2565
2566         WLAN_LOG_DEBUG(3,"ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2567
2568         /* Call the download(1,addr) function */
2569         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2570         hiaddr =  HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2571
2572         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2573                         lowaddr, hiaddr, 0);
2574
2575         if ( result == 0) {
2576                 /* Set the download state */
2577                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2578         } else {
2579                 WLAN_LOG_DEBUG(1,
2580                         "cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2581                         lowaddr,
2582                         hiaddr,
2583                         result);
2584         }
2585
2586         return result;
2587 }
2588
2589
2590 /*----------------------------------------------------------------
2591 * hfa384x_drvr_ramdl_write
2592 *
2593 * Performs a RAM download of a chunk of data. First checks to see
2594 * that we're in the RAM download state, then uses the [read|write]mem USB
2595 * commands to 1) copy the data, 2) readback and compare.  The download
2596 * state is unaffected.  When all data has been written using
2597 * this function, call drvr_ramdl_disable() to end the download state
2598 * and restart the MAC.
2599 *
2600 * Arguments:
2601 *       hw              device structure
2602 *       daddr           Card address to write to. (host order)
2603 *       buf             Ptr to data to write.
2604 *       len             Length of data (host order).
2605 *
2606 * Returns:
2607 *       0               success
2608 *       >0              f/w reported error - f/w status code
2609 *       <0              driver reported error
2610 *
2611 * Side effects:
2612 *
2613 * Call context:
2614 *       process
2615 ----------------------------------------------------------------*/
2616 int
2617 hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void* buf, u32 len)
2618 {
2619         int             result = 0;
2620         int             nwrites;
2621         u8              *data = buf;
2622         int             i;
2623         u32             curraddr;
2624         u16             currpage;
2625         u16             curroffset;
2626         u16             currlen;
2627
2628         /* Check that we're in the ram download state */
2629         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2630                 return -EINVAL;
2631         }
2632
2633         printk(KERN_INFO "Writing %d bytes to ram @0x%06x\n", len, daddr);
2634
2635         /* How many dowmem calls?  */
2636         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2637         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2638
2639         /* Do blocking wmem's */
2640         for(i=0; i < nwrites; i++) {
2641                 /* make address args */
2642                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2643                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2644                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2645                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2646                 if ( currlen > HFA384x_USB_RWMEM_MAXLEN) {
2647                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2648                 }
2649
2650                 /* Do blocking ctlx */
2651                 result = hfa384x_dowmem_wait( hw,
2652                                 currpage,
2653                                 curroffset,
2654                                 data + (i*HFA384x_USB_RWMEM_MAXLEN),
2655                                 currlen );
2656
2657                 if (result) break;
2658
2659                 /* TODO: We really should have a readback. */
2660         }
2661
2662         return result;
2663 }
2664
2665
2666 /*----------------------------------------------------------------
2667 * hfa384x_drvr_readpda
2668 *
2669 * Performs the sequence to read the PDA space.  Note there is no
2670 * drvr_writepda() function.  Writing a PDA is
2671 * generally implemented by a calling component via calls to
2672 * cmd_download and writing to the flash download buffer via the
2673 * aux regs.
2674 *
2675 * Arguments:
2676 *       hw              device structure
2677 *       buf             buffer to store PDA in
2678 *       len             buffer length
2679 *
2680 * Returns:
2681 *       0               success
2682 *       >0              f/w reported error - f/w status code
2683 *       <0              driver reported error
2684 *       -ETIMEOUT       timout waiting for the cmd regs to become
2685 *                       available, or waiting for the control reg
2686 *                       to indicate the Aux port is enabled.
2687 *       -ENODATA        the buffer does NOT contain a valid PDA.
2688 *                       Either the card PDA is bad, or the auxdata
2689 *                       reads are giving us garbage.
2690
2691 *
2692 * Side effects:
2693 *
2694 * Call context:
2695 *       process or non-card interrupt.
2696 ----------------------------------------------------------------*/
2697 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2698 {
2699         int             result = 0;
2700         u16             *pda = buf;
2701         int             pdaok = 0;
2702         int             morepdrs = 1;
2703         int             currpdr = 0;    /* word offset of the current pdr */
2704         size_t          i;
2705         u16             pdrlen;         /* pdr length in bytes, host order */
2706         u16             pdrcode;        /* pdr code, host order */
2707         u16             currpage;
2708         u16             curroffset;
2709         struct pdaloc {
2710                 u32     cardaddr;
2711                 u16     auxctl;
2712         } pdaloc[] =
2713         {
2714                 { HFA3842_PDA_BASE,             0},
2715                 { HFA3841_PDA_BASE,             0},
2716                 { HFA3841_PDA_BOGUS_BASE,       0}
2717         };
2718
2719         /* Read the pda from each known address.  */
2720         for ( i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2721                 /* Make address */
2722                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2723                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2724
2725                 result = hfa384x_dormem_wait(hw,
2726                         currpage,
2727                         curroffset,
2728                         buf,
2729                         len);           /* units of bytes */
2730
2731                 if (result) {
2732                         printk(KERN_WARNING
2733                                           "Read from index %zd failed, continuing\n",
2734                                 i );
2735                         continue;
2736                 }
2737
2738                 /* Test for garbage */
2739                 pdaok = 1;      /* initially assume good */
2740                 morepdrs = 1;
2741                 while ( pdaok && morepdrs ) {
2742                         pdrlen = hfa384x2host_16(pda[currpdr]) * 2;
2743                         pdrcode = hfa384x2host_16(pda[currpdr+1]);
2744                         /* Test the record length */
2745                         if ( pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2746                                 printk(KERN_ERR "pdrlen invalid=%d\n",
2747                                         pdrlen);
2748                                 pdaok = 0;
2749                                 break;
2750                         }
2751                         /* Test the code */
2752                         if ( !hfa384x_isgood_pdrcode(pdrcode) ) {
2753                                 printk(KERN_ERR "pdrcode invalid=%d\n",
2754                                         pdrcode);
2755                                 pdaok = 0;
2756                                 break;
2757                         }
2758                         /* Test for completion */
2759                         if ( pdrcode == HFA384x_PDR_END_OF_PDA) {
2760                                 morepdrs = 0;
2761                         }
2762
2763                         /* Move to the next pdr (if necessary) */
2764                         if ( morepdrs ) {
2765                                 /* note the access to pda[], need words here */
2766                                 currpdr += hfa384x2host_16(pda[currpdr]) + 1;
2767                         }
2768                 }
2769                 if ( pdaok ) {
2770                         printk(KERN_INFO
2771                                 "PDA Read from 0x%08x in %s space.\n",
2772                                 pdaloc[i].cardaddr,
2773                                 pdaloc[i].auxctl == 0 ? "EXTDS" :
2774                                 pdaloc[i].auxctl == 1 ? "NV" :
2775                                 pdaloc[i].auxctl == 2 ? "PHY" :
2776                                 pdaloc[i].auxctl == 3 ? "ICSRAM" :
2777                                 "<bogus auxctl>");
2778                         break;
2779                 }
2780         }
2781         result = pdaok ? 0 : -ENODATA;
2782
2783         if ( result ) {
2784                 WLAN_LOG_DEBUG(3,"Failure: pda is not okay\n");
2785         }
2786
2787         return result;
2788 }
2789
2790
2791 /*----------------------------------------------------------------
2792 * hfa384x_drvr_setconfig
2793 *
2794 * Performs the sequence necessary to write a config/info item.
2795 *
2796 * Arguments:
2797 *       hw              device structure
2798 *       rid             config/info record id (in host order)
2799 *       buf             host side record buffer
2800 *       len             buffer length (in bytes)
2801 *
2802 * Returns:
2803 *       0               success
2804 *       >0              f/w reported error - f/w status code
2805 *       <0              driver reported error
2806 *
2807 * Side effects:
2808 *
2809 * Call context:
2810 *       process
2811 ----------------------------------------------------------------*/
2812 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2813 {
2814         return hfa384x_dowrid_wait(hw, rid, buf, len);
2815 }
2816
2817 /*----------------------------------------------------------------
2818 * hfa384x_drvr_start
2819 *
2820 * Issues the MAC initialize command, sets up some data structures,
2821 * and enables the interrupts.  After this function completes, the
2822 * low-level stuff should be ready for any/all commands.
