drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invokations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They  call copy_[to|from]_bap() and
  66 *                       cmd_access().   These functions operate on the
  67 *                       RIDs and buffers without validation.  The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 /*================================================================*/
 114 /* System Includes */
 115 #define WLAN_DBVAR      prism2_debug
 116
 117 #include "version.h"
 118
 119
 120 #include <linux/version.h>
 121
 122 #include <linux/module.h>
 123 #include <linux/kernel.h>
 124 #include <linux/sched.h>
 125 #include <linux/types.h>
 126 #include <linux/slab.h>
 127 #include <linux/wireless.h>
 128 #include <linux/netdevice.h>
 129 #include <linux/timer.h>
 130 #include <asm/io.h>
 131 #include <linux/delay.h>
 132 #include <asm/byteorder.h>
 133 #include <asm/bitops.h>
 134 #include <linux/list.h>
 135 #include <linux/usb.h>
 136
 137 #include "wlan_compat.h"
 138
 139 #define SUBMIT_URB(u,f)  usb_submit_urb(u,f)
 140
 141 /*================================================================*/
 142 /* Project Includes */
 143
 144 #include "p80211types.h"
 145 #include "p80211hdr.h"
 146 #include "p80211mgmt.h"
 147 #include "p80211conv.h"
 148 #include "p80211msg.h"
 149 #include "p80211netdev.h"
 150 #include "p80211req.h"
 151 #include "p80211metadef.h"
 152 #include "p80211metastruct.h"
 153 #include "hfa384x.h"
 154 #include "prism2mgmt.h"
 155
 156 /*================================================================*/
 157 /* Local Constants */
 158
 159 enum cmd_mode
 160 {
 161   DOWAIT = 0,
 162   DOASYNC
 163 };
 164 typedef enum cmd_mode CMD_MODE;
 165
 166 #define THROTTLE_JIFFIES        (HZ/8)
 167
 168 /*================================================================*/
 169 /* Local Macros */
 170
 171 #define ROUNDUP64(a) (((a)+63)&~63)
 172
 173 /*================================================================*/
 174 /* Local Types */
 175
 176 /*================================================================*/
 177 /* Local Static Definitions */
 178 extern int prism2_debug;
 179
 180 /*================================================================*/
 181 /* Local Function Declarations */
 182
 183 #ifdef DEBUG_USB
 184 static void
 185 dbprint_urb(struct urb* urb);
 186 #endif
 187
 188 static void
 189 hfa384x_int_rxmonitor(
 190         wlandevice_t *wlandev,
 191         hfa384x_usb_rxfrm_t *rxfrm);
 192
 193 static void
 194 hfa384x_usb_defer(struct work_struct *data);
 195
 196 static int
 197 submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 198
 199 static int
 200 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 201
 202 /*---------------------------------------------------*/
 203 /* Callbacks */
 204 #ifdef URB_ONLY_CALLBACK
 205 static void
 206 hfa384x_usbout_callback(struct urb *urb);
 207 static void
 208 hfa384x_ctlxout_callback(struct urb *urb);
 209 static void
 210 hfa384x_usbin_callback(struct urb *urb);
 211 #else
 212 static void
 213 hfa384x_usbout_callback(struct urb *urb, struct pt_regs *regs);
 214 static void
 215 hfa384x_ctlxout_callback(struct urb *urb, struct pt_regs *regs);
 216 static void
 217 hfa384x_usbin_callback(struct urb *urb, struct pt_regs *regs);
 218 #endif
 219
 220 static void
 221 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 222
 223 static void
 224 hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 225
 226 static void
 227 hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 228
 229 static void
 230 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 231
 232 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 233                                int urb_status);
 234
 235 /*---------------------------------------------------*/
 236 /* Functions to support the prism2 usb command queue */
 237
 238 static void
 239 hfa384x_usbctlxq_run(hfa384x_t *hw);
 240
 241 static void
 242 hfa384x_usbctlx_reqtimerfn(unsigned long data);
 243
 244 static void
 245 hfa384x_usbctlx_resptimerfn(unsigned long data);
 246
 247 static void
 248 hfa384x_usb_throttlefn(unsigned long data);
 249
 250 static void
 251 hfa384x_usbctlx_completion_task(unsigned long data);
 252
 253 static void
 254 hfa384x_usbctlx_reaper_task(unsigned long data);
 255
 256 static int
 257 hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 258
 259 static void
 260 unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 261
 262 struct usbctlx_completor
 263 {
 264         int (*complete)(struct usbctlx_completor*);
 265 };
 266 typedef struct usbctlx_completor usbctlx_completor_t;
 267
 268 static int
 269 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 270                               hfa384x_usbctlx_t *ctlx,
 271                               usbctlx_completor_t *completor);
 272
 273 static int
 274 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 275
 276 static void
 277 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 278
 279 static void
 280 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 281
 282 static int
 283 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 284                    hfa384x_cmdresult_t *result);
 285
 286 static void
 287 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 288                        hfa384x_rridresult_t *result);
 289
 290 /*---------------------------------------------------*/
 291 /* Low level req/resp CTLX formatters and submitters */
 292 static int
 293 hfa384x_docmd(
 294         hfa384x_t *hw,
 295         CMD_MODE mode,
 296         hfa384x_metacmd_t *cmd,
 297         ctlx_cmdcb_t cmdcb,
 298         ctlx_usercb_t usercb,
 299         void    *usercb_data);
 300
 301 static int
 302 hfa384x_dorrid(
 303         hfa384x_t *hw,
 304         CMD_MODE mode,
 305         UINT16  rid,
 306         void    *riddata,
 307         UINT    riddatalen,
 308         ctlx_cmdcb_t cmdcb,
 309         ctlx_usercb_t usercb,
 310         void    *usercb_data);
 311
 312 static int
 313 hfa384x_dowrid(
 314         hfa384x_t *hw,
 315         CMD_MODE mode,
 316         UINT16  rid,
 317         void    *riddata,
 318         UINT    riddatalen,
 319         ctlx_cmdcb_t cmdcb,
 320         ctlx_usercb_t usercb,
 321         void    *usercb_data);
 322
 323 static int
 324 hfa384x_dormem(
 325         hfa384x_t *hw,
 326         CMD_MODE mode,
 327         UINT16  page,
 328         UINT16  offset,
 329         void    *data,
 330         UINT    len,
 331         ctlx_cmdcb_t cmdcb,
 332         ctlx_usercb_t usercb,
 333         void    *usercb_data);
 334
 335 static int
 336 hfa384x_dowmem(
 337         hfa384x_t *hw,
 338         CMD_MODE mode,
 339         UINT16  page,
 340         UINT16  offset,
 341         void    *data,
 342         UINT    len,
 343         ctlx_cmdcb_t cmdcb,
 344         ctlx_usercb_t usercb,
 345         void    *usercb_data);
 346
 347 static int
 348 hfa384x_isgood_pdrcode(UINT16 pdrcode);
 349
 350 /*================================================================*/
 351 /* Function Definitions */
 352 static inline const char* ctlxstr(CTLX_STATE s)
 353 {
 354         static const char* ctlx_str[] = {
 355                 "Initial state",
 356                 "Complete",
 357                 "Request failed",
 358                 "Request pending",
 359                 "Request packet submitted",
 360                 "Request packet completed",
 361                 "Response packet completed"
 362         };
 363
 364         return ctlx_str[s];
 365 };
 366
 367
 368 static inline hfa384x_usbctlx_t*
 369 get_active_ctlx(hfa384x_t *hw)
 370 {
 371         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 372 }
 373
 374
 375 #ifdef DEBUG_USB
 376 void
 377 dbprint_urb(struct urb* urb)
 378 {
 379         WLAN_LOG_DEBUG(3,"urb->pipe=0x%08x\n", urb->pipe);
 380         WLAN_LOG_DEBUG(3,"urb->status=0x%08x\n", urb->status);
 381         WLAN_LOG_DEBUG(3,"urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 382         WLAN_LOG_DEBUG(3,"urb->transfer_buffer=0x%08x\n", (UINT)urb->transfer_buffer);
 383         WLAN_LOG_DEBUG(3,"urb->transfer_buffer_length=0x%08x\n", urb->transfer_buffer_length);
 384         WLAN_LOG_DEBUG(3,"urb->actual_length=0x%08x\n", urb->actual_length);
 385         WLAN_LOG_DEBUG(3,"urb->bandwidth=0x%08x\n", urb->bandwidth);
 386         WLAN_LOG_DEBUG(3,"urb->setup_packet(ctl)=0x%08x\n", (UINT)urb->setup_packet);
 387         WLAN_LOG_DEBUG(3,"urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 388         WLAN_LOG_DEBUG(3,"urb->interval(irq)=0x%08x\n", urb->interval);
 389         WLAN_LOG_DEBUG(3,"urb->error_count(iso)=0x%08x\n", urb->error_count);
 390         WLAN_LOG_DEBUG(3,"urb->timeout=0x%08x\n", urb->timeout);
 391         WLAN_LOG_DEBUG(3,"urb->context=0x%08x\n", (UINT)urb->context);
 392         WLAN_LOG_DEBUG(3,"urb->complete=0x%08x\n", (UINT)urb->complete);
 393 }
 394 #endif
 395
 396
 397 /*----------------------------------------------------------------
 398 * submit_rx_urb
 399 *
 400 * Listen for input data on the BULK-IN pipe. If the pipe has
 401 * stalled then schedule it to be reset.
 402 *
 403 * Arguments:
 404 *       hw              device struct
 405 *       memflags        memory allocation flags
 406 *
 407 * Returns:
 408 *       error code from submission
 409 *
 410 * Call context:
 411 *       Any
 412 ----------------------------------------------------------------*/
 413 static int
 414 submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 415 {
 416         struct sk_buff *skb;
 417         int result;
 418
 419         DBFENTER;
 420
 421         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 422         if (skb == NULL) {
 423                 result = -ENOMEM;
 424                 goto done;
 425         }
 426
 427         /* Post the IN urb */
 428         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 429                       hw->endp_in,
 430                       skb->data, sizeof(hfa384x_usbin_t),
 431                       hfa384x_usbin_callback, hw->wlandev);
 432
 433         hw->rx_urb_skb = skb;
 434
 435         result = -ENOLINK;
 436         if ( !hw->wlandev->hwremoved && !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 437                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 438
 439                 /* Check whether we need to reset the RX pipe */
 440                 if (result == -EPIPE) {
 441                         WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
 442                                          hw->wlandev->netdev->name);
 443                         if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
 444                                 schedule_work(&hw->usb_work);
 445                 }
 446         }
 447
 448         /* Don't leak memory if anything should go wrong */
 449         if (result != 0) {
 450                 dev_kfree_skb(skb);
 451                 hw->rx_urb_skb = NULL;
 452         }
 453
 454  done:
 455
 456         DBFEXIT;
 457         return result;
 458 }
 459
 460 /*----------------------------------------------------------------
 461 * submit_tx_urb
 462 *
 463 * Prepares and submits the URB of transmitted data. If the
 464 * submission fails then it will schedule the output pipe to
 465 * be reset.
 466 *
 467 * Arguments:
 468 *       hw              device struct
 469 *       tx_urb          URB of data for tranmission
 470 *       memflags        memory allocation flags
 471 *
 472 * Returns:
 473 *       error code from submission
 474 *
 475 * Call context:
 476 *       Any
 477 ----------------------------------------------------------------*/
 478 static int
 479 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 480 {
 481         struct net_device *netdev = hw->wlandev->netdev;
 482         int result;
 483
 484         DBFENTER;
 485
 486         result = -ENOLINK;
 487         if ( netif_running(netdev) ) {
 488
 489                 if ( !hw->wlandev->hwremoved && !test_bit(WORK_TX_HALT, &hw->usb_flags) ) {
 490                         result = SUBMIT_URB(tx_urb, memflags);
 491
 492                         /* Test whether we need to reset the TX pipe */
 493                         if (result == -EPIPE) {
 494                                 WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
 495                                                  netdev->name);
 496                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 497                                 schedule_work(&hw->usb_work);
 498                         } else if (result == 0) {
 499                                 netif_stop_queue(netdev);
 500                         }
 501                 }
 502         }
 503
 504         DBFEXIT;
 505
 506         return result;
 507 }
 508
 509 /*----------------------------------------------------------------
 510 * hfa394x_usb_defer
 511 *
 512 * There are some things that the USB stack cannot do while
 513 * in interrupt context, so we arrange this function to run
 514 * in process context.
 515 *
 516 * Arguments:
 517 *       hw      device structure
 518 *
 519 * Returns:
 520 *       nothing
 521 *
 522 * Call context:
 523 *       process (by design)
 524 ----------------------------------------------------------------*/
 525 static void
 526 hfa384x_usb_defer(struct work_struct *data)
 527 {
 528         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 529         struct net_device *netdev = hw->wlandev->netdev;
 530
 531         DBFENTER;
 532
 533         /* Don't bother trying to reset anything if the plug
 534          * has been pulled ...
 535          */
 536         if ( hw->wlandev->hwremoved ) {
 537                 DBFEXIT;
 538                 return;
 539         }
 540
 541         /* Reception has stopped: try to reset the input pipe */
 542         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 543                 int ret;
 544
 545                 usb_kill_urb(&hw->rx_urb);  /* Cannot be holding spinlock! */
 546
 547                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 548                 if (ret != 0) {
 549                         printk(KERN_ERR
 550                                "Failed to clear rx pipe for %s: err=%d\n",
 551                                netdev->name, ret);
 552                 } else {
 553                         printk(KERN_INFO "%s rx pipe reset complete.\n",
 554                                          netdev->name);
 555                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 556                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 557                 }
 558         }
 559
 560         /* Resume receiving data back from the device. */
 561         if ( test_bit(WORK_RX_RESUME, &hw->usb_flags) ) {
 562                 int ret;
 563
 564                 ret = submit_rx_urb(hw, GFP_KERNEL);
 565                 if (ret != 0) {
 566                         printk(KERN_ERR
 567                                "Failed to resume %s rx pipe.\n", netdev->name);
 568                 } else {
 569                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 570                 }
 571         }
 572
 573         /* Transmission has stopped: try to reset the output pipe */
 574         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 575                 int ret;
 576
 577                 usb_kill_urb(&hw->tx_urb);
 578                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 579                 if (ret != 0) {
 580                         printk(KERN_ERR
 581                                "Failed to clear tx pipe for %s: err=%d\n",
 582                                netdev->name, ret);
 583                 } else {
 584                         printk(KERN_INFO "%s tx pipe reset complete.\n",
 585                                          netdev->name);
 586                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 587                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 588
 589                         /* Stopping the BULK-OUT pipe also blocked
 590                          * us from sending any more CTLX URBs, so
 591                          * we need to re-run our queue ...
 592                          */
 593                         hfa384x_usbctlxq_run(hw);
 594                 }
 595         }
 596
 597         /* Resume transmitting. */
 598         if ( test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags) ) {
 599                 p80211netdev_wake_queue(hw->wlandev);
 600         }
 601
 602         DBFEXIT;
 603 }
 604
 605
 606 /*----------------------------------------------------------------
 607 * hfa384x_create
 608 *
 609 * Sets up the hfa384x_t data structure for use.  Note this
 610 * does _not_ intialize the actual hardware, just the data structures
 611 * we use to keep track of its state.
 612 *
 613 * Arguments:
 614 *       hw              device structure
 615 *       irq             device irq number
 616 *       iobase          i/o base address for register access
 617 *       membase         memory base address for register access
 618 *
 619 * Returns:
 620 *       nothing
 621 *
 622 * Side effects:
 623 *
 624 * Call context:
 625 *       process
 626 ----------------------------------------------------------------*/
 627 void
 628 hfa384x_create( hfa384x_t *hw, struct usb_device *usb)
 629 {
 630         DBFENTER;
 631
 632         memset(hw, 0, sizeof(hfa384x_t));
 633         hw->usb = usb;
 634
 635         /* set up the endpoints */
 636         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 637         hw->endp_out = usb_sndbulkpipe(usb, 2);
 638
 639         /* Set up the waitq */
 640         init_waitqueue_head(&hw->cmdq);
 641
 642         /* Initialize the command queue */
 643         spin_lock_init(&hw->ctlxq.lock);
 644         INIT_LIST_HEAD(&hw->ctlxq.pending);
 645         INIT_LIST_HEAD(&hw->ctlxq.active);
 646         INIT_LIST_HEAD(&hw->ctlxq.completing);
 647         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 648
 649         /* Initialize the authentication queue */
 650         skb_queue_head_init(&hw->authq);
 651
 652         tasklet_init(&hw->reaper_bh,
 653                      hfa384x_usbctlx_reaper_task,
 654                      (unsigned long)hw);
 655         tasklet_init(&hw->completion_bh,
 656                      hfa384x_usbctlx_completion_task,
 657                      (unsigned long)hw);
 658         INIT_WORK2(&hw->link_bh, prism2sta_processing_defer);
 659         INIT_WORK2(&hw->usb_work, hfa384x_usb_defer);
 660
 661         init_timer(&hw->throttle);
 662         hw->throttle.function = hfa384x_usb_throttlefn;
 663         hw->throttle.data = (unsigned long)hw;
 664
 665         init_timer(&hw->resptimer);
 666         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 667         hw->resptimer.data = (unsigned long)hw;
 668
 669         init_timer(&hw->reqtimer);
 670         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 671         hw->reqtimer.data = (unsigned long)hw;
 672
 673         usb_init_urb(&hw->rx_urb);
 674         usb_init_urb(&hw->tx_urb);
 675         usb_init_urb(&hw->ctlx_urb);
 676
 677         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 678         hw->state = HFA384x_STATE_INIT;
 679
 680         INIT_WORK2(&hw->commsqual_bh, prism2sta_commsqual_defer);
 681         init_timer(&hw->commsqual_timer);
 682         hw->commsqual_timer.data = (unsigned long) hw;
 683         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 684
 685         DBFEXIT;
 686 }
 687
 688
 689 /*----------------------------------------------------------------
 690 * hfa384x_destroy
 691 *
 692 * Partner to hfa384x_create().  This function cleans up the hw
 693 * structure so that it can be freed by the caller using a simple
 694 * kfree.  Currently, this function is just a placeholder.  If, at some
 695 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 696 * kfree, this is where it should be done.  Note that if this function
 697 * is called on a _running_ hw structure, the drvr_stop() function is
 698 * called.
 699 *
 700 * Arguments:
 701 *       hw              device structure
 702 *
 703 * Returns:
 704 *       nothing, this function is not allowed to fail.
