drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invokations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They  call copy_[to|from]_bap() and
  66 *                       cmd_access().   These functions operate on the
  67 *                       RIDs and buffers without validation.  The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 /*================================================================*/
 114 /* System Includes */
 115 #define WLAN_DBVAR      prism2_debug
 116
 117 #include <linux/version.h>
 118
 119 #include <linux/module.h>
 120 #include <linux/kernel.h>
 121 #include <linux/sched.h>
 122 #include <linux/types.h>
 123 #include <linux/slab.h>
 124 #include <linux/wireless.h>
 125 #include <linux/netdevice.h>
 126 #include <linux/timer.h>
 127 #include <asm/io.h>
 128 #include <linux/delay.h>
 129 #include <asm/byteorder.h>
 130 #include <asm/bitops.h>
 131 #include <linux/list.h>
 132 #include <linux/usb.h>
 133
 134 #include "wlan_compat.h"
 135
 136 #define SUBMIT_URB(u,f)  usb_submit_urb(u,f)
 137
 138 /*================================================================*/
 139 /* Project Includes */
 140
 141 #include "p80211types.h"
 142 #include "p80211hdr.h"
 143 #include "p80211mgmt.h"
 144 #include "p80211conv.h"
 145 #include "p80211msg.h"
 146 #include "p80211netdev.h"
 147 #include "p80211req.h"
 148 #include "p80211metadef.h"
 149 #include "p80211metastruct.h"
 150 #include "hfa384x.h"
 151 #include "prism2mgmt.h"
 152
 153 /*================================================================*/
 154 /* Local Constants */
 155
 156 enum cmd_mode
 157 {
 158   DOWAIT = 0,
 159   DOASYNC
 160 };
 161 typedef enum cmd_mode CMD_MODE;
 162
 163 #define THROTTLE_JIFFIES        (HZ/8)
 164
 165 /*================================================================*/
 166 /* Local Macros */
 167
 168 #define ROUNDUP64(a) (((a)+63)&~63)
 169
 170 /*================================================================*/
 171 /* Local Types */
 172
 173 /*================================================================*/
 174 /* Local Static Definitions */
 175 extern int prism2_debug;
 176
 177 /*================================================================*/
 178 /* Local Function Declarations */
 179
 180 #ifdef DEBUG_USB
 181 static void
 182 dbprint_urb(struct urb* urb);
 183 #endif
 184
 185 static void
 186 hfa384x_int_rxmonitor(
 187         wlandevice_t *wlandev,
 188         hfa384x_usb_rxfrm_t *rxfrm);
 189
 190 static void
 191 hfa384x_usb_defer(struct work_struct *data);
 192
 193 static int
 194 submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 195
 196 static int
 197 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 198
 199 /*---------------------------------------------------*/
 200 /* Callbacks */
 201 static void
 202 hfa384x_usbout_callback(struct urb *urb);
 203 static void
 204 hfa384x_ctlxout_callback(struct urb *urb);
 205 static void
 206 hfa384x_usbin_callback(struct urb *urb);
 207
 208 static void
 209 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 210
 211 static void
 212 hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 213
 214 static void
 215 hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 216
 217 static void
 218 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 219
 220 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 221                                int urb_status);
 222
 223 /*---------------------------------------------------*/
 224 /* Functions to support the prism2 usb command queue */
 225
 226 static void
 227 hfa384x_usbctlxq_run(hfa384x_t *hw);
 228
 229 static void
 230 hfa384x_usbctlx_reqtimerfn(unsigned long data);
 231
 232 static void
 233 hfa384x_usbctlx_resptimerfn(unsigned long data);
 234
 235 static void
 236 hfa384x_usb_throttlefn(unsigned long data);
 237
 238 static void
 239 hfa384x_usbctlx_completion_task(unsigned long data);
 240
 241 static void
 242 hfa384x_usbctlx_reaper_task(unsigned long data);
 243
 244 static int
 245 hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 246
 247 static void
 248 unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 249
 250 struct usbctlx_completor
 251 {
 252         int (*complete)(struct usbctlx_completor*);
 253 };
 254 typedef struct usbctlx_completor usbctlx_completor_t;
 255
 256 static int
 257 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 258                               hfa384x_usbctlx_t *ctlx,
 259                               usbctlx_completor_t *completor);
 260
 261 static int
 262 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 263
 264 static void
 265 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 266
 267 static void
 268 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 269
 270 static int
 271 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 272                    hfa384x_cmdresult_t *result);
 273
 274 static void
 275 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 276                        hfa384x_rridresult_t *result);
 277
 278 /*---------------------------------------------------*/
 279 /* Low level req/resp CTLX formatters and submitters */
 280 static int
 281 hfa384x_docmd(
 282         hfa384x_t *hw,
 283         CMD_MODE mode,
 284         hfa384x_metacmd_t *cmd,
 285         ctlx_cmdcb_t cmdcb,
 286         ctlx_usercb_t usercb,
 287         void    *usercb_data);
 288
 289 static int
 290 hfa384x_dorrid(
 291         hfa384x_t *hw,
 292         CMD_MODE mode,
 293         u16     rid,
 294         void    *riddata,
 295         unsigned int    riddatalen,
 296         ctlx_cmdcb_t cmdcb,
 297         ctlx_usercb_t usercb,
 298         void    *usercb_data);
 299
 300 static int
 301 hfa384x_dowrid(
 302         hfa384x_t *hw,
 303         CMD_MODE mode,
 304         u16     rid,
 305         void    *riddata,
 306         unsigned int    riddatalen,
 307         ctlx_cmdcb_t cmdcb,
 308         ctlx_usercb_t usercb,
 309         void    *usercb_data);
 310
 311 static int
 312 hfa384x_dormem(
 313         hfa384x_t *hw,
 314         CMD_MODE mode,
 315         u16     page,
 316         u16     offset,
 317         void    *data,
 318         unsigned int    len,
 319         ctlx_cmdcb_t cmdcb,
 320         ctlx_usercb_t usercb,
 321         void    *usercb_data);
 322
 323 static int
 324 hfa384x_dowmem(
 325         hfa384x_t *hw,
 326         CMD_MODE mode,
 327         u16     page,
 328         u16     offset,
 329         void    *data,
 330         unsigned int    len,
 331         ctlx_cmdcb_t cmdcb,
 332         ctlx_usercb_t usercb,
 333         void    *usercb_data);
 334
 335 static int
 336 hfa384x_isgood_pdrcode(u16 pdrcode);
 337
 338 /*================================================================*/
 339 /* Function Definitions */
 340 static inline const char* ctlxstr(CTLX_STATE s)
 341 {
 342         static const char* ctlx_str[] = {
 343                 "Initial state",
 344                 "Complete",
 345                 "Request failed",
 346                 "Request pending",
 347                 "Request packet submitted",
 348                 "Request packet completed",
 349                 "Response packet completed"
 350         };
 351
 352         return ctlx_str[s];
 353 };
 354
 355
 356 static inline hfa384x_usbctlx_t*
 357 get_active_ctlx(hfa384x_t *hw)
 358 {
 359         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 360 }
 361
 362
 363 #ifdef DEBUG_USB
 364 void
 365 dbprint_urb(struct urb* urb)
 366 {
 367         WLAN_LOG_DEBUG(3,"urb->pipe=0x%08x\n", urb->pipe);
 368         WLAN_LOG_DEBUG(3,"urb->status=0x%08x\n", urb->status);
 369         WLAN_LOG_DEBUG(3,"urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 370         WLAN_LOG_DEBUG(3,"urb->transfer_buffer=0x%08x\n", (unsigned int)urb->transfer_buffer);
 371         WLAN_LOG_DEBUG(3,"urb->transfer_buffer_length=0x%08x\n", urb->transfer_buffer_length);
 372         WLAN_LOG_DEBUG(3,"urb->actual_length=0x%08x\n", urb->actual_length);
 373         WLAN_LOG_DEBUG(3,"urb->bandwidth=0x%08x\n", urb->bandwidth);
 374         WLAN_LOG_DEBUG(3,"urb->setup_packet(ctl)=0x%08x\n", (unsigned int)urb->setup_packet);
 375         WLAN_LOG_DEBUG(3,"urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 376         WLAN_LOG_DEBUG(3,"urb->interval(irq)=0x%08x\n", urb->interval);
 377         WLAN_LOG_DEBUG(3,"urb->error_count(iso)=0x%08x\n", urb->error_count);
 378         WLAN_LOG_DEBUG(3,"urb->timeout=0x%08x\n", urb->timeout);
 379         WLAN_LOG_DEBUG(3,"urb->context=0x%08x\n", (unsigned int)urb->context);
 380         WLAN_LOG_DEBUG(3,"urb->complete=0x%08x\n", (unsigned int)urb->complete);
 381 }
 382 #endif
 383
 384
 385 /*----------------------------------------------------------------
 386 * submit_rx_urb
 387 *
 388 * Listen for input data on the BULK-IN pipe. If the pipe has
 389 * stalled then schedule it to be reset.
 390 *
 391 * Arguments:
 392 *       hw              device struct
 393 *       memflags        memory allocation flags
 394 *
 395 * Returns:
 396 *       error code from submission
 397 *
 398 * Call context:
 399 *       Any
 400 ----------------------------------------------------------------*/
 401 static int
 402 submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 403 {
 404         struct sk_buff *skb;
 405         int result;
 406
 407         DBFENTER;
 408
 409         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 410         if (skb == NULL) {
 411                 result = -ENOMEM;
 412                 goto done;
 413         }
 414
 415         /* Post the IN urb */
 416         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 417                       hw->endp_in,
 418                       skb->data, sizeof(hfa384x_usbin_t),
 419                       hfa384x_usbin_callback, hw->wlandev);
 420
 421         hw->rx_urb_skb = skb;
 422
 423         result = -ENOLINK;
 424         if ( !hw->wlandev->hwremoved && !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 425                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 426
 427                 /* Check whether we need to reset the RX pipe */
 428                 if (result == -EPIPE) {
 429                         WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
 430                                          hw->wlandev->netdev->name);
 431                         if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
 432                                 schedule_work(&hw->usb_work);
 433                 }
 434         }
 435
 436         /* Don't leak memory if anything should go wrong */
 437         if (result != 0) {
 438                 dev_kfree_skb(skb);
 439                 hw->rx_urb_skb = NULL;
 440         }
 441
 442  done:
 443
 444         DBFEXIT;
 445         return result;
 446 }
 447
 448 /*----------------------------------------------------------------
 449 * submit_tx_urb
 450 *
 451 * Prepares and submits the URB of transmitted data. If the
 452 * submission fails then it will schedule the output pipe to
 453 * be reset.
 454 *
 455 * Arguments:
 456 *       hw              device struct
 457 *       tx_urb          URB of data for tranmission
 458 *       memflags        memory allocation flags
 459 *
 460 * Returns:
 461 *       error code from submission
 462 *
 463 * Call context:
 464 *       Any
 465 ----------------------------------------------------------------*/
 466 static int
 467 submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 468 {
 469         struct net_device *netdev = hw->wlandev->netdev;
 470         int result;
 471
 472         DBFENTER;
 473
 474         result = -ENOLINK;
 475         if ( netif_running(netdev) ) {
 476
 477                 if ( !hw->wlandev->hwremoved && !test_bit(WORK_TX_HALT, &hw->usb_flags) ) {
 478                         result = SUBMIT_URB(tx_urb, memflags);
 479
 480                         /* Test whether we need to reset the TX pipe */
 481                         if (result == -EPIPE) {
 482                                 WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
 483                                                  netdev->name);
 484                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 485                                 schedule_work(&hw->usb_work);
 486                         } else if (result == 0) {
 487                                 netif_stop_queue(netdev);
 488                         }
 489                 }
 490         }
 491
 492         DBFEXIT;
 493
 494         return result;
 495 }
 496
 497 /*----------------------------------------------------------------
 498 * hfa394x_usb_defer
 499 *
 500 * There are some things that the USB stack cannot do while
 501 * in interrupt context, so we arrange this function to run
 502 * in process context.
 503 *
 504 * Arguments:
 505 *       hw      device structure
 506 *
 507 * Returns:
 508 *       nothing
 509 *
 510 * Call context:
 511 *       process (by design)
 512 ----------------------------------------------------------------*/
 513 static void
 514 hfa384x_usb_defer(struct work_struct *data)
 515 {
 516         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 517         struct net_device *netdev = hw->wlandev->netdev;
 518
 519         DBFENTER;
 520
 521         /* Don't bother trying to reset anything if the plug
 522          * has been pulled ...
 523          */
 524         if ( hw->wlandev->hwremoved ) {
 525                 DBFEXIT;
 526                 return;
 527         }
 528
 529         /* Reception has stopped: try to reset the input pipe */
 530         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 531                 int ret;
 532
 533                 usb_kill_urb(&hw->rx_urb);  /* Cannot be holding spinlock! */
 534
 535                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 536                 if (ret != 0) {
 537                         printk(KERN_ERR
 538                                "Failed to clear rx pipe for %s: err=%d\n",
 539                                netdev->name, ret);
 540                 } else {
 541                         printk(KERN_INFO "%s rx pipe reset complete.\n",
 542                                          netdev->name);
 543                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 544                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 545                 }
 546         }
 547
 548         /* Resume receiving data back from the device. */
 549         if ( test_bit(WORK_RX_RESUME, &hw->usb_flags) ) {
 550                 int ret;
 551
 552                 ret = submit_rx_urb(hw, GFP_KERNEL);
 553                 if (ret != 0) {
 554                         printk(KERN_ERR
 555                                "Failed to resume %s rx pipe.\n", netdev->name);
 556                 } else {
 557                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 558                 }
 559         }
 560
 561         /* Transmission has stopped: try to reset the output pipe */
 562         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 563                 int ret;
 564
 565                 usb_kill_urb(&hw->tx_urb);
 566                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 567                 if (ret != 0) {
 568                         printk(KERN_ERR
 569                                "Failed to clear tx pipe for %s: err=%d\n",
 570                                netdev->name, ret);
 571                 } else {
 572                         printk(KERN_INFO "%s tx pipe reset complete.\n",
 573                                          netdev->name);
 574                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 575                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 576
 577                         /* Stopping the BULK-OUT pipe also blocked
 578                          * us from sending any more CTLX URBs, so
 579                          * we need to re-run our queue ...
 580                          */
 581                         hfa384x_usbctlxq_run(hw);
 582                 }
 583         }
 584
 585         /* Resume transmitting. */
 586         if ( test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags) ) {
 587                 p80211netdev_wake_queue(hw->wlandev);
 588         }
 589
 590         DBFEXIT;
 591 }
 592
 593
 594 /*----------------------------------------------------------------
 595 * hfa384x_create
 596 *
 597 * Sets up the hfa384x_t data structure for use.  Note this
 598 * does _not_ intialize the actual hardware, just the data structures
 599 * we use to keep track of its state.
 600 *
 601 * Arguments:
 602 *       hw              device structure
 603 *       irq             device irq number
 604 *       iobase          i/o base address for register access
 605 *       membase         memory base address for register access
 606 *
 607 * Returns:
 608 *       nothing
 609 *
 610 * Side effects:
 611 *
 612 * Call context:
 613 *       process
 614 ----------------------------------------------------------------*/
 615 void
 616 hfa384x_create( hfa384x_t *hw, struct usb_device *usb)
 617 {
 618         DBFENTER;
 619
 620         memset(hw, 0, sizeof(hfa384x_t));
 621         hw->usb = usb;
 622
 623         /* set up the endpoints */
 624         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 625         hw->endp_out = usb_sndbulkpipe(usb, 2);
 626
 627         /* Set up the waitq */
 628         init_waitqueue_head(&hw->cmdq);
 629
 630         /* Initialize the command queue */
 631         spin_lock_init(&hw->ctlxq.lock);
 632         INIT_LIST_HEAD(&hw->ctlxq.pending);
 633         INIT_LIST_HEAD(&hw->ctlxq.active);
 634         INIT_LIST_HEAD(&hw->ctlxq.completing);
 635         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 636
 637         /* Initialize the authentication queue */
 638         skb_queue_head_init(&hw->authq);
 639
 640         tasklet_init(&hw->reaper_bh,
 641                      hfa384x_usbctlx_reaper_task,
 642                      (unsigned long)hw);
 643         tasklet_init(&hw->completion_bh,
 644                      hfa384x_usbctlx_completion_task,
 645                      (unsigned long)hw);
 646         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 647         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 648
 649         init_timer(&hw->throttle);
 650         hw->throttle.function = hfa384x_usb_throttlefn;
 651         hw->throttle.data = (unsigned long)hw;
 652
 653         init_timer(&hw->resptimer);
 654         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 655         hw->resptimer.data = (unsigned long)hw;
 656
 657         init_timer(&hw->reqtimer);
 658         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 659         hw->reqtimer.data = (unsigned long)hw;
 660
 661         usb_init_urb(&hw->rx_urb);
 662         usb_init_urb(&hw->tx_urb);
 663         usb_init_urb(&hw->ctlx_urb);
 664
 665         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 666         hw->state = HFA384x_STATE_INIT;
 667
 668         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 669         init_timer(&hw->commsqual_timer);
 670         hw->commsqual_timer.data = (unsigned long) hw;
 671         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 672
 673         DBFEXIT;
 674 }
 675
 676
 677 /*----------------------------------------------------------------
 678 * hfa384x_destroy
 679 *
 680 * Partner to hfa384x_create().  This function cleans up the hw
 681 * structure so that it can be freed by the caller using a simple
 682 * kfree.  Currently, this function is just a placeholder.  If, at some
 683 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 684 * kfree, this is where it should be done.  Note that if this function
 685 * is called on a _running_ hw structure, the drvr_stop() function is
 686 * called.
 687 *
 688 * Arguments:
 689 *       hw              device structure
 690 *
 691 * Returns:
 692 *       nothing, this function is not allowed to fail.