2823 *
2824 * Arguments:
2825 *       hw              device structure
2826 * Returns:
2827 *       0               success
2828 *       >0              f/w reported error - f/w status code
2829 *       <0              driver reported error
2830 *
2831 * Side effects:
2832 *
2833 * Call context:
2834 *       process
2835 ----------------------------------------------------------------*/
2836
2837 int hfa384x_drvr_start(hfa384x_t *hw)
2838 {
2839         int             result, result1, result2;
2840         u16             status;
2841
2842         might_sleep();
2843
2844         /* Clear endpoint stalls - but only do this if the endpoint
2845          * is showing a stall status. Some prism2 cards seem to behave
2846          * badly if a clear_halt is called when the endpoint is already
2847          * ok
2848          */
2849         result = usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2850         if (result < 0) {
2851                 printk(KERN_ERR
2852                         "Cannot get bulk in endpoint status.\n");
2853                 goto done;
2854         }
2855         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in)) {
2856                 printk(KERN_ERR
2857                         "Failed to reset bulk in endpoint.\n");
2858         }
2859
2860         result = usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2861         if (result < 0) {
2862                 printk(KERN_ERR
2863                         "Cannot get bulk out endpoint status.\n");
2864                 goto done;
2865         }
2866         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out)) {
2867                 printk(KERN_ERR
2868                         "Failed to reset bulk out endpoint.\n");
2869         }
2870
2871         /* Synchronous unlink, in case we're trying to restart the driver */
2872         usb_kill_urb(&hw->rx_urb);
2873
2874         /* Post the IN urb */
2875         result = submit_rx_urb(hw, GFP_KERNEL);
2876         if (result != 0) {
2877                 printk(KERN_ERR
2878                         "Fatal, failed to submit RX URB, result=%d\n",
2879                         result);
2880                 goto done;
2881         }
2882
2883         /* Call initialize twice, with a 1 second sleep in between.
2884          * This is a nasty work-around since many prism2 cards seem to
2885          * need time to settle after an init from cold. The second
2886          * call to initialize in theory is not necessary - but we call
2887          * it anyway as a double insurance policy:
2888          * 1) If the first init should fail, the second may well succeed
2889          *    and the card can still be used
2890          * 2) It helps ensures all is well with the card after the first
2891          *    init and settle time.
2892          */
2893         result1 = hfa384x_cmd_initialize(hw);
2894         msleep(1000);
2895         result = result2 = hfa384x_cmd_initialize(hw);
2896         if (result1 != 0) {
2897                 if (result2 != 0) {
2898                         printk(KERN_ERR
2899                                 "cmd_initialize() failed on two attempts, results %d and %d\n",
2900                                 result1, result2);
2901                         usb_kill_urb(&hw->rx_urb);
2902                         goto done;
2903                 } else {
2904                         WLAN_LOG_DEBUG(0, "First cmd_initialize() failed (result %d),\n",
2905                                 result1);
2906                         WLAN_LOG_DEBUG(0, "but second attempt succeeded. All should be ok\n");
2907                 }
2908         } else if (result2 != 0) {
2909                 printk(KERN_WARNING
2910                         "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2911                         result2);
2912                 printk(KERN_WARNING "Most likely the card will be functional\n");
2913                         goto done;
2914         }
2915
2916         hw->state = HFA384x_STATE_RUNNING;
2917
2918 done:
2919         return result;
2920 }
2921
2922
2923 /*----------------------------------------------------------------
2924 * hfa384x_drvr_stop
2925 *
2926 * Shuts down the MAC to the point where it is safe to unload the
2927 * driver.  Any subsystem that may be holding a data or function
2928 * ptr into the driver must be cleared/deinitialized.
2929 *
2930 * Arguments:
2931 *       hw              device structure
2932 * Returns:
2933 *       0               success
2934 *       >0              f/w reported error - f/w status code
2935 *       <0              driver reported error
2936 *
2937 * Side effects:
2938 *
2939 * Call context:
2940 *       process
2941 ----------------------------------------------------------------*/
2942 int
2943 hfa384x_drvr_stop(hfa384x_t *hw)
2944 {
2945         int     result = 0;
2946         int     i;
2947
2948         might_sleep();
2949
2950         /* There's no need for spinlocks here. The USB "disconnect"
2951          * function sets this "removed" flag and then calls us.
2952          */
2953         if ( !hw->wlandev->hwremoved ) {
2954                 /* Call initialize to leave the MAC in its 'reset' state */
2955                 hfa384x_cmd_initialize(hw);
2956
2957                 /* Cancel the rxurb */
2958                 usb_kill_urb(&hw->rx_urb);
2959         }
2960
2961         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2962         hw->state = HFA384x_STATE_INIT;
2963
2964         del_timer_sync(&hw->commsqual_timer);
2965
2966         /* Clear all the port status */
2967         for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
2968                 hw->port_enabled[i] = 0;
2969         }
2970
2971         return result;
2972 }
2973
2974 /*----------------------------------------------------------------
2975 * hfa384x_drvr_txframe
2976 *
2977 * Takes a frame from prism2sta and queues it for transmission.
2978 *
2979 * Arguments:
2980 *       hw              device structure
2981 *       skb             packet buffer struct.  Contains an 802.11
2982 *                       data frame.
2983 *       p80211_hdr      points to the 802.11 header for the packet.
2984 * Returns:
2985 *       0               Success and more buffs available
2986 *       1               Success but no more buffs
2987 *       2               Allocation failure
2988 *       4               Buffer full or queue busy
2989 *
2990 * Side effects:
2991 *
2992 * Call context:
2993 *       interrupt
2994 ----------------------------------------------------------------*/
2995 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb, p80211_hdr_t *p80211_hdr, p80211_metawep_t *p80211_wep)
2996
2997 {
2998         int             usbpktlen = sizeof(hfa384x_tx_frame_t);
2999         int             result;
3000         int             ret;
3001         char            *ptr;
3002
3003         if (hw->tx_urb.status == -EINPROGRESS) {
3004                 printk(KERN_WARNING "TX URB already in use\n");
3005                 result = 3;
3006                 goto exit;
3007         }
3008
3009         /* Build Tx frame structure */
3010         /* Set up the control field */
3011         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
3012
3013         /* Setup the usb type field */
3014         hw->txbuff.type = host2hfa384x_16(HFA384x_USB_TXFRM);
3015
3016         /* Set up the sw_support field to identify this frame */
3017         hw->txbuff.txfrm.desc.sw_support = 0x0123;
3018
3019 /* Tx complete and Tx exception disable per dleach.  Might be causing
3020  * buf depletion
3021  */
3022 //#define DOEXC  SLP -- doboth breaks horribly under load, doexc less so.