 705 *
 706 * Side effects:
 707 *
 708 * Call context:
 709 *       process
 710 ----------------------------------------------------------------*/
 711 void
 712 hfa384x_destroy( hfa384x_t *hw)
 713 {
 714         struct sk_buff *skb;
 715
 716         DBFENTER;
 717
 718         if ( hw->state == HFA384x_STATE_RUNNING ) {
 719                 hfa384x_drvr_stop(hw);
 720         }
 721         hw->state = HFA384x_STATE_PREINIT;
 722
 723         if (hw->scanresults) {
 724                 kfree(hw->scanresults);
 725                 hw->scanresults = NULL;
 726         }
 727
 728         /* Now to clean out the auth queue */
 729         while ( (skb = skb_dequeue(&hw->authq)) ) {
 730                 dev_kfree_skb(skb);
 731         }
 732
 733         DBFEXIT;
 734 }
 735
 736
 737 /*----------------------------------------------------------------
 738  */
 739 static hfa384x_usbctlx_t* usbctlx_alloc(void)
 740 {
 741         hfa384x_usbctlx_t *ctlx;
 742
 743         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 744         if (ctlx != NULL)
 745         {
 746                 memset(ctlx, 0, sizeof(*ctlx));
 747                 init_completion(&ctlx->done);
 748         }
 749
 750         return ctlx;
 751 }
 752
 753
 754 /*----------------------------------------------------------------
 755  *
 756 ----------------------------------------------------------------*/
 757 static int
 758 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 759                    hfa384x_cmdresult_t *result)
 760 {
 761         DBFENTER;
 762
 763         result->status = hfa384x2host_16(cmdresp->status);
 764         result->resp0 = hfa384x2host_16(cmdresp->resp0);
 765         result->resp1 = hfa384x2host_16(cmdresp->resp1);
 766         result->resp2 = hfa384x2host_16(cmdresp->resp2);
 767
 768         WLAN_LOG_DEBUG(4, "cmdresult:status=0x%04x "
 769                           "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 770                         result->status,
 771                         result->resp0,
 772                         result->resp1,
 773                         result->resp2);
 774
 775         DBFEXIT;
 776         return (result->status & HFA384x_STATUS_RESULT);
 777 }
 778
 779 static void
 780 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 781                        hfa384x_rridresult_t *result)
 782 {
 783         DBFENTER;
 784
 785         result->rid = hfa384x2host_16(rridresp->rid);
 786         result->riddata = rridresp->data;
 787         result->riddata_len = ((hfa384x2host_16(rridresp->frmlen) - 1) * 2);
 788
 789         DBFEXIT;
 790 }
 791
 792
 793 /*----------------------------------------------------------------
 794 * Completor object:
 795 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 796 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 797 ----------------------------------------------------------------*/
 798 struct usbctlx_cmd_completor
 799 {
 800         usbctlx_completor_t     head;
 801
 802         const hfa384x_usb_cmdresp_t     *cmdresp;
 803         hfa384x_cmdresult_t     *result;
 804 };
 805 typedef struct usbctlx_cmd_completor usbctlx_cmd_completor_t;
 806
 807 static int usbctlx_cmd_completor_fn(usbctlx_completor_t *head)
 808 {
 809         usbctlx_cmd_completor_t *complete = (usbctlx_cmd_completor_t*)head;
 810         return usbctlx_get_status(complete->cmdresp, complete->result);
 811 }
 812
 813 static inline usbctlx_completor_t*
 814 init_cmd_completor(usbctlx_cmd_completor_t *completor,
 815                    const hfa384x_usb_cmdresp_t *cmdresp,
 816                    hfa384x_cmdresult_t *result)
 817 {
 818         completor->head.complete = usbctlx_cmd_completor_fn;
 819         completor->cmdresp = cmdresp;
 820         completor->result = result;
 821         return &(completor->head);
 822 }
 823
 824 /*----------------------------------------------------------------
 825 * Completor object:
 826 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 827 * when processing a CTLX that reads a RID.
 828 ----------------------------------------------------------------*/
 829 struct usbctlx_rrid_completor
 830 {
 831         usbctlx_completor_t     head;
 832
 833         const hfa384x_usb_rridresp_t    *rridresp;
 834         void                    *riddata;
 835         UINT                    riddatalen;
 836 };
 837 typedef struct usbctlx_rrid_completor usbctlx_rrid_completor_t;
 838
 839 static int usbctlx_rrid_completor_fn(usbctlx_completor_t *head)
 840 {
 841         usbctlx_rrid_completor_t *complete = (usbctlx_rrid_completor_t*)head;
 842         hfa384x_rridresult_t rridresult;
 843
 844         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 845
 846         /* Validate the length, note body len calculation in bytes */
 847         if ( rridresult.riddata_len != complete->riddatalen ) {
 848                 WLAN_LOG_WARNING(
 849                         "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 850                         rridresult.rid,
 851                         complete->riddatalen,
 852                         rridresult.riddata_len);
 853                 return -ENODATA;
 854         }
 855
 856         memcpy(complete->riddata,
 857                rridresult.riddata,
 858                complete->riddatalen);
 859         return 0;
 860 }
 861
 862 static inline usbctlx_completor_t*
 863 init_rrid_completor(usbctlx_rrid_completor_t *completor,
 864                     const hfa384x_usb_rridresp_t *rridresp,
 865                     void *riddata,
 866                     UINT riddatalen)
 867 {
 868         completor->head.complete = usbctlx_rrid_completor_fn;
 869         completor->rridresp = rridresp;
 870         completor->riddata = riddata;
 871         completor->riddatalen = riddatalen;
 872         return &(completor->head);
 873 }
 874
 875 /*----------------------------------------------------------------
 876 * Completor object:
 877 * Interprets the results of a synchronous RID-write
 878 ----------------------------------------------------------------*/
 879 typedef usbctlx_cmd_completor_t usbctlx_wrid_completor_t;
 880 #define init_wrid_completor  init_cmd_completor
 881
 882 /*----------------------------------------------------------------
 883 * Completor object:
 884 * Interprets the results of a synchronous memory-write
 885 ----------------------------------------------------------------*/
 886 typedef usbctlx_cmd_completor_t usbctlx_wmem_completor_t;
 887 #define init_wmem_completor  init_cmd_completor
 888
 889 /*----------------------------------------------------------------
 890 * Completor object:
 891 * Interprets the results of a synchronous memory-read
 892 ----------------------------------------------------------------*/
 893 struct usbctlx_rmem_completor
 894 {
 895         usbctlx_completor_t           head;
 896
 897         const hfa384x_usb_rmemresp_t  *rmemresp;
 898         void                          *data;
 899         UINT                          len;
 900 };
 901 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
 902
 903 static int usbctlx_rmem_completor_fn(usbctlx_completor_t *head)
 904 {
 905         usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t*)head;
 906
 907         WLAN_LOG_DEBUG(4,"rmemresp:len=%d\n", complete->rmemresp->frmlen);
 908         memcpy(complete->data, complete->rmemresp->data, complete->len);
 909         return 0;
 910 }
 911
 912 static inline usbctlx_completor_t*
 913 init_rmem_completor(usbctlx_rmem_completor_t *completor,
 914                     hfa384x_usb_rmemresp_t *rmemresp,
 915                     void *data,
 916                     UINT len)
 917 {
 918         completor->head.complete = usbctlx_rmem_completor_fn;
 919         completor->rmemresp = rmemresp;
 920         completor->data = data;
 921         completor->len = len;
 922         return &(completor->head);
 923 }
 924
 925 /*----------------------------------------------------------------
 926 * hfa384x_cb_status
 927 *
 928 * Ctlx_complete handler for async CMD type control exchanges.
 929 * mark the hw struct as such.
 930 *
 931 * Note: If the handling is changed here, it should probably be
 932 *       changed in docmd as well.
 933 *
 934 * Arguments:
 935 *       hw              hw struct
 936 *       ctlx            completed CTLX
 937 *
 938 * Returns:
 939 *       nothing
 940 *
 941 * Side effects:
 942 *
 943 * Call context:
 944 *       interrupt
 945 ----------------------------------------------------------------*/
 946 static void
 947 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 948 {
 949         DBFENTER;
 950
 951         if ( ctlx->usercb != NULL ) {
 952                 hfa384x_cmdresult_t cmdresult;
 953
 954                 if (ctlx->state != CTLX_COMPLETE) {
 955                         memset(&cmdresult, 0, sizeof(cmdresult));
 956                         cmdresult.status = HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 957                 } else {
 958                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 959                 }
 960
 961                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 962         }
 963
 964         DBFEXIT;
 965 }
 966
 967
 968 /*----------------------------------------------------------------
 969 * hfa384x_cb_rrid
 970 *
 971 * CTLX completion handler for async RRID type control exchanges.
 972 *
 973 * Note: If the handling is changed here, it should probably be
 974 *       changed in dorrid as well.
 975 *
 976 * Arguments:
 977 *       hw              hw struct
 978 *       ctlx            completed CTLX
 979 *
 980 * Returns:
 981 *       nothing
 982 *
 983 * Side effects:
 984 *
 985 * Call context:
 986 *       interrupt
 987 ----------------------------------------------------------------*/
 988 static void
 989 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 990 {
 991         DBFENTER;
 992
 993         if ( ctlx->usercb != NULL ) {
 994                 hfa384x_rridresult_t rridresult;
 995
 996                 if (ctlx->state != CTLX_COMPLETE) {
 997                         memset(&rridresult, 0, sizeof(rridresult));
 998                         rridresult.rid = hfa384x2host_16(ctlx->outbuf.rridreq.rid);
 999                 } else {
1000                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp, &rridresult);
1001                 }
1002
1003                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
1004         }
1005
1006         DBFEXIT;
1007 }
1008
1009 static inline int
1010 hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
1011 {
1012         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
1013 }
1014
1015 static inline int
1016 hfa384x_docmd_async(hfa384x_t *hw,
1017                     hfa384x_metacmd_t *cmd,
1018                     ctlx_cmdcb_t cmdcb,
1019                     ctlx_usercb_t usercb,
1020                     void *usercb_data)
1021 {
1022         return hfa384x_docmd(hw, DOASYNC, cmd,
1023                                 cmdcb, usercb, usercb_data);
1024 }
1025
1026 static inline int
1027 hfa384x_dorrid_wait(hfa384x_t *hw, UINT16 rid, void *riddata, UINT riddatalen)
1028 {
1029         return hfa384x_dorrid(hw, DOWAIT,
1030                               rid, riddata, riddatalen,
1031                               NULL, NULL, NULL);
1032 }
1033
1034 static inline int
1035 hfa384x_dorrid_async(hfa384x_t *hw,
1036                      UINT16 rid, void *riddata, UINT riddatalen,
1037                      ctlx_cmdcb_t cmdcb,
1038                      ctlx_usercb_t usercb,
1039                      void *usercb_data)
1040 {
1041         return hfa384x_dorrid(hw, DOASYNC,
1042                               rid, riddata, riddatalen,
1043                               cmdcb, usercb, usercb_data);
1044 }
1045
1046 static inline int
1047 hfa384x_dowrid_wait(hfa384x_t *hw, UINT16 rid, void *riddata, UINT riddatalen)
1048 {
1049         return hfa384x_dowrid(hw, DOWAIT,
1050                               rid, riddata, riddatalen,
1051                               NULL, NULL, NULL);
1052 }
1053
1054 static inline int
1055 hfa384x_dowrid_async(hfa384x_t *hw,
1056                      UINT16 rid, void *riddata, UINT riddatalen,
1057                      ctlx_cmdcb_t cmdcb,
1058                      ctlx_usercb_t usercb,
1059                      void *usercb_data)
1060 {
1061         return hfa384x_dowrid(hw, DOASYNC,
1062                               rid, riddata, riddatalen,
1063                               cmdcb, usercb, usercb_data);
1064 }
1065
1066 static inline int
1067 hfa384x_dormem_wait(hfa384x_t *hw,
1068                     UINT16 page, UINT16 offset, void *data, UINT len)
1069 {
1070         return hfa384x_dormem(hw, DOWAIT,
1071                               page, offset, data, len,
1072                               NULL, NULL, NULL);
1073 }
1074
1075 static inline int
1076 hfa384x_dormem_async(hfa384x_t *hw,
1077                      UINT16 page, UINT16 offset, void *data, UINT len,
1078                      ctlx_cmdcb_t cmdcb,
1079                      ctlx_usercb_t usercb,
1080                      void *usercb_data)
1081 {
1082         return hfa384x_dormem(hw, DOASYNC,
1083                               page, offset, data, len,
1084                               cmdcb, usercb, usercb_data);
1085 }
1086
1087 static inline int
1088 hfa384x_dowmem_wait(
1089         hfa384x_t *hw,
1090         UINT16  page,
1091         UINT16  offset,
1092         void    *data,
1093         UINT    len)
1094 {
1095         return hfa384x_dowmem(hw, DOWAIT,
1096                                   page, offset, data, len,
1097                                   NULL, NULL, NULL);
1098 }
1099
1100 static inline int
1101 hfa384x_dowmem_async(
1102         hfa384x_t *hw,
1103         UINT16  page,
1104         UINT16  offset,
1105         void    *data,
1106         UINT    len,
1107         ctlx_cmdcb_t cmdcb,
1108         ctlx_usercb_t usercb,
1109         void    *usercb_data)
1110 {
1111         return hfa384x_dowmem(hw, DOASYNC,
1112                                   page, offset, data, len,
1113                                   cmdcb, usercb, usercb_data);
1114 }
1115
1116 /*----------------------------------------------------------------
1117 * hfa384x_cmd_initialize
1118 *
1119 * Issues the initialize command and sets the hw->state based
1120 * on the result.
1121 *
1122 * Arguments:
1123 *       hw              device structure
1124 *
1125 * Returns:
1126 *       0               success
1127 *       >0              f/w reported error - f/w status code
1128 *       <0              driver reported error
1129 *
1130 * Side effects:
1131 *
1132 * Call context:
1133 *       process
1134 ----------------------------------------------------------------*/
1135 int
1136 hfa384x_cmd_initialize(hfa384x_t *hw)
1137 {
1138         int     result = 0;
1139         int     i;
1140         hfa384x_metacmd_t cmd;
1141
1142         DBFENTER;
1143
1144
1145         cmd.cmd = HFA384x_CMDCODE_INIT;
1146         cmd.parm0 = 0;
1147         cmd.parm1 = 0;
1148         cmd.parm2 = 0;
1149
1150         result = hfa384x_docmd_wait(hw, &cmd);
1151
1152
1153         WLAN_LOG_DEBUG(3,"cmdresp.init: "
1154                 "status=0x%04x, resp0=0x%04x, "
1155                 "resp1=0x%04x, resp2=0x%04x\n",
1156                 cmd.result.status,
1157                 cmd.result.resp0,
1158                 cmd.result.resp1,
1159                 cmd.result.resp2);
1160         if ( result == 0 ) {
1161                 for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
1162                         hw->port_enabled[i] = 0;
1163                 }
1164         }
1165
1166         hw->link_status = HFA384x_LINK_NOTCONNECTED;
1167
1168         DBFEXIT;
1169         return result;
1170 }
1171
1172
1173 /*----------------------------------------------------------------
1174 * hfa384x_cmd_disable
1175 *
1176 * Issues the disable command to stop communications on one of
1177 * the MACs 'ports'.
1178 *
1179 * Arguments:
1180 *       hw              device structure
1181 *       macport         MAC port number (host order)
1182 *
1183 * Returns:
1184 *       0               success
1185 *       >0              f/w reported failure - f/w status code
1186 *       <0              driver reported error (timeout|bad arg)
1187 *
1188 * Side effects:
1189 *
1190 * Call context:
1191 *       process
1192 ----------------------------------------------------------------*/
1193 int hfa384x_cmd_disable(hfa384x_t *hw, UINT16 macport)
1194 {
1195         int     result = 0;
1196         hfa384x_metacmd_t cmd;
1197
1198         DBFENTER;
1199
1200         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1201                   HFA384x_CMD_MACPORT_SET(macport);
1202         cmd.parm0 = 0;
1203         cmd.parm1 = 0;
1204         cmd.parm2 = 0;
1205
1206         result = hfa384x_docmd_wait(hw, &cmd);
1207
1208         DBFEXIT;
1209         return result;
1210 }
1211
1212
1213 /*----------------------------------------------------------------
1214 * hfa384x_cmd_enable
1215 *
1216 * Issues the enable command to enable communications on one of
1217 * the MACs 'ports'.
1218 *
1219 * Arguments:
1220 *       hw              device structure
1221 *       macport         MAC port number
1222 *
1223 * Returns:
1224 *       0               success
1225 *       >0              f/w reported failure - f/w status code
1226 *       <0              driver reported error (timeout|bad arg)
1227 *
1228 * Side effects:
1229 *
1230 * Call context:
1231 *       process
1232 ----------------------------------------------------------------*/
1233 int hfa384x_cmd_enable(hfa384x_t *hw, UINT16 macport)
1234 {
1235         int     result = 0;
1236         hfa384x_metacmd_t cmd;
1237
1238         DBFENTER;
1239
1240         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1241                   HFA384x_CMD_MACPORT_SET(macport);
1242         cmd.parm0 = 0;
1243         cmd.parm1 = 0;
1244         cmd.parm2 = 0;
1245
1246         result = hfa384x_docmd_wait(hw, &cmd);
1247
1248         DBFEXIT;
1249         return result;
1250 }
1251
1252
1253 /*----------------------------------------------------------------
1254 * hfa384x_cmd_notify
1255 *
1256 * Sends an info frame to the firmware to alter the behavior
1257 * of the f/w asynch processes.  Can only be called when the MAC
1258 * is in the enabled state.
1259 *
1260 * Arguments:
1261 *       hw              device structure
1262 *       reclaim         [0|1] indicates whether the given FID will
1263 *                       be handed back (via Alloc event) for reuse.
1264 *                       (host order)
1265 *       fid             FID of buffer containing the frame that was
1266 *                       previously copied to MAC memory via the bap.
1267 *                       (host order)
1268 *
1269 * Returns:
1270 *       0               success
1271 *       >0              f/w reported failure - f/w status code
1272 *       <0              driver reported error (timeout|bad arg)
1273 *
1274 * Side effects:
1275 *       hw->resp0 will contain the FID being used by async notify
1276 *       process.  If reclaim==0, resp0 will be the same as the fid
1277 *       argument.  If reclaim==1, resp0 will be the different.
1278 *
1279 * Call context:
1280 *       process
1281 ----------------------------------------------------------------*/
1282 int hfa384x_cmd_notify(hfa384x_t *hw, UINT16 reclaim, UINT16 fid,
1283                        void *buf, UINT16 len)
1284 {
1285 #if 0
1286         int     result = 0;
1287         UINT16  cmd;
1288         DBFENTER;
1289         cmd =   HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_NOTIFY) |
1290                 HFA384x_CMD_RECL_SET(reclaim);
1291         result = hfa384x_docmd_wait(hw, cmd);
1292
1293         DBFEXIT;
1294         return result;
1295 #endif
1296 return 0;
1297 }
1298
1299
1300 #if 0
1301 /*----------------------------------------------------------------
1302 * hfa384x_cmd_inquiry
1303 *
1304 * Requests an info frame from the firmware.  The info frame will
1305 * be delivered asynchronously via the Info event.
1306 *
1307 * Arguments:
1308 *       hw              device structure
1309 *       fid             FID of the info frame requested. (host order)
1310 *
1311 * Returns:
1312 *       0               success
1313 *       >0              f/w reported failure - f/w status code
1314 *       <0              driver reported error (timeout|bad arg)
1315 *
1316 * Side effects:
1317 *
1318 * Call context:
1319 *       process
1320 ----------------------------------------------------------------*/
1321 int hfa384x_cmd_inquiry(hfa384x_t *hw, UINT16 fid)
1322 {
1323         int     result = 0;
1324         hfa384x_metacmd_t cmd;
1325
1326         DBFENTER;
1327
1328         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_INQ);
1329         cmd.parm0 = 0;
1330         cmd.parm1 = 0;
1331         cmd.parm2 = 0;
1332
1333         result = hfa384x_docmd_wait(hw, &cmd);
1334
1335         DBFEXIT;
1336         return result;
1337 }
1338 #endif
1339
1340
1341 /*----------------------------------------------------------------
1342 * hfa384x_cmd_monitor
1343 *
1344 * Enables the 'monitor mode' of the MAC.  Here's the description of
1345 * monitor mode that I've received thus far:
1346 *
1347 *  "The "monitor mode" of operation is that the MAC passes all
1348 *  frames for which the PLCP checks are correct. All received
1349 *  MPDUs are passed to the host with MAC Port = 7, with a
1350 *  receive status of good, FCS error, or undecryptable. Passing
1351 *  certain MPDUs is a violation of the 802.11 standard, but useful
1352 *  for a debugging tool."  Normal communication is not possible
1353 *  while monitor mode is enabled.