 693 *
 694 * Side effects:
 695 *
 696 * Call context:
 697 *       process
 698 ----------------------------------------------------------------*/
 699 void
 700 hfa384x_destroy( hfa384x_t *hw)
 701 {
 702         struct sk_buff *skb;
 703
 704         DBFENTER;
 705
 706         if ( hw->state == HFA384x_STATE_RUNNING ) {
 707                 hfa384x_drvr_stop(hw);
 708         }
 709         hw->state = HFA384x_STATE_PREINIT;
 710
 711         if (hw->scanresults) {
 712                 kfree(hw->scanresults);
 713                 hw->scanresults = NULL;
 714         }
 715
 716         /* Now to clean out the auth queue */
 717         while ( (skb = skb_dequeue(&hw->authq)) ) {
 718                 dev_kfree_skb(skb);
 719         }
 720
 721         DBFEXIT;
 722 }
 723
 724
 725 /*----------------------------------------------------------------
 726  */
 727 static hfa384x_usbctlx_t* usbctlx_alloc(void)
 728 {
 729         hfa384x_usbctlx_t *ctlx;
 730
 731         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 732         if (ctlx != NULL)
 733         {
 734                 memset(ctlx, 0, sizeof(*ctlx));
 735                 init_completion(&ctlx->done);
 736         }
 737
 738         return ctlx;
 739 }
 740
 741
 742 /*----------------------------------------------------------------
 743  *
 744 ----------------------------------------------------------------*/
 745 static int
 746 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 747                    hfa384x_cmdresult_t *result)
 748 {
 749         DBFENTER;
 750
 751         result->status = hfa384x2host_16(cmdresp->status);
 752         result->resp0 = hfa384x2host_16(cmdresp->resp0);
 753         result->resp1 = hfa384x2host_16(cmdresp->resp1);
 754         result->resp2 = hfa384x2host_16(cmdresp->resp2);
 755
 756         WLAN_LOG_DEBUG(4, "cmdresult:status=0x%04x "
 757                           "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 758                         result->status,
 759                         result->resp0,
 760                         result->resp1,
 761                         result->resp2);
 762
 763         DBFEXIT;
 764         return (result->status & HFA384x_STATUS_RESULT);
 765 }
 766
 767 static void
 768 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 769                        hfa384x_rridresult_t *result)
 770 {
 771         DBFENTER;
 772
 773         result->rid = hfa384x2host_16(rridresp->rid);
 774         result->riddata = rridresp->data;
 775         result->riddata_len = ((hfa384x2host_16(rridresp->frmlen) - 1) * 2);
 776
 777         DBFEXIT;
 778 }
 779
 780
 781 /*----------------------------------------------------------------
 782 * Completor object:
 783 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 784 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 785 ----------------------------------------------------------------*/
 786 struct usbctlx_cmd_completor
 787 {
 788         usbctlx_completor_t     head;
 789
 790         const hfa384x_usb_cmdresp_t     *cmdresp;
 791         hfa384x_cmdresult_t     *result;
 792 };
 793 typedef struct usbctlx_cmd_completor usbctlx_cmd_completor_t;
 794
 795 static int usbctlx_cmd_completor_fn(usbctlx_completor_t *head)
 796 {
 797         usbctlx_cmd_completor_t *complete = (usbctlx_cmd_completor_t*)head;
 798         return usbctlx_get_status(complete->cmdresp, complete->result);
 799 }
 800
 801 static inline usbctlx_completor_t*
 802 init_cmd_completor(usbctlx_cmd_completor_t *completor,
 803                    const hfa384x_usb_cmdresp_t *cmdresp,
 804                    hfa384x_cmdresult_t *result)
 805 {
 806         completor->head.complete = usbctlx_cmd_completor_fn;
 807         completor->cmdresp = cmdresp;
 808         completor->result = result;
 809         return &(completor->head);
 810 }
 811
 812 /*----------------------------------------------------------------
 813 * Completor object:
 814 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 815 * when processing a CTLX that reads a RID.
 816 ----------------------------------------------------------------*/
 817 struct usbctlx_rrid_completor
 818 {
 819         usbctlx_completor_t     head;
 820
 821         const hfa384x_usb_rridresp_t    *rridresp;
 822         void                    *riddata;
 823         unsigned int                    riddatalen;
 824 };
 825 typedef struct usbctlx_rrid_completor usbctlx_rrid_completor_t;
 826
 827 static int usbctlx_rrid_completor_fn(usbctlx_completor_t *head)
 828 {
 829         usbctlx_rrid_completor_t *complete = (usbctlx_rrid_completor_t*)head;
 830         hfa384x_rridresult_t rridresult;
 831
 832         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 833
 834         /* Validate the length, note body len calculation in bytes */
 835         if ( rridresult.riddata_len != complete->riddatalen ) {
 836                 WLAN_LOG_WARNING(
 837                         "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 838                         rridresult.rid,
 839                         complete->riddatalen,
 840                         rridresult.riddata_len);
 841                 return -ENODATA;
 842         }
 843
 844         memcpy(complete->riddata,
 845                rridresult.riddata,
 846                complete->riddatalen);
 847         return 0;
 848 }
 849
 850 static inline usbctlx_completor_t*
 851 init_rrid_completor(usbctlx_rrid_completor_t *completor,
 852                     const hfa384x_usb_rridresp_t *rridresp,
 853                     void *riddata,
 854                     unsigned int riddatalen)
 855 {
 856         completor->head.complete = usbctlx_rrid_completor_fn;
 857         completor->rridresp = rridresp;
 858         completor->riddata = riddata;
 859         completor->riddatalen = riddatalen;
 860         return &(completor->head);
 861 }
 862
 863 /*----------------------------------------------------------------
 864 * Completor object:
 865 * Interprets the results of a synchronous RID-write
 866 ----------------------------------------------------------------*/
 867 typedef usbctlx_cmd_completor_t usbctlx_wrid_completor_t;
 868 #define init_wrid_completor  init_cmd_completor
 869
 870 /*----------------------------------------------------------------
 871 * Completor object:
 872 * Interprets the results of a synchronous memory-write
 873 ----------------------------------------------------------------*/
 874 typedef usbctlx_cmd_completor_t usbctlx_wmem_completor_t;
 875 #define init_wmem_completor  init_cmd_completor
 876
 877 /*----------------------------------------------------------------
 878 * Completor object:
 879 * Interprets the results of a synchronous memory-read
 880 ----------------------------------------------------------------*/
 881 struct usbctlx_rmem_completor
 882 {
 883         usbctlx_completor_t           head;
 884
 885         const hfa384x_usb_rmemresp_t  *rmemresp;
 886         void                          *data;
 887         unsigned int                          len;
 888 };
 889 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
 890
 891 static int usbctlx_rmem_completor_fn(usbctlx_completor_t *head)
 892 {
 893         usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t*)head;
 894
 895         WLAN_LOG_DEBUG(4,"rmemresp:len=%d\n", complete->rmemresp->frmlen);
 896         memcpy(complete->data, complete->rmemresp->data, complete->len);
 897         return 0;
 898 }
 899
 900 static inline usbctlx_completor_t*
 901 init_rmem_completor(usbctlx_rmem_completor_t *completor,
 902                     hfa384x_usb_rmemresp_t *rmemresp,
 903                     void *data,
 904                     unsigned int len)
 905 {
 906         completor->head.complete = usbctlx_rmem_completor_fn;
 907         completor->rmemresp = rmemresp;
 908         completor->data = data;
 909         completor->len = len;
 910         return &(completor->head);
 911 }
 912
 913 /*----------------------------------------------------------------
 914 * hfa384x_cb_status
 915 *
 916 * Ctlx_complete handler for async CMD type control exchanges.
 917 * mark the hw struct as such.
 918 *
 919 * Note: If the handling is changed here, it should probably be
 920 *       changed in docmd as well.
 921 *
 922 * Arguments:
 923 *       hw              hw struct
 924 *       ctlx            completed CTLX
 925 *
 926 * Returns:
 927 *       nothing
 928 *
 929 * Side effects:
 930 *
 931 * Call context:
 932 *       interrupt
 933 ----------------------------------------------------------------*/
 934 static void
 935 hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 936 {
 937         DBFENTER;
 938
 939         if ( ctlx->usercb != NULL ) {
 940                 hfa384x_cmdresult_t cmdresult;
 941
 942                 if (ctlx->state != CTLX_COMPLETE) {
 943                         memset(&cmdresult, 0, sizeof(cmdresult));
 944                         cmdresult.status = HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 945                 } else {
 946                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 947                 }
 948
 949                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 950         }
 951
 952         DBFEXIT;
 953 }
 954
 955
 956 /*----------------------------------------------------------------
 957 * hfa384x_cb_rrid
 958 *
 959 * CTLX completion handler for async RRID type control exchanges.
 960 *
 961 * Note: If the handling is changed here, it should probably be
 962 *       changed in dorrid as well.
 963 *
 964 * Arguments:
 965 *       hw              hw struct
 966 *       ctlx            completed CTLX
 967 *
 968 * Returns:
 969 *       nothing
 970 *
 971 * Side effects:
 972 *
 973 * Call context:
 974 *       interrupt
 975 ----------------------------------------------------------------*/
 976 static void
 977 hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 978 {
 979         DBFENTER;
 980
 981         if ( ctlx->usercb != NULL ) {
 982                 hfa384x_rridresult_t rridresult;
 983
 984                 if (ctlx->state != CTLX_COMPLETE) {
 985                         memset(&rridresult, 0, sizeof(rridresult));
 986                         rridresult.rid = hfa384x2host_16(ctlx->outbuf.rridreq.rid);
 987                 } else {
 988                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp, &rridresult);
 989                 }
 990
 991                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
 992         }
 993
 994         DBFEXIT;
 995 }
 996
 997 static inline int
 998 hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
 999 {
1000         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
1001 }
1002
1003 static inline int
1004 hfa384x_docmd_async(hfa384x_t *hw,
1005                     hfa384x_metacmd_t *cmd,
1006                     ctlx_cmdcb_t cmdcb,
1007                     ctlx_usercb_t usercb,
1008                     void *usercb_data)
1009 {
1010         return hfa384x_docmd(hw, DOASYNC, cmd,
1011                                 cmdcb, usercb, usercb_data);
1012 }
1013
1014 static inline int
1015 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1016 {
1017         return hfa384x_dorrid(hw, DOWAIT,
1018                               rid, riddata, riddatalen,
1019                               NULL, NULL, NULL);
1020 }
1021
1022 static inline int
1023 hfa384x_dorrid_async(hfa384x_t *hw,
1024                      u16 rid, void *riddata, unsigned int riddatalen,
1025                      ctlx_cmdcb_t cmdcb,
1026                      ctlx_usercb_t usercb,
1027                      void *usercb_data)
1028 {
1029         return hfa384x_dorrid(hw, DOASYNC,
1030                               rid, riddata, riddatalen,
1031                               cmdcb, usercb, usercb_data);
1032 }
1033
1034 static inline int
1035 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata, unsigned int riddatalen)
1036 {
1037         return hfa384x_dowrid(hw, DOWAIT,
1038                               rid, riddata, riddatalen,
1039                               NULL, NULL, NULL);
1040 }
1041
1042 static inline int
1043 hfa384x_dowrid_async(hfa384x_t *hw,
1044                      u16 rid, void *riddata, unsigned int riddatalen,
1045                      ctlx_cmdcb_t cmdcb,
1046                      ctlx_usercb_t usercb,
1047                      void *usercb_data)
1048 {
1049         return hfa384x_dowrid(hw, DOASYNC,
1050                               rid, riddata, riddatalen,
1051                               cmdcb, usercb, usercb_data);
1052 }
1053
1054 static inline int
1055 hfa384x_dormem_wait(hfa384x_t *hw,
1056                     u16 page, u16 offset, void *data, unsigned int len)
1057 {
1058         return hfa384x_dormem(hw, DOWAIT,
1059                               page, offset, data, len,
1060                               NULL, NULL, NULL);
1061 }
1062
1063 static inline int
1064 hfa384x_dormem_async(hfa384x_t *hw,
1065                      u16 page, u16 offset, void *data, unsigned int len,
1066                      ctlx_cmdcb_t cmdcb,
1067                      ctlx_usercb_t usercb,
1068                      void *usercb_data)
1069 {
1070         return hfa384x_dormem(hw, DOASYNC,
1071                               page, offset, data, len,
1072                               cmdcb, usercb, usercb_data);
1073 }
1074
1075 static inline int
1076 hfa384x_dowmem_wait(
1077         hfa384x_t *hw,
1078         u16  page,
1079         u16  offset,
1080         void    *data,
1081         unsigned int    len)
1082 {
1083         return hfa384x_dowmem(hw, DOWAIT,
1084                                   page, offset, data, len,
1085                                   NULL, NULL, NULL);
1086 }
1087
1088 static inline int
1089 hfa384x_dowmem_async(
1090         hfa384x_t *hw,
1091         u16  page,
1092         u16  offset,
1093         void    *data,
1094         unsigned int    len,
1095         ctlx_cmdcb_t cmdcb,
1096         ctlx_usercb_t usercb,
1097         void    *usercb_data)
1098 {
1099         return hfa384x_dowmem(hw, DOASYNC,
1100                                   page, offset, data, len,
1101                                   cmdcb, usercb, usercb_data);
1102 }
1103
1104 /*----------------------------------------------------------------
1105 * hfa384x_cmd_initialize
1106 *
1107 * Issues the initialize command and sets the hw->state based
1108 * on the result.
1109 *
1110 * Arguments:
1111 *       hw              device structure
1112 *
1113 * Returns:
1114 *       0               success
1115 *       >0              f/w reported error - f/w status code
1116 *       <0              driver reported error
1117 *
1118 * Side effects:
1119 *
1120 * Call context:
1121 *       process
1122 ----------------------------------------------------------------*/
1123 int
1124 hfa384x_cmd_initialize(hfa384x_t *hw)
1125 {
1126         int     result = 0;
1127         int     i;
1128         hfa384x_metacmd_t cmd;
1129
1130         DBFENTER;
1131
1132
1133         cmd.cmd = HFA384x_CMDCODE_INIT;
1134         cmd.parm0 = 0;
1135         cmd.parm1 = 0;
1136         cmd.parm2 = 0;
1137
1138         result = hfa384x_docmd_wait(hw, &cmd);
1139
1140
1141         WLAN_LOG_DEBUG(3,"cmdresp.init: "
1142                 "status=0x%04x, resp0=0x%04x, "
1143                 "resp1=0x%04x, resp2=0x%04x\n",
1144                 cmd.result.status,
1145                 cmd.result.resp0,
1146                 cmd.result.resp1,
1147                 cmd.result.resp2);
1148         if ( result == 0 ) {
1149                 for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
1150                         hw->port_enabled[i] = 0;
1151                 }
1152         }
1153
1154         hw->link_status = HFA384x_LINK_NOTCONNECTED;
1155
1156         DBFEXIT;
1157         return result;
1158 }
1159
1160
1161 /*----------------------------------------------------------------
1162 * hfa384x_cmd_disable
1163 *
1164 * Issues the disable command to stop communications on one of
1165 * the MACs 'ports'.
1166 *
1167 * Arguments:
1168 *       hw              device structure
1169 *       macport         MAC port number (host order)
1170 *
1171 * Returns:
1172 *       0               success
1173 *       >0              f/w reported failure - f/w status code
1174 *       <0              driver reported error (timeout|bad arg)
1175 *
1176 * Side effects:
1177 *
1178 * Call context:
1179 *       process
1180 ----------------------------------------------------------------*/
1181 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1182 {
1183         int     result = 0;
1184         hfa384x_metacmd_t cmd;
1185
1186         DBFENTER;
1187
1188         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1189                   HFA384x_CMD_MACPORT_SET(macport);
1190         cmd.parm0 = 0;
1191         cmd.parm1 = 0;
1192         cmd.parm2 = 0;
1193
1194         result = hfa384x_docmd_wait(hw, &cmd);
1195
1196         DBFEXIT;
1197         return result;
1198 }
1199
1200
1201 /*----------------------------------------------------------------
1202 * hfa384x_cmd_enable
1203 *
1204 * Issues the enable command to enable communications on one of
1205 * the MACs 'ports'.
1206 *
1207 * Arguments:
1208 *       hw              device structure
1209 *       macport         MAC port number
1210 *
1211 * Returns:
1212 *       0               success
1213 *       >0              f/w reported failure - f/w status code
1214 *       <0              driver reported error (timeout|bad arg)
1215 *
1216 * Side effects:
1217 *
1218 * Call context:
1219 *       process
1220 ----------------------------------------------------------------*/
1221 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1222 {
1223         int     result = 0;
1224         hfa384x_metacmd_t cmd;
1225
1226         DBFENTER;
1227
1228         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1229                   HFA384x_CMD_MACPORT_SET(macport);
1230         cmd.parm0 = 0;
1231         cmd.parm1 = 0;
1232         cmd.parm2 = 0;
1233
1234         result = hfa384x_docmd_wait(hw, &cmd);
1235
1236         DBFEXIT;
1237         return result;
1238 }
1239
1240
1241 /*----------------------------------------------------------------
1242 * hfa384x_cmd_notify
1243 *
1244 * Sends an info frame to the firmware to alter the behavior
1245 * of the f/w asynch processes.  Can only be called when the MAC
1246 * is in the enabled state.
1247 *
1248 * Arguments:
1249 *       hw              device structure
1250 *       reclaim         [0|1] indicates whether the given FID will
1251 *                       be handed back (via Alloc event) for reuse.
1252 *                       (host order)
1253 *       fid             FID of buffer containing the frame that was
1254 *                       previously copied to MAC memory via the bap.
1255 *                       (host order)
1256 *
1257 * Returns:
1258 *       0               success
1259 *       >0              f/w reported failure - f/w status code
1260 *       <0              driver reported error (timeout|bad arg)
1261 *
1262 * Side effects:
1263 *       hw->resp0 will contain the FID being used by async notify
1264 *       process.  If reclaim==0, resp0 will be the same as the fid
1265 *       argument.  If reclaim==1, resp0 will be the different.
1266 *
1267 * Call context:
1268 *       process
1269 ----------------------------------------------------------------*/
1270 int hfa384x_cmd_notify(hfa384x_t *hw, u16 reclaim, u16 fid,
1271                        void *buf, u16 len)
1272 {
1273 #if 0
1274         int     result = 0;
1275         u16     cmd;
1276         DBFENTER;
1277         cmd =   HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_NOTIFY) |
1278                 HFA384x_CMD_RECL_SET(reclaim);
1279         result = hfa384x_docmd_wait(hw, cmd);
1280
1281         DBFEXIT;
1282         return result;
1283 #endif
1284 return 0;
1285 }
1286
1287
1288 #if 0
1289 /*----------------------------------------------------------------
1290 * hfa384x_cmd_inquiry
1291 *
1292 * Requests an info frame from the firmware.  The info frame will
1293 * be delivered asynchronously via the Info event.