3023 #if defined(DOBOTH)
3024         hw->txbuff.txfrm.desc.tx_control =
3025                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3026                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
3027 #elif defined(DOEXC)
3028         hw->txbuff.txfrm.desc.tx_control =
3029                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3030                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
3031 #else
3032         hw->txbuff.txfrm.desc.tx_control =
3033                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3034                 HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
3035 #endif
3036         hw->txbuff.txfrm.desc.tx_control =
3037                 host2hfa384x_16(hw->txbuff.txfrm.desc.tx_control);
3038
3039         /* copy the header over to the txdesc */
3040         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr, sizeof(p80211_hdr_t));
3041
3042         /* if we're using host WEP, increase size by IV+ICV */
3043         if (p80211_wep->data) {
3044                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len+8);
3045                 usbpktlen+=8;
3046         } else {
3047                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len);
3048         }
3049
3050         usbpktlen += skb->len;
3051
3052         /* copy over the WEP IV if we are using host WEP */
3053         ptr = hw->txbuff.txfrm.data;
3054         if (p80211_wep->data) {
3055                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
3056                 ptr+= sizeof(p80211_wep->iv);
3057                 memcpy(ptr, p80211_wep->data, skb->len);
3058         } else {
3059                 memcpy(ptr, skb->data, skb->len);
3060         }
3061         /* copy over the packet data */
3062         ptr+= skb->len;
3063
3064         /* copy over the WEP ICV if we are using host WEP */
3065         if (p80211_wep->data) {
3066                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
3067         }
3068
3069         /* Send the USB packet */
3070         usb_fill_bulk_urb( &(hw->tx_urb), hw->usb,
3071                        hw->endp_out,
3072                        &(hw->txbuff), ROUNDUP64(usbpktlen),
3073                        hfa384x_usbout_callback, hw->wlandev );
3074         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
3075
3076         result = 1;
3077         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
3078         if ( ret != 0 ) {
3079                 printk(KERN_ERR
3080                         "submit_tx_urb() failed, error=%d\n", ret);
3081                 result = 3;
3082         }
3083
3084  exit:
3085         return result;
3086 }
3087
3088 void hfa384x_tx_timeout(wlandevice_t *wlandev)
3089 {
3090         hfa384x_t       *hw = wlandev->priv;
3091         unsigned long flags;
3092
3093         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3094
3095         if ( !hw->wlandev->hwremoved &&
3096              /* Note the bitwise OR, not the logical OR. */
3097              ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) |
3098                !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) ) )
3099         {
3100                 schedule_work(&hw->usb_work);
3101         }
3102
3103         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3104 }
3105
3106 /*----------------------------------------------------------------
3107 * hfa384x_usbctlx_reaper_task
3108 *
3109 * Tasklet to delete dead CTLX objects
3110 *
3111 * Arguments:
3112 *       data    ptr to a hfa384x_t
3113 *
3114 * Returns:
3115 *
3116 * Call context:
3117 *       Interrupt
3118 ----------------------------------------------------------------*/
3119 static void hfa384x_usbctlx_reaper_task(unsigned long data)
3120 {
3121         hfa384x_t       *hw = (hfa384x_t*)data;
3122         struct list_head *entry;
3123         struct list_head *temp;
3124         unsigned long   flags;
3125
3126         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3127
3128         /* This list is guaranteed to be empty if someone
3129          * has unplugged the adapter.
3130          */
3131         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
3132                 hfa384x_usbctlx_t       *ctlx;
3133
3134                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3135                 list_del(&ctlx->list);
3136                 kfree(ctlx);
3137         }
3138
3139         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3140
3141 }
3142
3143 /*----------------------------------------------------------------
3144 * hfa384x_usbctlx_completion_task
3145 *
3146 * Tasklet to call completion handlers for returned CTLXs
3147 *
3148 * Arguments:
3149 *       data    ptr to hfa384x_t
3150 *
3151 * Returns:
3152 *       Nothing
3153 *
3154 * Call context:
3155 *       Interrupt
3156 ----------------------------------------------------------------*/
3157 static void hfa384x_usbctlx_completion_task(unsigned long data)
3158 {
3159         hfa384x_t *hw = (hfa384x_t*)data;
3160         struct list_head *entry;
3161         struct list_head *temp;
3162         unsigned long flags;
3163
3164         int reap = 0;
3165
3166         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3167
3168         /* This list is guaranteed to be empty if someone
3169          * has unplugged the adapter ...
3170          */
3171         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
3172                 hfa384x_usbctlx_t *ctlx;
3173
3174                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3175
3176                 /* Call the completion function that this
3177                  * command was assigned, assuming it has one.
3178                  */
3179                 if ( ctlx->cmdcb != NULL ) {
3180                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3181                         ctlx->cmdcb(hw, ctlx);
3182                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3183
3184                         /* Make sure we don't try and complete
3185                          * this CTLX more than once!
3186                          */
3187                         ctlx->cmdcb = NULL;
3188
3189                         /* Did someone yank the adapter out
3190                          * while our list was (briefly) unlocked?
3191                          */
3192                         if ( hw->wlandev->hwremoved )
3193                         {
3194                                 reap = 0;
3195                                 break;
3196                         }
3197                 }
3198
3199                 /*
3200                  * "Reapable" CTLXs are ones which don't have any
3201                  * threads waiting for them to die. Hence they must
3202                  * be delivered to The Reaper!
3203                  */
3204                 if ( ctlx->reapable ) {
3205                         /* Move the CTLX off the "completing" list (hopefully)
3206                          * on to the "reapable" list where the reaper task
3207                          * can find it. And "reapable" means that this CTLX
3208                          * isn't sitting on a wait-queue somewhere.
3209                          */
3210                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
3211                         reap = 1;
3212                 }
3213
3214                 complete(&ctlx->done);
3215         }
3216         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3217
3218         if (reap)
3219                 tasklet_schedule(&hw->reaper_bh);
3220 }
3221
3222 /*----------------------------------------------------------------
3223 * unlocked_usbctlx_cancel_async
3224 *
3225 * Mark the CTLX dead asynchronously, and ensure that the
3226 * next command on the queue is run afterwards.
3227 *
3228 * Arguments:
3229 *       hw      ptr to the hfa384x_t structure
3230 *       ctlx    ptr to a CTLX structure
3231 *
3232 * Returns:
3233 *       0       the CTLX's URB is inactive
3234 * -EINPROGRESS  the URB is currently being unlinked
3235 *
3236 * Call context:
3237 *       Either process or interrupt, but presumably interrupt
3238 ----------------------------------------------------------------*/
3239 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3240 {
3241         int ret;
3242
3243         /*
3244          * Try to delete the URB containing our request packet.
3245          * If we succeed, then its completion handler will be
3246          * called with a status of -ECONNRESET.
3247          */
3248         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3249         ret = usb_unlink_urb(&hw->ctlx_urb);
3250
3251         if (ret != -EINPROGRESS) {
3252                 /*
3253                  * The OUT URB had either already completed
3254                  * or was still in the pending queue, so the
3255                  * URB's completion function will not be called.
3256                  * We will have to complete the CTLX ourselves.
3257                  */
3258                 ctlx->state = CTLX_REQ_FAILED;
3259                 unlocked_usbctlx_complete(hw, ctlx);
3260                 ret = 0;
3261         }
3262
3263         return ret;
3264 }
3265
3266 /*----------------------------------------------------------------
3267 * unlocked_usbctlx_complete
3268 *
3269 * A CTLX has completed.  It may have been successful, it may not
3270 * have been. At this point, the CTLX should be quiescent.  The URBs
3271 * aren't active and the timers should have been stopped.
3272 *
3273 * The CTLX is migrated to the "completing" queue, and the completing
3274 * tasklet is scheduled.
3275 *
3276 * Arguments:
3277 *       hw              ptr to a hfa384x_t structure
3278 *       ctlx            ptr to a ctlx structure
3279 *
3280 * Returns:
3281 *       nothing
3282 *
3283 * Side effects:
3284 *
3285 * Call context:
3286 *       Either, assume interrupt
3287 ----------------------------------------------------------------*/
3288 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3289 {
3290         /* Timers have been stopped, and ctlx should be in
3291          * a terminal state. Retire it from the "active"
3292          * queue.
3293          */
3294         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3295         tasklet_schedule(&hw->completion_bh);
3296
3297         switch (ctlx->state) {
3298         case CTLX_COMPLETE:
3299         case CTLX_REQ_FAILED:
3300                 /* This are the correct terminating states. */
3301                 break;
3302
3303         default:
3304                 printk(KERN_ERR "CTLX[%d] not in a terminating state(%s)\n",
3305                                hfa384x2host_16(ctlx->outbuf.type),
3306                                ctlxstr(ctlx->state));
3307                 break;
3308         } /* switch */
3309 }
3310
3311 /*----------------------------------------------------------------
3312 * hfa384x_usbctlxq_run
3313 *
3314 * Checks to see if the head item is running.  If not, starts it.