1354 *
1355 * Arguments:
1356 *       hw              device structure
1357 *       enable          a code (0x0b|0x0f) that enables/disables
1358 *                       monitor mode. (host order)
1359 *
1360 * Returns:
1361 *       0               success
1362 *       >0              f/w reported failure - f/w status code
1363 *       <0              driver reported error (timeout|bad arg)
1364 *
1365 * Side effects:
1366 *
1367 * Call context:
1368 *       process
1369 ----------------------------------------------------------------*/
1370 int hfa384x_cmd_monitor(hfa384x_t *hw, UINT16 enable)
1371 {
1372         int     result = 0;
1373         hfa384x_metacmd_t cmd;
1374
1375         DBFENTER;
1376
1377         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1378                 HFA384x_CMD_AINFO_SET(enable);
1379         cmd.parm0 = 0;
1380         cmd.parm1 = 0;
1381         cmd.parm2 = 0;
1382
1383         result = hfa384x_docmd_wait(hw, &cmd);
1384
1385         DBFEXIT;
1386         return result;
1387 }
1388
1389
1390 /*----------------------------------------------------------------
1391 * hfa384x_cmd_download
1392 *
1393 * Sets the controls for the MAC controller code/data download
1394 * process.  The arguments set the mode and address associated
1395 * with a download.  Note that the aux registers should be enabled
1396 * prior to setting one of the download enable modes.
1397 *
1398 * Arguments:
1399 *       hw              device structure
1400 *       mode            0 - Disable programming and begin code exec
1401 *                       1 - Enable volatile mem programming
1402 *                       2 - Enable non-volatile mem programming
1403 *                       3 - Program non-volatile section from NV download
1404 *                           buffer.
1405 *                       (host order)
1406 *       lowaddr
1407 *       highaddr        For mode 1, sets the high & low order bits of
1408 *                       the "destination address".  This address will be
1409 *                       the execution start address when download is
1410 *                       subsequently disabled.
1411 *                       For mode 2, sets the high & low order bits of
1412 *                       the destination in NV ram.
1413 *                       For modes 0 & 3, should be zero. (host order)
1414 *                       NOTE: these are CMD format.
1415 *       codelen         Length of the data to write in mode 2,
1416 *                       zero otherwise. (host order)
1417 *
1418 * Returns:
1419 *       0               success
1420 *       >0              f/w reported failure - f/w status code
1421 *       <0              driver reported error (timeout|bad arg)
1422 *
1423 * Side effects:
1424 *
1425 * Call context:
1426 *       process
1427 ----------------------------------------------------------------*/
1428 int hfa384x_cmd_download(hfa384x_t *hw, UINT16 mode, UINT16 lowaddr,
1429                                 UINT16 highaddr, UINT16 codelen)
1430 {
1431         int     result = 0;
1432         hfa384x_metacmd_t cmd;
1433
1434         DBFENTER;
1435         WLAN_LOG_DEBUG(5,
1436                 "mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1437                 mode, lowaddr, highaddr, codelen);
1438
1439         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1440                    HFA384x_CMD_PROGMODE_SET(mode));
1441
1442         cmd.parm0 = lowaddr;
1443         cmd.parm1 = highaddr;
1444         cmd.parm2 = codelen;
1445
1446         result = hfa384x_docmd_wait(hw, &cmd);
1447
1448         DBFEXIT;
1449         return result;
1450 }
1451
1452
1453 /*----------------------------------------------------------------
1454 * hfa384x_copy_from_aux
1455 *
1456 * Copies a collection of bytes from the controller memory.  The
1457 * Auxiliary port MUST be enabled prior to calling this function.
1458 * We _might_ be in a download state.
1459 *
1460 * Arguments:
1461 *       hw              device structure
1462 *       cardaddr        address in hfa384x data space to read
1463 *       auxctl          address space select
1464 *       buf             ptr to destination host buffer
1465 *       len             length of data to transfer (in bytes)
1466 *
1467 * Returns:
1468 *       nothing
1469 *
1470 * Side effects:
1471 *       buf contains the data copied
1472 *
1473 * Call context:
1474 *       process
1475 *       interrupt
1476 ----------------------------------------------------------------*/
1477 void
1478 hfa384x_copy_from_aux(
1479         hfa384x_t *hw, UINT32 cardaddr, UINT32 auxctl, void *buf, UINT len)
1480 {
1481         DBFENTER;
1482         WLAN_LOG_ERROR("not used in USB.\n");
1483         DBFEXIT;
1484 }
1485
1486
1487 /*----------------------------------------------------------------
1488 * hfa384x_copy_to_aux
1489 *
1490 * Copies a collection of bytes to the controller memory.  The
1491 * Auxiliary port MUST be enabled prior to calling this function.
1492 * We _might_ be in a download state.
1493 *
1494 * Arguments:
1495 *       hw              device structure
1496 *       cardaddr        address in hfa384x data space to read
1497 *       auxctl          address space select
1498 *       buf             ptr to destination host buffer
1499 *       len             length of data to transfer (in bytes)
1500 *
1501 * Returns:
1502 *       nothing
1503 *
1504 * Side effects:
1505 *       Controller memory now contains a copy of buf
1506 *
1507 * Call context:
1508 *       process
1509 *       interrupt
1510 ----------------------------------------------------------------*/
1511 void
1512 hfa384x_copy_to_aux(
1513         hfa384x_t *hw, UINT32 cardaddr, UINT32 auxctl, void *buf, UINT len)
1514 {
1515         DBFENTER;
1516         WLAN_LOG_ERROR("not used in USB.\n");
1517         DBFEXIT;
1518 }
1519
1520
1521 /*----------------------------------------------------------------
1522 * hfa384x_corereset
1523 *
1524 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1525 * structure is in its "created" state.  That is, it is initialized
1526 * with proper values.  Note that if a reset is done after the
1527 * device has been active for awhile, the caller might have to clean
1528 * up some leftover cruft in the hw structure.
1529 *
1530 * Arguments:
1531 *       hw              device structure
1532 *       holdtime        how long (in ms) to hold the reset
1533 *       settletime      how long (in ms) to wait after releasing
1534 *                       the reset
1535 *
1536 * Returns:
1537 *       nothing
1538 *
1539 * Side effects:
1540 *
1541 * Call context:
1542 *       process
1543 ----------------------------------------------------------------*/
1544 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1545 {
1546         int                     result = 0;
1547
1548         DBFENTER;
1549
1550         result=usb_reset_device(hw->usb);
1551         if(result<0) {
1552                 WLAN_LOG_ERROR("usb_reset_device() failed, result=%d.\n",result);
1553         }
1554
1555         DBFEXIT;
1556         return result;
1557 }
1558
1559
1560 /*----------------------------------------------------------------
1561 * hfa384x_usbctlx_complete_sync
1562 *
1563 * Waits for a synchronous CTLX object to complete,
1564 * and then handles the response.
1565 *
1566 * Arguments:
1567 *       hw              device structure
1568 *       ctlx            CTLX ptr
1569 *       completor       functor object to decide what to
1570 *                       do with the CTLX's result.
1571 *
1572 * Returns:
1573 *       0               Success
1574 *       -ERESTARTSYS    Interrupted by a signal
1575 *       -EIO            CTLX failed
1576 *       -ENODEV         Adapter was unplugged
1577 *       ???             Result from completor
1578 *
1579 * Side effects:
1580 *
1581 * Call context:
1582 *       process
1583 ----------------------------------------------------------------*/
1584 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1585                                          hfa384x_usbctlx_t *ctlx,
1586                                          usbctlx_completor_t *completor)
1587 {
1588         unsigned long flags;
1589         int result;
1590
1591         DBFENTER;
1592
1593         result = wait_for_completion_interruptible(&ctlx->done);
1594
1595         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1596
1597         /*
1598          * We can only handle the CTLX if the USB disconnect
1599          * function has not run yet ...
1600          */
1601         cleanup:
1602         if ( hw->wlandev->hwremoved )
1603         {
1604                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1605                 result = -ENODEV;
1606         }
1607         else if ( result != 0 )
1608         {
1609                 int runqueue = 0;
1610
1611                 /*
1612                  * We were probably interrupted, so delete
1613                  * this CTLX asynchronously, kill the timers
1614                  * and the URB, and then start the next
1615                  * pending CTLX.
1616                  *
1617                  * NOTE: We can only delete the timers and
1618                  *       the URB if this CTLX is active.
1619                  */
1620                 if (ctlx == get_active_ctlx(hw))
1621                 {
1622                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1623
1624                         del_singleshot_timer_sync(&hw->reqtimer);
1625                         del_singleshot_timer_sync(&hw->resptimer);
1626                         hw->req_timer_done = 1;
1627                         hw->resp_timer_done = 1;
1628                         usb_kill_urb(&hw->ctlx_urb);
1629
1630                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1631
1632                         runqueue = 1;
1633
1634                         /*
1635                          * This scenario is so unlikely that I'm
1636                          * happy with a grubby "goto" solution ...
1637                          */
1638                         if ( hw->wlandev->hwremoved )
1639                                 goto cleanup;
1640                 }
1641
1642                 /*
1643                  * The completion task will send this CTLX
1644                  * to the reaper the next time it runs. We
1645                  * are no longer in a hurry.
1646                  */
1647                 ctlx->reapable = 1;
1648                 ctlx->state = CTLX_REQ_FAILED;
1649                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1650
1651                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1652
1653                 if (runqueue)
1654                         hfa384x_usbctlxq_run(hw);
1655         } else {
1656                 if (ctlx->state == CTLX_COMPLETE) {
1657                         result = completor->complete(completor);
1658                 } else {
1659                         WLAN_LOG_WARNING("CTLX[%d] error: state(%s)\n",
1660                                          hfa384x2host_16(ctlx->outbuf.type),
1661                                          ctlxstr(ctlx->state));
1662                         result = -EIO;
1663                 }
1664
1665                 list_del(&ctlx->list);
1666                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1667                 kfree(ctlx);
1668         }
1669
1670         DBFEXIT;
1671         return result;
1672 }
1673
1674 /*----------------------------------------------------------------
1675 * hfa384x_docmd
1676 *
1677 * Constructs a command CTLX and submits it.
1678 *
1679 * NOTE: Any changes to the 'post-submit' code in this function
1680 *       need to be carried over to hfa384x_cbcmd() since the handling
1681 *       is virtually identical.
1682 *
1683 * Arguments:
1684 *       hw              device structure
1685 *       mode            DOWAIT or DOASYNC
1686 *       cmd             cmd structure.  Includes all arguments and result
1687 *                       data points.  All in host order. in host order
1688 *       cmdcb           command-specific callback
1689 *       usercb          user callback for async calls, NULL for DOWAIT calls
1690 *       usercb_data     user supplied data pointer for async calls, NULL
1691 *                       for DOASYNC calls
1692 *
1693 * Returns:
1694 *       0               success
1695 *       -EIO            CTLX failure
1696 *       -ERESTARTSYS    Awakened on signal
1697 *       >0              command indicated error, Status and Resp0-2 are
1698 *                       in hw structure.
1699 *
1700 * Side effects:
1701 *
1702 *
1703 * Call context:
1704 *       process
1705 ----------------------------------------------------------------*/
1706 static int
1707 hfa384x_docmd(
1708         hfa384x_t *hw,
1709         CMD_MODE mode,
1710         hfa384x_metacmd_t *cmd,
1711         ctlx_cmdcb_t    cmdcb,
1712         ctlx_usercb_t   usercb,
1713         void    *usercb_data)
1714 {
1715         int                     result;
1716         hfa384x_usbctlx_t       *ctlx;
1717
1718         DBFENTER;
1719         ctlx = usbctlx_alloc();
1720         if ( ctlx == NULL ) {
1721                 result = -ENOMEM;
1722                 goto done;
1723         }
1724
1725         /* Initialize the command */
1726         ctlx->outbuf.cmdreq.type =      host2hfa384x_16(HFA384x_USB_CMDREQ);
1727         ctlx->outbuf.cmdreq.cmd =       host2hfa384x_16(cmd->cmd);
1728         ctlx->outbuf.cmdreq.parm0 =     host2hfa384x_16(cmd->parm0);
1729         ctlx->outbuf.cmdreq.parm1 =     host2hfa384x_16(cmd->parm1);
1730         ctlx->outbuf.cmdreq.parm2 =     host2hfa384x_16(cmd->parm2);
1731
1732         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1733
1734         WLAN_LOG_DEBUG(4, "cmdreq: cmd=0x%04x "
1735                 "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1736                 cmd->cmd,
1737                 cmd->parm0,
1738                 cmd->parm1,
1739                 cmd->parm2);
1740
1741         ctlx->reapable = mode;
1742         ctlx->cmdcb = cmdcb;
1743         ctlx->usercb = usercb;
1744         ctlx->usercb_data = usercb_data;
1745
1746         result = hfa384x_usbctlx_submit(hw, ctlx);
1747         if (result != 0) {
1748                 kfree(ctlx);
1749         } else if (mode == DOWAIT) {
1750                 usbctlx_cmd_completor_t completor;
1751
1752                 result = hfa384x_usbctlx_complete_sync(
1753                              hw, ctlx, init_cmd_completor(&completor,
1754                                                           &ctlx->inbuf.cmdresp,
1755                                                           &cmd->result) );
1756         }
1757
1758 done:
1759         DBFEXIT;
1760         return result;
1761 }
1762
1763
1764 /*----------------------------------------------------------------
1765 * hfa384x_dorrid
1766 *
1767 * Constructs a read rid CTLX and issues it.
1768 *
1769 * NOTE: Any changes to the 'post-submit' code in this function
1770 *       need to be carried over to hfa384x_cbrrid() since the handling
1771 *       is virtually identical.
1772 *
1773 * Arguments:
1774 *       hw              device structure
1775 *       mode            DOWAIT or DOASYNC
1776 *       rid             Read RID number (host order)
1777 *       riddata         Caller supplied buffer that MAC formatted RID.data
1778 *                       record will be written to for DOWAIT calls. Should
1779 *                       be NULL for DOASYNC calls.
1780 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1781 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1782 *       usercb          user callback for async calls, NULL for DOWAIT calls
1783 *       usercb_data     user supplied data pointer for async calls, NULL
1784 *                       for DOWAIT calls
1785 *
1786 * Returns:
1787 *       0               success
1788 *       -EIO            CTLX failure
1789 *       -ERESTARTSYS    Awakened on signal
1790 *       -ENODATA        riddatalen != macdatalen
1791 *       >0              command indicated error, Status and Resp0-2 are
1792 *                       in hw structure.
1793 *
1794 * Side effects:
1795 *
1796 * Call context:
1797 *       interrupt (DOASYNC)
1798 *       process (DOWAIT or DOASYNC)
1799 ----------------------------------------------------------------*/
1800 static int
1801 hfa384x_dorrid(
1802         hfa384x_t *hw,
1803         CMD_MODE mode,
1804         UINT16  rid,
1805         void    *riddata,
1806         UINT    riddatalen,
1807         ctlx_cmdcb_t cmdcb,
1808         ctlx_usercb_t usercb,
1809         void    *usercb_data)
1810 {
1811         int                     result;
1812         hfa384x_usbctlx_t       *ctlx;
1813
1814         DBFENTER;
1815         ctlx = usbctlx_alloc();
1816         if ( ctlx == NULL ) {
1817                 result = -ENOMEM;
1818                 goto done;
1819         }
1820
1821         /* Initialize the command */
1822         ctlx->outbuf.rridreq.type =   host2hfa384x_16(HFA384x_USB_RRIDREQ);
1823         ctlx->outbuf.rridreq.frmlen =
1824                 host2hfa384x_16(sizeof(ctlx->outbuf.rridreq.rid));
1825         ctlx->outbuf.rridreq.rid =    host2hfa384x_16(rid);
1826
1827         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1828
1829         ctlx->reapable = mode;
1830         ctlx->cmdcb = cmdcb;
1831         ctlx->usercb = usercb;
1832         ctlx->usercb_data = usercb_data;
1833
1834         /* Submit the CTLX */
1835         result = hfa384x_usbctlx_submit(hw, ctlx);
1836         if (result != 0) {
1837                 kfree(ctlx);
1838         } else if (mode == DOWAIT) {
1839                 usbctlx_rrid_completor_t completor;
1840
1841                 result = hfa384x_usbctlx_complete_sync(
1842                            hw, ctlx, init_rrid_completor(&completor,
1843                                                          &ctlx->inbuf.rridresp,
1844                                                          riddata,
1845                                                          riddatalen) );
1846         }
1847
1848 done:
1849         DBFEXIT;
1850         return result;
1851 }
1852
1853
1854 /*----------------------------------------------------------------
1855 * hfa384x_dowrid
1856 *
1857 * Constructs a write rid CTLX and issues it.
1858 *
1859 * NOTE: Any changes to the 'post-submit' code in this function
1860 *       need to be carried over to hfa384x_cbwrid() since the handling
1861 *       is virtually identical.
1862 *
1863 * Arguments:
1864 *       hw              device structure
1865 *       CMD_MODE        DOWAIT or DOASYNC
1866 *       rid             RID code
1867 *       riddata         Data portion of RID formatted for MAC
1868 *       riddatalen      Length of the data portion in bytes
1869 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1870 *       usercb          user callback for async calls, NULL for DOWAIT calls
1871 *       usercb_data     user supplied data pointer for async calls
1872 *
1873 * Returns:
1874 *       0               success
1875 *       -ETIMEDOUT      timed out waiting for register ready or
1876 *                       command completion
1877 *       >0              command indicated error, Status and Resp0-2 are
1878 *                       in hw structure.
1879 *
1880 * Side effects:
1881 *
1882 * Call context:
1883 *       interrupt (DOASYNC)
1884 *       process (DOWAIT or DOASYNC)
1885 ----------------------------------------------------------------*/
1886 static int
1887 hfa384x_dowrid(
1888         hfa384x_t *hw,
1889         CMD_MODE mode,
1890         UINT16  rid,
1891         void    *riddata,
1892         UINT    riddatalen,
1893         ctlx_cmdcb_t cmdcb,
1894         ctlx_usercb_t usercb,
1895         void    *usercb_data)
1896 {
1897         int                     result;
1898         hfa384x_usbctlx_t       *ctlx;
1899
1900         DBFENTER;
1901         ctlx = usbctlx_alloc();
1902         if ( ctlx == NULL ) {
1903                 result = -ENOMEM;
1904                 goto done;
1905         }
1906
1907         /* Initialize the command */
1908         ctlx->outbuf.wridreq.type =   host2hfa384x_16(HFA384x_USB_WRIDREQ);
1909         ctlx->outbuf.wridreq.frmlen = host2hfa384x_16(
1910                                         (sizeof(ctlx->outbuf.wridreq.rid) +
1911                                         riddatalen + 1) / 2);
1912         ctlx->outbuf.wridreq.rid =    host2hfa384x_16(rid);
1913         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1914
1915         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1916                            sizeof(ctlx->outbuf.wridreq.frmlen) +
1917                            sizeof(ctlx->outbuf.wridreq.rid) +
1918                            riddatalen;
1919
1920         ctlx->reapable = mode;
1921         ctlx->cmdcb = cmdcb;
1922         ctlx->usercb = usercb;
1923         ctlx->usercb_data = usercb_data;
1924
1925         /* Submit the CTLX */
1926         result = hfa384x_usbctlx_submit(hw, ctlx);
1927         if (result != 0) {
1928                 kfree(ctlx);
1929         } else if (mode == DOWAIT) {
1930                 usbctlx_wrid_completor_t completor;
1931                 hfa384x_cmdresult_t wridresult;
1932
1933                 result = hfa384x_usbctlx_complete_sync(
1934                                hw,
1935                                ctlx,
1936                                init_wrid_completor(&completor,
1937                                                    &ctlx->inbuf.wridresp,
1938                                                    &wridresult) );
1939         }
1940
1941 done:
1942         DBFEXIT;
1943         return result;
1944 }
1945
1946 /*----------------------------------------------------------------
1947 * hfa384x_dormem
1948 *
1949 * Constructs a readmem CTLX and issues it.