1294 *
1295 * Arguments:
1296 *       hw              device structure
1297 *       fid             FID of the info frame requested. (host order)
1298 *
1299 * Returns:
1300 *       0               success
1301 *       >0              f/w reported failure - f/w status code
1302 *       <0              driver reported error (timeout|bad arg)
1303 *
1304 * Side effects:
1305 *
1306 * Call context:
1307 *       process
1308 ----------------------------------------------------------------*/
1309 int hfa384x_cmd_inquiry(hfa384x_t *hw, u16 fid)
1310 {
1311         int     result = 0;
1312         hfa384x_metacmd_t cmd;
1313
1314         DBFENTER;
1315
1316         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_INQ);
1317         cmd.parm0 = 0;
1318         cmd.parm1 = 0;
1319         cmd.parm2 = 0;
1320
1321         result = hfa384x_docmd_wait(hw, &cmd);
1322
1323         DBFEXIT;
1324         return result;
1325 }
1326 #endif
1327
1328
1329 /*----------------------------------------------------------------
1330 * hfa384x_cmd_monitor
1331 *
1332 * Enables the 'monitor mode' of the MAC.  Here's the description of
1333 * monitor mode that I've received thus far:
1334 *
1335 *  "The "monitor mode" of operation is that the MAC passes all
1336 *  frames for which the PLCP checks are correct. All received
1337 *  MPDUs are passed to the host with MAC Port = 7, with a
1338 *  receive status of good, FCS error, or undecryptable. Passing
1339 *  certain MPDUs is a violation of the 802.11 standard, but useful
1340 *  for a debugging tool."  Normal communication is not possible
1341 *  while monitor mode is enabled.
1342 *
1343 * Arguments:
1344 *       hw              device structure
1345 *       enable          a code (0x0b|0x0f) that enables/disables
1346 *                       monitor mode. (host order)
1347 *
1348 * Returns:
1349 *       0               success
1350 *       >0              f/w reported failure - f/w status code
1351 *       <0              driver reported error (timeout|bad arg)
1352 *
1353 * Side effects:
1354 *
1355 * Call context:
1356 *       process
1357 ----------------------------------------------------------------*/
1358 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1359 {
1360         int     result = 0;
1361         hfa384x_metacmd_t cmd;
1362
1363         DBFENTER;
1364
1365         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1366                 HFA384x_CMD_AINFO_SET(enable);
1367         cmd.parm0 = 0;
1368         cmd.parm1 = 0;
1369         cmd.parm2 = 0;
1370
1371         result = hfa384x_docmd_wait(hw, &cmd);
1372
1373         DBFEXIT;
1374         return result;
1375 }
1376
1377
1378 /*----------------------------------------------------------------
1379 * hfa384x_cmd_download
1380 *
1381 * Sets the controls for the MAC controller code/data download
1382 * process.  The arguments set the mode and address associated
1383 * with a download.  Note that the aux registers should be enabled
1384 * prior to setting one of the download enable modes.
1385 *
1386 * Arguments:
1387 *       hw              device structure
1388 *       mode            0 - Disable programming and begin code exec
1389 *                       1 - Enable volatile mem programming
1390 *                       2 - Enable non-volatile mem programming
1391 *                       3 - Program non-volatile section from NV download
1392 *                           buffer.
1393 *                       (host order)
1394 *       lowaddr
1395 *       highaddr        For mode 1, sets the high & low order bits of
1396 *                       the "destination address".  This address will be
1397 *                       the execution start address when download is
1398 *                       subsequently disabled.
1399 *                       For mode 2, sets the high & low order bits of
1400 *                       the destination in NV ram.
1401 *                       For modes 0 & 3, should be zero. (host order)
1402 *                       NOTE: these are CMD format.
1403 *       codelen         Length of the data to write in mode 2,
1404 *                       zero otherwise. (host order)
1405 *
1406 * Returns:
1407 *       0               success
1408 *       >0              f/w reported failure - f/w status code
1409 *       <0              driver reported error (timeout|bad arg)
1410 *
1411 * Side effects:
1412 *
1413 * Call context:
1414 *       process
1415 ----------------------------------------------------------------*/
1416 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1417                                 u16 highaddr, u16 codelen)
1418 {
1419         int     result = 0;
1420         hfa384x_metacmd_t cmd;
1421
1422         DBFENTER;
1423         WLAN_LOG_DEBUG(5,
1424                 "mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1425                 mode, lowaddr, highaddr, codelen);
1426
1427         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1428                    HFA384x_CMD_PROGMODE_SET(mode));
1429
1430         cmd.parm0 = lowaddr;
1431         cmd.parm1 = highaddr;
1432         cmd.parm2 = codelen;
1433
1434         result = hfa384x_docmd_wait(hw, &cmd);
1435
1436         DBFEXIT;
1437         return result;
1438 }
1439
1440
1441 /*----------------------------------------------------------------
1442 * hfa384x_copy_from_aux
1443 *
1444 * Copies a collection of bytes from the controller memory.  The
1445 * Auxiliary port MUST be enabled prior to calling this function.
1446 * We _might_ be in a download state.
1447 *
1448 * Arguments:
1449 *       hw              device structure
1450 *       cardaddr        address in hfa384x data space to read
1451 *       auxctl          address space select
1452 *       buf             ptr to destination host buffer
1453 *       len             length of data to transfer (in bytes)
1454 *
1455 * Returns:
1456 *       nothing
1457 *
1458 * Side effects:
1459 *       buf contains the data copied
1460 *
1461 * Call context:
1462 *       process
1463 *       interrupt
1464 ----------------------------------------------------------------*/
1465 void
1466 hfa384x_copy_from_aux(
1467         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1468 {
1469         DBFENTER;
1470         WLAN_LOG_ERROR("not used in USB.\n");
1471         DBFEXIT;
1472 }
1473
1474
1475 /*----------------------------------------------------------------
1476 * hfa384x_copy_to_aux
1477 *
1478 * Copies a collection of bytes to the controller memory.  The
1479 * Auxiliary port MUST be enabled prior to calling this function.
1480 * We _might_ be in a download state.
1481 *
1482 * Arguments:
1483 *       hw              device structure
1484 *       cardaddr        address in hfa384x data space to read
1485 *       auxctl          address space select
1486 *       buf             ptr to destination host buffer
1487 *       len             length of data to transfer (in bytes)
1488 *
1489 * Returns:
1490 *       nothing
1491 *
1492 * Side effects:
1493 *       Controller memory now contains a copy of buf
1494 *
1495 * Call context:
1496 *       process
1497 *       interrupt
1498 ----------------------------------------------------------------*/
1499 void
1500 hfa384x_copy_to_aux(
1501         hfa384x_t *hw, u32 cardaddr, u32 auxctl, void *buf, unsigned int len)
1502 {
1503         DBFENTER;
1504         WLAN_LOG_ERROR("not used in USB.\n");
1505         DBFEXIT;
1506 }
1507
1508
1509 /*----------------------------------------------------------------
1510 * hfa384x_corereset
1511 *
1512 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1513 * structure is in its "created" state.  That is, it is initialized
1514 * with proper values.  Note that if a reset is done after the
1515 * device has been active for awhile, the caller might have to clean
1516 * up some leftover cruft in the hw structure.
1517 *
1518 * Arguments:
1519 *       hw              device structure
1520 *       holdtime        how long (in ms) to hold the reset
1521 *       settletime      how long (in ms) to wait after releasing
1522 *                       the reset
1523 *
1524 * Returns:
1525 *       nothing
1526 *
1527 * Side effects:
1528 *
1529 * Call context:
1530 *       process
1531 ----------------------------------------------------------------*/
1532 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1533 {
1534         int                     result = 0;
1535
1536         DBFENTER;
1537
1538         result=usb_reset_device(hw->usb);
1539         if(result<0) {
1540                 WLAN_LOG_ERROR("usb_reset_device() failed, result=%d.\n",result);
1541         }
1542
1543         DBFEXIT;
1544         return result;
1545 }
1546
1547
1548 /*----------------------------------------------------------------
1549 * hfa384x_usbctlx_complete_sync
1550 *
1551 * Waits for a synchronous CTLX object to complete,
1552 * and then handles the response.
1553 *
1554 * Arguments:
1555 *       hw              device structure
1556 *       ctlx            CTLX ptr
1557 *       completor       functor object to decide what to
1558 *                       do with the CTLX's result.
1559 *
1560 * Returns:
1561 *       0               Success
1562 *       -ERESTARTSYS    Interrupted by a signal
1563 *       -EIO            CTLX failed
1564 *       -ENODEV         Adapter was unplugged
1565 *       ???             Result from completor
1566 *
1567 * Side effects:
1568 *
1569 * Call context:
1570 *       process
1571 ----------------------------------------------------------------*/
1572 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1573                                          hfa384x_usbctlx_t *ctlx,
1574                                          usbctlx_completor_t *completor)
1575 {
1576         unsigned long flags;
1577         int result;
1578
1579         DBFENTER;
1580
1581         result = wait_for_completion_interruptible(&ctlx->done);
1582
1583         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1584
1585         /*
1586          * We can only handle the CTLX if the USB disconnect
1587          * function has not run yet ...
1588          */
1589         cleanup:
1590         if ( hw->wlandev->hwremoved )
1591         {
1592                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1593                 result = -ENODEV;
1594         }
1595         else if ( result != 0 )
1596         {
1597                 int runqueue = 0;
1598
1599                 /*
1600                  * We were probably interrupted, so delete
1601                  * this CTLX asynchronously, kill the timers
1602                  * and the URB, and then start the next
1603                  * pending CTLX.
1604                  *
1605                  * NOTE: We can only delete the timers and
1606                  *       the URB if this CTLX is active.
1607                  */
1608                 if (ctlx == get_active_ctlx(hw))
1609                 {
1610                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1611
1612                         del_singleshot_timer_sync(&hw->reqtimer);
1613                         del_singleshot_timer_sync(&hw->resptimer);
1614                         hw->req_timer_done = 1;
1615                         hw->resp_timer_done = 1;
1616                         usb_kill_urb(&hw->ctlx_urb);
1617
1618                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1619
1620                         runqueue = 1;
1621
1622                         /*
1623                          * This scenario is so unlikely that I'm
1624                          * happy with a grubby "goto" solution ...
1625                          */
1626                         if ( hw->wlandev->hwremoved )
1627                                 goto cleanup;
1628                 }
1629
1630                 /*
1631                  * The completion task will send this CTLX
1632                  * to the reaper the next time it runs. We
1633                  * are no longer in a hurry.
1634                  */
1635                 ctlx->reapable = 1;
1636                 ctlx->state = CTLX_REQ_FAILED;
1637                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1638
1639                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1640
1641                 if (runqueue)
1642                         hfa384x_usbctlxq_run(hw);
1643         } else {
1644                 if (ctlx->state == CTLX_COMPLETE) {
1645                         result = completor->complete(completor);
1646                 } else {
1647                         WLAN_LOG_WARNING("CTLX[%d] error: state(%s)\n",
1648                                          hfa384x2host_16(ctlx->outbuf.type),
1649                                          ctlxstr(ctlx->state));
1650                         result = -EIO;
1651                 }
1652
1653                 list_del(&ctlx->list);
1654                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1655                 kfree(ctlx);
1656         }
1657
1658         DBFEXIT;
1659         return result;
1660 }
1661
1662 /*----------------------------------------------------------------
1663 * hfa384x_docmd
1664 *
1665 * Constructs a command CTLX and submits it.
1666 *
1667 * NOTE: Any changes to the 'post-submit' code in this function
1668 *       need to be carried over to hfa384x_cbcmd() since the handling
1669 *       is virtually identical.
1670 *
1671 * Arguments:
1672 *       hw              device structure
1673 *       mode            DOWAIT or DOASYNC
1674 *       cmd             cmd structure.  Includes all arguments and result
1675 *                       data points.  All in host order. in host order
1676 *       cmdcb           command-specific callback
1677 *       usercb          user callback for async calls, NULL for DOWAIT calls
1678 *       usercb_data     user supplied data pointer for async calls, NULL
1679 *                       for DOASYNC calls
1680 *
1681 * Returns:
1682 *       0               success
1683 *       -EIO            CTLX failure
1684 *       -ERESTARTSYS    Awakened on signal
1685 *       >0              command indicated error, Status and Resp0-2 are
1686 *                       in hw structure.
1687 *
1688 * Side effects:
1689 *
1690 *
1691 * Call context:
1692 *       process
1693 ----------------------------------------------------------------*/
1694 static int
1695 hfa384x_docmd(
1696         hfa384x_t *hw,
1697         CMD_MODE mode,
1698         hfa384x_metacmd_t *cmd,
1699         ctlx_cmdcb_t    cmdcb,
1700         ctlx_usercb_t   usercb,
1701         void    *usercb_data)
1702 {
1703         int                     result;
1704         hfa384x_usbctlx_t       *ctlx;
1705
1706         DBFENTER;
1707         ctlx = usbctlx_alloc();
1708         if ( ctlx == NULL ) {
1709                 result = -ENOMEM;
1710                 goto done;
1711         }
1712
1713         /* Initialize the command */
1714         ctlx->outbuf.cmdreq.type =      host2hfa384x_16(HFA384x_USB_CMDREQ);
1715         ctlx->outbuf.cmdreq.cmd =       host2hfa384x_16(cmd->cmd);
1716         ctlx->outbuf.cmdreq.parm0 =     host2hfa384x_16(cmd->parm0);
1717         ctlx->outbuf.cmdreq.parm1 =     host2hfa384x_16(cmd->parm1);
1718         ctlx->outbuf.cmdreq.parm2 =     host2hfa384x_16(cmd->parm2);
1719
1720         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1721
1722         WLAN_LOG_DEBUG(4, "cmdreq: cmd=0x%04x "
1723                 "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1724                 cmd->cmd,
1725                 cmd->parm0,
1726                 cmd->parm1,
1727                 cmd->parm2);
1728
1729         ctlx->reapable = mode;
1730         ctlx->cmdcb = cmdcb;
1731         ctlx->usercb = usercb;
1732         ctlx->usercb_data = usercb_data;
1733
1734         result = hfa384x_usbctlx_submit(hw, ctlx);
1735         if (result != 0) {
1736                 kfree(ctlx);
1737         } else if (mode == DOWAIT) {
1738                 usbctlx_cmd_completor_t completor;
1739
1740                 result = hfa384x_usbctlx_complete_sync(
1741                              hw, ctlx, init_cmd_completor(&completor,
1742                                                           &ctlx->inbuf.cmdresp,
1743                                                           &cmd->result) );
1744         }
1745
1746 done:
1747         DBFEXIT;
1748         return result;
1749 }
1750
1751
1752 /*----------------------------------------------------------------
1753 * hfa384x_dorrid
1754 *
1755 * Constructs a read rid CTLX and issues it.
1756 *
1757 * NOTE: Any changes to the 'post-submit' code in this function
1758 *       need to be carried over to hfa384x_cbrrid() since the handling
1759 *       is virtually identical.
1760 *
1761 * Arguments:
1762 *       hw              device structure
1763 *       mode            DOWAIT or DOASYNC
1764 *       rid             Read RID number (host order)
1765 *       riddata         Caller supplied buffer that MAC formatted RID.data
1766 *                       record will be written to for DOWAIT calls. Should
1767 *                       be NULL for DOASYNC calls.
1768 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1769 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1770 *       usercb          user callback for async calls, NULL for DOWAIT calls
1771 *       usercb_data     user supplied data pointer for async calls, NULL
1772 *                       for DOWAIT calls
1773 *
1774 * Returns:
1775 *       0               success
1776 *       -EIO            CTLX failure
1777 *       -ERESTARTSYS    Awakened on signal
1778 *       -ENODATA        riddatalen != macdatalen
1779 *       >0              command indicated error, Status and Resp0-2 are
1780 *                       in hw structure.
1781 *
1782 * Side effects:
1783 *
1784 * Call context:
1785 *       interrupt (DOASYNC)
1786 *       process (DOWAIT or DOASYNC)
1787 ----------------------------------------------------------------*/
1788 static int
1789 hfa384x_dorrid(
1790         hfa384x_t *hw,
1791         CMD_MODE mode,
1792         u16     rid,
1793         void    *riddata,
1794         unsigned int    riddatalen,
1795         ctlx_cmdcb_t cmdcb,
1796         ctlx_usercb_t usercb,
1797         void    *usercb_data)
1798 {
1799         int                     result;
1800         hfa384x_usbctlx_t       *ctlx;
1801
1802         DBFENTER;
1803         ctlx = usbctlx_alloc();
1804         if ( ctlx == NULL ) {
1805                 result = -ENOMEM;
1806                 goto done;
1807         }
1808
1809         /* Initialize the command */
1810         ctlx->outbuf.rridreq.type =   host2hfa384x_16(HFA384x_USB_RRIDREQ);
1811         ctlx->outbuf.rridreq.frmlen =
1812                 host2hfa384x_16(sizeof(ctlx->outbuf.rridreq.rid));
1813         ctlx->outbuf.rridreq.rid =    host2hfa384x_16(rid);
1814
1815         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1816
1817         ctlx->reapable = mode;
1818         ctlx->cmdcb = cmdcb;
1819         ctlx->usercb = usercb;
1820         ctlx->usercb_data = usercb_data;
1821
1822         /* Submit the CTLX */
1823         result = hfa384x_usbctlx_submit(hw, ctlx);
1824         if (result != 0) {
1825                 kfree(ctlx);
1826         } else if (mode == DOWAIT) {
1827                 usbctlx_rrid_completor_t completor;
1828
1829                 result = hfa384x_usbctlx_complete_sync(
1830                            hw, ctlx, init_rrid_completor(&completor,
1831                                                          &ctlx->inbuf.rridresp,
1832                                                          riddata,
1833                                                          riddatalen) );
1834         }
1835
1836 done:
1837         DBFEXIT;
1838         return result;
1839 }
1840
1841
1842 /*----------------------------------------------------------------
1843 * hfa384x_dowrid
1844 *
1845 * Constructs a write rid CTLX and issues it.
1846 *
1847 * NOTE: Any changes to the 'post-submit' code in this function
1848 *       need to be carried over to hfa384x_cbwrid() since the handling
1849 *       is virtually identical.