3315 *
3316 * Arguments:
3317 *       hw      ptr to hfa384x_t
3318 *
3319 * Returns:
3320 *       nothing
3321 *
3322 * Side effects:
3323 *
3324 * Call context:
3325 *       any
3326 ----------------------------------------------------------------*/
3327 static void
3328 hfa384x_usbctlxq_run(hfa384x_t  *hw)
3329 {
3330         unsigned long           flags;
3331
3332         /* acquire lock */
3333         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3334
3335         /* Only one active CTLX at any one time, because there's no
3336          * other (reliable) way to match the response URB to the
3337          * correct CTLX.
3338          *
3339          * Don't touch any of these CTLXs if the hardware
3340          * has been removed or the USB subsystem is stalled.
3341          */
3342         if ( !list_empty(&hw->ctlxq.active) ||
3343              test_bit(WORK_TX_HALT, &hw->usb_flags) ||
3344              hw->wlandev->hwremoved )
3345                 goto unlock;
3346
3347         while ( !list_empty(&hw->ctlxq.pending) ) {
3348                 hfa384x_usbctlx_t       *head;
3349                 int                     result;
3350
3351                 /* This is the first pending command */
3352                 head = list_entry(hw->ctlxq.pending.next,
3353                                   hfa384x_usbctlx_t,
3354                                   list);
3355
3356                 /* We need to split this off to avoid a race condition */
3357                 list_move_tail(&head->list, &hw->ctlxq.active);
3358
3359                 /* Fill the out packet */
3360                 usb_fill_bulk_urb( &(hw->ctlx_urb), hw->usb,
3361                                    hw->endp_out,
3362                                    &(head->outbuf), ROUNDUP64(head->outbufsize),
3363                                    hfa384x_ctlxout_callback, hw);
3364                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3365
3366                 /* Now submit the URB and update the CTLX's state
3367                  */
3368                 if ((result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC)) == 0) {
3369                         /* This CTLX is now running on the active queue */
3370                         head->state = CTLX_REQ_SUBMITTED;
3371
3372                         /* Start the OUT wait timer */
3373                         hw->req_timer_done = 0;
3374                         hw->reqtimer.expires = jiffies + HZ;
3375                         add_timer(&hw->reqtimer);
3376
3377                         /* Start the IN wait timer */
3378                         hw->resp_timer_done = 0;
3379                         hw->resptimer.expires = jiffies + 2*HZ;
3380                         add_timer(&hw->resptimer);
3381
3382                         break;
3383                 }
3384
3385                 if (result == -EPIPE) {
3386                         /* The OUT pipe needs resetting, so put
3387                          * this CTLX back in the "pending" queue
3388                          * and schedule a reset ...
3389                          */
3390                         printk(KERN_WARNING "%s tx pipe stalled: requesting reset\n",
3391                                          hw->wlandev->netdev->name);
3392                         list_move(&head->list, &hw->ctlxq.pending);
3393                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3394                         schedule_work(&hw->usb_work);
3395                         break;
3396                 }
3397
3398                 if (result == -ESHUTDOWN) {
3399                         printk(KERN_WARNING "%s urb shutdown!\n",
3400                                          hw->wlandev->netdev->name);
3401                         break;
3402                 }
3403
3404                 printk(KERN_ERR "Failed to submit CTLX[%d]: error=%d\n",
3405                                hfa384x2host_16(head->outbuf.type), result);
3406                 unlocked_usbctlx_complete(hw, head);
3407         } /* while */
3408
3409         unlock:
3410         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3411 }
3412
3413
3414 /*----------------------------------------------------------------
3415 * hfa384x_usbin_callback
3416 *
3417 * Callback for URBs on the BULKIN endpoint.
3418 *
3419 * Arguments:
3420 *       urb             ptr to the completed urb
3421 *
3422 * Returns:
3423 *       nothing
3424 *
3425 * Side effects:
3426 *
3427 * Call context:
3428 *       interrupt
3429 ----------------------------------------------------------------*/
3430 static void hfa384x_usbin_callback(struct urb *urb)
3431 {
3432         wlandevice_t            *wlandev = urb->context;
3433         hfa384x_t               *hw;
3434         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3435         struct sk_buff          *skb = NULL;
3436         int                     result;
3437         int                     urb_status;
3438         u16                     type;
3439
3440         enum USBIN_ACTION {
3441                 HANDLE,
3442                 RESUBMIT,
3443                 ABORT
3444         } action;
3445
3446         if ( !wlandev ||
3447              !wlandev->netdev ||
3448              wlandev->hwremoved )
3449                 goto exit;
3450
3451         hw = wlandev->priv;
3452         if (!hw)
3453                 goto exit;
3454
3455         skb = hw->rx_urb_skb;
3456         if (!skb || (skb->data != urb->transfer_buffer)) {
3457                 BUG();
3458         }
3459         hw->rx_urb_skb = NULL;
3460
3461         /* Check for error conditions within the URB */
3462         switch (urb->status) {
3463         case 0:
3464                 action = HANDLE;
3465
3466                 /* Check for short packet */
3467                 if ( urb->actual_length == 0 ) {
3468                         ++(wlandev->linux_stats.rx_errors);
3469                         ++(wlandev->linux_stats.rx_length_errors);
3470                         action = RESUBMIT;
3471                 }
3472                 break;
3473
3474         case -EPIPE:
3475                 printk(KERN_WARNING "%s rx pipe stalled: requesting reset\n",
3476                                  wlandev->netdev->name);
3477                 if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
3478                         schedule_work(&hw->usb_work);
3479                 ++(wlandev->linux_stats.rx_errors);
3480                 action = ABORT;
3481                 break;
3482
3483         case -EILSEQ:
3484         case -ETIMEDOUT:
3485         case -EPROTO:
3486                 if ( !test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3487                      !timer_pending(&hw->throttle) ) {
3488                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3489                 }
3490                 ++(wlandev->linux_stats.rx_errors);
3491                 action = ABORT;
3492                 break;
3493
3494         case -EOVERFLOW:
3495                 ++(wlandev->linux_stats.rx_over_errors);
3496                 action = RESUBMIT;
3497                 break;
3498
3499         case -ENODEV:
3500         case -ESHUTDOWN:
3501                 WLAN_LOG_DEBUG(3,"status=%d, device removed.\n", urb->status);
3502                 action = ABORT;
3503                 break;
3504
3505         case -ENOENT:
3506         case -ECONNRESET:
3507                 WLAN_LOG_DEBUG(3,"status=%d, urb explicitly unlinked.\n", urb->status);
3508                 action = ABORT;
3509                 break;
3510
3511         default:
3512                 WLAN_LOG_DEBUG(3,"urb status=%d, transfer flags=0x%x\n",
3513                                  urb->status, urb->transfer_flags);
3514                 ++(wlandev->linux_stats.rx_errors);
3515                 action = RESUBMIT;
3516                 break;
3517         }
3518
3519         urb_status = urb->status;
3520
3521         if (action != ABORT) {
3522                 /* Repost the RX URB */
3523                 result = submit_rx_urb(hw, GFP_ATOMIC);
3524
3525                 if (result != 0) {
3526                         printk(KERN_ERR
3527                                 "Fatal, failed to resubmit rx_urb. error=%d\n",
3528                                 result);
3529                 }
3530         }
3531
3532         /* Handle any USB-IN packet */
3533         /* Note: the check of the sw_support field, the type field doesn't
3534          *       have bit 12 set like the docs suggest.