1950 *
1951 * NOTE: Any changes to the 'post-submit' code in this function
1952 *       need to be carried over to hfa384x_cbrmem() since the handling
1953 *       is virtually identical.
1954 *
1955 * Arguments:
1956 *       hw              device structure
1957 *       mode            DOWAIT or DOASYNC
1958 *       page            MAC address space page (CMD format)
1959 *       offset          MAC address space offset
1960 *       data            Ptr to data buffer to receive read
1961 *       len             Length of the data to read (max == 2048)
1962 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1963 *       usercb          user callback for async calls, NULL for DOWAIT calls
1964 *       usercb_data     user supplied data pointer for async calls
1965 *
1966 * Returns:
1967 *       0               success
1968 *       -ETIMEDOUT      timed out waiting for register ready or
1969 *                       command completion
1970 *       >0              command indicated error, Status and Resp0-2 are
1971 *                       in hw structure.
1972 *
1973 * Side effects:
1974 *
1975 * Call context:
1976 *       interrupt (DOASYNC)
1977 *       process (DOWAIT or DOASYNC)
1978 ----------------------------------------------------------------*/
1979 static int
1980 hfa384x_dormem(
1981         hfa384x_t *hw,
1982         CMD_MODE mode,
1983         UINT16  page,
1984         UINT16  offset,
1985         void    *data,
1986         UINT    len,
1987         ctlx_cmdcb_t cmdcb,
1988         ctlx_usercb_t usercb,
1989         void    *usercb_data)
1990 {
1991         int                     result;
1992         hfa384x_usbctlx_t       *ctlx;
1993
1994         DBFENTER;
1995         ctlx = usbctlx_alloc();
1996         if ( ctlx == NULL ) {
1997                 result = -ENOMEM;
1998                 goto done;
1999         }
2000
2001         /* Initialize the command */
2002         ctlx->outbuf.rmemreq.type =    host2hfa384x_16(HFA384x_USB_RMEMREQ);
2003         ctlx->outbuf.rmemreq.frmlen =  host2hfa384x_16(
2004                                         sizeof(ctlx->outbuf.rmemreq.offset) +
2005                                         sizeof(ctlx->outbuf.rmemreq.page) +
2006                                         len);
2007         ctlx->outbuf.rmemreq.offset =   host2hfa384x_16(offset);
2008         ctlx->outbuf.rmemreq.page =     host2hfa384x_16(page);
2009
2010         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
2011
2012         WLAN_LOG_DEBUG(4,
2013                 "type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
2014                 ctlx->outbuf.rmemreq.type,
2015                 ctlx->outbuf.rmemreq.frmlen,
2016                 ctlx->outbuf.rmemreq.offset,
2017                 ctlx->outbuf.rmemreq.page);
2018
2019         WLAN_LOG_DEBUG(4,"pktsize=%zd\n",
2020                 ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
2021
2022         ctlx->reapable = mode;
2023         ctlx->cmdcb = cmdcb;
2024         ctlx->usercb = usercb;
2025         ctlx->usercb_data = usercb_data;
2026
2027         result = hfa384x_usbctlx_submit(hw, ctlx);
2028         if (result != 0) {
2029                 kfree(ctlx);
2030         } else if ( mode == DOWAIT ) {
2031                 usbctlx_rmem_completor_t completor;
2032
2033                 result = hfa384x_usbctlx_complete_sync(
2034                            hw, ctlx, init_rmem_completor(&completor,
2035                                                          &ctlx->inbuf.rmemresp,
2036                                                          data,
2037                                                          len) );
2038         }
2039
2040 done:
2041         DBFEXIT;
2042         return result;
2043 }
2044
2045
2046
2047 /*----------------------------------------------------------------
2048 * hfa384x_dowmem
2049 *
2050 * Constructs a writemem CTLX and issues it.
2051 *
2052 * NOTE: Any changes to the 'post-submit' code in this function
2053 *       need to be carried over to hfa384x_cbwmem() since the handling
2054 *       is virtually identical.
2055 *
2056 * Arguments:
2057 *       hw              device structure
2058 *       mode            DOWAIT or DOASYNC
2059 *       page            MAC address space page (CMD format)
2060 *       offset          MAC address space offset
2061 *       data            Ptr to data buffer containing write data
2062 *       len             Length of the data to read (max == 2048)
2063 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
2064 *       usercb          user callback for async calls, NULL for DOWAIT calls
2065 *       usercb_data     user supplied data pointer for async calls.
2066 *
2067 * Returns:
2068 *       0               success
2069 *       -ETIMEDOUT      timed out waiting for register ready or
2070 *                       command completion
2071 *       >0              command indicated error, Status and Resp0-2 are
2072 *                       in hw structure.
2073 *
2074 * Side effects:
2075 *
2076 * Call context:
2077 *       interrupt (DOWAIT)
2078 *       process (DOWAIT or DOASYNC)
2079 ----------------------------------------------------------------*/
2080 static int
2081 hfa384x_dowmem(
2082         hfa384x_t *hw,
2083         CMD_MODE mode,
2084         UINT16  page,
2085         UINT16  offset,
2086         void    *data,
2087         UINT    len,
2088         ctlx_cmdcb_t cmdcb,
2089         ctlx_usercb_t usercb,
2090         void    *usercb_data)
2091 {
2092         int                     result;
2093         hfa384x_usbctlx_t       *ctlx;
2094
2095         DBFENTER;
2096         WLAN_LOG_DEBUG(5, "page=0x%04x offset=0x%04x len=%d\n",
2097                 page,offset,len);
2098
2099         ctlx = usbctlx_alloc();
2100         if ( ctlx == NULL ) {
2101                 result = -ENOMEM;
2102                 goto done;
2103         }
2104
2105         /* Initialize the command */
2106         ctlx->outbuf.wmemreq.type =   host2hfa384x_16(HFA384x_USB_WMEMREQ);
2107         ctlx->outbuf.wmemreq.frmlen = host2hfa384x_16(
2108                                         sizeof(ctlx->outbuf.wmemreq.offset) +
2109                                         sizeof(ctlx->outbuf.wmemreq.page) +
2110                                         len);
2111         ctlx->outbuf.wmemreq.offset = host2hfa384x_16(offset);
2112         ctlx->outbuf.wmemreq.page =   host2hfa384x_16(page);
2113         memcpy(ctlx->outbuf.wmemreq.data, data, len);
2114
2115         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
2116                            sizeof(ctlx->outbuf.wmemreq.frmlen) +
2117                            sizeof(ctlx->outbuf.wmemreq.offset) +
2118                            sizeof(ctlx->outbuf.wmemreq.page) +
2119                            len;
2120
2121         ctlx->reapable = mode;
2122         ctlx->cmdcb = cmdcb;
2123         ctlx->usercb = usercb;
2124         ctlx->usercb_data = usercb_data;
2125
2126         result = hfa384x_usbctlx_submit(hw, ctlx);
2127         if (result != 0) {
2128                 kfree(ctlx);
2129         } else if ( mode == DOWAIT ) {
2130                 usbctlx_wmem_completor_t completor;
2131                 hfa384x_cmdresult_t wmemresult;
2132
2133                 result = hfa384x_usbctlx_complete_sync(
2134                                hw,
2135                                ctlx,
2136                                init_wmem_completor(&completor,
2137                                                    &ctlx->inbuf.wmemresp,
2138                                                    &wmemresult) );
2139         }
2140
2141 done:
2142         DBFEXIT;
2143         return result;
2144 }
2145
2146
2147 /*----------------------------------------------------------------
2148 * hfa384x_drvr_commtallies
2149 *
2150 * Send a commtallies inquiry to the MAC.  Note that this is an async
2151 * call that will result in an info frame arriving sometime later.
2152 *
2153 * Arguments:
2154 *       hw              device structure
2155 *
2156 * Returns:
2157 *       zero            success.
2158 *
2159 * Side effects:
2160 *
2161 * Call context:
2162 *       process
2163 ----------------------------------------------------------------*/
2164 int hfa384x_drvr_commtallies( hfa384x_t *hw )
2165 {
2166         hfa384x_metacmd_t cmd;
2167
2168         DBFENTER;
2169
2170         cmd.cmd = HFA384x_CMDCODE_INQ;
2171         cmd.parm0 = HFA384x_IT_COMMTALLIES;
2172         cmd.parm1 = 0;
2173         cmd.parm2 = 0;
2174
2175         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
2176
2177         DBFEXIT;
2178         return 0;
2179 }
2180
2181
2182 /*----------------------------------------------------------------
2183 * hfa384x_drvr_disable
2184 *
2185 * Issues the disable command to stop communications on one of
2186 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2187 * APs may also disable macports 1-6.  Only ports that have been
2188 * previously enabled may be disabled.
2189 *
2190 * Arguments:
2191 *       hw              device structure
2192 *       macport         MAC port number (host order)
2193 *
2194 * Returns:
2195 *       0               success
2196 *       >0              f/w reported failure - f/w status code
2197 *       <0              driver reported error (timeout|bad arg)
2198 *
2199 * Side effects:
2200 *
2201 * Call context:
2202 *       process
2203 ----------------------------------------------------------------*/
2204 int hfa384x_drvr_disable(hfa384x_t *hw, UINT16 macport)
2205 {
2206         int     result = 0;
2207
2208         DBFENTER;
2209         if ((!hw->isap && macport != 0) ||
2210             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2211             !(hw->port_enabled[macport]) ){
2212                 result = -EINVAL;
2213         } else {
2214                 result = hfa384x_cmd_disable(hw, macport);
2215                 if ( result == 0 ) {
2216                         hw->port_enabled[macport] = 0;
2217                 }
2218         }
2219         DBFEXIT;
2220         return result;
2221 }
2222
2223
2224 /*----------------------------------------------------------------
2225 * hfa384x_drvr_enable
2226 *
2227 * Issues the enable command to enable communications on one of
2228 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2229 * APs may also enable macports 1-6.  Only ports that are currently
2230 * disabled may be enabled.
2231 *
2232 * Arguments:
2233 *       hw              device structure
2234 *       macport         MAC port number
2235 *
2236 * Returns:
2237 *       0               success
2238 *       >0              f/w reported failure - f/w status code
2239 *       <0              driver reported error (timeout|bad arg)
2240 *
2241 * Side effects:
2242 *
2243 * Call context:
2244 *       process
2245 ----------------------------------------------------------------*/
2246 int hfa384x_drvr_enable(hfa384x_t *hw, UINT16 macport)
2247 {
2248         int     result = 0;
2249
2250         DBFENTER;
2251         if ((!hw->isap && macport != 0) ||
2252             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2253             (hw->port_enabled[macport]) ){
2254                 result = -EINVAL;
2255         } else {
2256                 result = hfa384x_cmd_enable(hw, macport);
2257                 if ( result == 0 ) {
2258                         hw->port_enabled[macport] = 1;
2259                 }
2260         }
2261         DBFEXIT;
2262         return result;
2263 }
2264
2265
2266 /*----------------------------------------------------------------
2267 * hfa384x_drvr_flashdl_enable
2268 *
2269 * Begins the flash download state.  Checks to see that we're not
2270 * already in a download state and that a port isn't enabled.
2271 * Sets the download state and retrieves the flash download
2272 * buffer location, buffer size, and timeout length.
2273 *
2274 * Arguments:
2275 *       hw              device structure
2276 *
2277 * Returns:
2278 *       0               success
2279 *       >0              f/w reported error - f/w status code
2280 *       <0              driver reported error
2281 *
2282 * Side effects:
2283 *
2284 * Call context:
2285 *       process
2286 ----------------------------------------------------------------*/
2287 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
2288 {
2289         int             result = 0;
2290         int             i;
2291
2292         DBFENTER;
2293         /* Check that a port isn't active */
2294         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2295                 if ( hw->port_enabled[i] ) {
2296                         WLAN_LOG_DEBUG(1,"called when port enabled.\n");
2297                         return -EINVAL;
2298                 }
2299         }
2300
2301         /* Check that we're not already in a download state */
2302         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2303                 return -EINVAL;
2304         }
2305
2306         /* Retrieve the buffer loc&size and timeout */
2307         if ( (result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
2308                                 &(hw->bufinfo), sizeof(hw->bufinfo))) ) {
2309                 return result;
2310         }
2311         hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
2312         hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
2313         hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
2314         if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
2315                                 &(hw->dltimeout))) ) {
2316                 return result;
2317         }
2318         hw->dltimeout = hfa384x2host_16(hw->dltimeout);
2319
2320         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2321
2322         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
2323         DBFEXIT;
2324         return result;
2325 }
2326
2327
2328 /*----------------------------------------------------------------
2329 * hfa384x_drvr_flashdl_disable
2330 *
2331 * Ends the flash download state.  Note that this will cause the MAC
2332 * firmware to restart.
2333 *
2334 * Arguments:
2335 *       hw              device structure
2336 *
2337 * Returns:
2338 *       0               success
2339 *       >0              f/w reported error - f/w status code
2340 *       <0              driver reported error
2341 *
2342 * Side effects:
2343 *
2344 * Call context:
2345 *       process
2346 ----------------------------------------------------------------*/
2347 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
2348 {
2349         DBFENTER;
2350         /* Check that we're already in the download state */
2351         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2352                 return -EINVAL;
2353         }
2354
2355         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2356
2357         /* There isn't much we can do at this point, so I don't */
2358         /*  bother  w/ the return value */
2359         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2360         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2361
2362         DBFEXIT;
2363         return 0;
2364 }
2365
2366
2367 /*----------------------------------------------------------------
2368 * hfa384x_drvr_flashdl_write
2369 *
2370 * Performs a FLASH download of a chunk of data. First checks to see
2371 * that we're in the FLASH download state, then sets the download
2372 * mode, uses the aux functions to 1) copy the data to the flash
2373 * buffer, 2) sets the download 'write flash' mode, 3) readback and
2374 * compare.  Lather rinse, repeat as many times an necessary to get
2375 * all the given data into flash.
2376 * When all data has been written using this function (possibly
2377 * repeatedly), call drvr_flashdl_disable() to end the download state
2378 * and restart the MAC.
2379 *
2380 * Arguments:
2381 *       hw              device structure
2382 *       daddr           Card address to write to. (host order)
2383 *       buf             Ptr to data to write.
2384 *       len             Length of data (host order).
2385 *
2386 * Returns:
2387 *       0               success
2388 *       >0              f/w reported error - f/w status code
2389 *       <0              driver reported error
2390 *
2391 * Side effects:
2392 *
2393 * Call context:
2394 *       process
2395 ----------------------------------------------------------------*/
2396 int
2397 hfa384x_drvr_flashdl_write(
2398         hfa384x_t       *hw,
2399         UINT32          daddr,
2400         void            *buf,
2401         UINT32          len)
2402 {
2403         int             result = 0;
2404         UINT32          dlbufaddr;
2405         int             nburns;
2406         UINT32          burnlen;
2407         UINT32          burndaddr;
2408         UINT16          burnlo;
2409         UINT16          burnhi;
2410         int             nwrites;
2411         UINT8           *writebuf;
2412         UINT16          writepage;
2413         UINT16          writeoffset;
2414         UINT32          writelen;
2415         int             i;
2416         int             j;
2417
2418         DBFENTER;
2419         WLAN_LOG_DEBUG(5,"daddr=0x%08x len=%d\n", daddr, len);
2420
2421         /* Check that we're in the flash download state */
2422         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2423                 return -EINVAL;
2424         }
2425
2426         WLAN_LOG_INFO("Download %d bytes to flash @0x%06x\n", len, daddr);
2427
2428         /* Convert to flat address for arithmetic */
2429         /* NOTE: dlbuffer RID stores the address in AUX format */
2430         dlbufaddr = HFA384x_ADDR_AUX_MKFLAT(
2431                         hw->bufinfo.page, hw->bufinfo.offset);
2432         WLAN_LOG_DEBUG(5,
2433                 "dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2434                 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2435
2436 #if 0
2437 WLAN_LOG_WARNING("dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
2438 #endif
2439         /* Calculations to determine how many fills of the dlbuffer to do
2440          * and how many USB wmemreq's to do for each fill.  At this point
2441          * in time, the dlbuffer size and the wmemreq size are the same.
2442          * Therefore, nwrites should always be 1.  The extra complexity
2443          * here is a hedge against future changes.
2444          */
2445
2446         /* Figure out how many times to do the flash programming */
2447         nburns = len / hw->bufinfo.len;
2448         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2449
2450         /* For each flash program cycle, how many USB wmemreq's are needed? */
2451         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2452         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2453
2454         /* For each burn */
2455         for ( i = 0; i < nburns; i++) {
2456                 /* Get the dest address and len */
2457                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2458                                 hw->bufinfo.len :
2459                                 (len - (hw->bufinfo.len * i));
2460                 burndaddr = daddr + (hw->bufinfo.len * i);
2461                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2462                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2463
2464                 WLAN_LOG_INFO("Writing %d bytes to flash @0x%06x\n",
2465                         burnlen, burndaddr);
2466
2467                 /* Set the download mode */
2468                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2469                                 burnlo, burnhi, burnlen);
2470                 if ( result ) {
2471                         WLAN_LOG_ERROR("download(NV,lo=%x,hi=%x,len=%x) "
2472                                 "cmd failed, result=%d. Aborting d/l\n",
2473                                 burnlo, burnhi, burnlen, result);
2474                         goto exit_proc;
2475                 }
2476
2477                 /* copy the data to the flash download buffer */
2478                 for ( j=0; j < nwrites; j++) {
2479                         writebuf = buf +
2480                                 (i*hw->bufinfo.len) +
2481                                 (j*HFA384x_USB_RWMEM_MAXLEN);
2482
2483                         writepage = HFA384x_ADDR_CMD_MKPAGE(
2484                                         dlbufaddr +
2485                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2486                         writeoffset = HFA384x_ADDR_CMD_MKOFF(
2487                                         dlbufaddr +
2488                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2489
2490                         writelen = burnlen-(j*HFA384x_USB_RWMEM_MAXLEN);
2491                         writelen = writelen  > HFA384x_USB_RWMEM_MAXLEN ?