1850 *
1851 * Arguments:
1852 *       hw              device structure
1853 *       CMD_MODE        DOWAIT or DOASYNC
1854 *       rid             RID code
1855 *       riddata         Data portion of RID formatted for MAC
1856 *       riddatalen      Length of the data portion in bytes
1857 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1858 *       usercb          user callback for async calls, NULL for DOWAIT calls
1859 *       usercb_data     user supplied data pointer for async calls
1860 *
1861 * Returns:
1862 *       0               success
1863 *       -ETIMEDOUT      timed out waiting for register ready or
1864 *                       command completion
1865 *       >0              command indicated error, Status and Resp0-2 are
1866 *                       in hw structure.
1867 *
1868 * Side effects:
1869 *
1870 * Call context:
1871 *       interrupt (DOASYNC)
1872 *       process (DOWAIT or DOASYNC)
1873 ----------------------------------------------------------------*/
1874 static int
1875 hfa384x_dowrid(
1876         hfa384x_t *hw,
1877         CMD_MODE mode,
1878         u16     rid,
1879         void    *riddata,
1880         unsigned int    riddatalen,
1881         ctlx_cmdcb_t cmdcb,
1882         ctlx_usercb_t usercb,
1883         void    *usercb_data)
1884 {
1885         int                     result;
1886         hfa384x_usbctlx_t       *ctlx;
1887
1888         DBFENTER;
1889         ctlx = usbctlx_alloc();
1890         if ( ctlx == NULL ) {
1891                 result = -ENOMEM;
1892                 goto done;
1893         }
1894
1895         /* Initialize the command */
1896         ctlx->outbuf.wridreq.type =   host2hfa384x_16(HFA384x_USB_WRIDREQ);
1897         ctlx->outbuf.wridreq.frmlen = host2hfa384x_16(
1898                                         (sizeof(ctlx->outbuf.wridreq.rid) +
1899                                         riddatalen + 1) / 2);
1900         ctlx->outbuf.wridreq.rid =    host2hfa384x_16(rid);
1901         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1902
1903         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1904                            sizeof(ctlx->outbuf.wridreq.frmlen) +
1905                            sizeof(ctlx->outbuf.wridreq.rid) +
1906                            riddatalen;
1907
1908         ctlx->reapable = mode;
1909         ctlx->cmdcb = cmdcb;
1910         ctlx->usercb = usercb;
1911         ctlx->usercb_data = usercb_data;
1912
1913         /* Submit the CTLX */
1914         result = hfa384x_usbctlx_submit(hw, ctlx);
1915         if (result != 0) {
1916                 kfree(ctlx);
1917         } else if (mode == DOWAIT) {
1918                 usbctlx_wrid_completor_t completor;
1919                 hfa384x_cmdresult_t wridresult;
1920
1921                 result = hfa384x_usbctlx_complete_sync(
1922                                hw,
1923                                ctlx,
1924                                init_wrid_completor(&completor,
1925                                                    &ctlx->inbuf.wridresp,
1926                                                    &wridresult) );
1927         }
1928
1929 done:
1930         DBFEXIT;
1931         return result;
1932 }
1933
1934 /*----------------------------------------------------------------
1935 * hfa384x_dormem
1936 *
1937 * Constructs a readmem CTLX and issues it.
1938 *
1939 * NOTE: Any changes to the 'post-submit' code in this function
1940 *       need to be carried over to hfa384x_cbrmem() since the handling
1941 *       is virtually identical.
1942 *
1943 * Arguments:
1944 *       hw              device structure
1945 *       mode            DOWAIT or DOASYNC
1946 *       page            MAC address space page (CMD format)
1947 *       offset          MAC address space offset
1948 *       data            Ptr to data buffer to receive read
1949 *       len             Length of the data to read (max == 2048)
1950 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1951 *       usercb          user callback for async calls, NULL for DOWAIT calls
1952 *       usercb_data     user supplied data pointer for async calls
1953 *
1954 * Returns:
1955 *       0               success
1956 *       -ETIMEDOUT      timed out waiting for register ready or
1957 *                       command completion
1958 *       >0              command indicated error, Status and Resp0-2 are
1959 *                       in hw structure.
1960 *
1961 * Side effects:
1962 *
1963 * Call context:
1964 *       interrupt (DOASYNC)
1965 *       process (DOWAIT or DOASYNC)
1966 ----------------------------------------------------------------*/
1967 static int
1968 hfa384x_dormem(
1969         hfa384x_t *hw,
1970         CMD_MODE mode,
1971         u16     page,
1972         u16     offset,
1973         void    *data,
1974         unsigned int    len,
1975         ctlx_cmdcb_t cmdcb,
1976         ctlx_usercb_t usercb,
1977         void    *usercb_data)
1978 {
1979         int                     result;
1980         hfa384x_usbctlx_t       *ctlx;
1981
1982         DBFENTER;
1983         ctlx = usbctlx_alloc();
1984         if ( ctlx == NULL ) {
1985                 result = -ENOMEM;
1986                 goto done;
1987         }
1988
1989         /* Initialize the command */
1990         ctlx->outbuf.rmemreq.type =    host2hfa384x_16(HFA384x_USB_RMEMREQ);
1991         ctlx->outbuf.rmemreq.frmlen =  host2hfa384x_16(
1992                                         sizeof(ctlx->outbuf.rmemreq.offset) +
1993                                         sizeof(ctlx->outbuf.rmemreq.page) +
1994                                         len);
1995         ctlx->outbuf.rmemreq.offset =   host2hfa384x_16(offset);
1996         ctlx->outbuf.rmemreq.page =     host2hfa384x_16(page);
1997
1998         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1999
2000         WLAN_LOG_DEBUG(4,
2001                 "type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
2002                 ctlx->outbuf.rmemreq.type,
2003                 ctlx->outbuf.rmemreq.frmlen,
2004                 ctlx->outbuf.rmemreq.offset,
2005                 ctlx->outbuf.rmemreq.page);
2006
2007         WLAN_LOG_DEBUG(4,"pktsize=%zd\n",
2008                 ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
2009
2010         ctlx->reapable = mode;
2011         ctlx->cmdcb = cmdcb;
2012         ctlx->usercb = usercb;
2013         ctlx->usercb_data = usercb_data;
2014
2015         result = hfa384x_usbctlx_submit(hw, ctlx);
2016         if (result != 0) {
2017                 kfree(ctlx);
2018         } else if ( mode == DOWAIT ) {
2019                 usbctlx_rmem_completor_t completor;
2020
2021                 result = hfa384x_usbctlx_complete_sync(
2022                            hw, ctlx, init_rmem_completor(&completor,
2023                                                          &ctlx->inbuf.rmemresp,
2024                                                          data,
2025                                                          len) );
2026         }
2027
2028 done:
2029         DBFEXIT;
2030         return result;
2031 }
2032
2033
2034
2035 /*----------------------------------------------------------------
2036 * hfa384x_dowmem
2037 *
2038 * Constructs a writemem CTLX and issues it.
2039 *
2040 * NOTE: Any changes to the 'post-submit' code in this function
2041 *       need to be carried over to hfa384x_cbwmem() since the handling
2042 *       is virtually identical.
2043 *
2044 * Arguments:
2045 *       hw              device structure
2046 *       mode            DOWAIT or DOASYNC
2047 *       page            MAC address space page (CMD format)
2048 *       offset          MAC address space offset
2049 *       data            Ptr to data buffer containing write data
2050 *       len             Length of the data to read (max == 2048)
2051 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
2052 *       usercb          user callback for async calls, NULL for DOWAIT calls
2053 *       usercb_data     user supplied data pointer for async calls.
2054 *
2055 * Returns:
2056 *       0               success
2057 *       -ETIMEDOUT      timed out waiting for register ready or
2058 *                       command completion
2059 *       >0              command indicated error, Status and Resp0-2 are
2060 *                       in hw structure.
2061 *
2062 * Side effects:
2063 *
2064 * Call context:
2065 *       interrupt (DOWAIT)
2066 *       process (DOWAIT or DOASYNC)
2067 ----------------------------------------------------------------*/
2068 static int
2069 hfa384x_dowmem(
2070         hfa384x_t *hw,
2071         CMD_MODE mode,
2072         u16     page,
2073         u16     offset,
2074         void    *data,
2075         unsigned int    len,
2076         ctlx_cmdcb_t cmdcb,
2077         ctlx_usercb_t usercb,
2078         void    *usercb_data)
2079 {
2080         int                     result;
2081         hfa384x_usbctlx_t       *ctlx;
2082
2083         DBFENTER;
2084         WLAN_LOG_DEBUG(5, "page=0x%04x offset=0x%04x len=%d\n",
2085                 page,offset,len);
2086
2087         ctlx = usbctlx_alloc();
2088         if ( ctlx == NULL ) {
2089                 result = -ENOMEM;
2090                 goto done;
2091         }
2092
2093         /* Initialize the command */
2094         ctlx->outbuf.wmemreq.type =   host2hfa384x_16(HFA384x_USB_WMEMREQ);
2095         ctlx->outbuf.wmemreq.frmlen = host2hfa384x_16(
2096                                         sizeof(ctlx->outbuf.wmemreq.offset) +
2097                                         sizeof(ctlx->outbuf.wmemreq.page) +
2098                                         len);
2099         ctlx->outbuf.wmemreq.offset = host2hfa384x_16(offset);
2100         ctlx->outbuf.wmemreq.page =   host2hfa384x_16(page);
2101         memcpy(ctlx->outbuf.wmemreq.data, data, len);
2102
2103         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
2104                            sizeof(ctlx->outbuf.wmemreq.frmlen) +
2105                            sizeof(ctlx->outbuf.wmemreq.offset) +
2106                            sizeof(ctlx->outbuf.wmemreq.page) +
2107                            len;
2108
2109         ctlx->reapable = mode;
2110         ctlx->cmdcb = cmdcb;
2111         ctlx->usercb = usercb;
2112         ctlx->usercb_data = usercb_data;
2113
2114         result = hfa384x_usbctlx_submit(hw, ctlx);
2115         if (result != 0) {
2116                 kfree(ctlx);
2117         } else if ( mode == DOWAIT ) {
2118                 usbctlx_wmem_completor_t completor;
2119                 hfa384x_cmdresult_t wmemresult;
2120
2121                 result = hfa384x_usbctlx_complete_sync(
2122                                hw,
2123                                ctlx,
2124                                init_wmem_completor(&completor,
2125                                                    &ctlx->inbuf.wmemresp,
2126                                                    &wmemresult) );
2127         }
2128
2129 done:
2130         DBFEXIT;
2131         return result;
2132 }
2133
2134
2135 /*----------------------------------------------------------------
2136 * hfa384x_drvr_commtallies
2137 *
2138 * Send a commtallies inquiry to the MAC.  Note that this is an async
2139 * call that will result in an info frame arriving sometime later.
2140 *
2141 * Arguments:
2142 *       hw              device structure
2143 *
2144 * Returns:
2145 *       zero            success.
2146 *
2147 * Side effects:
2148 *
2149 * Call context:
2150 *       process
2151 ----------------------------------------------------------------*/
2152 int hfa384x_drvr_commtallies( hfa384x_t *hw )
2153 {
2154         hfa384x_metacmd_t cmd;
2155
2156         DBFENTER;
2157
2158         cmd.cmd = HFA384x_CMDCODE_INQ;
2159         cmd.parm0 = HFA384x_IT_COMMTALLIES;
2160         cmd.parm1 = 0;
2161         cmd.parm2 = 0;
2162
2163         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
2164
2165         DBFEXIT;
2166         return 0;
2167 }
2168
2169
2170 /*----------------------------------------------------------------
2171 * hfa384x_drvr_disable
2172 *
2173 * Issues the disable command to stop communications on one of
2174 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2175 * APs may also disable macports 1-6.  Only ports that have been
2176 * previously enabled may be disabled.
2177 *
2178 * Arguments:
2179 *       hw              device structure
2180 *       macport         MAC port number (host order)
2181 *
2182 * Returns:
2183 *       0               success
2184 *       >0              f/w reported failure - f/w status code
2185 *       <0              driver reported error (timeout|bad arg)
2186 *
2187 * Side effects:
2188 *
2189 * Call context:
2190 *       process
2191 ----------------------------------------------------------------*/
2192 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
2193 {
2194         int     result = 0;
2195
2196         DBFENTER;
2197         if ((!hw->isap && macport != 0) ||
2198             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2199             !(hw->port_enabled[macport]) ){
2200                 result = -EINVAL;
2201         } else {
2202                 result = hfa384x_cmd_disable(hw, macport);
2203                 if ( result == 0 ) {
2204                         hw->port_enabled[macport] = 0;
2205                 }
2206         }
2207         DBFEXIT;
2208         return result;
2209 }
2210
2211
2212 /*----------------------------------------------------------------
2213 * hfa384x_drvr_enable
2214 *
2215 * Issues the enable command to enable communications on one of
2216 * the MACs 'ports'.  Only macport 0 is valid  for stations.
2217 * APs may also enable macports 1-6.  Only ports that are currently
2218 * disabled may be enabled.
2219 *
2220 * Arguments:
2221 *       hw              device structure
2222 *       macport         MAC port number
2223 *
2224 * Returns:
2225 *       0               success
2226 *       >0              f/w reported failure - f/w status code
2227 *       <0              driver reported error (timeout|bad arg)
2228 *
2229 * Side effects:
2230 *
2231 * Call context:
2232 *       process
2233 ----------------------------------------------------------------*/
2234 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
2235 {
2236         int     result = 0;
2237
2238         DBFENTER;
2239         if ((!hw->isap && macport != 0) ||
2240             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
2241             (hw->port_enabled[macport]) ){
2242                 result = -EINVAL;
2243         } else {
2244                 result = hfa384x_cmd_enable(hw, macport);
2245                 if ( result == 0 ) {
2246                         hw->port_enabled[macport] = 1;
2247                 }
2248         }
2249         DBFEXIT;
2250         return result;
2251 }
2252
2253
2254 /*----------------------------------------------------------------
2255 * hfa384x_drvr_flashdl_enable
2256 *
2257 * Begins the flash download state.  Checks to see that we're not
2258 * already in a download state and that a port isn't enabled.
2259 * Sets the download state and retrieves the flash download
2260 * buffer location, buffer size, and timeout length.
2261 *
2262 * Arguments:
2263 *       hw              device structure
2264 *
2265 * Returns:
2266 *       0               success
2267 *       >0              f/w reported error - f/w status code
2268 *       <0              driver reported error
2269 *
2270 * Side effects:
2271 *
2272 * Call context:
2273 *       process
2274 ----------------------------------------------------------------*/
2275 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
2276 {
2277         int             result = 0;
2278         int             i;
2279
2280         DBFENTER;
2281         /* Check that a port isn't active */
2282         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2283                 if ( hw->port_enabled[i] ) {
2284                         WLAN_LOG_DEBUG(1,"called when port enabled.\n");
2285                         return -EINVAL;
2286                 }
2287         }
2288
2289         /* Check that we're not already in a download state */
2290         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2291                 return -EINVAL;
2292         }
2293
2294         /* Retrieve the buffer loc&size and timeout */
2295         if ( (result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
2296                                 &(hw->bufinfo), sizeof(hw->bufinfo))) ) {
2297                 return result;
2298         }
2299         hw->bufinfo.page = hfa384x2host_16(hw->bufinfo.page);
2300         hw->bufinfo.offset = hfa384x2host_16(hw->bufinfo.offset);
2301         hw->bufinfo.len = hfa384x2host_16(hw->bufinfo.len);
2302         if ( (result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
2303                                 &(hw->dltimeout))) ) {
2304                 return result;
2305         }
2306         hw->dltimeout = hfa384x2host_16(hw->dltimeout);
2307
2308         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2309
2310         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
2311         DBFEXIT;
2312         return result;
2313 }
2314
2315
2316 /*----------------------------------------------------------------
2317 * hfa384x_drvr_flashdl_disable
2318 *
2319 * Ends the flash download state.  Note that this will cause the MAC
2320 * firmware to restart.
2321 *
2322 * Arguments:
2323 *       hw              device structure
2324 *
2325 * Returns:
2326 *       0               success
2327 *       >0              f/w reported error - f/w status code
2328 *       <0              driver reported error
2329 *
2330 * Side effects:
2331 *
2332 * Call context:
2333 *       process
2334 ----------------------------------------------------------------*/
2335 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
2336 {
2337         DBFENTER;
2338         /* Check that we're already in the download state */
2339         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2340                 return -EINVAL;
2341         }
2342
2343         WLAN_LOG_DEBUG(1,"flashdl_enable\n");
2344
2345         /* There isn't much we can do at this point, so I don't */
2346         /*  bother  w/ the return value */
2347         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2348         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2349
2350         DBFEXIT;
2351         return 0;
2352 }
2353
2354
2355 /*----------------------------------------------------------------
2356 * hfa384x_drvr_flashdl_write
2357 *
2358 * Performs a FLASH download of a chunk of data. First checks to see
2359 * that we're in the FLASH download state, then sets the download
2360 * mode, uses the aux functions to 1) copy the data to the flash
2361 * buffer, 2) sets the download 'write flash' mode, 3) readback and
2362 * compare.  Lather rinse, repeat as many times an necessary to get
2363 * all the given data into flash.
2364 * When all data has been written using this function (possibly
2365 * repeatedly), call drvr_flashdl_disable() to end the download state
2366 * and restart the MAC.
2367 *
2368 * Arguments:
2369 *       hw              device structure
2370 *       daddr           Card address to write to. (host order)
2371 *       buf             Ptr to data to write.
2372 *       len             Length of data (host order).
2373 *
2374 * Returns:
2375 *       0               success
2376 *       >0              f/w reported error - f/w status code
2377 *       <0              driver reported error
2378 *
2379 * Side effects:
2380 *
2381 * Call context:
2382 *       process
2383 ----------------------------------------------------------------*/
2384 int
2385 hfa384x_drvr_flashdl_write(
2386         hfa384x_t       *hw,
2387         u32             daddr,
2388         void            *buf,
2389         u32             len)
2390 {
2391         int             result = 0;
2392         u32             dlbufaddr;
2393         int             nburns;
2394         u32             burnlen;
2395         u32             burndaddr;
2396         u16             burnlo;
2397         u16             burnhi;
2398         int             nwrites;
2399         u8              *writebuf;
2400         u16             writepage;
2401         u16             writeoffset;
2402         u32             writelen;
2403         int             i;
2404         int             j;
2405
2406         DBFENTER;
2407         WLAN_LOG_DEBUG(5,"daddr=0x%08x len=%d\n", daddr, len);
2408
2409         /* Check that we're in the flash download state */
2410         if ( hw->dlstate != HFA384x_DLSTATE_FLASHENABLED ) {
2411                 return -EINVAL;
2412         }
2413
2414         WLAN_LOG_INFO("Download %d bytes to flash @0x%06x\n", len, daddr);
2415
2416         /* Convert to flat address for arithmetic */
2417         /* NOTE: dlbuffer RID stores the address in AUX format */
2418         dlbufaddr = HFA384x_ADDR_AUX_MKFLAT(
2419                         hw->bufinfo.page, hw->bufinfo.offset);
2420         WLAN_LOG_DEBUG(5,
2421                 "dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2422                 hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2423
2424 #if 0
2425 WLAN_LOG_WARNING("dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr, hw->bufinfo.len, hw->dltimeout);
2426 #endif
2427         /* Calculations to determine how many fills of the dlbuffer to do
2428          * and how many USB wmemreq's to do for each fill.  At this point
2429          * in time, the dlbuffer size and the wmemreq size are the same.