3535          */
3536         type = hfa384x2host_16(usbin->type);
3537         if (HFA384x_USB_ISRXFRM(type)) {
3538                 if (action == HANDLE) {
3539                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3540                                 hfa384x_usbin_txcompl(wlandev, usbin);
3541                         } else {
3542                                 skb_put(skb, sizeof(*usbin));
3543                                 hfa384x_usbin_rx(wlandev, skb);
3544                                 skb = NULL;
3545                         }
3546                 }
3547                 goto exit;
3548         }
3549         if (HFA384x_USB_ISTXFRM(type)) {
3550                 if (action == HANDLE)
3551                         hfa384x_usbin_txcompl(wlandev, usbin);
3552                 goto exit;
3553         }
3554         switch (type) {
3555         case HFA384x_USB_INFOFRM:
3556                 if (action == ABORT)
3557                         goto exit;
3558                 if (action == HANDLE)
3559                         hfa384x_usbin_info(wlandev, usbin);
3560                 break;
3561
3562         case HFA384x_USB_CMDRESP:
3563         case HFA384x_USB_WRIDRESP:
3564         case HFA384x_USB_RRIDRESP:
3565         case HFA384x_USB_WMEMRESP:
3566         case HFA384x_USB_RMEMRESP:
3567                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3568                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3569                 break;
3570
3571         case HFA384x_USB_BUFAVAIL:
3572                 WLAN_LOG_DEBUG(3,"Received BUFAVAIL packet, frmlen=%d\n",
3573                         usbin->bufavail.frmlen);
3574                 break;
3575
3576         case HFA384x_USB_ERROR:
3577                 WLAN_LOG_DEBUG(3,"Received USB_ERROR packet, errortype=%d\n",
3578                         usbin->usberror.errortype);
3579                 break;
3580
3581         default:
3582                 WLAN_LOG_DEBUG(3,"Unrecognized USBIN packet, type=%x, status=%d\n",
3583                         usbin->type, urb_status);
3584                 break;
3585         } /* switch */
3586
3587 exit:
3588
3589         if (skb)
3590                 dev_kfree_skb(skb);
3591 }
3592
3593
3594 /*----------------------------------------------------------------
3595 * hfa384x_usbin_ctlx
3596 *
3597 * We've received a URB containing a Prism2 "response" message.
3598 * This message needs to be matched up with a CTLX on the active
3599 * queue and our state updated accordingly.
3600 *
3601 * Arguments:
3602 *       hw              ptr to hfa384x_t
3603 *       usbin           ptr to USB IN packet
3604 *       urb_status      status of this Bulk-In URB
3605 *
3606 * Returns:
3607 *       nothing
3608 *
3609 * Side effects:
3610 *
3611 * Call context:
3612 *       interrupt
3613 ----------------------------------------------------------------*/
3614 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3615                                int urb_status)
3616 {
3617         hfa384x_usbctlx_t       *ctlx;
3618         int                     run_queue = 0;
3619         unsigned long           flags;
3620
3621 retry:
3622         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3623
3624         /* There can be only one CTLX on the active queue
3625          * at any one time, and this is the CTLX that the
3626          * timers are waiting for.
3627          */
3628         if ( list_empty(&hw->ctlxq.active) ) {
3629                 goto unlock;
3630         }
3631
3632         /* Remove the "response timeout". It's possible that
3633          * we are already too late, and that the timeout is
3634          * already running. And that's just too bad for us,
3635          * because we could lose our CTLX from the active
3636          * queue here ...
3637          */
3638         if (del_timer(&hw->resptimer) == 0) {
3639                 if (hw->resp_timer_done == 0) {
3640                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3641                         goto retry;
3642                 }
3643         }
3644         else {
3645                 hw->resp_timer_done = 1;
3646         }
3647
3648         ctlx = get_active_ctlx(hw);
3649
3650         if (urb_status != 0) {
3651                 /*
3652                  * Bad CTLX, so get rid of it. But we only
3653                  * remove it from the active queue if we're no
3654                  * longer expecting the OUT URB to complete.
3655                  */
3656                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3657                         run_queue = 1;
3658         } else {
3659                 const u16 intype = (usbin->type&~host2hfa384x_16(0x8000));
3660
3661                 /*
3662                  * Check that our message is what we're expecting ...
3663                  */
3664                 if (ctlx->outbuf.type != intype) {
3665                         printk(KERN_WARNING "Expected IN[%d], received IN[%d] - ignored.\n",
3666                                          hfa384x2host_16(ctlx->outbuf.type),
3667                                          hfa384x2host_16(intype));
3668                         goto unlock;
3669                 }
3670
3671                 /* This URB has succeeded, so grab the data ... */
3672                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3673
3674                 switch (ctlx->state) {
3675                 case CTLX_REQ_SUBMITTED:
3676                         /*
3677                          * We have received our response URB before
3678                          * our request has been acknowledged. Odd,
3679                          * but our OUT URB is still alive...
3680                          */
3681                         WLAN_LOG_DEBUG(0, "Causality violation: please reboot Universe, or email linux-wlan-devel@lists.linux-wlan.com\n");
3682                         ctlx->state = CTLX_RESP_COMPLETE;
3683                         break;
3684
3685                 case CTLX_REQ_COMPLETE:
3686                         /*
3687                          * This is the usual path: our request
3688                          * has already been acknowledged, and
3689                          * now we have received the reply too.
3690                          */
3691                         ctlx->state = CTLX_COMPLETE;
3692                         unlocked_usbctlx_complete(hw, ctlx);
3693                         run_queue = 1;
3694                         break;
3695
3696                 default:
3697                         /*
3698                          * Throw this CTLX away ...
3699                          */
3700                         printk(KERN_ERR "Matched IN URB, CTLX[%d] in invalid state(%s)."
3701                                        " Discarded.\n",
3702                                        hfa384x2host_16(ctlx->outbuf.type),
3703                                        ctlxstr(ctlx->state));
3704                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3705                                 run_queue = 1;
3706                         break;
3707                 } /* switch */
3708         }
3709
3710 unlock:
3711         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3712
3713         if (run_queue)
3714                 hfa384x_usbctlxq_run(hw);
3715 }
3716
3717
3718 /*----------------------------------------------------------------
3719 * hfa384x_usbin_txcompl
3720 *
3721 * At this point we have the results of a previous transmit.
3722 *
3723 * Arguments:
3724 *       wlandev         wlan device
3725 *       usbin           ptr to the usb transfer buffer
3726 *
3727 * Returns:
3728 *       nothing
3729 *
3730 * Side effects:
3731 *
3732 * Call context:
3733 *       interrupt
3734 ----------------------------------------------------------------*/
3735 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3736 {
3737         u16                     status;
3738
3739         status = hfa384x2host_16(usbin->type); /* yeah I know it says type...*/
3740
3741         /* Was there an error? */
3742         if (HFA384x_TXSTATUS_ISERROR(status)) {
3743                 prism2sta_ev_txexc(wlandev, status);
3744         } else {
3745                 prism2sta_ev_tx(wlandev, status);
3746         }
3747         // prism2sta_ev_alloc(wlandev);
3748 }
3749
3750
3751 /*----------------------------------------------------------------
3752 * hfa384x_usbin_rx
3753 *
3754 * At this point we have a successful received a rx frame packet.