2492                                         HFA384x_USB_RWMEM_MAXLEN :
2493                                         writelen;
2494
2495                         result = hfa384x_dowmem_wait( hw,
2496                                         writepage,
2497                                         writeoffset,
2498                                         writebuf,
2499                                         writelen );
2500 #if 0
2501
2502 Comment out for debugging, assume the write was successful.
2503                         if (result) {
2504                                 WLAN_LOG_ERROR(
2505                                         "Write to dl buffer failed, "
2506                                         "result=0x%04x. Aborting.\n",
2507                                         result);
2508                                 goto exit_proc;
2509                         }
2510 #endif
2511
2512                 }
2513
2514                 /* set the download 'write flash' mode */
2515                 result = hfa384x_cmd_download(hw,
2516                                 HFA384x_PROGMODE_NVWRITE,
2517                                 0,0,0);
2518                 if ( result ) {
2519                         WLAN_LOG_ERROR(
2520                                 "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2521                                 "cmd failed, result=%d. Aborting d/l\n",
2522                                 burnlo, burnhi, burnlen, result);
2523                         goto exit_proc;
2524                 }
2525
2526                 /* TODO: We really should do a readback and compare. */
2527         }
2528
2529 exit_proc:
2530
2531         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2532         /*  actually disable programming mode.  Remember, that will cause the */
2533         /*  the firmware to effectively reset itself. */
2534
2535         DBFEXIT;
2536         return result;
2537 }
2538
2539
2540 /*----------------------------------------------------------------
2541 * hfa384x_drvr_getconfig
2542 *
2543 * Performs the sequence necessary to read a config/info item.
2544 *
2545 * Arguments:
2546 *       hw              device structure
2547 *       rid             config/info record id (host order)
2548 *       buf             host side record buffer.  Upon return it will
2549 *                       contain the body portion of the record (minus the
2550 *                       RID and len).
2551 *       len             buffer length (in bytes, should match record length)
2552 *
2553 * Returns:
2554 *       0               success
2555 *       >0              f/w reported error - f/w status code
2556 *       <0              driver reported error
2557 *       -ENODATA        length mismatch between argument and retrieved
2558 *                       record.
2559 *
2560 * Side effects:
2561 *
2562 * Call context:
2563 *       process
2564 ----------------------------------------------------------------*/
2565 int hfa384x_drvr_getconfig(hfa384x_t *hw, UINT16 rid, void *buf, UINT16 len)
2566 {
2567         int                     result;
2568         DBFENTER;
2569
2570         result = hfa384x_dorrid_wait(hw, rid, buf, len);
2571
2572         DBFEXIT;
2573         return result;
2574 }
2575
2576 /*----------------------------------------------------------------
2577  * hfa384x_drvr_getconfig_async
2578  *
2579  * Performs the sequence necessary to perform an async read of
2580  * of a config/info item.
2581  *
2582  * Arguments:
2583  *       hw              device structure
2584  *       rid             config/info record id (host order)
2585  *       buf             host side record buffer.  Upon return it will
2586  *                       contain the body portion of the record (minus the
2587  *                       RID and len).
2588  *       len             buffer length (in bytes, should match record length)
2589  *       cbfn            caller supplied callback, called when the command
2590  *                       is done (successful or not).
2591  *       cbfndata        pointer to some caller supplied data that will be
2592  *                       passed in as an argument to the cbfn.
2593  *
2594  * Returns:
2595  *       nothing         the cbfn gets a status argument identifying if
2596  *                       any errors occur.
2597  * Side effects:
2598  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2599  *
2600  * Call context:
2601  *       Any
2602  ----------------------------------------------------------------*/
2603 int
2604 hfa384x_drvr_getconfig_async(
2605          hfa384x_t               *hw,
2606          UINT16                  rid,
2607          ctlx_usercb_t           usercb,
2608          void                    *usercb_data)
2609 {
2610          return hfa384x_dorrid_async(hw, rid, NULL, 0,
2611                                      hfa384x_cb_rrid, usercb, usercb_data);
2612 }
2613
2614 /*----------------------------------------------------------------
2615  * hfa384x_drvr_setconfig_async
2616  *
2617  * Performs the sequence necessary to write a config/info item.
2618  *
2619  * Arguments:
2620  *       hw              device structure
2621  *       rid             config/info record id (in host order)
2622  *       buf             host side record buffer
2623  *       len             buffer length (in bytes)
2624  *       usercb          completion callback
2625  *       usercb_data     completion callback argument
2626  *
2627  * Returns:
2628  *       0               success
2629  *       >0              f/w reported error - f/w status code
2630  *       <0              driver reported error
2631  *
2632  * Side effects:
2633  *
2634  * Call context:
2635  *       process
2636  ----------------------------------------------------------------*/
2637 int
2638 hfa384x_drvr_setconfig_async(
2639          hfa384x_t       *hw,
2640          UINT16          rid,
2641          void            *buf,
2642          UINT16          len,
2643          ctlx_usercb_t   usercb,
2644          void            *usercb_data)
2645 {
2646         return hfa384x_dowrid_async(hw, rid, buf, len,
2647                                     hfa384x_cb_status, usercb, usercb_data);
2648 }
2649
2650 /*----------------------------------------------------------------
2651 * hfa384x_drvr_handover
2652 *
2653 * Sends a handover notification to the MAC.
2654 *
2655 * Arguments:
2656 *       hw              device structure
2657 *       addr            address of station that's left
2658 *
2659 * Returns:
2660 *       zero            success.
2661 *       -ERESTARTSYS    received signal while waiting for semaphore.
2662 *       -EIO            failed to write to bap, or failed in cmd.
2663 *
2664 * Side effects:
2665 *
2666 * Call context:
2667 *       process
2668 ----------------------------------------------------------------*/
2669 int hfa384x_drvr_handover( hfa384x_t *hw, UINT8 *addr)
2670 {
2671         DBFENTER;
2672         WLAN_LOG_ERROR("Not currently supported in USB!\n");
2673         DBFEXIT;
2674         return -EIO;
2675 }
2676
2677 /*----------------------------------------------------------------
2678 * hfa384x_drvr_low_level
2679 *
2680 * Write test commands to the card.  Some test commands don't make
2681 * sense without prior set-up.  For example, continous TX isn't very
2682 * useful until you set the channel.  That functionality should be
2683 *
2684 * Side effects:
2685 *
2686 * Call context:
2687 *      process thread
2688 * -----------------------------------------------------------------*/
2689 int hfa384x_drvr_low_level(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
2690 {
2691         int             result;
2692         DBFENTER;
2693
2694         /* Do i need a host2hfa... conversion ? */
2695
2696         result = hfa384x_docmd_wait(hw, cmd);
2697
2698         DBFEXIT;
2699         return result;
2700 }
2701
2702 /*----------------------------------------------------------------
2703 * hfa384x_drvr_mmi_read
2704 *
2705 * Read mmi registers.  mmi is intersil-speak for the baseband
2706 * processor registers.
2707 *
2708 * Arguments:
2709 *       hw              device structure
2710 *       register        The test register to be accessed (must be even #).
2711 *
2712 * Returns:
2713 *       0               success
2714 *       >0              f/w reported error - f/w status code
2715 *       <0              driver reported error
2716 *
2717 * Side effects:
2718 *
2719 * Call context:
2720 *       process
2721 ----------------------------------------------------------------*/
2722 int hfa384x_drvr_mmi_read(hfa384x_t *hw, UINT32 addr, UINT32 *resp)
2723 {
2724 #if 0
2725         int             result = 0;
2726         UINT16  cmd_code = (UINT16) 0x30;
2727         UINT16 param = (UINT16) addr;
2728         DBFENTER;
2729
2730         /* Do i need a host2hfa... conversion ? */
2731         result = hfa384x_docmd_wait(hw, cmd_code);
2732
2733         DBFEXIT;
2734         return result;
2735 #endif
2736 return 0;
2737 }
2738
2739 /*----------------------------------------------------------------
2740 * hfa384x_drvr_mmi_write
2741 *
2742 * Read mmi registers.  mmi is intersil-speak for the baseband
2743 * processor registers.
2744 *
2745 * Arguments:
2746 *       hw              device structure
2747 *       addr            The test register to be accessed (must be even #).
2748 *       data            The data value to write to the register.
2749 *
2750 * Returns:
2751 *       0               success
2752 *       >0              f/w reported error - f/w status code
2753 *       <0              driver reported error
2754 *
2755 * Side effects:
2756 *
2757 * Call context:
2758 *       process
2759 ----------------------------------------------------------------*/
2760
2761 int
2762 hfa384x_drvr_mmi_write(hfa384x_t *hw, UINT32 addr, UINT32 data)
2763 {
2764 #if 0
2765         int             result = 0;
2766         UINT16  cmd_code = (UINT16) 0x31;
2767         UINT16 param0 = (UINT16) addr;
2768         UINT16 param1 = (UINT16) data;
2769         DBFENTER;
2770
2771         WLAN_LOG_DEBUG(1,"mmi write : addr = 0x%08lx\n", addr);
2772         WLAN_LOG_DEBUG(1,"mmi write : data = 0x%08lx\n", data);
2773
2774         /* Do i need a host2hfa... conversion ? */
2775         result = hfa384x_docmd_wait(hw, cmd_code);
2776
2777         DBFEXIT;
2778         return result;
2779 #endif
2780 return 0;
2781 }
2782
2783
2784 /*----------------------------------------------------------------
2785 * hfa384x_drvr_ramdl_disable
2786 *
2787 * Ends the ram download state.
2788 *
2789 * Arguments:
2790 *       hw              device structure
2791 *
2792 * Returns:
2793 *       0               success
2794 *       >0              f/w reported error - f/w status code
2795 *       <0              driver reported error
2796 *
2797 * Side effects:
2798 *
2799 * Call context:
2800 *       process
2801 ----------------------------------------------------------------*/
2802 int
2803 hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2804 {
2805         DBFENTER;
2806         /* Check that we're already in the download state */
2807         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2808                 return -EINVAL;
2809         }
2810
2811         WLAN_LOG_DEBUG(3,"ramdl_disable()\n");
2812
2813         /* There isn't much we can do at this point, so I don't */
2814         /*  bother  w/ the return value */
2815         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2816         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2817
2818         DBFEXIT;
2819         return 0;
2820 }
2821
2822
2823 /*----------------------------------------------------------------
2824 * hfa384x_drvr_ramdl_enable
2825 *
2826 * Begins the ram download state.  Checks to see that we're not
2827 * already in a download state and that a port isn't enabled.
2828 * Sets the download state and calls cmd_download with the
2829 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2830 *
2831 * Arguments:
2832 *       hw              device structure
2833 *       exeaddr         the card execution address that will be
2834 *                       jumped to when ramdl_disable() is called
2835 *                       (host order).
2836 *
2837 * Returns:
2838 *       0               success
2839 *       >0              f/w reported error - f/w status code
2840 *       <0              driver reported error
2841 *
2842 * Side effects:
2843 *
2844 * Call context:
2845 *       process
2846 ----------------------------------------------------------------*/
2847 int
2848 hfa384x_drvr_ramdl_enable(hfa384x_t *hw, UINT32 exeaddr)
2849 {
2850         int             result = 0;
2851         UINT16          lowaddr;
2852         UINT16          hiaddr;
2853         int             i;
2854         DBFENTER;
2855         /* Check that a port isn't active */
2856         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2857                 if ( hw->port_enabled[i] ) {
2858                         WLAN_LOG_ERROR(
2859                                 "Can't download with a macport enabled.\n");
2860                         return -EINVAL;
2861                 }
2862         }
2863
2864         /* Check that we're not already in a download state */
2865         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2866                 WLAN_LOG_ERROR(
2867                         "Download state not disabled.\n");
2868                 return -EINVAL;
2869         }
2870
2871         WLAN_LOG_DEBUG(3,"ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2872
2873         /* Call the download(1,addr) function */
2874         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2875         hiaddr =  HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2876
2877         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2878                         lowaddr, hiaddr, 0);
2879
2880         if ( result == 0) {
2881                 /* Set the download state */
2882                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2883         } else {
2884                 WLAN_LOG_DEBUG(1,
2885                         "cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2886                         lowaddr,
2887                         hiaddr,
2888                         result);
2889         }
2890
2891         DBFEXIT;
2892         return result;
2893 }
2894
2895
2896 /*----------------------------------------------------------------
2897 * hfa384x_drvr_ramdl_write
2898 *
2899 * Performs a RAM download of a chunk of data. First checks to see
2900 * that we're in the RAM download state, then uses the [read|write]mem USB
2901 * commands to 1) copy the data, 2) readback and compare.  The download
2902 * state is unaffected.  When all data has been written using
2903 * this function, call drvr_ramdl_disable() to end the download state
2904 * and restart the MAC.
2905 *
2906 * Arguments:
2907 *       hw              device structure
2908 *       daddr           Card address to write to. (host order)
2909 *       buf             Ptr to data to write.
2910 *       len             Length of data (host order).
2911 *
2912 * Returns:
2913 *       0               success
2914 *       >0              f/w reported error - f/w status code
2915 *       <0              driver reported error
2916 *
2917 * Side effects:
2918 *
2919 * Call context:
2920 *       process
2921 ----------------------------------------------------------------*/
2922 int
2923 hfa384x_drvr_ramdl_write(hfa384x_t *hw, UINT32 daddr, void* buf, UINT32 len)
2924 {
2925         int             result = 0;
2926         int             nwrites;
2927         UINT8           *data = buf;
2928         int             i;
2929         UINT32          curraddr;
2930         UINT16          currpage;
2931         UINT16          curroffset;
2932         UINT16          currlen;
2933         DBFENTER;
2934         /* Check that we're in the ram download state */
2935         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2936                 return -EINVAL;
2937         }
2938
2939         WLAN_LOG_INFO("Writing %d bytes to ram @0x%06x\n", len, daddr);
2940
2941         /* How many dowmem calls?  */
2942         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2943         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2944
2945         /* Do blocking wmem's */
2946         for(i=0; i < nwrites; i++) {
2947                 /* make address args */
2948                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2949                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2950                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2951                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2952                 if ( currlen > HFA384x_USB_RWMEM_MAXLEN) {
2953                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2954                 }
2955
2956                 /* Do blocking ctlx */
2957                 result = hfa384x_dowmem_wait( hw,
2958                                 currpage,
2959                                 curroffset,
2960                                 data + (i*HFA384x_USB_RWMEM_MAXLEN),
2961                                 currlen );
2962
2963                 if (result) break;
2964
2965                 /* TODO: We really should have a readback. */
2966         }
2967
2968         DBFEXIT;
2969         return result;
2970 }
2971
2972
2973 /*----------------------------------------------------------------
2974 * hfa384x_drvr_readpda
2975 *
2976 * Performs the sequence to read the PDA space.  Note there is no
2977 * drvr_writepda() function.  Writing a PDA is
2978 * generally implemented by a calling component via calls to
2979 * cmd_download and writing to the flash download buffer via the
2980 * aux regs.
2981 *
2982 * Arguments:
2983 *       hw              device structure
2984 *       buf             buffer to store PDA in
2985 *       len             buffer length
2986 *
2987 * Returns:
2988 *       0               success
2989 *       >0              f/w reported error - f/w status code
2990 *       <0              driver reported error
2991 *       -ETIMEOUT       timout waiting for the cmd regs to become
2992 *                       available, or waiting for the control reg
2993 *                       to indicate the Aux port is enabled.
2994 *       -ENODATA        the buffer does NOT contain a valid PDA.
2995 *                       Either the card PDA is bad, or the auxdata
2996 *                       reads are giving us garbage.
2997
2998 *
2999 * Side effects:
3000 *
3001 * Call context:
3002 *       process or non-card interrupt.
3003 ----------------------------------------------------------------*/
3004 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, UINT len)
3005 {
3006         int             result = 0;
3007         UINT16          *pda = buf;
3008         int             pdaok = 0;
3009         int             morepdrs = 1;
3010         int             currpdr = 0;    /* word offset of the current pdr */
3011         size_t          i;
3012         UINT16          pdrlen;         /* pdr length in bytes, host order */
3013         UINT16          pdrcode;        /* pdr code, host order */
3014         UINT16          currpage;
3015         UINT16          curroffset;
3016         struct pdaloc {
3017                 UINT32  cardaddr;
3018                 UINT16  auxctl;
3019         } pdaloc[] =
3020         {
3021                 { HFA3842_PDA_BASE,             0},
3022                 { HFA3841_PDA_BASE,             0},
3023                 { HFA3841_PDA_BOGUS_BASE,       0}
3024         };
3025
3026         DBFENTER;
3027
3028         /* Read the pda from each known address.  */
3029         for ( i = 0; i < ARRAY_SIZE(pdaloc); i++) {
3030                 /* Make address */
3031                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
3032                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
3033
3034                 result = hfa384x_dormem_wait(hw,
3035                         currpage,
3036                         curroffset,
3037                         buf,
3038                         len);           /* units of bytes */
3039
3040                 if (result) {
3041                         WLAN_LOG_WARNING(
3042                                           "Read from index %zd failed, continuing\n",
3043                                 i );
3044                         continue;
3045                 }
3046
3047                 /* Test for garbage */
3048                 pdaok = 1;      /* initially assume good */
3049                 morepdrs = 1;
3050                 while ( pdaok && morepdrs ) {
3051                         pdrlen = hfa384x2host_16(pda[currpdr]) * 2;
3052                         pdrcode = hfa384x2host_16(pda[currpdr+1]);
3053                         /* Test the record length */
3054                         if ( pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
3055                                 WLAN_LOG_ERROR("pdrlen invalid=%d\n",
3056                                         pdrlen);
3057                                 pdaok = 0;
3058                                 break;
3059                         }
3060                         /* Test the code */
3061                         if ( !hfa384x_isgood_pdrcode(pdrcode) ) {
3062                                 WLAN_LOG_ERROR("pdrcode invalid=%d\n",
3063                                         pdrcode);
3064                                 pdaok = 0;
3065                                 break;
3066                         }
3067                         /* Test for completion */
3068                         if ( pdrcode == HFA384x_PDR_END_OF_PDA) {
3069                                 morepdrs = 0;
3070                         }
3071
3072                         /* Move to the next pdr (if necessary) */
3073                         if ( morepdrs ) {
3074                                 /* note the access to pda[], need words here */
3075                                 currpdr += hfa384x2host_16(pda[currpdr]) + 1;
3076                         }
3077                 }
3078                 if ( pdaok ) {
3079                         WLAN_LOG_INFO(
3080                                 "PDA Read from 0x%08x in %s space.\n",
3081                                 pdaloc[i].cardaddr,
3082                                 pdaloc[i].auxctl == 0 ? "EXTDS" :
3083                                 pdaloc[i].auxctl == 1 ? "NV" :
3084                                 pdaloc[i].auxctl == 2 ? "PHY" :
3085                                 pdaloc[i].auxctl == 3 ? "ICSRAM" :
3086                                 "<bogus auxctl>");
3087                         break;
3088                 }
3089         }
3090         result = pdaok ? 0 : -ENODATA;
3091
3092         if ( result ) {
3093                 WLAN_LOG_DEBUG(3,"Failure: pda is not okay\n");
3094         }
3095
3096         DBFEXIT;
3097         return result;
3098 }
3099
3100
3101 /*----------------------------------------------------------------
3102 * hfa384x_drvr_setconfig
3103 *
3104 * Performs the sequence necessary to write a config/info item.