2430          * Therefore, nwrites should always be 1.  The extra complexity
2431          * here is a hedge against future changes.
2432          */
2433
2434         /* Figure out how many times to do the flash programming */
2435         nburns = len / hw->bufinfo.len;
2436         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2437
2438         /* For each flash program cycle, how many USB wmemreq's are needed? */
2439         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2440         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2441
2442         /* For each burn */
2443         for ( i = 0; i < nburns; i++) {
2444                 /* Get the dest address and len */
2445                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2446                                 hw->bufinfo.len :
2447                                 (len - (hw->bufinfo.len * i));
2448                 burndaddr = daddr + (hw->bufinfo.len * i);
2449                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2450                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2451
2452                 WLAN_LOG_INFO("Writing %d bytes to flash @0x%06x\n",
2453                         burnlen, burndaddr);
2454
2455                 /* Set the download mode */
2456                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2457                                 burnlo, burnhi, burnlen);
2458                 if ( result ) {
2459                         WLAN_LOG_ERROR("download(NV,lo=%x,hi=%x,len=%x) "
2460                                 "cmd failed, result=%d. Aborting d/l\n",
2461                                 burnlo, burnhi, burnlen, result);
2462                         goto exit_proc;
2463                 }
2464
2465                 /* copy the data to the flash download buffer */
2466                 for ( j=0; j < nwrites; j++) {
2467                         writebuf = buf +
2468                                 (i*hw->bufinfo.len) +
2469                                 (j*HFA384x_USB_RWMEM_MAXLEN);
2470
2471                         writepage = HFA384x_ADDR_CMD_MKPAGE(
2472                                         dlbufaddr +
2473                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2474                         writeoffset = HFA384x_ADDR_CMD_MKOFF(
2475                                         dlbufaddr +
2476                                         (j*HFA384x_USB_RWMEM_MAXLEN));
2477
2478                         writelen = burnlen-(j*HFA384x_USB_RWMEM_MAXLEN);
2479                         writelen = writelen  > HFA384x_USB_RWMEM_MAXLEN ?
2480                                         HFA384x_USB_RWMEM_MAXLEN :
2481                                         writelen;
2482
2483                         result = hfa384x_dowmem_wait( hw,
2484                                         writepage,
2485                                         writeoffset,
2486                                         writebuf,
2487                                         writelen );
2488 #if 0
2489
2490 Comment out for debugging, assume the write was successful.
2491                         if (result) {
2492                                 WLAN_LOG_ERROR(
2493                                         "Write to dl buffer failed, "
2494                                         "result=0x%04x. Aborting.\n",
2495                                         result);
2496                                 goto exit_proc;
2497                         }
2498 #endif
2499
2500                 }
2501
2502                 /* set the download 'write flash' mode */
2503                 result = hfa384x_cmd_download(hw,
2504                                 HFA384x_PROGMODE_NVWRITE,
2505                                 0,0,0);
2506                 if ( result ) {
2507                         WLAN_LOG_ERROR(
2508                                 "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2509                                 "cmd failed, result=%d. Aborting d/l\n",
2510                                 burnlo, burnhi, burnlen, result);
2511                         goto exit_proc;
2512                 }
2513
2514                 /* TODO: We really should do a readback and compare. */
2515         }
2516
2517 exit_proc:
2518
2519         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2520         /*  actually disable programming mode.  Remember, that will cause the */
2521         /*  the firmware to effectively reset itself. */
2522
2523         DBFEXIT;
2524         return result;
2525 }
2526
2527
2528 /*----------------------------------------------------------------
2529 * hfa384x_drvr_getconfig
2530 *
2531 * Performs the sequence necessary to read a config/info item.
2532 *
2533 * Arguments:
2534 *       hw              device structure
2535 *       rid             config/info record id (host order)
2536 *       buf             host side record buffer.  Upon return it will
2537 *                       contain the body portion of the record (minus the
2538 *                       RID and len).
2539 *       len             buffer length (in bytes, should match record length)
2540 *
2541 * Returns:
2542 *       0               success
2543 *       >0              f/w reported error - f/w status code
2544 *       <0              driver reported error
2545 *       -ENODATA        length mismatch between argument and retrieved
2546 *                       record.
2547 *
2548 * Side effects:
2549 *
2550 * Call context:
2551 *       process
2552 ----------------------------------------------------------------*/
2553 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2554 {
2555         int                     result;
2556         DBFENTER;
2557
2558         result = hfa384x_dorrid_wait(hw, rid, buf, len);
2559
2560         DBFEXIT;
2561         return result;
2562 }
2563
2564 /*----------------------------------------------------------------
2565  * hfa384x_drvr_getconfig_async
2566  *
2567  * Performs the sequence necessary to perform an async read of
2568  * of a config/info item.
2569  *
2570  * Arguments:
2571  *       hw              device structure
2572  *       rid             config/info record id (host order)
2573  *       buf             host side record buffer.  Upon return it will
2574  *                       contain the body portion of the record (minus the
2575  *                       RID and len).
2576  *       len             buffer length (in bytes, should match record length)
2577  *       cbfn            caller supplied callback, called when the command
2578  *                       is done (successful or not).
2579  *       cbfndata        pointer to some caller supplied data that will be
2580  *                       passed in as an argument to the cbfn.
2581  *
2582  * Returns:
2583  *       nothing         the cbfn gets a status argument identifying if
2584  *                       any errors occur.
2585  * Side effects:
2586  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2587  *
2588  * Call context:
2589  *       Any
2590  ----------------------------------------------------------------*/
2591 int
2592 hfa384x_drvr_getconfig_async(
2593          hfa384x_t               *hw,
2594          u16                  rid,
2595          ctlx_usercb_t           usercb,
2596          void                    *usercb_data)
2597 {
2598          return hfa384x_dorrid_async(hw, rid, NULL, 0,
2599                                      hfa384x_cb_rrid, usercb, usercb_data);
2600 }
2601
2602 /*----------------------------------------------------------------
2603  * hfa384x_drvr_setconfig_async
2604  *
2605  * Performs the sequence necessary to write a config/info item.
2606  *
2607  * Arguments:
2608  *       hw              device structure
2609  *       rid             config/info record id (in host order)
2610  *       buf             host side record buffer
2611  *       len             buffer length (in bytes)
2612  *       usercb          completion callback
2613  *       usercb_data     completion callback argument
2614  *
2615  * Returns:
2616  *       0               success
2617  *       >0              f/w reported error - f/w status code
2618  *       <0              driver reported error
2619  *
2620  * Side effects:
2621  *
2622  * Call context:
2623  *       process
2624  ----------------------------------------------------------------*/
2625 int
2626 hfa384x_drvr_setconfig_async(
2627          hfa384x_t       *hw,
2628          u16          rid,
2629          void            *buf,
2630          u16          len,
2631          ctlx_usercb_t   usercb,
2632          void            *usercb_data)
2633 {
2634         return hfa384x_dowrid_async(hw, rid, buf, len,
2635                                     hfa384x_cb_status, usercb, usercb_data);
2636 }
2637
2638 /*----------------------------------------------------------------
2639 * hfa384x_drvr_handover
2640 *
2641 * Sends a handover notification to the MAC.
2642 *
2643 * Arguments:
2644 *       hw              device structure
2645 *       addr            address of station that's left
2646 *
2647 * Returns:
2648 *       zero            success.
2649 *       -ERESTARTSYS    received signal while waiting for semaphore.
2650 *       -EIO            failed to write to bap, or failed in cmd.
2651 *
2652 * Side effects:
2653 *
2654 * Call context:
2655 *       process
2656 ----------------------------------------------------------------*/
2657 int hfa384x_drvr_handover( hfa384x_t *hw, u8 *addr)
2658 {
2659         DBFENTER;
2660         WLAN_LOG_ERROR("Not currently supported in USB!\n");
2661         DBFEXIT;
2662         return -EIO;
2663 }
2664
2665 /*----------------------------------------------------------------
2666 * hfa384x_drvr_low_level
2667 *
2668 * Write test commands to the card.  Some test commands don't make
2669 * sense without prior set-up.  For example, continous TX isn't very
2670 * useful until you set the channel.  That functionality should be
2671 *
2672 * Side effects:
2673 *
2674 * Call context:
2675 *      process thread
2676 * -----------------------------------------------------------------*/
2677 int hfa384x_drvr_low_level(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
2678 {
2679         int             result;
2680         DBFENTER;
2681
2682         /* Do i need a host2hfa... conversion ? */
2683
2684         result = hfa384x_docmd_wait(hw, cmd);
2685
2686         DBFEXIT;
2687         return result;
2688 }
2689
2690 /*----------------------------------------------------------------
2691 * hfa384x_drvr_mmi_read
2692 *
2693 * Read mmi registers.  mmi is intersil-speak for the baseband
2694 * processor registers.
2695 *
2696 * Arguments:
2697 *       hw              device structure
2698 *       register        The test register to be accessed (must be even #).
2699 *
2700 * Returns:
2701 *       0               success
2702 *       >0              f/w reported error - f/w status code
2703 *       <0              driver reported error
2704 *
2705 * Side effects:
2706 *
2707 * Call context:
2708 *       process
2709 ----------------------------------------------------------------*/
2710 int hfa384x_drvr_mmi_read(hfa384x_t *hw, u32 addr, u32 *resp)
2711 {
2712 #if 0
2713         int             result = 0;
2714         u16  cmd_code = (u16) 0x30;
2715         u16 param = (u16) addr;
2716         DBFENTER;
2717
2718         /* Do i need a host2hfa... conversion ? */
2719         result = hfa384x_docmd_wait(hw, cmd_code);
2720
2721         DBFEXIT;
2722         return result;
2723 #endif
2724 return 0;
2725 }
2726
2727 /*----------------------------------------------------------------
2728 * hfa384x_drvr_mmi_write
2729 *
2730 * Read mmi registers.  mmi is intersil-speak for the baseband
2731 * processor registers.
2732 *
2733 * Arguments:
2734 *       hw              device structure
2735 *       addr            The test register to be accessed (must be even #).
2736 *       data            The data value to write to the register.
2737 *
2738 * Returns:
2739 *       0               success
2740 *       >0              f/w reported error - f/w status code
2741 *       <0              driver reported error
2742 *
2743 * Side effects:
2744 *
2745 * Call context:
2746 *       process
2747 ----------------------------------------------------------------*/
2748
2749 int
2750 hfa384x_drvr_mmi_write(hfa384x_t *hw, u32 addr, u32 data)
2751 {
2752 #if 0
2753         int             result = 0;
2754         u16  cmd_code = (u16) 0x31;
2755         u16 param0 = (u16) addr;
2756         u16 param1 = (u16) data;
2757         DBFENTER;
2758
2759         WLAN_LOG_DEBUG(1,"mmi write : addr = 0x%08lx\n", addr);
2760         WLAN_LOG_DEBUG(1,"mmi write : data = 0x%08lx\n", data);
2761
2762         /* Do i need a host2hfa... conversion ? */
2763         result = hfa384x_docmd_wait(hw, cmd_code);
2764
2765         DBFEXIT;
2766         return result;
2767 #endif
2768 return 0;
2769 }
2770
2771
2772 /*----------------------------------------------------------------
2773 * hfa384x_drvr_ramdl_disable
2774 *
2775 * Ends the ram download state.
2776 *
2777 * Arguments:
2778 *       hw              device structure
2779 *
2780 * Returns:
2781 *       0               success
2782 *       >0              f/w reported error - f/w status code
2783 *       <0              driver reported error
2784 *
2785 * Side effects:
2786 *
2787 * Call context:
2788 *       process
2789 ----------------------------------------------------------------*/
2790 int
2791 hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2792 {
2793         DBFENTER;
2794         /* Check that we're already in the download state */
2795         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2796                 return -EINVAL;
2797         }
2798
2799         WLAN_LOG_DEBUG(3,"ramdl_disable()\n");
2800
2801         /* There isn't much we can do at this point, so I don't */
2802         /*  bother  w/ the return value */
2803         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0 , 0);
2804         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2805
2806         DBFEXIT;
2807         return 0;
2808 }
2809
2810
2811 /*----------------------------------------------------------------
2812 * hfa384x_drvr_ramdl_enable
2813 *
2814 * Begins the ram download state.  Checks to see that we're not
2815 * already in a download state and that a port isn't enabled.
2816 * Sets the download state and calls cmd_download with the
2817 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2818 *
2819 * Arguments:
2820 *       hw              device structure
2821 *       exeaddr         the card execution address that will be
2822 *                       jumped to when ramdl_disable() is called
2823 *                       (host order).
2824 *
2825 * Returns:
2826 *       0               success
2827 *       >0              f/w reported error - f/w status code
2828 *       <0              driver reported error
2829 *
2830 * Side effects:
2831 *
2832 * Call context:
2833 *       process
2834 ----------------------------------------------------------------*/
2835 int
2836 hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2837 {
2838         int             result = 0;
2839         u16             lowaddr;
2840         u16             hiaddr;
2841         int             i;
2842         DBFENTER;
2843         /* Check that a port isn't active */
2844         for ( i = 0; i < HFA384x_PORTID_MAX; i++) {
2845                 if ( hw->port_enabled[i] ) {
2846                         WLAN_LOG_ERROR(
2847                                 "Can't download with a macport enabled.\n");
2848                         return -EINVAL;
2849                 }
2850         }
2851
2852         /* Check that we're not already in a download state */
2853         if ( hw->dlstate != HFA384x_DLSTATE_DISABLED ) {
2854                 WLAN_LOG_ERROR(
2855                         "Download state not disabled.\n");
2856                 return -EINVAL;
2857         }
2858
2859         WLAN_LOG_DEBUG(3,"ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2860
2861         /* Call the download(1,addr) function */
2862         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2863         hiaddr =  HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2864
2865         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2866                         lowaddr, hiaddr, 0);
2867
2868         if ( result == 0) {
2869                 /* Set the download state */
2870                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2871         } else {
2872                 WLAN_LOG_DEBUG(1,
2873                         "cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2874                         lowaddr,
2875                         hiaddr,
2876                         result);
2877         }
2878
2879         DBFEXIT;
2880         return result;
2881 }
2882
2883
2884 /*----------------------------------------------------------------
2885 * hfa384x_drvr_ramdl_write
2886 *
2887 * Performs a RAM download of a chunk of data. First checks to see
2888 * that we're in the RAM download state, then uses the [read|write]mem USB
2889 * commands to 1) copy the data, 2) readback and compare.  The download
2890 * state is unaffected.  When all data has been written using
2891 * this function, call drvr_ramdl_disable() to end the download state
2892 * and restart the MAC.
2893 *
2894 * Arguments:
2895 *       hw              device structure
2896 *       daddr           Card address to write to. (host order)
2897 *       buf             Ptr to data to write.
2898 *       len             Length of data (host order).
2899 *
2900 * Returns:
2901 *       0               success
2902 *       >0              f/w reported error - f/w status code
2903 *       <0              driver reported error
2904 *
2905 * Side effects:
2906 *
2907 * Call context:
2908 *       process
2909 ----------------------------------------------------------------*/
2910 int
2911 hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void* buf, u32 len)
2912 {
2913         int             result = 0;
2914         int             nwrites;
2915         u8              *data = buf;
2916         int             i;
2917         u32             curraddr;
2918         u16             currpage;
2919         u16             curroffset;
2920         u16             currlen;
2921         DBFENTER;
2922         /* Check that we're in the ram download state */
2923         if ( hw->dlstate != HFA384x_DLSTATE_RAMENABLED ) {
2924                 return -EINVAL;
2925         }
2926
2927         WLAN_LOG_INFO("Writing %d bytes to ram @0x%06x\n", len, daddr);
2928
2929         /* How many dowmem calls?  */
2930         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2931         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2932
2933         /* Do blocking wmem's */
2934         for(i=0; i < nwrites; i++) {
2935                 /* make address args */
2936                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2937                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2938                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2939                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2940                 if ( currlen > HFA384x_USB_RWMEM_MAXLEN) {
2941                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2942                 }
2943
2944                 /* Do blocking ctlx */
2945                 result = hfa384x_dowmem_wait( hw,
2946                                 currpage,
2947                                 curroffset,
2948                                 data + (i*HFA384x_USB_RWMEM_MAXLEN),
2949                                 currlen );
2950
2951                 if (result) break;
2952
2953                 /* TODO: We really should have a readback. */
2954         }
2955
2956         DBFEXIT;
2957         return result;
2958 }
2959
2960
2961 /*----------------------------------------------------------------
2962 * hfa384x_drvr_readpda
2963 *
2964 * Performs the sequence to read the PDA space.  Note there is no
2965 * drvr_writepda() function.  Writing a PDA is
2966 * generally implemented by a calling component via calls to
2967 * cmd_download and writing to the flash download buffer via the
2968 * aux regs.
2969 *
2970 * Arguments:
2971 *       hw              device structure
2972 *       buf             buffer to store PDA in
2973 *       len             buffer length
2974 *
2975 * Returns:
2976 *       0               success
2977 *       >0              f/w reported error - f/w status code
2978 *       <0              driver reported error
2979 *       -ETIMEOUT       timout waiting for the cmd regs to become
2980 *                       available, or waiting for the control reg
2981 *                       to indicate the Aux port is enabled.
2982 *       -ENODATA        the buffer does NOT contain a valid PDA.
2983 *                       Either the card PDA is bad, or the auxdata
2984 *                       reads are giving us garbage.
2985
2986 *
2987 * Side effects:
2988 *
2989 * Call context:
2990 *       process or non-card interrupt.