3755 *
3756 * Arguments:
3757 *       wlandev         wlan device
3758 *       usbin           ptr to the usb transfer buffer
3759 *
3760 * Returns:
3761 *       nothing
3762 *
3763 * Side effects:
3764 *
3765 * Call context:
3766 *       interrupt
3767 ----------------------------------------------------------------*/
3768 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
3769 {
3770         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) skb->data;
3771         hfa384x_t               *hw = wlandev->priv;
3772         int                     hdrlen;
3773         p80211_rxmeta_t         *rxmeta;
3774         u16                  data_len;
3775         u16                  fc;
3776
3777         /* Byte order convert once up front. */
3778         usbin->rxfrm.desc.status =
3779                 hfa384x2host_16(usbin->rxfrm.desc.status);
3780         usbin->rxfrm.desc.time =
3781                 hfa384x2host_32(usbin->rxfrm.desc.time);
3782
3783         /* Now handle frame based on port# */
3784         switch( HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) )
3785         {
3786         case 0:
3787                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3788
3789                 /* If exclude and we receive an unencrypted, drop it */
3790                 if ( (wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3791                      !WLAN_GET_FC_ISWEP(fc)){
3792                         goto done;
3793                 }
3794
3795                 data_len = hfa384x2host_16(usbin->rxfrm.desc.data_len);
3796
3797                 /* How much header data do we have? */
3798                 hdrlen = p80211_headerlen(fc);
3799
3800                 /* Pull off the descriptor */
3801                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
3802
3803                 /* Now shunt the header block up against the data block
3804                  * with an "overlapping" copy
3805                  */
3806                 memmove(skb_push(skb, hdrlen),
3807                         &usbin->rxfrm.desc.frame_control,
3808                         hdrlen);
3809
3810                 skb->dev = wlandev->netdev;
3811                 skb->dev->last_rx = jiffies;
3812
3813                 /* And set the frame length properly */
3814                 skb_trim(skb, data_len + hdrlen);
3815
3816                 /* The prism2 series does not return the CRC */
3817                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3818
3819                 skb_reset_mac_header(skb);
3820
3821                 /* Attach the rxmeta, set some stuff */
3822                 p80211skb_rxmeta_attach(wlandev, skb);
3823                 rxmeta = P80211SKB_RXMETA(skb);
3824                 rxmeta->mactime = usbin->rxfrm.desc.time;
3825                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3826                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3827                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3828
3829                 prism2sta_ev_rx(wlandev, skb);
3830
3831                 break;
3832
3833         case 7:
3834                 if ( ! HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status) ) {
3835                         /* Copy to wlansnif skb */
3836                         hfa384x_int_rxmonitor( wlandev, &usbin->rxfrm);
3837                         dev_kfree_skb(skb);
3838                 } else {
3839                         WLAN_LOG_DEBUG(3,"Received monitor frame: FCSerr set\n");
3840                 }
3841                 break;
3842
3843         default:
3844                 printk(KERN_WARNING "Received frame on unsupported port=%d\n",
3845                         HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) );
3846                 goto done;
3847                 break;
3848         }
3849
3850 done:
3851         return;
3852 }
3853
3854 /*----------------------------------------------------------------
3855 * hfa384x_int_rxmonitor
3856 *
3857 * Helper function for int_rx.  Handles monitor frames.
3858 * Note that this function allocates space for the FCS and sets it
3859 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3860 * higher layers expect it.  0xffffffff is used as a flag to indicate
3861 * the FCS is bogus.
3862 *
3863 * Arguments:
3864 *       wlandev         wlan device structure
3865 *       rxfrm           rx descriptor read from card in int_rx
3866 *
3867 * Returns:
3868 *       nothing
3869 *
3870 * Side effects:
3871 *       Allocates an skb and passes it up via the PF_PACKET interface.
3872 * Call context:
3873 *       interrupt
3874 ----------------------------------------------------------------*/
3875 static void hfa384x_int_rxmonitor( wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm)
3876 {
3877         hfa384x_rx_frame_t              *rxdesc = &(rxfrm->desc);
3878         unsigned int                            hdrlen = 0;
3879         unsigned int                            datalen = 0;
3880         unsigned int                            skblen = 0;
3881         u8                              *datap;
3882         u16                             fc;
3883         struct sk_buff                  *skb;
3884         hfa384x_t                       *hw = wlandev->priv;
3885
3886         /* Don't forget the status, time, and data_len fields are in host order */
3887         /* Figure out how big the frame is */
3888         fc = le16_to_cpu(rxdesc->frame_control);
3889         hdrlen = p80211_headerlen(fc);
3890         datalen = hfa384x2host_16(rxdesc->data_len);
3891
3892         /* Allocate an ind message+framesize skb */
3893         skblen = sizeof(p80211_caphdr_t) +
3894                 hdrlen + datalen + WLAN_CRC_LEN;
3895
3896         /* sanity check the length */
3897         if ( skblen >
3898              (sizeof(p80211_caphdr_t) +
3899               WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN) ) {
3900                 WLAN_LOG_DEBUG(1, "overlen frm: len=%zd\n",
3901                                skblen - sizeof(p80211_caphdr_t));
3902         }
3903
3904         if ( (skb = dev_alloc_skb(skblen)) == NULL ) {
3905                 printk(KERN_ERR "alloc_skb failed trying to allocate %d bytes\n", skblen);
3906                 return;
3907         }
3908
3909         /* only prepend the prism header if in the right mode */
3910         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3911             (hw->sniffhdr != 0)) {
3912                 p80211_caphdr_t         *caphdr;
3913                 /* The NEW header format! */
3914                 datap = skb_put(skb, sizeof(p80211_caphdr_t));
3915                 caphdr = (p80211_caphdr_t*) datap;
3916
3917                 caphdr->version =       htonl(P80211CAPTURE_VERSION);
3918                 caphdr->length =        htonl(sizeof(p80211_caphdr_t));
3919                 caphdr->mactime =       __cpu_to_be64(rxdesc->time) * 1000;
3920                 caphdr->hosttime =      __cpu_to_be64(jiffies);
3921                 caphdr->phytype =       htonl(4); /* dss_dot11_b */
3922                 caphdr->channel =       htonl(hw->sniff_channel);
3923                 caphdr->datarate =      htonl(rxdesc->rate);
3924                 caphdr->antenna =       htonl(0); /* unknown */
3925                 caphdr->priority =      htonl(0); /* unknown */
3926                 caphdr->ssi_type =      htonl(3); /* rssi_raw */
3927                 caphdr->ssi_signal =    htonl(rxdesc->signal);
3928                 caphdr->ssi_noise =     htonl(rxdesc->silence);
3929                 caphdr->preamble =      htonl(0); /* unknown */
3930                 caphdr->encoding =      htonl(1); /* cck */
3931         }
3932
3933         /* Copy the 802.11 header to the skb (ctl frames may be less than a full header) */
3934         datap = skb_put(skb, hdrlen);
3935         memcpy( datap, &(rxdesc->frame_control), hdrlen);
3936
3937         /* If any, copy the data from the card to the skb */
3938         if ( datalen > 0 )
3939         {
3940                 datap = skb_put(skb, datalen);
3941                 memcpy(datap, rxfrm->data, datalen);
3942
3943                 /* check for unencrypted stuff if WEP bit set. */
3944                 if (*(datap - hdrlen + 1) & 0x40) // wep set
3945                   if ((*(datap) == 0xaa) && (*(datap+1) == 0xaa))
3946                     *(datap - hdrlen + 1) &= 0xbf; // clear wep; it's the 802.2 header!
3947         }
3948
3949         if (hw->sniff_fcs) {
3950                 /* Set the FCS */
3951                 datap = skb_put(skb, WLAN_CRC_LEN);
3952                 memset( datap, 0xff, WLAN_CRC_LEN);
3953         }
3954
3955         /* pass it back up */
3956         prism2sta_ev_rx(wlandev, skb);
3957
3958         return;
3959 }
3960
3961
3962
3963 /*----------------------------------------------------------------
3964 * hfa384x_usbin_info
3965 *
3966 * At this point we have a successful received a Prism2 info frame.
3967 *
3968 * Arguments:
3969 *       wlandev         wlan device
3970 *       usbin           ptr to the usb transfer buffer
3971 *
3972 * Returns:
3973 *       nothing
3974 *
3975 * Side effects:
3976 *
3977 * Call context:
3978 *       interrupt
3979 ----------------------------------------------------------------*/
3980 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3981 {
3982         usbin->infofrm.info.framelen = hfa384x2host_16(usbin->infofrm.info.framelen);
3983         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3984 }
3985
3986
3987
3988 /*----------------------------------------------------------------
3989 * hfa384x_usbout_callback
3990 *
3991 * Callback for URBs on the BULKOUT endpoint.