3105 *
3106 * Arguments:
3107 *       hw              device structure
3108 *       rid             config/info record id (in host order)
3109 *       buf             host side record buffer
3110 *       len             buffer length (in bytes)
3111 *
3112 * Returns:
3113 *       0               success
3114 *       >0              f/w reported error - f/w status code
3115 *       <0              driver reported error
3116 *
3117 * Side effects:
3118 *
3119 * Call context:
3120 *       process
3121 ----------------------------------------------------------------*/
3122 int hfa384x_drvr_setconfig(hfa384x_t *hw, UINT16 rid, void *buf, UINT16 len)
3123 {
3124         return hfa384x_dowrid_wait(hw, rid, buf, len);
3125 }
3126
3127 /*----------------------------------------------------------------
3128 * hfa384x_drvr_start
3129 *
3130 * Issues the MAC initialize command, sets up some data structures,
3131 * and enables the interrupts.  After this function completes, the
3132 * low-level stuff should be ready for any/all commands.
3133 *
3134 * Arguments:
3135 *       hw              device structure
3136 * Returns:
3137 *       0               success
3138 *       >0              f/w reported error - f/w status code
3139 *       <0              driver reported error
3140 *
3141 * Side effects:
3142 *
3143 * Call context:
3144 *       process
3145 ----------------------------------------------------------------*/
3146 int hfa384x_drvr_start(hfa384x_t *hw)
3147 {
3148         int             result;
3149         DBFENTER;
3150
3151         might_sleep();
3152
3153         if (usb_clear_halt(hw->usb, hw->endp_in)) {
3154                 WLAN_LOG_ERROR(
3155                         "Failed to reset bulk in endpoint.\n");
3156         }
3157
3158         if (usb_clear_halt(hw->usb, hw->endp_out)) {
3159                 WLAN_LOG_ERROR(
3160                         "Failed to reset bulk out endpoint.\n");
3161         }
3162
3163         /* Synchronous unlink, in case we're trying to restart the driver */
3164         usb_kill_urb(&hw->rx_urb);
3165
3166         /* Post the IN urb */
3167         result = submit_rx_urb(hw, GFP_KERNEL);
3168         if (result != 0) {
3169                 WLAN_LOG_ERROR(
3170                         "Fatal, failed to submit RX URB, result=%d\n",
3171                         result);
3172                 goto done;
3173         }
3174
3175         /* call initialize */
3176         result = hfa384x_cmd_initialize(hw);
3177         if (result != 0) {
3178                 usb_kill_urb(&hw->rx_urb);
3179                 WLAN_LOG_ERROR(
3180                         "cmd_initialize() failed, result=%d\n",
3181                         result);
3182                 goto done;
3183         }
3184
3185         hw->state = HFA384x_STATE_RUNNING;
3186
3187 done:
3188         DBFEXIT;
3189         return result;
3190 }
3191
3192
3193 /*----------------------------------------------------------------
3194 * hfa384x_drvr_stop
3195 *
3196 * Shuts down the MAC to the point where it is safe to unload the
3197 * driver.  Any subsystem that may be holding a data or function
3198 * ptr into the driver must be cleared/deinitialized.
3199 *
3200 * Arguments:
3201 *       hw              device structure
3202 * Returns:
3203 *       0               success
3204 *       >0              f/w reported error - f/w status code
3205 *       <0              driver reported error
3206 *
3207 * Side effects:
3208 *
3209 * Call context:
3210 *       process
3211 ----------------------------------------------------------------*/
3212 int
3213 hfa384x_drvr_stop(hfa384x_t *hw)
3214 {
3215         int     result = 0;
3216         int     i;
3217         DBFENTER;
3218
3219         might_sleep();
3220
3221         /* There's no need for spinlocks here. The USB "disconnect"
3222          * function sets this "removed" flag and then calls us.
3223          */
3224         if ( !hw->wlandev->hwremoved ) {
3225                 /* Call initialize to leave the MAC in its 'reset' state */
3226                 hfa384x_cmd_initialize(hw);
3227
3228                 /* Cancel the rxurb */
3229                 usb_kill_urb(&hw->rx_urb);
3230         }
3231
3232         hw->link_status = HFA384x_LINK_NOTCONNECTED;
3233         hw->state = HFA384x_STATE_INIT;
3234
3235         del_timer_sync(&hw->commsqual_timer);
3236
3237         /* Clear all the port status */
3238         for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
3239                 hw->port_enabled[i] = 0;
3240         }
3241
3242         DBFEXIT;
3243         return result;
3244 }
3245
3246 /*----------------------------------------------------------------
3247 * hfa384x_drvr_txframe
3248 *
3249 * Takes a frame from prism2sta and queues it for transmission.
3250 *
3251 * Arguments:
3252 *       hw              device structure
3253 *       skb             packet buffer struct.  Contains an 802.11
3254 *                       data frame.
3255 *       p80211_hdr      points to the 802.11 header for the packet.
3256 * Returns:
3257 *       0               Success and more buffs available
3258 *       1               Success but no more buffs
3259 *       2               Allocation failure
3260 *       4               Buffer full or queue busy
3261 *
3262 * Side effects:
3263 *
3264 * Call context:
3265 *       interrupt
3266 ----------------------------------------------------------------*/
3267 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb, p80211_hdr_t *p80211_hdr, p80211_metawep_t *p80211_wep)
3268
3269 {
3270         int             usbpktlen = sizeof(hfa384x_tx_frame_t);
3271         int             result;
3272         int             ret;
3273         char            *ptr;
3274
3275         DBFENTER;
3276
3277         if (hw->tx_urb.status == -EINPROGRESS) {
3278                 WLAN_LOG_WARNING("TX URB already in use\n");
3279                 result = 3;
3280                 goto exit;
3281         }
3282
3283         /* Build Tx frame structure */
3284         /* Set up the control field */
3285         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
3286
3287         /* Setup the usb type field */
3288         hw->txbuff.type = host2hfa384x_16(HFA384x_USB_TXFRM);
3289
3290         /* Set up the sw_support field to identify this frame */
3291         hw->txbuff.txfrm.desc.sw_support = 0x0123;
3292
3293 /* Tx complete and Tx exception disable per dleach.  Might be causing
3294  * buf depletion
3295  */
3296 //#define DOEXC  SLP -- doboth breaks horribly under load, doexc less so.
3297 #if defined(DOBOTH)
3298         hw->txbuff.txfrm.desc.tx_control =
3299                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3300                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
3301 #elif defined(DOEXC)
3302         hw->txbuff.txfrm.desc.tx_control =
3303                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3304                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
3305 #else
3306         hw->txbuff.txfrm.desc.tx_control =
3307                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3308                 HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
3309 #endif
3310         hw->txbuff.txfrm.desc.tx_control =
3311                 host2hfa384x_16(hw->txbuff.txfrm.desc.tx_control);
3312
3313         /* copy the header over to the txdesc */
3314         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr, sizeof(p80211_hdr_t));
3315
3316         /* if we're using host WEP, increase size by IV+ICV */
3317         if (p80211_wep->data) {
3318                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len+8);
3319                 // hw->txbuff.txfrm.desc.tx_control |= HFA384x_TX_NOENCRYPT_SET(1);
3320                 usbpktlen+=8;
3321         } else {
3322                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len);
3323         }
3324
3325         usbpktlen += skb->len;
3326
3327         /* copy over the WEP IV if we are using host WEP */
3328         ptr = hw->txbuff.txfrm.data;
3329         if (p80211_wep->data) {
3330                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
3331                 ptr+= sizeof(p80211_wep->iv);
3332                 memcpy(ptr, p80211_wep->data, skb->len);
3333         } else {
3334                 memcpy(ptr, skb->data, skb->len);
3335         }
3336         /* copy over the packet data */
3337         ptr+= skb->len;
3338
3339         /* copy over the WEP ICV if we are using host WEP */
3340         if (p80211_wep->data) {
3341                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
3342         }
3343
3344         /* Send the USB packet */
3345         usb_fill_bulk_urb( &(hw->tx_urb), hw->usb,
3346                        hw->endp_out,
3347                        &(hw->txbuff), ROUNDUP64(usbpktlen),
3348                        hfa384x_usbout_callback, hw->wlandev );
3349         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
3350
3351         result = 1;
3352         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
3353         if ( ret != 0 ) {
3354                 WLAN_LOG_ERROR(
3355                         "submit_tx_urb() failed, error=%d\n", ret);
3356                 result = 3;
3357         }
3358
3359  exit:
3360         DBFEXIT;
3361         return result;
3362 }
3363
3364 void hfa384x_tx_timeout(wlandevice_t *wlandev)
3365 {
3366         hfa384x_t       *hw = wlandev->priv;
3367         unsigned long flags;
3368
3369         DBFENTER;
3370
3371         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3372
3373         if ( !hw->wlandev->hwremoved &&
3374              /* Note the bitwise OR, not the logical OR. */
3375              ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) |
3376                !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) ) )
3377         {
3378                 schedule_work(&hw->usb_work);
3379         }
3380
3381         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3382
3383         DBFEXIT;
3384 }
3385
3386 /*----------------------------------------------------------------
3387 * hfa384x_usbctlx_reaper_task
3388 *
3389 * Tasklet to delete dead CTLX objects
3390 *
3391 * Arguments:
3392 *       data    ptr to a hfa384x_t
3393 *
3394 * Returns:
3395 *
3396 * Call context:
3397 *       Interrupt
3398 ----------------------------------------------------------------*/
3399 static void hfa384x_usbctlx_reaper_task(unsigned long data)
3400 {
3401         hfa384x_t       *hw = (hfa384x_t*)data;
3402         struct list_head *entry;
3403         struct list_head *temp;
3404         unsigned long   flags;
3405
3406         DBFENTER;
3407
3408         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3409
3410         /* This list is guaranteed to be empty if someone
3411          * has unplugged the adapter.
3412          */
3413         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
3414                 hfa384x_usbctlx_t       *ctlx;
3415
3416                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3417                 list_del(&ctlx->list);
3418                 kfree(ctlx);
3419         }
3420
3421         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3422
3423         DBFEXIT;
3424 }
3425
3426 /*----------------------------------------------------------------
3427 * hfa384x_usbctlx_completion_task
3428 *
3429 * Tasklet to call completion handlers for returned CTLXs
3430 *
3431 * Arguments:
3432 *       data    ptr to hfa384x_t
3433 *
3434 * Returns:
3435 *       Nothing
3436 *
3437 * Call context:
3438 *       Interrupt
3439 ----------------------------------------------------------------*/
3440 static void hfa384x_usbctlx_completion_task(unsigned long data)
3441 {
3442         hfa384x_t *hw = (hfa384x_t*)data;
3443         struct list_head *entry;
3444         struct list_head *temp;
3445         unsigned long flags;
3446
3447         int reap = 0;
3448
3449         DBFENTER;
3450
3451         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3452
3453         /* This list is guaranteed to be empty if someone
3454          * has unplugged the adapter ...
3455          */
3456         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
3457                 hfa384x_usbctlx_t *ctlx;
3458
3459                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3460
3461                 /* Call the completion function that this
3462                  * command was assigned, assuming it has one.
3463                  */
3464                 if ( ctlx->cmdcb != NULL ) {
3465                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3466                         ctlx->cmdcb(hw, ctlx);
3467                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3468
3469                         /* Make sure we don't try and complete
3470                          * this CTLX more than once!
3471                          */
3472                         ctlx->cmdcb = NULL;
3473
3474                         /* Did someone yank the adapter out
3475                          * while our list was (briefly) unlocked?
3476                          */
3477                         if ( hw->wlandev->hwremoved )
3478                         {
3479                                 reap = 0;
3480                                 break;
3481                         }
3482                 }
3483
3484                 /*
3485                  * "Reapable" CTLXs are ones which don't have any
3486                  * threads waiting for them to die. Hence they must
3487                  * be delivered to The Reaper!
3488                  */
3489                 if ( ctlx->reapable ) {
3490                         /* Move the CTLX off the "completing" list (hopefully)
3491                          * on to the "reapable" list where the reaper task
3492                          * can find it. And "reapable" means that this CTLX
3493                          * isn't sitting on a wait-queue somewhere.
3494                          */
3495                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
3496                         reap = 1;
3497                 }
3498
3499                 complete(&ctlx->done);
3500         }
3501         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3502
3503         if (reap)
3504                 tasklet_schedule(&hw->reaper_bh);
3505
3506         DBFEXIT;
3507 }
3508
3509 /*----------------------------------------------------------------
3510 * unlocked_usbctlx_cancel_async
3511 *
3512 * Mark the CTLX dead asynchronously, and ensure that the
3513 * next command on the queue is run afterwards.
3514 *
3515 * Arguments:
3516 *       hw      ptr to the hfa384x_t structure
3517 *       ctlx    ptr to a CTLX structure
3518 *
3519 * Returns:
3520 *       0       the CTLX's URB is inactive
3521 * -EINPROGRESS  the URB is currently being unlinked
3522 *
3523 * Call context:
3524 *       Either process or interrupt, but presumably interrupt
3525 ----------------------------------------------------------------*/
3526 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3527 {
3528         int ret;
3529
3530         DBFENTER;
3531
3532         /*
3533          * Try to delete the URB containing our request packet.
3534          * If we succeed, then its completion handler will be
3535          * called with a status of -ECONNRESET.
3536          */
3537         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3538         ret = usb_unlink_urb(&hw->ctlx_urb);
3539
3540         if (ret != -EINPROGRESS) {
3541                 /*
3542                  * The OUT URB had either already completed
3543                  * or was still in the pending queue, so the
3544                  * URB's completion function will not be called.
3545                  * We will have to complete the CTLX ourselves.
3546                  */
3547                 ctlx->state = CTLX_REQ_FAILED;
3548                 unlocked_usbctlx_complete(hw, ctlx);
3549                 ret = 0;
3550         }
3551
3552         DBFEXIT;
3553
3554         return ret;
3555 }
3556
3557 /*----------------------------------------------------------------
3558 * unlocked_usbctlx_complete
3559 *
3560 * A CTLX has completed.  It may have been successful, it may not
3561 * have been. At this point, the CTLX should be quiescent.  The URBs
3562 * aren't active and the timers should have been stopped.
3563 *
3564 * The CTLX is migrated to the "completing" queue, and the completing
3565 * tasklet is scheduled.
3566 *
3567 * Arguments:
3568 *       hw              ptr to a hfa384x_t structure
3569 *       ctlx            ptr to a ctlx structure
3570 *
3571 * Returns:
3572 *       nothing
3573 *
3574 * Side effects:
3575 *
3576 * Call context:
3577 *       Either, assume interrupt
3578 ----------------------------------------------------------------*/
3579 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3580 {
3581         DBFENTER;
3582
3583         /* Timers have been stopped, and ctlx should be in
3584          * a terminal state. Retire it from the "active"
3585          * queue.
3586          */
3587         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3588         tasklet_schedule(&hw->completion_bh);
3589
3590         switch (ctlx->state) {
3591         case CTLX_COMPLETE:
3592         case CTLX_REQ_FAILED:
3593                 /* This are the correct terminating states. */
3594                 break;
3595
3596         default:
3597                 WLAN_LOG_ERROR("CTLX[%d] not in a terminating state(%s)\n",
3598                                hfa384x2host_16(ctlx->outbuf.type),
3599                                ctlxstr(ctlx->state));
3600                 break;
3601         } /* switch */
3602
3603         DBFEXIT;
3604 }
3605
3606 /*----------------------------------------------------------------
3607 * hfa384x_usbctlxq_run
3608 *
3609 * Checks to see if the head item is running.  If not, starts it.
3610 *
3611 * Arguments:
3612 *       hw      ptr to hfa384x_t
3613 *
3614 * Returns:
3615 *       nothing
3616 *
3617 * Side effects:
3618 *
3619 * Call context:
3620 *       any
3621 ----------------------------------------------------------------*/
3622 static void
3623 hfa384x_usbctlxq_run(hfa384x_t  *hw)
3624 {
3625         unsigned long           flags;
3626         DBFENTER;
3627
3628         /* acquire lock */
3629         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3630
3631         /* Only one active CTLX at any one time, because there's no
3632          * other (reliable) way to match the response URB to the
3633          * correct CTLX.
3634          *
3635          * Don't touch any of these CTLXs if the hardware
3636          * has been removed or the USB subsystem is stalled.
3637          */
3638         if ( !list_empty(&hw->ctlxq.active) ||
3639              test_bit(WORK_TX_HALT, &hw->usb_flags) ||
3640              hw->wlandev->hwremoved )
3641                 goto unlock;
3642
3643         while ( !list_empty(&hw->ctlxq.pending) ) {
3644                 hfa384x_usbctlx_t       *head;
3645                 int                     result;
3646
3647                 /* This is the first pending command */
3648                 head = list_entry(hw->ctlxq.pending.next,
3649                                   hfa384x_usbctlx_t,
3650                                   list);
3651
3652                 /* We need to split this off to avoid a race condition */
3653                 list_move_tail(&head->list, &hw->ctlxq.active);
3654
3655                 /* Fill the out packet */
3656                 usb_fill_bulk_urb( &(hw->ctlx_urb), hw->usb,
3657                                    hw->endp_out,
3658                                    &(head->outbuf), ROUNDUP64(head->outbufsize),
3659                                    hfa384x_ctlxout_callback, hw);
3660                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3661
3662                 /* Now submit the URB and update the CTLX's state
3663                  */
3664                 if ((result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC)) == 0) {
3665                         /* This CTLX is now running on the active queue */
3666                         head->state = CTLX_REQ_SUBMITTED;
3667
3668                         /* Start the OUT wait timer */
3669                         hw->req_timer_done = 0;
3670                         hw->reqtimer.expires = jiffies + HZ;
3671                         add_timer(&hw->reqtimer);
3672
3673                         /* Start the IN wait timer */
3674                         hw->resp_timer_done = 0;
3675                         hw->resptimer.expires = jiffies + 2*HZ;
3676                         add_timer(&hw->resptimer);
3677
3678                         break;
3679                 }
3680
3681                 if (result == -EPIPE) {
3682                         /* The OUT pipe needs resetting, so put
3683                          * this CTLX back in the "pending" queue
3684                          * and schedule a reset ...
3685                          */
3686                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
3687                                          hw->wlandev->netdev->name);
3688                         list_move(&head->list, &hw->ctlxq.pending);
3689                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3690                         schedule_work(&hw->usb_work);
3691                         break;
3692                 }
3693
3694                 if (result == -ESHUTDOWN) {
3695                         WLAN_LOG_WARNING("%s urb shutdown!\n",
3696                                          hw->wlandev->netdev->name);
3697                         break;
3698                 }
3699
3700                 WLAN_LOG_ERROR("Failed to submit CTLX[%d]: error=%d\n",
3701                                hfa384x2host_16(head->outbuf.type), result);
3702                 unlocked_usbctlx_complete(hw, head);
3703         } /* while */
3704
3705         unlock:
3706         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3707
3708         DBFEXIT;
3709 }
3710
3711
3712 /*----------------------------------------------------------------
3713 * hfa384x_usbin_callback
3714 *
3715 * Callback for URBs on the BULKIN endpoint.