2991 ----------------------------------------------------------------*/
2992 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2993 {
2994         int             result = 0;
2995         u16             *pda = buf;
2996         int             pdaok = 0;
2997         int             morepdrs = 1;
2998         int             currpdr = 0;    /* word offset of the current pdr */
2999         size_t          i;
3000         u16             pdrlen;         /* pdr length in bytes, host order */
3001         u16             pdrcode;        /* pdr code, host order */
3002         u16             currpage;
3003         u16             curroffset;
3004         struct pdaloc {
3005                 u32     cardaddr;
3006                 u16     auxctl;
3007         } pdaloc[] =
3008         {
3009                 { HFA3842_PDA_BASE,             0},
3010                 { HFA3841_PDA_BASE,             0},
3011                 { HFA3841_PDA_BOGUS_BASE,       0}
3012         };
3013
3014         DBFENTER;
3015
3016         /* Read the pda from each known address.  */
3017         for ( i = 0; i < ARRAY_SIZE(pdaloc); i++) {
3018                 /* Make address */
3019                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
3020                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
3021
3022                 result = hfa384x_dormem_wait(hw,
3023                         currpage,
3024                         curroffset,
3025                         buf,
3026                         len);           /* units of bytes */
3027
3028                 if (result) {
3029                         WLAN_LOG_WARNING(
3030                                           "Read from index %zd failed, continuing\n",
3031                                 i );
3032                         continue;
3033                 }
3034
3035                 /* Test for garbage */
3036                 pdaok = 1;      /* initially assume good */
3037                 morepdrs = 1;
3038                 while ( pdaok && morepdrs ) {
3039                         pdrlen = hfa384x2host_16(pda[currpdr]) * 2;
3040                         pdrcode = hfa384x2host_16(pda[currpdr+1]);
3041                         /* Test the record length */
3042                         if ( pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
3043                                 WLAN_LOG_ERROR("pdrlen invalid=%d\n",
3044                                         pdrlen);
3045                                 pdaok = 0;
3046                                 break;
3047                         }
3048                         /* Test the code */
3049                         if ( !hfa384x_isgood_pdrcode(pdrcode) ) {
3050                                 WLAN_LOG_ERROR("pdrcode invalid=%d\n",
3051                                         pdrcode);
3052                                 pdaok = 0;
3053                                 break;
3054                         }
3055                         /* Test for completion */
3056                         if ( pdrcode == HFA384x_PDR_END_OF_PDA) {
3057                                 morepdrs = 0;
3058                         }
3059
3060                         /* Move to the next pdr (if necessary) */
3061                         if ( morepdrs ) {
3062                                 /* note the access to pda[], need words here */
3063                                 currpdr += hfa384x2host_16(pda[currpdr]) + 1;
3064                         }
3065                 }
3066                 if ( pdaok ) {
3067                         WLAN_LOG_INFO(
3068                                 "PDA Read from 0x%08x in %s space.\n",
3069                                 pdaloc[i].cardaddr,
3070                                 pdaloc[i].auxctl == 0 ? "EXTDS" :
3071                                 pdaloc[i].auxctl == 1 ? "NV" :
3072                                 pdaloc[i].auxctl == 2 ? "PHY" :
3073                                 pdaloc[i].auxctl == 3 ? "ICSRAM" :
3074                                 "<bogus auxctl>");
3075                         break;
3076                 }
3077         }
3078         result = pdaok ? 0 : -ENODATA;
3079
3080         if ( result ) {
3081                 WLAN_LOG_DEBUG(3,"Failure: pda is not okay\n");
3082         }
3083
3084         DBFEXIT;
3085         return result;
3086 }
3087
3088
3089 /*----------------------------------------------------------------
3090 * hfa384x_drvr_setconfig
3091 *
3092 * Performs the sequence necessary to write a config/info item.
3093 *
3094 * Arguments:
3095 *       hw              device structure
3096 *       rid             config/info record id (in host order)
3097 *       buf             host side record buffer
3098 *       len             buffer length (in bytes)
3099 *
3100 * Returns:
3101 *       0               success
3102 *       >0              f/w reported error - f/w status code
3103 *       <0              driver reported error
3104 *
3105 * Side effects:
3106 *
3107 * Call context:
3108 *       process
3109 ----------------------------------------------------------------*/
3110 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
3111 {
3112         return hfa384x_dowrid_wait(hw, rid, buf, len);
3113 }
3114
3115 /*----------------------------------------------------------------
3116 * hfa384x_drvr_start
3117 *
3118 * Issues the MAC initialize command, sets up some data structures,
3119 * and enables the interrupts.  After this function completes, the
3120 * low-level stuff should be ready for any/all commands.
3121 *
3122 * Arguments:
3123 *       hw              device structure
3124 * Returns:
3125 *       0               success
3126 *       >0              f/w reported error - f/w status code
3127 *       <0              driver reported error
3128 *
3129 * Side effects:
3130 *
3131 * Call context:
3132 *       process
3133 ----------------------------------------------------------------*/
3134 int hfa384x_drvr_start(hfa384x_t *hw)
3135 {
3136         int             result;
3137         DBFENTER;
3138
3139         might_sleep();
3140
3141         if (usb_clear_halt(hw->usb, hw->endp_in)) {
3142                 WLAN_LOG_ERROR(
3143                         "Failed to reset bulk in endpoint.\n");
3144         }
3145
3146         if (usb_clear_halt(hw->usb, hw->endp_out)) {
3147                 WLAN_LOG_ERROR(
3148                         "Failed to reset bulk out endpoint.\n");
3149         }
3150
3151         /* Synchronous unlink, in case we're trying to restart the driver */
3152         usb_kill_urb(&hw->rx_urb);
3153
3154         /* Post the IN urb */
3155         result = submit_rx_urb(hw, GFP_KERNEL);
3156         if (result != 0) {
3157                 WLAN_LOG_ERROR(
3158                         "Fatal, failed to submit RX URB, result=%d\n",
3159                         result);
3160                 goto done;
3161         }
3162
3163         /* call initialize */
3164         result = hfa384x_cmd_initialize(hw);
3165         if (result != 0) {
3166                 usb_kill_urb(&hw->rx_urb);
3167                 WLAN_LOG_ERROR(
3168                         "cmd_initialize() failed, result=%d\n",
3169                         result);
3170                 goto done;
3171         }
3172
3173         hw->state = HFA384x_STATE_RUNNING;
3174
3175 done:
3176         DBFEXIT;
3177         return result;
3178 }
3179
3180
3181 /*----------------------------------------------------------------
3182 * hfa384x_drvr_stop
3183 *
3184 * Shuts down the MAC to the point where it is safe to unload the
3185 * driver.  Any subsystem that may be holding a data or function
3186 * ptr into the driver must be cleared/deinitialized.
3187 *
3188 * Arguments:
3189 *       hw              device structure
3190 * Returns:
3191 *       0               success
3192 *       >0              f/w reported error - f/w status code
3193 *       <0              driver reported error
3194 *
3195 * Side effects:
3196 *
3197 * Call context:
3198 *       process
3199 ----------------------------------------------------------------*/
3200 int
3201 hfa384x_drvr_stop(hfa384x_t *hw)
3202 {
3203         int     result = 0;
3204         int     i;
3205         DBFENTER;
3206
3207         might_sleep();
3208
3209         /* There's no need for spinlocks here. The USB "disconnect"
3210          * function sets this "removed" flag and then calls us.
3211          */
3212         if ( !hw->wlandev->hwremoved ) {
3213                 /* Call initialize to leave the MAC in its 'reset' state */
3214                 hfa384x_cmd_initialize(hw);
3215
3216                 /* Cancel the rxurb */
3217                 usb_kill_urb(&hw->rx_urb);
3218         }
3219
3220         hw->link_status = HFA384x_LINK_NOTCONNECTED;
3221         hw->state = HFA384x_STATE_INIT;
3222
3223         del_timer_sync(&hw->commsqual_timer);
3224
3225         /* Clear all the port status */
3226         for ( i = 0; i < HFA384x_NUMPORTS_MAX; i++) {
3227                 hw->port_enabled[i] = 0;
3228         }
3229
3230         DBFEXIT;
3231         return result;
3232 }
3233
3234 /*----------------------------------------------------------------
3235 * hfa384x_drvr_txframe
3236 *
3237 * Takes a frame from prism2sta and queues it for transmission.
3238 *
3239 * Arguments:
3240 *       hw              device structure
3241 *       skb             packet buffer struct.  Contains an 802.11
3242 *                       data frame.
3243 *       p80211_hdr      points to the 802.11 header for the packet.
3244 * Returns:
3245 *       0               Success and more buffs available
3246 *       1               Success but no more buffs
3247 *       2               Allocation failure
3248 *       4               Buffer full or queue busy
3249 *
3250 * Side effects:
3251 *
3252 * Call context:
3253 *       interrupt
3254 ----------------------------------------------------------------*/
3255 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb, p80211_hdr_t *p80211_hdr, p80211_metawep_t *p80211_wep)
3256
3257 {
3258         int             usbpktlen = sizeof(hfa384x_tx_frame_t);
3259         int             result;
3260         int             ret;
3261         char            *ptr;
3262
3263         DBFENTER;
3264
3265         if (hw->tx_urb.status == -EINPROGRESS) {
3266                 WLAN_LOG_WARNING("TX URB already in use\n");
3267                 result = 3;
3268                 goto exit;
3269         }
3270
3271         /* Build Tx frame structure */
3272         /* Set up the control field */
3273         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
3274
3275         /* Setup the usb type field */
3276         hw->txbuff.type = host2hfa384x_16(HFA384x_USB_TXFRM);
3277
3278         /* Set up the sw_support field to identify this frame */
3279         hw->txbuff.txfrm.desc.sw_support = 0x0123;
3280
3281 /* Tx complete and Tx exception disable per dleach.  Might be causing
3282  * buf depletion
3283  */
3284 //#define DOEXC  SLP -- doboth breaks horribly under load, doexc less so.
3285 #if defined(DOBOTH)
3286         hw->txbuff.txfrm.desc.tx_control =
3287                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3288                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
3289 #elif defined(DOEXC)
3290         hw->txbuff.txfrm.desc.tx_control =
3291                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3292                 HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
3293 #else
3294         hw->txbuff.txfrm.desc.tx_control =
3295                 HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
3296                 HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
3297 #endif
3298         hw->txbuff.txfrm.desc.tx_control =
3299                 host2hfa384x_16(hw->txbuff.txfrm.desc.tx_control);
3300
3301         /* copy the header over to the txdesc */
3302         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr, sizeof(p80211_hdr_t));
3303
3304         /* if we're using host WEP, increase size by IV+ICV */
3305         if (p80211_wep->data) {
3306                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len+8);
3307                 // hw->txbuff.txfrm.desc.tx_control |= HFA384x_TX_NOENCRYPT_SET(1);
3308                 usbpktlen+=8;
3309         } else {
3310                 hw->txbuff.txfrm.desc.data_len = host2hfa384x_16(skb->len);
3311         }
3312
3313         usbpktlen += skb->len;
3314
3315         /* copy over the WEP IV if we are using host WEP */
3316         ptr = hw->txbuff.txfrm.data;
3317         if (p80211_wep->data) {
3318                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
3319                 ptr+= sizeof(p80211_wep->iv);
3320                 memcpy(ptr, p80211_wep->data, skb->len);
3321         } else {
3322                 memcpy(ptr, skb->data, skb->len);
3323         }
3324         /* copy over the packet data */
3325         ptr+= skb->len;
3326
3327         /* copy over the WEP ICV if we are using host WEP */
3328         if (p80211_wep->data) {
3329                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
3330         }
3331
3332         /* Send the USB packet */
3333         usb_fill_bulk_urb( &(hw->tx_urb), hw->usb,
3334                        hw->endp_out,
3335                        &(hw->txbuff), ROUNDUP64(usbpktlen),
3336                        hfa384x_usbout_callback, hw->wlandev );
3337         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
3338
3339         result = 1;
3340         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
3341         if ( ret != 0 ) {
3342                 WLAN_LOG_ERROR(
3343                         "submit_tx_urb() failed, error=%d\n", ret);
3344                 result = 3;
3345         }
3346
3347  exit:
3348         DBFEXIT;
3349         return result;
3350 }
3351
3352 void hfa384x_tx_timeout(wlandevice_t *wlandev)
3353 {
3354         hfa384x_t       *hw = wlandev->priv;
3355         unsigned long flags;
3356
3357         DBFENTER;
3358
3359         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3360
3361         if ( !hw->wlandev->hwremoved &&
3362              /* Note the bitwise OR, not the logical OR. */
3363              ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) |
3364                !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) ) )
3365         {
3366                 schedule_work(&hw->usb_work);
3367         }
3368
3369         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3370
3371         DBFEXIT;
3372 }
3373
3374 /*----------------------------------------------------------------
3375 * hfa384x_usbctlx_reaper_task
3376 *
3377 * Tasklet to delete dead CTLX objects
3378 *
3379 * Arguments:
3380 *       data    ptr to a hfa384x_t
3381 *
3382 * Returns:
3383 *
3384 * Call context:
3385 *       Interrupt
3386 ----------------------------------------------------------------*/
3387 static void hfa384x_usbctlx_reaper_task(unsigned long data)
3388 {
3389         hfa384x_t       *hw = (hfa384x_t*)data;
3390         struct list_head *entry;
3391         struct list_head *temp;
3392         unsigned long   flags;
3393
3394         DBFENTER;
3395
3396         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3397
3398         /* This list is guaranteed to be empty if someone
3399          * has unplugged the adapter.
3400          */
3401         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
3402                 hfa384x_usbctlx_t       *ctlx;
3403
3404                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3405                 list_del(&ctlx->list);
3406                 kfree(ctlx);
3407         }
3408
3409         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3410
3411         DBFEXIT;
3412 }
3413
3414 /*----------------------------------------------------------------
3415 * hfa384x_usbctlx_completion_task
3416 *
3417 * Tasklet to call completion handlers for returned CTLXs
3418 *
3419 * Arguments:
3420 *       data    ptr to hfa384x_t
3421 *
3422 * Returns:
3423 *       Nothing
3424 *
3425 * Call context:
3426 *       Interrupt
3427 ----------------------------------------------------------------*/
3428 static void hfa384x_usbctlx_completion_task(unsigned long data)
3429 {
3430         hfa384x_t *hw = (hfa384x_t*)data;
3431         struct list_head *entry;
3432         struct list_head *temp;
3433         unsigned long flags;
3434
3435         int reap = 0;
3436
3437         DBFENTER;
3438
3439         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3440
3441         /* This list is guaranteed to be empty if someone
3442          * has unplugged the adapter ...
3443          */
3444         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
3445                 hfa384x_usbctlx_t *ctlx;
3446
3447                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
3448
3449                 /* Call the completion function that this
3450                  * command was assigned, assuming it has one.
3451                  */
3452                 if ( ctlx->cmdcb != NULL ) {
3453                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3454                         ctlx->cmdcb(hw, ctlx);
3455                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3456
3457                         /* Make sure we don't try and complete
3458                          * this CTLX more than once!
3459                          */
3460                         ctlx->cmdcb = NULL;
3461
3462                         /* Did someone yank the adapter out
3463                          * while our list was (briefly) unlocked?
3464                          */
3465                         if ( hw->wlandev->hwremoved )
3466                         {
3467                                 reap = 0;
3468                                 break;
3469                         }
3470                 }
3471
3472                 /*
3473                  * "Reapable" CTLXs are ones which don't have any
3474                  * threads waiting for them to die. Hence they must
3475                  * be delivered to The Reaper!
3476                  */
3477                 if ( ctlx->reapable ) {
3478                         /* Move the CTLX off the "completing" list (hopefully)
3479                          * on to the "reapable" list where the reaper task
3480                          * can find it. And "reapable" means that this CTLX
3481                          * isn't sitting on a wait-queue somewhere.
3482                          */
3483                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
3484                         reap = 1;
3485                 }
3486
3487                 complete(&ctlx->done);
3488         }
3489         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3490
3491         if (reap)
3492                 tasklet_schedule(&hw->reaper_bh);
3493
3494         DBFEXIT;
3495 }
3496
3497 /*----------------------------------------------------------------
3498 * unlocked_usbctlx_cancel_async
3499 *
3500 * Mark the CTLX dead asynchronously, and ensure that the
3501 * next command on the queue is run afterwards.
3502 *
3503 * Arguments:
3504 *       hw      ptr to the hfa384x_t structure
3505 *       ctlx    ptr to a CTLX structure
3506 *
3507 * Returns:
3508 *       0       the CTLX's URB is inactive
3509 * -EINPROGRESS  the URB is currently being unlinked
3510 *
3511 * Call context:
3512 *       Either process or interrupt, but presumably interrupt
3513 ----------------------------------------------------------------*/
3514 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3515 {
3516         int ret;
3517
3518         DBFENTER;
3519
3520         /*
3521          * Try to delete the URB containing our request packet.
3522          * If we succeed, then its completion handler will be
3523          * called with a status of -ECONNRESET.
3524          */
3525         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3526         ret = usb_unlink_urb(&hw->ctlx_urb);
3527
3528         if (ret != -EINPROGRESS) {
3529                 /*
3530                  * The OUT URB had either already completed
3531                  * or was still in the pending queue, so the
3532                  * URB's completion function will not be called.
3533                  * We will have to complete the CTLX ourselves.
3534                  */
3535                 ctlx->state = CTLX_REQ_FAILED;
3536                 unlocked_usbctlx_complete(hw, ctlx);
3537                 ret = 0;
3538         }
3539
3540         DBFEXIT;
3541
3542         return ret;
3543 }
3544
3545 /*----------------------------------------------------------------
3546 * unlocked_usbctlx_complete
3547 *
3548 * A CTLX has completed.  It may have been successful, it may not
3549 * have been. At this point, the CTLX should be quiescent.  The URBs
3550 * aren't active and the timers should have been stopped.
3551 *
3552 * The CTLX is migrated to the "completing" queue, and the completing
3553 * tasklet is scheduled.
3554 *
3555 * Arguments:
3556 *       hw              ptr to a hfa384x_t structure
3557 *       ctlx            ptr to a ctlx structure
3558 *
3559 * Returns:
3560 *       nothing
3561 *
3562 * Side effects:
3563 *
3564 * Call context:
3565 *       Either, assume interrupt
3566 ----------------------------------------------------------------*/
3567 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3568 {
3569         DBFENTER;
3570
3571         /* Timers have been stopped, and ctlx should be in
3572          * a terminal state. Retire it from the "active"
3573          * queue.