3992 *
3993 * Arguments:
3994 *       urb             ptr to the completed urb
3995 *
3996 * Returns:
3997 *       nothing
3998 *
3999 * Side effects:
4000 *
4001 * Call context:
4002 *       interrupt
4003 ----------------------------------------------------------------*/
4004 static void hfa384x_usbout_callback(struct urb *urb)
4005 {
4006         wlandevice_t            *wlandev = urb->context;
4007         hfa384x_usbout_t        *usbout = urb->transfer_buffer;
4008
4009 #ifdef DEBUG_USB
4010         dbprint_urb(urb);
4011 #endif
4012
4013         if ( wlandev &&
4014              wlandev->netdev ) {
4015
4016                 switch(urb->status) {
4017                 case 0:
4018                         hfa384x_usbout_tx(wlandev, usbout);
4019                         break;
4020
4021                 case -EPIPE:
4022                 {
4023                         hfa384x_t *hw = wlandev->priv;
4024                         printk(KERN_WARNING "%s tx pipe stalled: requesting reset\n",
4025                                          wlandev->netdev->name);
4026                         if ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) )
4027                                 schedule_work(&hw->usb_work);
4028                         ++(wlandev->linux_stats.tx_errors);
4029                         break;
4030                 }
4031
4032                 case -EPROTO:
4033                 case -ETIMEDOUT:
4034                 case -EILSEQ:
4035                 {
4036                         hfa384x_t *hw = wlandev->priv;
4037
4038                         if ( !test_and_set_bit(THROTTLE_TX, &hw->usb_flags)
4039                              && !timer_pending(&hw->throttle) ) {
4040                                 mod_timer(&hw->throttle,
4041                                           jiffies + THROTTLE_JIFFIES);
4042                         }
4043                         ++(wlandev->linux_stats.tx_errors);
4044                         netif_stop_queue(wlandev->netdev);
4045                         break;
4046                 }
4047
4048                 case -ENOENT:
4049                 case -ESHUTDOWN:
4050                         /* Ignorable errors */
4051                         break;
4052
4053                 default:
4054                         printk(KERN_INFO "unknown urb->status=%d\n", urb->status);
4055                         ++(wlandev->linux_stats.tx_errors);
4056                         break;
4057                 } /* switch */
4058         }
4059 }
4060
4061
4062 /*----------------------------------------------------------------
4063 * hfa384x_ctlxout_callback
4064 *
4065 * Callback for control data on the BULKOUT endpoint.
4066 *
4067 * Arguments:
4068 *       urb             ptr to the completed urb
4069 *
4070 * Returns:
4071 * nothing
4072 *
4073 * Side effects:
4074 *
4075 * Call context:
4076 * interrupt
4077 ----------------------------------------------------------------*/
4078 static void hfa384x_ctlxout_callback(struct urb *urb)
4079 {
4080         hfa384x_t       *hw = urb->context;
4081         int             delete_resptimer = 0;
4082         int             timer_ok = 1;
4083         int             run_queue = 0;
4084         hfa384x_usbctlx_t       *ctlx;
4085         unsigned long   flags;
4086
4087         WLAN_LOG_DEBUG(3,"urb->status=%d\n", urb->status);
4088 #ifdef DEBUG_USB
4089         dbprint_urb(urb);
4090 #endif
4091         if ( (urb->status == -ESHUTDOWN) ||
4092              (urb->status == -ENODEV) ||
4093              (hw == NULL) )
4094                 goto done;
4095
4096 retry:
4097         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4098
4099         /*
4100          * Only one CTLX at a time on the "active" list, and
4101          * none at all if we are unplugged. However, we can
4102          * rely on the disconnect function to clean everything
4103          * up if someone unplugged the adapter.
4104          */
4105         if ( list_empty(&hw->ctlxq.active) ) {
4106                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4107                 goto done;
4108         }
4109
4110         /*
4111          * Having something on the "active" queue means
4112          * that we have timers to worry about ...
4113          */
4114         if (del_timer(&hw->reqtimer) == 0) {
4115                 if (hw->req_timer_done == 0) {
4116                         /*
4117                          * This timer was actually running while we
4118                          * were trying to delete it. Let it terminate
4119                          * gracefully instead.
4120                          */
4121                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4122                         goto retry;
4123                 }
4124         }
4125         else {
4126                 hw->req_timer_done = 1;
4127         }
4128
4129         ctlx = get_active_ctlx(hw);
4130
4131         if ( urb->status == 0 ) {
4132                 /* Request portion of a CTLX is successful */
4133                 switch ( ctlx->state ) {
4134                 case CTLX_REQ_SUBMITTED:
4135                         /* This OUT-ACK received before IN */
4136                         ctlx->state = CTLX_REQ_COMPLETE;
4137                         break;
4138
4139                 case CTLX_RESP_COMPLETE:
4140                         /* IN already received before this OUT-ACK,
4141                          * so this command must now be complete.
4142                          */
4143                         ctlx->state = CTLX_COMPLETE;
4144                         unlocked_usbctlx_complete(hw, ctlx);
4145                         run_queue = 1;
4146                         break;
4147
4148                 default:
4149                         /* This is NOT a valid CTLX "success" state! */
4150                         printk(KERN_ERR
4151                             "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
4152                             hfa384x2host_16(ctlx->outbuf.type),
4153                             ctlxstr(ctlx->state), urb->status);
4154                         break;
4155                 } /* switch */
4156         } else {
4157                 /* If the pipe has stalled then we need to reset it */
4158                 if ( (urb->status == -EPIPE) &&
4159                       !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) ) {
4160                         printk(KERN_WARNING "%s tx pipe stalled: requesting reset\n",
4161                                          hw->wlandev->netdev->name);
4162                         schedule_work(&hw->usb_work);
4163                 }
4164
4165                 /* If someone cancels the OUT URB then its status
4166                  * should be either -ECONNRESET or -ENOENT.
4167                  */
4168                 ctlx->state = CTLX_REQ_FAILED;
4169                 unlocked_usbctlx_complete(hw, ctlx);
4170                 delete_resptimer = 1;
4171                 run_queue = 1;
4172         }
4173
4174  delresp:
4175         if (delete_resptimer) {
4176                 if ((timer_ok = del_timer(&hw->resptimer)) != 0) {
4177                         hw->resp_timer_done = 1;
4178                 }
4179         }
4180
4181         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4182
4183         if ( !timer_ok && (hw->resp_timer_done == 0) ) {
4184                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
4185                 goto delresp;
4186         }
4187
4188         if (run_queue)
4189                 hfa384x_usbctlxq_run(hw);
4190
4191  done:
4192         ;
4193 }
4194
4195
4196 /*----------------------------------------------------------------
4197 * hfa384x_usbctlx_reqtimerfn
4198 *
4199 * Timer response function for CTLX request timeouts.  If this
4200 * function is called, it means that the callback for the OUT
4201 * URB containing a Prism2.x XXX_Request was never called.
4202 *
4203 * Arguments:
4204 *       data            a ptr to the hfa384x_t
4205 *
4206 * Returns:
4207 *       nothing
4208 *
4209 * Side effects:
4210 *
4211 * Call context:
4212 *       interrupt
4213 ----------------------------------------------------------------*/
4214 static void
4215 hfa384x_usbctlx_reqtimerfn(unsigned long data)
4216 {
4217         hfa384x_t       *hw = (hfa384x_t*)data;
4218         unsigned long   flags;
4219
4220         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4221
4222         hw->req_timer_done = 1;
4223
4224         /* Removing the hardware automatically empties
4225          * the active list ...
4226          */
4227         if ( !list_empty(&hw->ctlxq.active) )
4228         {
4229                 /*
4230                  * We must ensure that our URB is removed from
4231                  * the system, if it hasn't already expired.
4232                  */
4233                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
4234                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS)
4235                 {
4236                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4237
4238                         ctlx->state = CTLX_REQ_FAILED;
4239
4240                         /* This URB was active, but has now been
4241                          * cancelled. It will now have a status of
4242                          * -ECONNRESET in the callback function.