3716 *
3717 * Arguments:
3718 *       urb             ptr to the completed urb
3719 *
3720 * Returns:
3721 *       nothing
3722 *
3723 * Side effects:
3724 *
3725 * Call context:
3726 *       interrupt
3727 ----------------------------------------------------------------*/
3728 #ifdef URB_ONLY_CALLBACK
3729 static void hfa384x_usbin_callback(struct urb *urb)
3730 #else
3731 static void hfa384x_usbin_callback(struct urb *urb, struct pt_regs *regs)
3732 #endif
3733 {
3734         wlandevice_t            *wlandev = urb->context;
3735         hfa384x_t               *hw;
3736         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3737         struct sk_buff          *skb = NULL;
3738         int                     result;
3739         int                     urb_status;
3740         UINT16                  type;
3741
3742         enum USBIN_ACTION {
3743                 HANDLE,
3744                 RESUBMIT,
3745                 ABORT
3746         } action;
3747
3748         DBFENTER;
3749
3750         if ( !wlandev ||
3751              !wlandev->netdev ||
3752              !netif_device_present(wlandev->netdev) )
3753                 goto exit;
3754
3755         hw = wlandev->priv;
3756         if (!hw)
3757                 goto exit;
3758
3759         skb = hw->rx_urb_skb;
3760         if (!skb || (skb->data != urb->transfer_buffer)) {
3761                 BUG();
3762         }
3763         hw->rx_urb_skb = NULL;
3764
3765         /* Check for error conditions within the URB */
3766         switch (urb->status) {
3767         case 0:
3768                 action = HANDLE;
3769
3770                 /* Check for short packet */
3771                 if ( urb->actual_length == 0 ) {
3772                         ++(wlandev->linux_stats.rx_errors);
3773                         ++(wlandev->linux_stats.rx_length_errors);
3774                         action = RESUBMIT;
3775                 }
3776                 break;
3777
3778         case -EPIPE:
3779                 WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
3780                                  wlandev->netdev->name);
3781                 if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
3782                         schedule_work(&hw->usb_work);
3783                 ++(wlandev->linux_stats.rx_errors);
3784                 action = ABORT;
3785                 break;
3786
3787         case -EILSEQ:
3788         case -ETIMEDOUT:
3789         case -EPROTO:
3790                 if ( !test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3791                      !timer_pending(&hw->throttle) ) {
3792                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3793                 }
3794                 ++(wlandev->linux_stats.rx_errors);
3795                 action = ABORT;
3796                 break;
3797
3798         case -EOVERFLOW:
3799                 ++(wlandev->linux_stats.rx_over_errors);
3800                 action = RESUBMIT;
3801                 break;
3802
3803         case -ENODEV:
3804         case -ESHUTDOWN:
3805                 WLAN_LOG_DEBUG(3,"status=%d, device removed.\n", urb->status);
3806                 action = ABORT;
3807                 break;
3808
3809         case -ENOENT:
3810         case -ECONNRESET:
3811                 WLAN_LOG_DEBUG(3,"status=%d, urb explicitly unlinked.\n", urb->status);
3812                 action = ABORT;
3813                 break;
3814
3815         default:
3816                 WLAN_LOG_DEBUG(3,"urb status=%d, transfer flags=0x%x\n",
3817                                  urb->status, urb->transfer_flags);
3818                 ++(wlandev->linux_stats.rx_errors);
3819                 action = RESUBMIT;
3820                 break;
3821         }
3822
3823         urb_status = urb->status;
3824
3825         if (action != ABORT) {
3826                 /* Repost the RX URB */
3827                 result = submit_rx_urb(hw, GFP_ATOMIC);
3828
3829                 if (result != 0) {
3830                         WLAN_LOG_ERROR(
3831                                 "Fatal, failed to resubmit rx_urb. error=%d\n",
3832                                 result);
3833                 }
3834         }
3835
3836         /* Handle any USB-IN packet */
3837         /* Note: the check of the sw_support field, the type field doesn't
3838          *       have bit 12 set like the docs suggest.
3839          */
3840         type = hfa384x2host_16(usbin->type);
3841         if (HFA384x_USB_ISRXFRM(type)) {
3842                 if (action == HANDLE) {
3843                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3844                                 hfa384x_usbin_txcompl(wlandev, usbin);
3845                         } else {
3846                                 skb_put(skb, sizeof(*usbin));
3847                                 hfa384x_usbin_rx(wlandev, skb);
3848                                 skb = NULL;
3849                         }
3850                 }
3851                 goto exit;
3852         }
3853         if (HFA384x_USB_ISTXFRM(type)) {
3854                 if (action == HANDLE)
3855                         hfa384x_usbin_txcompl(wlandev, usbin);
3856                 goto exit;
3857         }
3858         switch (type) {
3859         case HFA384x_USB_INFOFRM:
3860                 if (action == ABORT)
3861                         goto exit;
3862                 if (action == HANDLE)
3863                         hfa384x_usbin_info(wlandev, usbin);
3864                 break;
3865
3866         case HFA384x_USB_CMDRESP:
3867         case HFA384x_USB_WRIDRESP:
3868         case HFA384x_USB_RRIDRESP:
3869         case HFA384x_USB_WMEMRESP:
3870         case HFA384x_USB_RMEMRESP:
3871                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3872                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3873                 break;
3874
3875         case HFA384x_USB_BUFAVAIL:
3876                 WLAN_LOG_DEBUG(3,"Received BUFAVAIL packet, frmlen=%d\n",
3877                         usbin->bufavail.frmlen);
3878                 break;
3879
3880         case HFA384x_USB_ERROR:
3881                 WLAN_LOG_DEBUG(3,"Received USB_ERROR packet, errortype=%d\n",
3882                         usbin->usberror.errortype);
3883                 break;
3884
3885         default:
3886                 WLAN_LOG_DEBUG(3,"Unrecognized USBIN packet, type=%x, status=%d\n",
3887                         usbin->type, urb_status);
3888                 break;
3889         } /* switch */
3890
3891 exit:
3892
3893         if (skb)
3894                 dev_kfree_skb(skb);
3895
3896         DBFEXIT;
3897 }
3898
3899
3900 /*----------------------------------------------------------------
3901 * hfa384x_usbin_ctlx
3902 *
3903 * We've received a URB containing a Prism2 "response" message.
3904 * This message needs to be matched up with a CTLX on the active
3905 * queue and our state updated accordingly.
3906 *
3907 * Arguments:
3908 *       hw              ptr to hfa384x_t
3909 *       usbin           ptr to USB IN packet
3910 *       urb_status      status of this Bulk-In URB
3911 *
3912 * Returns:
3913 *       nothing
3914 *
3915 * Side effects:
3916 *
3917 * Call context:
3918 *       interrupt
3919 ----------------------------------------------------------------*/
3920 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3921                                int urb_status)
3922 {
3923         hfa384x_usbctlx_t       *ctlx;
3924         int                     run_queue = 0;
3925         unsigned long           flags;
3926
3927         DBFENTER;
3928
3929 retry:
3930         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3931
3932         /* There can be only one CTLX on the active queue
3933          * at any one time, and this is the CTLX that the
3934          * timers are waiting for.
3935          */
3936         if ( list_empty(&hw->ctlxq.active) ) {
3937                 goto unlock;
3938         }
3939
3940         /* Remove the "response timeout". It's possible that
3941          * we are already too late, and that the timeout is
3942          * already running. And that's just too bad for us,
3943          * because we could lose our CTLX from the active
3944          * queue here ...
3945          */
3946         if (del_timer(&hw->resptimer) == 0) {
3947                 if (hw->resp_timer_done == 0) {
3948                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3949                         goto retry;
3950                 }
3951         }
3952         else {
3953                 hw->resp_timer_done = 1;
3954         }
3955
3956         ctlx = get_active_ctlx(hw);
3957
3958         if (urb_status != 0) {
3959                 /*
3960                  * Bad CTLX, so get rid of it. But we only
3961                  * remove it from the active queue if we're no
3962                  * longer expecting the OUT URB to complete.
3963                  */
3964                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3965                         run_queue = 1;
3966         } else {
3967                 const UINT16 intype = (usbin->type&~host2hfa384x_16(0x8000));
3968
3969                 /*
3970                  * Check that our message is what we're expecting ...
3971                  */
3972                 if (ctlx->outbuf.type != intype) {
3973                         WLAN_LOG_WARNING("Expected IN[%d], received IN[%d] - ignored.\n",
3974                                          hfa384x2host_16(ctlx->outbuf.type),
3975                                          hfa384x2host_16(intype));
3976                         goto unlock;
3977                 }
3978
3979                 /* This URB has succeeded, so grab the data ... */
3980                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3981
3982                 switch (ctlx->state) {
3983                 case CTLX_REQ_SUBMITTED:
3984                         /*
3985                          * We have received our response URB before
3986                          * our request has been acknowledged. Odd,
3987                          * but our OUT URB is still alive...
3988                          */
3989                         WLAN_LOG_DEBUG(0, "Causality violation: please reboot Universe, or email linux-wlan-devel@lists.linux-wlan.com\n");
3990                         ctlx->state = CTLX_RESP_COMPLETE;
3991                         break;
3992
3993                 case CTLX_REQ_COMPLETE:
3994                         /*
3995                          * This is the usual path: our request
3996                          * has already been acknowledged, and
3997                          * now we have received the reply too.
3998                          */
3999                         ctlx->state = CTLX_COMPLETE;
4000                         unlocked_usbctlx_complete(hw, ctlx);
4001                         run_queue = 1;
4002                         break;
4003
4004                 default:
4005                         /*
4006                          * Throw this CTLX away ...
4007                          */
4008                         WLAN_LOG_ERROR("Matched IN URB, CTLX[%d] in invalid state(%s)."
4009                                        " Discarded.\n",
4010                                        hfa384x2host_16(ctlx->outbuf.type),
4011                                        ctlxstr(ctlx->state));
4012                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
4013                                 run_queue = 1;
4014                         break;
4015                 } /* switch */
4016         }
4017
4018 unlock:
4019         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4020
4021         if (run_queue)
4022                 hfa384x_usbctlxq_run(hw);
4023
4024         DBFEXIT;
4025 }
4026
4027
4028 /*----------------------------------------------------------------
4029 * hfa384x_usbin_txcompl
4030 *
4031 * At this point we have the results of a previous transmit.
4032 *
4033 * Arguments:
4034 *       wlandev         wlan device
4035 *       usbin           ptr to the usb transfer buffer
4036 *
4037 * Returns:
4038 *       nothing
4039 *
4040 * Side effects:
4041 *
4042 * Call context:
4043 *       interrupt
4044 ----------------------------------------------------------------*/
4045 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4046 {
4047         UINT16                  status;
4048         DBFENTER;
4049
4050         status = hfa384x2host_16(usbin->type); /* yeah I know it says type...*/
4051
4052         /* Was there an error? */
4053         if (HFA384x_TXSTATUS_ISERROR(status)) {
4054                 prism2sta_ev_txexc(wlandev, status);
4055         } else {
4056                 prism2sta_ev_tx(wlandev, status);
4057         }
4058         // prism2sta_ev_alloc(wlandev);
4059
4060         DBFEXIT;
4061 }
4062
4063
4064 /*----------------------------------------------------------------
4065 * hfa384x_usbin_rx
4066 *
4067 * At this point we have a successful received a rx frame packet.
4068 *
4069 * Arguments:
4070 *       wlandev         wlan device
4071 *       usbin           ptr to the usb transfer buffer
4072 *
4073 * Returns:
4074 *       nothing
4075 *
4076 * Side effects:
4077 *
4078 * Call context:
4079 *       interrupt
4080 ----------------------------------------------------------------*/
4081 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
4082 {
4083         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) skb->data;
4084         hfa384x_t               *hw = wlandev->priv;
4085         int                     hdrlen;
4086         p80211_rxmeta_t         *rxmeta;
4087         UINT16                  data_len;
4088         UINT16                  fc;
4089
4090         DBFENTER;
4091
4092         /* Byte order convert once up front. */
4093         usbin->rxfrm.desc.status =
4094                 hfa384x2host_16(usbin->rxfrm.desc.status);
4095         usbin->rxfrm.desc.time =
4096                 hfa384x2host_32(usbin->rxfrm.desc.time);
4097
4098         /* Now handle frame based on port# */
4099         switch( HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) )
4100         {
4101         case 0:
4102                 fc = ieee2host16(usbin->rxfrm.desc.frame_control);
4103
4104                 /* If exclude and we receive an unencrypted, drop it */
4105                 if ( (wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
4106                      !WLAN_GET_FC_ISWEP(fc)){
4107                         goto done;
4108                 }
4109
4110                 data_len = hfa384x2host_16(usbin->rxfrm.desc.data_len);
4111
4112                 /* How much header data do we have? */
4113                 hdrlen = p80211_headerlen(fc);
4114
4115                 /* Pull off the descriptor */
4116                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
4117
4118                 /* Now shunt the header block up against the data block
4119                  * with an "overlapping" copy
4120                  */
4121                 memmove(skb_push(skb, hdrlen),
4122                         &usbin->rxfrm.desc.frame_control,
4123                         hdrlen);
4124
4125                 skb->dev = wlandev->netdev;
4126                 skb->dev->last_rx = jiffies;
4127
4128                 /* And set the frame length properly */
4129                 skb_trim(skb, data_len + hdrlen);
4130
4131                 /* The prism2 series does not return the CRC */
4132                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
4133
4134                 skb_reset_mac_header(skb);
4135
4136                 /* Attach the rxmeta, set some stuff */
4137                 p80211skb_rxmeta_attach(wlandev, skb);
4138                 rxmeta = P80211SKB_RXMETA(skb);
4139                 rxmeta->mactime = usbin->rxfrm.desc.time;
4140                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
4141                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
4142                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
4143
4144                 prism2sta_ev_rx(wlandev, skb);
4145
4146                 break;
4147
4148         case 7:
4149                 if ( ! HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status) ) {
4150                         /* Copy to wlansnif skb */
4151                         hfa384x_int_rxmonitor( wlandev, &usbin->rxfrm);
4152                         dev_kfree_skb(skb);
4153                 } else {
4154                         WLAN_LOG_DEBUG(3,"Received monitor frame: FCSerr set\n");
4155                 }
4156                 break;
4157
4158         default:
4159                 WLAN_LOG_WARNING("Received frame on unsupported port=%d\n",
4160                         HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) );
4161                 goto done;
4162                 break;
4163         }
4164
4165 done:
4166         DBFEXIT;
4167         return;
4168 }
4169
4170 /*----------------------------------------------------------------
4171 * hfa384x_int_rxmonitor
4172 *
4173 * Helper function for int_rx.  Handles monitor frames.
4174 * Note that this function allocates space for the FCS and sets it
4175 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
4176 * higher layers expect it.  0xffffffff is used as a flag to indicate
4177 * the FCS is bogus.
4178 *
4179 * Arguments:
4180 *       wlandev         wlan device structure
4181 *       rxfrm           rx descriptor read from card in int_rx
4182 *
4183 * Returns:
4184 *       nothing
4185 *
4186 * Side effects:
4187 *       Allocates an skb and passes it up via the PF_PACKET interface.
4188 * Call context:
4189 *       interrupt
4190 ----------------------------------------------------------------*/
4191 static void hfa384x_int_rxmonitor( wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm)
4192 {
4193         hfa384x_rx_frame_t              *rxdesc = &(rxfrm->desc);
4194         UINT                            hdrlen = 0;
4195         UINT                            datalen = 0;
4196         UINT                            skblen = 0;
4197         p80211msg_lnxind_wlansniffrm_t  *msg;
4198         UINT8                           *datap;
4199         UINT16                          fc;
4200         struct sk_buff                  *skb;
4201         hfa384x_t                       *hw = wlandev->priv;
4202
4203
4204         DBFENTER;
4205         /* Don't forget the status, time, and data_len fields are in host order */
4206         /* Figure out how big the frame is */
4207         fc = ieee2host16(rxdesc->frame_control);
4208         hdrlen = p80211_headerlen(fc);
4209         datalen = hfa384x2host_16(rxdesc->data_len);
4210
4211         /* Allocate an ind message+framesize skb */
4212         skblen = sizeof(p80211msg_lnxind_wlansniffrm_t) +
4213                 hdrlen + datalen + WLAN_CRC_LEN;
4214
4215         /* sanity check the length */
4216         if ( skblen >
4217                 (sizeof(p80211msg_lnxind_wlansniffrm_t) +
4218                 WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN) ) {
4219                 WLAN_LOG_DEBUG(1, "overlen frm: len=%zd\n",
4220                         skblen - sizeof(p80211msg_lnxind_wlansniffrm_t));
4221         }
4222
4223         if ( (skb = dev_alloc_skb(skblen)) == NULL ) {
4224                 WLAN_LOG_ERROR("alloc_skb failed trying to allocate %d bytes\n", skblen);
4225                 return;
4226         }
4227
4228         /* only prepend the prism header if in the right mode */
4229         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4230             (hw->sniffhdr == 0)) {
4231                 datap = skb_put(skb, sizeof(p80211msg_lnxind_wlansniffrm_t));
4232                 msg = (p80211msg_lnxind_wlansniffrm_t*) datap;
4233
4234                 /* Initialize the message members */
4235                 msg->msgcode = DIDmsg_lnxind_wlansniffrm;
4236                 msg->msglen = sizeof(p80211msg_lnxind_wlansniffrm_t);
4237                 strcpy(msg->devname, wlandev->name);
4238
4239                 msg->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
4240                 msg->hosttime.status = 0;
4241                 msg->hosttime.len = 4;
4242                 msg->hosttime.data = jiffies;
4243
4244                 msg->mactime.did = DIDmsg_lnxind_wlansniffrm_mactime;
4245                 msg->mactime.status = 0;
4246                 msg->mactime.len = 4;
4247                 msg->mactime.data = rxdesc->time;
4248
4249                 msg->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
4250                 msg->channel.status = 0;
4251                 msg->channel.len = 4;
4252                 msg->channel.data = hw->sniff_channel;
4253
4254                 msg->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
4255                 msg->rssi.status = P80211ENUM_msgitem_status_no_value;
4256                 msg->rssi.len = 4;
4257                 msg->rssi.data = 0;
4258
4259                 msg->sq.did = DIDmsg_lnxind_wlansniffrm_sq;
4260                 msg->sq.status = P80211ENUM_msgitem_status_no_value;
4261                 msg->sq.len = 4;
4262                 msg->sq.data = 0;
4263
4264                 msg->signal.did = DIDmsg_lnxind_wlansniffrm_signal;
4265                 msg->signal.status = 0;
4266                 msg->signal.len = 4;
4267                 msg->signal.data = rxdesc->signal;
4268
4269                 msg->noise.did = DIDmsg_lnxind_wlansniffrm_noise;
4270                 msg->noise.status = 0;
4271                 msg->noise.len = 4;
4272                 msg->noise.data = rxdesc->silence;
4273
4274                 msg->rate.did = DIDmsg_lnxind_wlansniffrm_rate;
4275                 msg->rate.status = 0;
4276                 msg->rate.len = 4;
4277                 msg->rate.data = rxdesc->rate / 5; /* set to 802.11 units */
4278
4279                 msg->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
4280                 msg->istx.status = 0;
4281                 msg->istx.len = 4;
4282                 msg->istx.data = P80211ENUM_truth_false;
4283
4284                 msg->frmlen.did = DIDmsg_lnxind_wlansniffrm_frmlen;
4285                 msg->frmlen.status = 0;
4286                 msg->frmlen.len = 4;
4287                 msg->frmlen.data = hdrlen + datalen + WLAN_CRC_LEN;
4288         } else if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4289                    (hw->sniffhdr != 0)) {
4290                 p80211_caphdr_t         *caphdr;
4291                 /* The NEW header format! */
4292                 datap = skb_put(skb, sizeof(p80211_caphdr_t));
4293                 caphdr = (p80211_caphdr_t*) datap;
4294
4295                 caphdr->version =       htonl(P80211CAPTURE_VERSION);
4296                 caphdr->length =        htonl(sizeof(p80211_caphdr_t));
4297                 caphdr->mactime =       __cpu_to_be64(rxdesc->time) * 1000;
4298                 caphdr->hosttime =      __cpu_to_be64(jiffies);
4299                 caphdr->phytype =       htonl(4); /* dss_dot11_b */
4300                 caphdr->channel =       htonl(hw->sniff_channel);
4301                 caphdr->datarate =      htonl(rxdesc->rate);
4302                 caphdr->antenna =       htonl(0); /* unknown */
4303                 caphdr->priority =      htonl(0); /* unknown */
4304                 caphdr->ssi_type =      htonl(3); /* rssi_raw */
4305                 caphdr->ssi_signal =    htonl(rxdesc->signal);
4306                 caphdr->ssi_noise =     htonl(rxdesc->silence);
4307                 caphdr->preamble =      htonl(0); /* unknown */
4308                 caphdr->encoding =      htonl(1); /* cck */
4309         }
4310
4311         /* Copy the 802.11 header to the skb (ctl frames may be less than a full header) */
4312         datap = skb_put(skb, hdrlen);
4313         memcpy( datap, &(rxdesc->frame_control), hdrlen);
4314
4315         /* If any, copy the data from the card to the skb */
4316         if ( datalen > 0 )
4317         {
4318                 datap = skb_put(skb, datalen);
4319                 memcpy(datap, rxfrm->data, datalen);
4320
4321                 /* check for unencrypted stuff if WEP bit set. */
4322                 if (*(datap - hdrlen + 1) & 0x40) // wep set
4323                   if ((*(datap) == 0xaa) && (*(datap+1) == 0xaa))
4324                     *(datap - hdrlen + 1) &= 0xbf; // clear wep; it's the 802.2 header!