3574          */
3575         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3576         tasklet_schedule(&hw->completion_bh);
3577
3578         switch (ctlx->state) {
3579         case CTLX_COMPLETE:
3580         case CTLX_REQ_FAILED:
3581                 /* This are the correct terminating states. */
3582                 break;
3583
3584         default:
3585                 WLAN_LOG_ERROR("CTLX[%d] not in a terminating state(%s)\n",
3586                                hfa384x2host_16(ctlx->outbuf.type),
3587                                ctlxstr(ctlx->state));
3588                 break;
3589         } /* switch */
3590
3591         DBFEXIT;
3592 }
3593
3594 /*----------------------------------------------------------------
3595 * hfa384x_usbctlxq_run
3596 *
3597 * Checks to see if the head item is running.  If not, starts it.
3598 *
3599 * Arguments:
3600 *       hw      ptr to hfa384x_t
3601 *
3602 * Returns:
3603 *       nothing
3604 *
3605 * Side effects:
3606 *
3607 * Call context:
3608 *       any
3609 ----------------------------------------------------------------*/
3610 static void
3611 hfa384x_usbctlxq_run(hfa384x_t  *hw)
3612 {
3613         unsigned long           flags;
3614         DBFENTER;
3615
3616         /* acquire lock */
3617         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3618
3619         /* Only one active CTLX at any one time, because there's no
3620          * other (reliable) way to match the response URB to the
3621          * correct CTLX.
3622          *
3623          * Don't touch any of these CTLXs if the hardware
3624          * has been removed or the USB subsystem is stalled.
3625          */
3626         if ( !list_empty(&hw->ctlxq.active) ||
3627              test_bit(WORK_TX_HALT, &hw->usb_flags) ||
3628              hw->wlandev->hwremoved )
3629                 goto unlock;
3630
3631         while ( !list_empty(&hw->ctlxq.pending) ) {
3632                 hfa384x_usbctlx_t       *head;
3633                 int                     result;
3634
3635                 /* This is the first pending command */
3636                 head = list_entry(hw->ctlxq.pending.next,
3637                                   hfa384x_usbctlx_t,
3638                                   list);
3639
3640                 /* We need to split this off to avoid a race condition */
3641                 list_move_tail(&head->list, &hw->ctlxq.active);
3642
3643                 /* Fill the out packet */
3644                 usb_fill_bulk_urb( &(hw->ctlx_urb), hw->usb,
3645                                    hw->endp_out,
3646                                    &(head->outbuf), ROUNDUP64(head->outbufsize),
3647                                    hfa384x_ctlxout_callback, hw);
3648                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3649
3650                 /* Now submit the URB and update the CTLX's state
3651                  */
3652                 if ((result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC)) == 0) {
3653                         /* This CTLX is now running on the active queue */
3654                         head->state = CTLX_REQ_SUBMITTED;
3655
3656                         /* Start the OUT wait timer */
3657                         hw->req_timer_done = 0;
3658                         hw->reqtimer.expires = jiffies + HZ;
3659                         add_timer(&hw->reqtimer);
3660
3661                         /* Start the IN wait timer */
3662                         hw->resp_timer_done = 0;
3663                         hw->resptimer.expires = jiffies + 2*HZ;
3664                         add_timer(&hw->resptimer);
3665
3666                         break;
3667                 }
3668
3669                 if (result == -EPIPE) {
3670                         /* The OUT pipe needs resetting, so put
3671                          * this CTLX back in the "pending" queue
3672                          * and schedule a reset ...
3673                          */
3674                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
3675                                          hw->wlandev->netdev->name);
3676                         list_move(&head->list, &hw->ctlxq.pending);
3677                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3678                         schedule_work(&hw->usb_work);
3679                         break;
3680                 }
3681
3682                 if (result == -ESHUTDOWN) {
3683                         WLAN_LOG_WARNING("%s urb shutdown!\n",
3684                                          hw->wlandev->netdev->name);
3685                         break;
3686                 }
3687
3688                 WLAN_LOG_ERROR("Failed to submit CTLX[%d]: error=%d\n",
3689                                hfa384x2host_16(head->outbuf.type), result);
3690                 unlocked_usbctlx_complete(hw, head);
3691         } /* while */
3692
3693         unlock:
3694         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3695
3696         DBFEXIT;
3697 }
3698
3699
3700 /*----------------------------------------------------------------
3701 * hfa384x_usbin_callback
3702 *
3703 * Callback for URBs on the BULKIN endpoint.
3704 *
3705 * Arguments:
3706 *       urb             ptr to the completed urb
3707 *
3708 * Returns:
3709 *       nothing
3710 *
3711 * Side effects:
3712 *
3713 * Call context:
3714 *       interrupt
3715 ----------------------------------------------------------------*/
3716 static void hfa384x_usbin_callback(struct urb *urb)
3717 {
3718         wlandevice_t            *wlandev = urb->context;
3719         hfa384x_t               *hw;
3720         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3721         struct sk_buff          *skb = NULL;
3722         int                     result;
3723         int                     urb_status;
3724         u16                     type;
3725
3726         enum USBIN_ACTION {
3727                 HANDLE,
3728                 RESUBMIT,
3729                 ABORT
3730         } action;
3731
3732         DBFENTER;
3733
3734         if ( !wlandev ||
3735              !wlandev->netdev ||
3736              !netif_device_present(wlandev->netdev) )
3737                 goto exit;
3738
3739         hw = wlandev->priv;
3740         if (!hw)
3741                 goto exit;
3742
3743         skb = hw->rx_urb_skb;
3744         if (!skb || (skb->data != urb->transfer_buffer)) {
3745                 BUG();
3746         }
3747         hw->rx_urb_skb = NULL;
3748
3749         /* Check for error conditions within the URB */
3750         switch (urb->status) {
3751         case 0:
3752                 action = HANDLE;
3753
3754                 /* Check for short packet */
3755                 if ( urb->actual_length == 0 ) {
3756                         ++(wlandev->linux_stats.rx_errors);
3757                         ++(wlandev->linux_stats.rx_length_errors);
3758                         action = RESUBMIT;
3759                 }
3760                 break;
3761
3762         case -EPIPE:
3763                 WLAN_LOG_WARNING("%s rx pipe stalled: requesting reset\n",
3764                                  wlandev->netdev->name);
3765                 if ( !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags) )
3766                         schedule_work(&hw->usb_work);
3767                 ++(wlandev->linux_stats.rx_errors);
3768                 action = ABORT;
3769                 break;
3770
3771         case -EILSEQ:
3772         case -ETIMEDOUT:
3773         case -EPROTO:
3774                 if ( !test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3775                      !timer_pending(&hw->throttle) ) {
3776                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3777                 }
3778                 ++(wlandev->linux_stats.rx_errors);
3779                 action = ABORT;
3780                 break;
3781
3782         case -EOVERFLOW:
3783                 ++(wlandev->linux_stats.rx_over_errors);
3784                 action = RESUBMIT;
3785                 break;
3786
3787         case -ENODEV:
3788         case -ESHUTDOWN:
3789                 WLAN_LOG_DEBUG(3,"status=%d, device removed.\n", urb->status);
3790                 action = ABORT;
3791                 break;
3792
3793         case -ENOENT:
3794         case -ECONNRESET:
3795                 WLAN_LOG_DEBUG(3,"status=%d, urb explicitly unlinked.\n", urb->status);
3796                 action = ABORT;
3797                 break;
3798
3799         default:
3800                 WLAN_LOG_DEBUG(3,"urb status=%d, transfer flags=0x%x\n",
3801                                  urb->status, urb->transfer_flags);
3802                 ++(wlandev->linux_stats.rx_errors);
3803                 action = RESUBMIT;
3804                 break;
3805         }
3806
3807         urb_status = urb->status;
3808
3809         if (action != ABORT) {
3810                 /* Repost the RX URB */
3811                 result = submit_rx_urb(hw, GFP_ATOMIC);
3812
3813                 if (result != 0) {
3814                         WLAN_LOG_ERROR(
3815                                 "Fatal, failed to resubmit rx_urb. error=%d\n",
3816                                 result);
3817                 }
3818         }
3819
3820         /* Handle any USB-IN packet */
3821         /* Note: the check of the sw_support field, the type field doesn't
3822          *       have bit 12 set like the docs suggest.
3823          */
3824         type = hfa384x2host_16(usbin->type);
3825         if (HFA384x_USB_ISRXFRM(type)) {
3826                 if (action == HANDLE) {
3827                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3828                                 hfa384x_usbin_txcompl(wlandev, usbin);
3829                         } else {
3830                                 skb_put(skb, sizeof(*usbin));
3831                                 hfa384x_usbin_rx(wlandev, skb);
3832                                 skb = NULL;
3833                         }
3834                 }
3835                 goto exit;
3836         }
3837         if (HFA384x_USB_ISTXFRM(type)) {
3838                 if (action == HANDLE)
3839                         hfa384x_usbin_txcompl(wlandev, usbin);
3840                 goto exit;
3841         }
3842         switch (type) {
3843         case HFA384x_USB_INFOFRM:
3844                 if (action == ABORT)
3845                         goto exit;
3846                 if (action == HANDLE)
3847                         hfa384x_usbin_info(wlandev, usbin);
3848                 break;
3849
3850         case HFA384x_USB_CMDRESP:
3851         case HFA384x_USB_WRIDRESP:
3852         case HFA384x_USB_RRIDRESP:
3853         case HFA384x_USB_WMEMRESP:
3854         case HFA384x_USB_RMEMRESP:
3855                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3856                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3857                 break;
3858
3859         case HFA384x_USB_BUFAVAIL:
3860                 WLAN_LOG_DEBUG(3,"Received BUFAVAIL packet, frmlen=%d\n",
3861                         usbin->bufavail.frmlen);
3862                 break;
3863
3864         case HFA384x_USB_ERROR:
3865                 WLAN_LOG_DEBUG(3,"Received USB_ERROR packet, errortype=%d\n",
3866                         usbin->usberror.errortype);
3867                 break;
3868
3869         default:
3870                 WLAN_LOG_DEBUG(3,"Unrecognized USBIN packet, type=%x, status=%d\n",
3871                         usbin->type, urb_status);
3872                 break;
3873         } /* switch */
3874
3875 exit:
3876
3877         if (skb)
3878                 dev_kfree_skb(skb);
3879
3880         DBFEXIT;
3881 }
3882
3883
3884 /*----------------------------------------------------------------
3885 * hfa384x_usbin_ctlx
3886 *
3887 * We've received a URB containing a Prism2 "response" message.
3888 * This message needs to be matched up with a CTLX on the active
3889 * queue and our state updated accordingly.
3890 *
3891 * Arguments:
3892 *       hw              ptr to hfa384x_t
3893 *       usbin           ptr to USB IN packet
3894 *       urb_status      status of this Bulk-In URB
3895 *
3896 * Returns:
3897 *       nothing
3898 *
3899 * Side effects:
3900 *
3901 * Call context:
3902 *       interrupt
3903 ----------------------------------------------------------------*/
3904 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3905                                int urb_status)
3906 {
3907         hfa384x_usbctlx_t       *ctlx;
3908         int                     run_queue = 0;
3909         unsigned long           flags;
3910
3911         DBFENTER;
3912
3913 retry:
3914         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3915
3916         /* There can be only one CTLX on the active queue
3917          * at any one time, and this is the CTLX that the
3918          * timers are waiting for.
3919          */
3920         if ( list_empty(&hw->ctlxq.active) ) {
3921                 goto unlock;
3922         }
3923
3924         /* Remove the "response timeout". It's possible that
3925          * we are already too late, and that the timeout is
3926          * already running. And that's just too bad for us,
3927          * because we could lose our CTLX from the active
3928          * queue here ...
3929          */
3930         if (del_timer(&hw->resptimer) == 0) {
3931                 if (hw->resp_timer_done == 0) {
3932                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3933                         goto retry;
3934                 }
3935         }
3936         else {
3937                 hw->resp_timer_done = 1;
3938         }
3939
3940         ctlx = get_active_ctlx(hw);
3941
3942         if (urb_status != 0) {
3943                 /*
3944                  * Bad CTLX, so get rid of it. But we only
3945                  * remove it from the active queue if we're no
3946                  * longer expecting the OUT URB to complete.
3947                  */
3948                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3949                         run_queue = 1;
3950         } else {
3951                 const u16 intype = (usbin->type&~host2hfa384x_16(0x8000));
3952
3953                 /*
3954                  * Check that our message is what we're expecting ...
3955                  */
3956                 if (ctlx->outbuf.type != intype) {
3957                         WLAN_LOG_WARNING("Expected IN[%d], received IN[%d] - ignored.\n",
3958                                          hfa384x2host_16(ctlx->outbuf.type),
3959                                          hfa384x2host_16(intype));
3960                         goto unlock;
3961                 }
3962
3963                 /* This URB has succeeded, so grab the data ... */
3964                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3965
3966                 switch (ctlx->state) {
3967                 case CTLX_REQ_SUBMITTED:
3968                         /*
3969                          * We have received our response URB before
3970                          * our request has been acknowledged. Odd,
3971                          * but our OUT URB is still alive...
3972                          */
3973                         WLAN_LOG_DEBUG(0, "Causality violation: please reboot Universe, or email linux-wlan-devel@lists.linux-wlan.com\n");
3974                         ctlx->state = CTLX_RESP_COMPLETE;
3975                         break;
3976
3977                 case CTLX_REQ_COMPLETE:
3978                         /*
3979                          * This is the usual path: our request
3980                          * has already been acknowledged, and
3981                          * now we have received the reply too.
3982                          */
3983                         ctlx->state = CTLX_COMPLETE;
3984                         unlocked_usbctlx_complete(hw, ctlx);
3985                         run_queue = 1;
3986                         break;
3987
3988                 default:
3989                         /*
3990                          * Throw this CTLX away ...
3991                          */
3992                         WLAN_LOG_ERROR("Matched IN URB, CTLX[%d] in invalid state(%s)."
3993                                        " Discarded.\n",
3994                                        hfa384x2host_16(ctlx->outbuf.type),
3995                                        ctlxstr(ctlx->state));
3996                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3997                                 run_queue = 1;
3998                         break;
3999                 } /* switch */
4000         }
4001
4002 unlock:
4003         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4004
4005         if (run_queue)
4006                 hfa384x_usbctlxq_run(hw);
4007
4008         DBFEXIT;
4009 }
4010
4011
4012 /*----------------------------------------------------------------
4013 * hfa384x_usbin_txcompl
4014 *
4015 * At this point we have the results of a previous transmit.
4016 *
4017 * Arguments:
4018 *       wlandev         wlan device
4019 *       usbin           ptr to the usb transfer buffer
4020 *
4021 * Returns:
4022 *       nothing
4023 *
4024 * Side effects:
4025 *
4026 * Call context:
4027 *       interrupt
4028 ----------------------------------------------------------------*/
4029 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4030 {
4031         u16                     status;
4032         DBFENTER;
4033
4034         status = hfa384x2host_16(usbin->type); /* yeah I know it says type...*/
4035
4036         /* Was there an error? */
4037         if (HFA384x_TXSTATUS_ISERROR(status)) {
4038                 prism2sta_ev_txexc(wlandev, status);
4039         } else {
4040                 prism2sta_ev_tx(wlandev, status);
4041         }
4042         // prism2sta_ev_alloc(wlandev);
4043
4044         DBFEXIT;
4045 }
4046
4047
4048 /*----------------------------------------------------------------
4049 * hfa384x_usbin_rx
4050 *
4051 * At this point we have a successful received a rx frame packet.
4052 *
4053 * Arguments:
4054 *       wlandev         wlan device
4055 *       usbin           ptr to the usb transfer buffer
4056 *
4057 * Returns:
4058 *       nothing
4059 *
4060 * Side effects:
4061 *
4062 * Call context:
4063 *       interrupt
4064 ----------------------------------------------------------------*/
4065 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
4066 {
4067         hfa384x_usbin_t         *usbin = (hfa384x_usbin_t *) skb->data;
4068         hfa384x_t               *hw = wlandev->priv;
4069         int                     hdrlen;
4070         p80211_rxmeta_t         *rxmeta;
4071         u16                  data_len;
4072         u16                  fc;
4073
4074         DBFENTER;
4075
4076         /* Byte order convert once up front. */
4077         usbin->rxfrm.desc.status =
4078                 hfa384x2host_16(usbin->rxfrm.desc.status);
4079         usbin->rxfrm.desc.time =
4080                 hfa384x2host_32(usbin->rxfrm.desc.time);
4081
4082         /* Now handle frame based on port# */
4083         switch( HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) )
4084         {
4085         case 0:
4086                 fc = ieee2host16(usbin->rxfrm.desc.frame_control);
4087
4088                 /* If exclude and we receive an unencrypted, drop it */
4089                 if ( (wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
4090                      !WLAN_GET_FC_ISWEP(fc)){
4091                         goto done;
4092                 }
4093
4094                 data_len = hfa384x2host_16(usbin->rxfrm.desc.data_len);
4095
4096                 /* How much header data do we have? */
4097                 hdrlen = p80211_headerlen(fc);
4098
4099                 /* Pull off the descriptor */
4100                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
4101
4102                 /* Now shunt the header block up against the data block
4103                  * with an "overlapping" copy
4104                  */
4105                 memmove(skb_push(skb, hdrlen),
4106                         &usbin->rxfrm.desc.frame_control,
4107                         hdrlen);
4108
4109                 skb->dev = wlandev->netdev;
4110                 skb->dev->last_rx = jiffies;
4111
4112                 /* And set the frame length properly */
4113                 skb_trim(skb, data_len + hdrlen);
4114
4115                 /* The prism2 series does not return the CRC */
4116                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
4117
4118                 skb_reset_mac_header(skb);
4119
4120                 /* Attach the rxmeta, set some stuff */
4121                 p80211skb_rxmeta_attach(wlandev, skb);
4122                 rxmeta = P80211SKB_RXMETA(skb);
4123                 rxmeta->mactime = usbin->rxfrm.desc.time;
4124                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
4125                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
4126                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
4127
4128                 prism2sta_ev_rx(wlandev, skb);
4129
4130                 break;
4131
4132         case 7:
4133                 if ( ! HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status) ) {
4134                         /* Copy to wlansnif skb */
4135                         hfa384x_int_rxmonitor( wlandev, &usbin->rxfrm);
4136                         dev_kfree_skb(skb);
4137                 } else {
4138                         WLAN_LOG_DEBUG(3,"Received monitor frame: FCSerr set\n");
4139                 }
4140                 break;
4141
4142         default:
4143                 WLAN_LOG_WARNING("Received frame on unsupported port=%d\n",
4144                         HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status) );
4145                 goto done;
4146                 break;
4147         }
4148
4149 done:
4150         DBFEXIT;
4151         return;
4152 }
4153
4154 /*----------------------------------------------------------------
4155 * hfa384x_int_rxmonitor
4156 *
4157 * Helper function for int_rx.  Handles monitor frames.