4243                          *
4244                          * We are cancelling this CTLX, so we're
4245                          * not going to need to wait for a response.
4246                          * The URB's callback function will check
4247                          * that this timer is truly dead.
4248                          */
4249                         if (del_timer(&hw->resptimer) != 0)
4250                                 hw->resp_timer_done = 1;
4251                 }
4252         }
4253
4254         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4255 }
4256
4257
4258 /*----------------------------------------------------------------
4259 * hfa384x_usbctlx_resptimerfn
4260 *
4261 * Timer response function for CTLX response timeouts.  If this
4262 * function is called, it means that the callback for the IN
4263 * URB containing a Prism2.x XXX_Response was never called.
4264 *
4265 * Arguments:
4266 *       data            a ptr to the hfa384x_t
4267 *
4268 * Returns:
4269 *       nothing
4270 *
4271 * Side effects:
4272 *
4273 * Call context:
4274 *       interrupt
4275 ----------------------------------------------------------------*/
4276 static void
4277 hfa384x_usbctlx_resptimerfn(unsigned long data)
4278 {
4279         hfa384x_t *hw = (hfa384x_t*)data;
4280         unsigned long   flags;
4281
4282         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4283
4284         hw->resp_timer_done = 1;
4285
4286         /* The active list will be empty if the
4287          * adapter has been unplugged ...
4288          */
4289         if ( !list_empty(&hw->ctlxq.active) )
4290         {
4291                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4292
4293                 if ( unlocked_usbctlx_cancel_async(hw, ctlx) == 0 )
4294                 {
4295                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4296                         hfa384x_usbctlxq_run(hw);
4297                         goto done;
4298                 }
4299         }
4300
4301         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4302
4303  done:
4304         ;
4305
4306 }
4307
4308 /*----------------------------------------------------------------
4309 * hfa384x_usb_throttlefn
4310 *
4311 *
4312 * Arguments:
4313 *       data    ptr to hw
4314 *
4315 * Returns:
4316 *       Nothing
4317 *
4318 * Side effects:
4319 *
4320 * Call context:
4321 *       Interrupt
4322 ----------------------------------------------------------------*/
4323 static void
4324 hfa384x_usb_throttlefn(unsigned long data)
4325 {
4326         hfa384x_t *hw = (hfa384x_t*)data;
4327         unsigned long   flags;
4328
4329         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4330
4331         /*
4332          * We need to check BOTH the RX and the TX throttle controls,
4333          * so we use the bitwise OR instead of the logical OR.
4334          */
4335         WLAN_LOG_DEBUG(3, "flags=0x%lx\n", hw->usb_flags);
4336         if ( !hw->wlandev->hwremoved &&
4337              (
4338                (test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4339                !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4340                |
4341                (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4342                 !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4343              ) )
4344         {
4345                 schedule_work(&hw->usb_work);
4346         }
4347
4348         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4349 }
4350
4351
4352 /*----------------------------------------------------------------
4353 * hfa384x_usbctlx_submit
4354 *
4355 * Called from the doxxx functions to submit a CTLX to the queue
4356 *
4357 * Arguments:
4358 *       hw              ptr to the hw struct
4359 *       ctlx            ctlx structure to enqueue
4360 *
4361 * Returns:
4362 *       -ENODEV if the adapter is unplugged
4363 *       0
4364 *
4365 * Side effects:
4366 *
4367 * Call context:
4368 *       process or interrupt
4369 ----------------------------------------------------------------*/
4370 static int
4371 hfa384x_usbctlx_submit(
4372         hfa384x_t               *hw,
4373         hfa384x_usbctlx_t       *ctlx)
4374 {
4375         unsigned long flags;
4376         int ret;
4377
4378         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4379
4380         if (hw->wlandev->hwremoved) {
4381                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4382                 ret = -ENODEV;
4383         } else {
4384                 ctlx->state = CTLX_PENDING;
4385                 list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4386
4387                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4388                 hfa384x_usbctlxq_run(hw);
4389                 ret = 0;
4390         }
4391
4392         return ret;
4393 }
4394
4395
4396 /*----------------------------------------------------------------
4397 * hfa384x_usbout_tx
4398 *
4399 * At this point we have finished a send of a frame.  Mark the URB
4400 * as available and call ev_alloc to notify higher layers we're
4401 * ready for more.
4402 *
4403 * Arguments:
4404 *       wlandev         wlan device
4405 *       usbout          ptr to the usb transfer buffer
4406 *
4407 * Returns:
4408 *       nothing
4409 *
4410 * Side effects:
4411 *
4412 * Call context:
4413 *       interrupt
4414 ----------------------------------------------------------------*/
4415 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4416 {
4417         prism2sta_ev_alloc(wlandev);
4418 }
4419
4420 /*----------------------------------------------------------------
4421 * hfa384x_isgood_pdrcore
4422 *
4423 * Quick check of PDR codes.
4424 *
4425 * Arguments:
4426 *       pdrcode         PDR code number (host order)
4427 *
4428 * Returns:
4429 *       zero            not good.
4430 *       one             is good.
4431 *
4432 * Side effects:
4433 *
4434 * Call context:
4435 ----------------------------------------------------------------*/
4436 static int
4437 hfa384x_isgood_pdrcode(u16 pdrcode)
4438 {
4439         switch(pdrcode) {
4440         case HFA384x_PDR_END_OF_PDA:
4441         case HFA384x_PDR_PCB_PARTNUM:
4442         case HFA384x_PDR_PDAVER:
4443         case HFA384x_PDR_NIC_SERIAL:
4444         case HFA384x_PDR_MKK_MEASUREMENTS:
4445         case HFA384x_PDR_NIC_RAMSIZE:
4446         case HFA384x_PDR_MFISUPRANGE:
4447         case HFA384x_PDR_CFISUPRANGE:
4448         case HFA384x_PDR_NICID:
4449         case HFA384x_PDR_MAC_ADDRESS:
4450         case HFA384x_PDR_REGDOMAIN:
4451         case HFA384x_PDR_ALLOWED_CHANNEL:
4452         case HFA384x_PDR_DEFAULT_CHANNEL:
4453         case HFA384x_PDR_TEMPTYPE:
4454         case HFA384x_PDR_IFR_SETTING:
4455         case HFA384x_PDR_RFR_SETTING:
4456         case HFA384x_PDR_HFA3861_BASELINE:
4457         case HFA384x_PDR_HFA3861_SHADOW:
4458         case HFA384x_PDR_HFA3861_IFRF:
4459         case HFA384x_PDR_HFA3861_CHCALSP:
4460         case HFA384x_PDR_HFA3861_CHCALI:
4461         case HFA384x_PDR_3842_NIC_CONFIG:
4462         case HFA384x_PDR_USB_ID:
4463         case HFA384x_PDR_PCI_ID:
4464         case HFA384x_PDR_PCI_IFCONF:
4465         case HFA384x_PDR_PCI_PMCONF:
4466         case HFA384x_PDR_RFENRGY:
4467         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4468         case HFA384x_PDR_HFA3861_MANF_TESTI:
4469                 /* code is OK */
4470                 return 1;
4471                 break;
4472         default:
4473                 if ( pdrcode < 0x1000 ) {
4474                         /* code is OK, but we don't know exactly what it is */
4475                         WLAN_LOG_DEBUG(3,
4476                                 "Encountered unknown PDR#=0x%04x, "
4477                                 "assuming it's ok.\n",
4478                                 pdrcode);
4479                         return 1;
4480                 } else {
4481                         /* bad code */
4482                         WLAN_LOG_DEBUG(3,
4483                                 "Encountered unknown PDR#=0x%04x, "
4484                                 "(>=0x1000), assuming it's bad.\n",
4485                                 pdrcode);
4486                         return 0;
4487                 }
4488                 break;
4489         }
4490         return 0; /* avoid compiler warnings */
4491 }
4492