4325         }
4326
4327         if (hw->sniff_fcs) {
4328                 /* Set the FCS */
4329                 datap = skb_put(skb, WLAN_CRC_LEN);
4330                 memset( datap, 0xff, WLAN_CRC_LEN);
4331         }
4332
4333         /* pass it back up */
4334         prism2sta_ev_rx(wlandev, skb);
4335
4336         DBFEXIT;
4337         return;
4338 }
4339
4340
4341
4342 /*----------------------------------------------------------------
4343 * hfa384x_usbin_info
4344 *
4345 * At this point we have a successful received a Prism2 info frame.
4346 *
4347 * Arguments:
4348 *       wlandev         wlan device
4349 *       usbin           ptr to the usb transfer buffer
4350 *
4351 * Returns:
4352 *       nothing
4353 *
4354 * Side effects:
4355 *
4356 * Call context:
4357 *       interrupt
4358 ----------------------------------------------------------------*/
4359 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4360 {
4361         DBFENTER;
4362
4363         usbin->infofrm.info.framelen = hfa384x2host_16(usbin->infofrm.info.framelen);
4364         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
4365
4366         DBFEXIT;
4367 }
4368
4369
4370
4371 /*----------------------------------------------------------------
4372 * hfa384x_usbout_callback
4373 *
4374 * Callback for URBs on the BULKOUT endpoint.
4375 *
4376 * Arguments:
4377 *       urb             ptr to the completed urb
4378 *
4379 * Returns:
4380 *       nothing
4381 *
4382 * Side effects:
4383 *
4384 * Call context:
4385 *       interrupt
4386 ----------------------------------------------------------------*/
4387 #ifdef URB_ONLY_CALLBACK
4388 static void hfa384x_usbout_callback(struct urb *urb)
4389 #else
4390 static void hfa384x_usbout_callback(struct urb *urb, struct pt_regs *regs)
4391 #endif
4392 {
4393         wlandevice_t            *wlandev = urb->context;
4394         hfa384x_usbout_t        *usbout = urb->transfer_buffer;
4395         DBFENTER;
4396
4397 #ifdef DEBUG_USB
4398         dbprint_urb(urb);
4399 #endif
4400
4401         if ( wlandev &&
4402              wlandev->netdev ) {
4403
4404                 switch(urb->status) {
4405                 case 0:
4406                         hfa384x_usbout_tx(wlandev, usbout);
4407                         break;
4408
4409                 case -EPIPE:
4410                 {
4411                         hfa384x_t *hw = wlandev->priv;
4412                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4413                                          wlandev->netdev->name);
4414                         if ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) )
4415                                 schedule_work(&hw->usb_work);
4416                         ++(wlandev->linux_stats.tx_errors);
4417                         break;
4418                 }
4419
4420                 case -EPROTO:
4421                 case -ETIMEDOUT:
4422                 case -EILSEQ:
4423                 {
4424                         hfa384x_t *hw = wlandev->priv;
4425
4426                         if ( !test_and_set_bit(THROTTLE_TX, &hw->usb_flags)
4427                              && !timer_pending(&hw->throttle) ) {
4428                                 mod_timer(&hw->throttle,
4429                                           jiffies + THROTTLE_JIFFIES);
4430                         }
4431                         ++(wlandev->linux_stats.tx_errors);
4432                         netif_stop_queue(wlandev->netdev);
4433                         break;
4434                 }
4435
4436                 case -ENOENT:
4437                 case -ESHUTDOWN:
4438                         /* Ignorable errors */
4439                         break;
4440
4441                 default:
4442                         WLAN_LOG_INFO("unknown urb->status=%d\n", urb->status);
4443                         ++(wlandev->linux_stats.tx_errors);
4444                         break;
4445                 } /* switch */
4446         }
4447
4448         DBFEXIT;
4449 }
4450
4451
4452 /*----------------------------------------------------------------
4453 * hfa384x_ctlxout_callback
4454 *
4455 * Callback for control data on the BULKOUT endpoint.
4456 *
4457 * Arguments:
4458 *       urb             ptr to the completed urb
4459 *
4460 * Returns:
4461 * nothing
4462 *
4463 * Side effects:
4464 *
4465 * Call context:
4466 * interrupt
4467 ----------------------------------------------------------------*/
4468 #ifdef URB_ONLY_CALLBACK
4469 static void hfa384x_ctlxout_callback(struct urb *urb)
4470 #else
4471 static void hfa384x_ctlxout_callback(struct urb *urb, struct pt_regs *regs)
4472 #endif
4473 {
4474         hfa384x_t       *hw = urb->context;
4475         int             delete_resptimer = 0;
4476         int             timer_ok = 1;
4477         int             run_queue = 0;
4478         hfa384x_usbctlx_t       *ctlx;
4479         unsigned long   flags;
4480
4481         DBFENTER;
4482
4483         WLAN_LOG_DEBUG(3,"urb->status=%d\n", urb->status);
4484 #ifdef DEBUG_USB
4485         dbprint_urb(urb);
4486 #endif
4487         if ( (urb->status == -ESHUTDOWN) ||
4488              (urb->status == -ENODEV) ||
4489              (hw == NULL) )
4490                 goto done;
4491
4492 retry:
4493         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4494
4495         /*
4496          * Only one CTLX at a time on the "active" list, and
4497          * none at all if we are unplugged. However, we can
4498          * rely on the disconnect function to clean everything
4499          * up if someone unplugged the adapter.
4500          */
4501         if ( list_empty(&hw->ctlxq.active) ) {
4502                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4503                 goto done;
4504         }
4505
4506         /*
4507          * Having something on the "active" queue means
4508          * that we have timers to worry about ...
4509          */
4510         if (del_timer(&hw->reqtimer) == 0) {
4511                 if (hw->req_timer_done == 0) {
4512                         /*
4513                          * This timer was actually running while we
4514                          * were trying to delete it. Let it terminate
4515                          * gracefully instead.
4516                          */
4517                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4518                         goto retry;
4519                 }
4520         }
4521         else {
4522                 hw->req_timer_done = 1;
4523         }
4524
4525         ctlx = get_active_ctlx(hw);
4526
4527         if ( urb->status == 0 ) {
4528                 /* Request portion of a CTLX is successful */
4529                 switch ( ctlx->state ) {
4530                 case CTLX_REQ_SUBMITTED:
4531                         /* This OUT-ACK received before IN */
4532                         ctlx->state = CTLX_REQ_COMPLETE;
4533                         break;
4534
4535                 case CTLX_RESP_COMPLETE:
4536                         /* IN already received before this OUT-ACK,
4537                          * so this command must now be complete.
4538                          */
4539                         ctlx->state = CTLX_COMPLETE;
4540                         unlocked_usbctlx_complete(hw, ctlx);
4541                         run_queue = 1;
4542                         break;
4543
4544                 default:
4545                         /* This is NOT a valid CTLX "success" state! */
4546                         WLAN_LOG_ERROR(
4547                             "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
4548                             hfa384x2host_16(ctlx->outbuf.type),
4549                             ctlxstr(ctlx->state), urb->status);
4550                         break;
4551                 } /* switch */
4552         } else {
4553                 /* If the pipe has stalled then we need to reset it */
4554                 if ( (urb->status == -EPIPE) &&
4555                       !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) ) {
4556                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4557                                          hw->wlandev->netdev->name);
4558                         schedule_work(&hw->usb_work);
4559                 }
4560
4561                 /* If someone cancels the OUT URB then its status
4562                  * should be either -ECONNRESET or -ENOENT.
4563                  */
4564                 ctlx->state = CTLX_REQ_FAILED;
4565                 unlocked_usbctlx_complete(hw, ctlx);
4566                 delete_resptimer = 1;
4567                 run_queue = 1;
4568         }
4569
4570  delresp:
4571         if (delete_resptimer) {
4572                 if ((timer_ok = del_timer(&hw->resptimer)) != 0) {
4573                         hw->resp_timer_done = 1;
4574                 }
4575         }
4576
4577         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4578
4579         if ( !timer_ok && (hw->resp_timer_done == 0) ) {
4580                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
4581                 goto delresp;
4582         }
4583
4584         if (run_queue)
4585                 hfa384x_usbctlxq_run(hw);
4586
4587  done:
4588         DBFEXIT;
4589 }
4590
4591
4592 /*----------------------------------------------------------------
4593 * hfa384x_usbctlx_reqtimerfn
4594 *
4595 * Timer response function for CTLX request timeouts.  If this
4596 * function is called, it means that the callback for the OUT
4597 * URB containing a Prism2.x XXX_Request was never called.
4598 *
4599 * Arguments:
4600 *       data            a ptr to the hfa384x_t
4601 *
4602 * Returns:
4603 *       nothing
4604 *
4605 * Side effects:
4606 *
4607 * Call context:
4608 *       interrupt
4609 ----------------------------------------------------------------*/
4610 static void
4611 hfa384x_usbctlx_reqtimerfn(unsigned long data)
4612 {
4613         hfa384x_t       *hw = (hfa384x_t*)data;
4614         unsigned long   flags;
4615         DBFENTER;
4616
4617         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4618
4619         hw->req_timer_done = 1;
4620
4621         /* Removing the hardware automatically empties
4622          * the active list ...
4623          */
4624         if ( !list_empty(&hw->ctlxq.active) )
4625         {
4626                 /*
4627                  * We must ensure that our URB is removed from
4628                  * the system, if it hasn't already expired.
4629                  */
4630                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
4631                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS)
4632                 {
4633                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4634
4635                         ctlx->state = CTLX_REQ_FAILED;
4636
4637                         /* This URB was active, but has now been
4638                          * cancelled. It will now have a status of
4639                          * -ECONNRESET in the callback function.
4640                          *
4641                          * We are cancelling this CTLX, so we're
4642                          * not going to need to wait for a response.
4643                          * The URB's callback function will check
4644                          * that this timer is truly dead.
4645                          */
4646                         if (del_timer(&hw->resptimer) != 0)
4647                                 hw->resp_timer_done = 1;
4648                 }
4649         }
4650
4651         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4652
4653         DBFEXIT;
4654 }
4655
4656
4657 /*----------------------------------------------------------------
4658 * hfa384x_usbctlx_resptimerfn
4659 *
4660 * Timer response function for CTLX response timeouts.  If this
4661 * function is called, it means that the callback for the IN
4662 * URB containing a Prism2.x XXX_Response was never called.
4663 *
4664 * Arguments:
4665 *       data            a ptr to the hfa384x_t
4666 *
4667 * Returns:
4668 *       nothing
4669 *
4670 * Side effects:
4671 *
4672 * Call context:
4673 *       interrupt
4674 ----------------------------------------------------------------*/
4675 static void
4676 hfa384x_usbctlx_resptimerfn(unsigned long data)
4677 {
4678         hfa384x_t *hw = (hfa384x_t*)data;
4679         unsigned long   flags;
4680
4681         DBFENTER;
4682
4683         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4684
4685         hw->resp_timer_done = 1;
4686
4687         /* The active list will be empty if the
4688          * adapter has been unplugged ...
4689          */
4690         if ( !list_empty(&hw->ctlxq.active) )
4691         {
4692                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4693
4694                 if ( unlocked_usbctlx_cancel_async(hw, ctlx) == 0 )
4695                 {
4696                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4697                         hfa384x_usbctlxq_run(hw);
4698                         goto done;
4699                 }
4700         }
4701
4702         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4703
4704  done:
4705         DBFEXIT;
4706 }
4707
4708 /*----------------------------------------------------------------
4709 * hfa384x_usb_throttlefn
4710 *
4711 *
4712 * Arguments:
4713 *       data    ptr to hw
4714 *
4715 * Returns:
4716 *       Nothing
4717 *
4718 * Side effects:
4719 *
4720 * Call context:
4721 *       Interrupt
4722 ----------------------------------------------------------------*/
4723 static void
4724 hfa384x_usb_throttlefn(unsigned long data)
4725 {
4726         hfa384x_t *hw = (hfa384x_t*)data;
4727         unsigned long   flags;
4728
4729         DBFENTER;
4730
4731         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4732
4733         /*
4734          * We need to check BOTH the RX and the TX throttle controls,
4735          * so we use the bitwise OR instead of the logical OR.
4736          */
4737         WLAN_LOG_DEBUG(3, "flags=0x%lx\n", hw->usb_flags);
4738         if ( !hw->wlandev->hwremoved &&
4739              (
4740                (test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4741                !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4742                |
4743                (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4744                 !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4745              ) )
4746         {
4747                 schedule_work(&hw->usb_work);
4748         }
4749
4750         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4751
4752         DBFEXIT;
4753 }
4754
4755
4756 /*----------------------------------------------------------------
4757 * hfa384x_usbctlx_submit
4758 *
4759 * Called from the doxxx functions to submit a CTLX to the queue
4760 *
4761 * Arguments:
4762 *       hw              ptr to the hw struct
4763 *       ctlx            ctlx structure to enqueue
4764 *
4765 * Returns:
4766 *       -ENODEV if the adapter is unplugged
4767 *       0
4768 *
4769 * Side effects:
4770 *
4771 * Call context:
4772 *       process or interrupt
4773 ----------------------------------------------------------------*/
4774 static int
4775 hfa384x_usbctlx_submit(
4776         hfa384x_t               *hw,
4777         hfa384x_usbctlx_t       *ctlx)
4778 {
4779         unsigned long flags;
4780         int ret;
4781
4782         DBFENTER;
4783
4784         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4785
4786         if (hw->wlandev->hwremoved) {
4787                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4788                 ret = -ENODEV;
4789         } else {
4790                 ctlx->state = CTLX_PENDING;
4791                 list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4792
4793                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4794                 hfa384x_usbctlxq_run(hw);
4795                 ret = 0;
4796         }
4797
4798         DBFEXIT;
4799         return ret;
4800 }
4801
4802
4803 /*----------------------------------------------------------------
4804 * hfa384x_usbout_tx
4805 *
4806 * At this point we have finished a send of a frame.  Mark the URB
4807 * as available and call ev_alloc to notify higher layers we're
4808 * ready for more.
4809 *
4810 * Arguments:
4811 *       wlandev         wlan device
4812 *       usbout          ptr to the usb transfer buffer
4813 *
4814 * Returns:
4815 *       nothing
4816 *
4817 * Side effects:
4818 *
4819 * Call context:
4820 *       interrupt
4821 ----------------------------------------------------------------*/
4822 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4823 {
4824         DBFENTER;
4825
4826         prism2sta_ev_alloc(wlandev);
4827
4828         DBFEXIT;
4829 }
4830
4831 /*----------------------------------------------------------------
4832 * hfa384x_isgood_pdrcore
4833 *
4834 * Quick check of PDR codes.
4835 *
4836 * Arguments:
4837 *       pdrcode         PDR code number (host order)
4838 *
4839 * Returns:
4840 *       zero            not good.
4841 *       one             is good.
4842 *
4843 * Side effects:
4844 *
4845 * Call context:
4846 ----------------------------------------------------------------*/
4847 static int
4848 hfa384x_isgood_pdrcode(UINT16 pdrcode)
4849 {
4850         switch(pdrcode) {
4851         case HFA384x_PDR_END_OF_PDA:
4852         case HFA384x_PDR_PCB_PARTNUM:
4853         case HFA384x_PDR_PDAVER:
4854         case HFA384x_PDR_NIC_SERIAL:
4855         case HFA384x_PDR_MKK_MEASUREMENTS:
4856         case HFA384x_PDR_NIC_RAMSIZE:
4857         case HFA384x_PDR_MFISUPRANGE:
4858         case HFA384x_PDR_CFISUPRANGE:
4859         case HFA384x_PDR_NICID:
4860         case HFA384x_PDR_MAC_ADDRESS:
4861         case HFA384x_PDR_REGDOMAIN:
4862         case HFA384x_PDR_ALLOWED_CHANNEL:
4863         case HFA384x_PDR_DEFAULT_CHANNEL:
4864         case HFA384x_PDR_TEMPTYPE:
4865         case HFA384x_PDR_IFR_SETTING:
4866         case HFA384x_PDR_RFR_SETTING:
4867         case HFA384x_PDR_HFA3861_BASELINE:
4868         case HFA384x_PDR_HFA3861_SHADOW:
4869         case HFA384x_PDR_HFA3861_IFRF:
4870         case HFA384x_PDR_HFA3861_CHCALSP:
4871         case HFA384x_PDR_HFA3861_CHCALI:
4872         case HFA384x_PDR_3842_NIC_CONFIG:
4873         case HFA384x_PDR_USB_ID:
4874         case HFA384x_PDR_PCI_ID:
4875         case HFA384x_PDR_PCI_IFCONF:
4876         case HFA384x_PDR_PCI_PMCONF:
4877         case HFA384x_PDR_RFENRGY:
4878         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4879         case HFA384x_PDR_HFA3861_MANF_TESTI:
4880                 /* code is OK */
4881                 return 1;
4882                 break;
4883         default:
4884                 if ( pdrcode < 0x1000 ) {
4885                         /* code is OK, but we don't know exactly what it is */
4886                         WLAN_LOG_DEBUG(3,
4887                                 "Encountered unknown PDR#=0x%04x, "
4888                                 "assuming it's ok.\n",
4889                                 pdrcode);
4890                         return 1;
4891                 } else {
4892                         /* bad code */
4893                         WLAN_LOG_DEBUG(3,
4894                                 "Encountered unknown PDR#=0x%04x, "
4895                                 "(>=0x1000), assuming it's bad.\n",
4896                                 pdrcode);
4897                         return 0;
4898                 }
4899                 break;
4900         }
4901         return 0; /* avoid compiler warnings */
4902 }
4903