4158 * Note that this function allocates space for the FCS and sets it
4159 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
4160 * higher layers expect it.  0xffffffff is used as a flag to indicate
4161 * the FCS is bogus.
4162 *
4163 * Arguments:
4164 *       wlandev         wlan device structure
4165 *       rxfrm           rx descriptor read from card in int_rx
4166 *
4167 * Returns:
4168 *       nothing
4169 *
4170 * Side effects:
4171 *       Allocates an skb and passes it up via the PF_PACKET interface.
4172 * Call context:
4173 *       interrupt
4174 ----------------------------------------------------------------*/
4175 static void hfa384x_int_rxmonitor( wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm)
4176 {
4177         hfa384x_rx_frame_t              *rxdesc = &(rxfrm->desc);
4178         unsigned int                            hdrlen = 0;
4179         unsigned int                            datalen = 0;
4180         unsigned int                            skblen = 0;
4181         p80211msg_lnxind_wlansniffrm_t  *msg;
4182         u8                              *datap;
4183         u16                             fc;
4184         struct sk_buff                  *skb;
4185         hfa384x_t                       *hw = wlandev->priv;
4186
4187
4188         DBFENTER;
4189         /* Don't forget the status, time, and data_len fields are in host order */
4190         /* Figure out how big the frame is */
4191         fc = ieee2host16(rxdesc->frame_control);
4192         hdrlen = p80211_headerlen(fc);
4193         datalen = hfa384x2host_16(rxdesc->data_len);
4194
4195         /* Allocate an ind message+framesize skb */
4196         skblen = sizeof(p80211msg_lnxind_wlansniffrm_t) +
4197                 hdrlen + datalen + WLAN_CRC_LEN;
4198
4199         /* sanity check the length */
4200         if ( skblen >
4201                 (sizeof(p80211msg_lnxind_wlansniffrm_t) +
4202                 WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN) ) {
4203                 WLAN_LOG_DEBUG(1, "overlen frm: len=%zd\n",
4204                         skblen - sizeof(p80211msg_lnxind_wlansniffrm_t));
4205         }
4206
4207         if ( (skb = dev_alloc_skb(skblen)) == NULL ) {
4208                 WLAN_LOG_ERROR("alloc_skb failed trying to allocate %d bytes\n", skblen);
4209                 return;
4210         }
4211
4212         /* only prepend the prism header if in the right mode */
4213         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4214             (hw->sniffhdr == 0)) {
4215                 datap = skb_put(skb, sizeof(p80211msg_lnxind_wlansniffrm_t));
4216                 msg = (p80211msg_lnxind_wlansniffrm_t*) datap;
4217
4218                 /* Initialize the message members */
4219                 msg->msgcode = DIDmsg_lnxind_wlansniffrm;
4220                 msg->msglen = sizeof(p80211msg_lnxind_wlansniffrm_t);
4221                 strcpy(msg->devname, wlandev->name);
4222
4223                 msg->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
4224                 msg->hosttime.status = 0;
4225                 msg->hosttime.len = 4;
4226                 msg->hosttime.data = jiffies;
4227
4228                 msg->mactime.did = DIDmsg_lnxind_wlansniffrm_mactime;
4229                 msg->mactime.status = 0;
4230                 msg->mactime.len = 4;
4231                 msg->mactime.data = rxdesc->time;
4232
4233                 msg->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
4234                 msg->channel.status = 0;
4235                 msg->channel.len = 4;
4236                 msg->channel.data = hw->sniff_channel;
4237
4238                 msg->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
4239                 msg->rssi.status = P80211ENUM_msgitem_status_no_value;
4240                 msg->rssi.len = 4;
4241                 msg->rssi.data = 0;
4242
4243                 msg->sq.did = DIDmsg_lnxind_wlansniffrm_sq;
4244                 msg->sq.status = P80211ENUM_msgitem_status_no_value;
4245                 msg->sq.len = 4;
4246                 msg->sq.data = 0;
4247
4248                 msg->signal.did = DIDmsg_lnxind_wlansniffrm_signal;
4249                 msg->signal.status = 0;
4250                 msg->signal.len = 4;
4251                 msg->signal.data = rxdesc->signal;
4252
4253                 msg->noise.did = DIDmsg_lnxind_wlansniffrm_noise;
4254                 msg->noise.status = 0;
4255                 msg->noise.len = 4;
4256                 msg->noise.data = rxdesc->silence;
4257
4258                 msg->rate.did = DIDmsg_lnxind_wlansniffrm_rate;
4259                 msg->rate.status = 0;
4260                 msg->rate.len = 4;
4261                 msg->rate.data = rxdesc->rate / 5; /* set to 802.11 units */
4262
4263                 msg->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
4264                 msg->istx.status = 0;
4265                 msg->istx.len = 4;
4266                 msg->istx.data = P80211ENUM_truth_false;
4267
4268                 msg->frmlen.did = DIDmsg_lnxind_wlansniffrm_frmlen;
4269                 msg->frmlen.status = 0;
4270                 msg->frmlen.len = 4;
4271                 msg->frmlen.data = hdrlen + datalen + WLAN_CRC_LEN;
4272         } else if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
4273                    (hw->sniffhdr != 0)) {
4274                 p80211_caphdr_t         *caphdr;
4275                 /* The NEW header format! */
4276                 datap = skb_put(skb, sizeof(p80211_caphdr_t));
4277                 caphdr = (p80211_caphdr_t*) datap;
4278
4279                 caphdr->version =       htonl(P80211CAPTURE_VERSION);
4280                 caphdr->length =        htonl(sizeof(p80211_caphdr_t));
4281                 caphdr->mactime =       __cpu_to_be64(rxdesc->time) * 1000;
4282                 caphdr->hosttime =      __cpu_to_be64(jiffies);
4283                 caphdr->phytype =       htonl(4); /* dss_dot11_b */
4284                 caphdr->channel =       htonl(hw->sniff_channel);
4285                 caphdr->datarate =      htonl(rxdesc->rate);
4286                 caphdr->antenna =       htonl(0); /* unknown */
4287                 caphdr->priority =      htonl(0); /* unknown */
4288                 caphdr->ssi_type =      htonl(3); /* rssi_raw */
4289                 caphdr->ssi_signal =    htonl(rxdesc->signal);
4290                 caphdr->ssi_noise =     htonl(rxdesc->silence);
4291                 caphdr->preamble =      htonl(0); /* unknown */
4292                 caphdr->encoding =      htonl(1); /* cck */
4293         }
4294
4295         /* Copy the 802.11 header to the skb (ctl frames may be less than a full header) */
4296         datap = skb_put(skb, hdrlen);
4297         memcpy( datap, &(rxdesc->frame_control), hdrlen);
4298
4299         /* If any, copy the data from the card to the skb */
4300         if ( datalen > 0 )
4301         {
4302                 datap = skb_put(skb, datalen);
4303                 memcpy(datap, rxfrm->data, datalen);
4304
4305                 /* check for unencrypted stuff if WEP bit set. */
4306                 if (*(datap - hdrlen + 1) & 0x40) // wep set
4307                   if ((*(datap) == 0xaa) && (*(datap+1) == 0xaa))
4308                     *(datap - hdrlen + 1) &= 0xbf; // clear wep; it's the 802.2 header!
4309         }
4310
4311         if (hw->sniff_fcs) {
4312                 /* Set the FCS */
4313                 datap = skb_put(skb, WLAN_CRC_LEN);
4314                 memset( datap, 0xff, WLAN_CRC_LEN);
4315         }
4316
4317         /* pass it back up */
4318         prism2sta_ev_rx(wlandev, skb);
4319
4320         DBFEXIT;
4321         return;
4322 }
4323
4324
4325
4326 /*----------------------------------------------------------------
4327 * hfa384x_usbin_info
4328 *
4329 * At this point we have a successful received a Prism2 info frame.
4330 *
4331 * Arguments:
4332 *       wlandev         wlan device
4333 *       usbin           ptr to the usb transfer buffer
4334 *
4335 * Returns:
4336 *       nothing
4337 *
4338 * Side effects:
4339 *
4340 * Call context:
4341 *       interrupt
4342 ----------------------------------------------------------------*/
4343 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
4344 {
4345         DBFENTER;
4346
4347         usbin->infofrm.info.framelen = hfa384x2host_16(usbin->infofrm.info.framelen);
4348         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
4349
4350         DBFEXIT;
4351 }
4352
4353
4354
4355 /*----------------------------------------------------------------
4356 * hfa384x_usbout_callback
4357 *
4358 * Callback for URBs on the BULKOUT endpoint.
4359 *
4360 * Arguments:
4361 *       urb             ptr to the completed urb
4362 *
4363 * Returns:
4364 *       nothing
4365 *
4366 * Side effects:
4367 *
4368 * Call context:
4369 *       interrupt
4370 ----------------------------------------------------------------*/
4371 static void hfa384x_usbout_callback(struct urb *urb)
4372 {
4373         wlandevice_t            *wlandev = urb->context;
4374         hfa384x_usbout_t        *usbout = urb->transfer_buffer;
4375         DBFENTER;
4376
4377 #ifdef DEBUG_USB
4378         dbprint_urb(urb);
4379 #endif
4380
4381         if ( wlandev &&
4382              wlandev->netdev ) {
4383
4384                 switch(urb->status) {
4385                 case 0:
4386                         hfa384x_usbout_tx(wlandev, usbout);
4387                         break;
4388
4389                 case -EPIPE:
4390                 {
4391                         hfa384x_t *hw = wlandev->priv;
4392                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4393                                          wlandev->netdev->name);
4394                         if ( !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) )
4395                                 schedule_work(&hw->usb_work);
4396                         ++(wlandev->linux_stats.tx_errors);
4397                         break;
4398                 }
4399
4400                 case -EPROTO:
4401                 case -ETIMEDOUT:
4402                 case -EILSEQ:
4403                 {
4404                         hfa384x_t *hw = wlandev->priv;
4405
4406                         if ( !test_and_set_bit(THROTTLE_TX, &hw->usb_flags)
4407                              && !timer_pending(&hw->throttle) ) {
4408                                 mod_timer(&hw->throttle,
4409                                           jiffies + THROTTLE_JIFFIES);
4410                         }
4411                         ++(wlandev->linux_stats.tx_errors);
4412                         netif_stop_queue(wlandev->netdev);
4413                         break;
4414                 }
4415
4416                 case -ENOENT:
4417                 case -ESHUTDOWN:
4418                         /* Ignorable errors */
4419                         break;
4420
4421                 default:
4422                         WLAN_LOG_INFO("unknown urb->status=%d\n", urb->status);
4423                         ++(wlandev->linux_stats.tx_errors);
4424                         break;
4425                 } /* switch */
4426         }
4427
4428         DBFEXIT;
4429 }
4430
4431
4432 /*----------------------------------------------------------------
4433 * hfa384x_ctlxout_callback
4434 *
4435 * Callback for control data on the BULKOUT endpoint.
4436 *
4437 * Arguments:
4438 *       urb             ptr to the completed urb
4439 *
4440 * Returns:
4441 * nothing
4442 *
4443 * Side effects:
4444 *
4445 * Call context:
4446 * interrupt
4447 ----------------------------------------------------------------*/
4448 static void hfa384x_ctlxout_callback(struct urb *urb)
4449 {
4450         hfa384x_t       *hw = urb->context;
4451         int             delete_resptimer = 0;
4452         int             timer_ok = 1;
4453         int             run_queue = 0;
4454         hfa384x_usbctlx_t       *ctlx;
4455         unsigned long   flags;
4456
4457         DBFENTER;
4458
4459         WLAN_LOG_DEBUG(3,"urb->status=%d\n", urb->status);
4460 #ifdef DEBUG_USB
4461         dbprint_urb(urb);
4462 #endif
4463         if ( (urb->status == -ESHUTDOWN) ||
4464              (urb->status == -ENODEV) ||
4465              (hw == NULL) )
4466                 goto done;
4467
4468 retry:
4469         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4470
4471         /*
4472          * Only one CTLX at a time on the "active" list, and
4473          * none at all if we are unplugged. However, we can
4474          * rely on the disconnect function to clean everything
4475          * up if someone unplugged the adapter.
4476          */
4477         if ( list_empty(&hw->ctlxq.active) ) {
4478                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4479                 goto done;
4480         }
4481
4482         /*
4483          * Having something on the "active" queue means
4484          * that we have timers to worry about ...
4485          */
4486         if (del_timer(&hw->reqtimer) == 0) {
4487                 if (hw->req_timer_done == 0) {
4488                         /*
4489                          * This timer was actually running while we
4490                          * were trying to delete it. Let it terminate
4491                          * gracefully instead.
4492                          */
4493                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4494                         goto retry;
4495                 }
4496         }
4497         else {
4498                 hw->req_timer_done = 1;
4499         }
4500
4501         ctlx = get_active_ctlx(hw);
4502
4503         if ( urb->status == 0 ) {
4504                 /* Request portion of a CTLX is successful */
4505                 switch ( ctlx->state ) {
4506                 case CTLX_REQ_SUBMITTED:
4507                         /* This OUT-ACK received before IN */
4508                         ctlx->state = CTLX_REQ_COMPLETE;
4509                         break;
4510
4511                 case CTLX_RESP_COMPLETE:
4512                         /* IN already received before this OUT-ACK,
4513                          * so this command must now be complete.
4514                          */
4515                         ctlx->state = CTLX_COMPLETE;
4516                         unlocked_usbctlx_complete(hw, ctlx);
4517                         run_queue = 1;
4518                         break;
4519
4520                 default:
4521                         /* This is NOT a valid CTLX "success" state! */
4522                         WLAN_LOG_ERROR(
4523                             "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
4524                             hfa384x2host_16(ctlx->outbuf.type),
4525                             ctlxstr(ctlx->state), urb->status);
4526                         break;
4527                 } /* switch */
4528         } else {
4529                 /* If the pipe has stalled then we need to reset it */
4530                 if ( (urb->status == -EPIPE) &&
4531                       !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags) ) {
4532                         WLAN_LOG_WARNING("%s tx pipe stalled: requesting reset\n",
4533                                          hw->wlandev->netdev->name);
4534                         schedule_work(&hw->usb_work);
4535                 }
4536
4537                 /* If someone cancels the OUT URB then its status
4538                  * should be either -ECONNRESET or -ENOENT.
4539                  */
4540                 ctlx->state = CTLX_REQ_FAILED;
4541                 unlocked_usbctlx_complete(hw, ctlx);
4542                 delete_resptimer = 1;
4543                 run_queue = 1;
4544         }
4545
4546  delresp:
4547         if (delete_resptimer) {
4548                 if ((timer_ok = del_timer(&hw->resptimer)) != 0) {
4549                         hw->resp_timer_done = 1;
4550                 }
4551         }
4552
4553         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4554
4555         if ( !timer_ok && (hw->resp_timer_done == 0) ) {
4556                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
4557                 goto delresp;
4558         }
4559
4560         if (run_queue)
4561                 hfa384x_usbctlxq_run(hw);
4562
4563  done:
4564         DBFEXIT;
4565 }
4566
4567
4568 /*----------------------------------------------------------------
4569 * hfa384x_usbctlx_reqtimerfn
4570 *
4571 * Timer response function for CTLX request timeouts.  If this
4572 * function is called, it means that the callback for the OUT
4573 * URB containing a Prism2.x XXX_Request was never called.
4574 *
4575 * Arguments:
4576 *       data            a ptr to the hfa384x_t
4577 *
4578 * Returns:
4579 *       nothing
4580 *
4581 * Side effects:
4582 *
4583 * Call context:
4584 *       interrupt
4585 ----------------------------------------------------------------*/
4586 static void
4587 hfa384x_usbctlx_reqtimerfn(unsigned long data)
4588 {
4589         hfa384x_t       *hw = (hfa384x_t*)data;
4590         unsigned long   flags;
4591         DBFENTER;
4592
4593         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4594
4595         hw->req_timer_done = 1;
4596
4597         /* Removing the hardware automatically empties
4598          * the active list ...
4599          */
4600         if ( !list_empty(&hw->ctlxq.active) )
4601         {
4602                 /*
4603                  * We must ensure that our URB is removed from
4604                  * the system, if it hasn't already expired.
4605                  */
4606                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
4607                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS)
4608                 {
4609                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4610
4611                         ctlx->state = CTLX_REQ_FAILED;
4612
4613                         /* This URB was active, but has now been
4614                          * cancelled. It will now have a status of
4615                          * -ECONNRESET in the callback function.
4616                          *
4617                          * We are cancelling this CTLX, so we're
4618                          * not going to need to wait for a response.
4619                          * The URB's callback function will check
4620                          * that this timer is truly dead.
4621                          */
4622                         if (del_timer(&hw->resptimer) != 0)
4623                                 hw->resp_timer_done = 1;
4624                 }
4625         }
4626
4627         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4628
4629         DBFEXIT;
4630 }
4631
4632
4633 /*----------------------------------------------------------------
4634 * hfa384x_usbctlx_resptimerfn
4635 *
4636 * Timer response function for CTLX response timeouts.  If this
4637 * function is called, it means that the callback for the IN
4638 * URB containing a Prism2.x XXX_Response was never called.
4639 *
4640 * Arguments:
4641 *       data            a ptr to the hfa384x_t
4642 *
4643 * Returns:
4644 *       nothing
4645 *
4646 * Side effects:
4647 *
4648 * Call context:
4649 *       interrupt
4650 ----------------------------------------------------------------*/
4651 static void
4652 hfa384x_usbctlx_resptimerfn(unsigned long data)
4653 {
4654         hfa384x_t *hw = (hfa384x_t*)data;
4655         unsigned long   flags;
4656
4657         DBFENTER;
4658
4659         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4660
4661         hw->resp_timer_done = 1;
4662
4663         /* The active list will be empty if the
4664          * adapter has been unplugged ...
4665          */
4666         if ( !list_empty(&hw->ctlxq.active) )
4667         {
4668                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
4669
4670                 if ( unlocked_usbctlx_cancel_async(hw, ctlx) == 0 )
4671                 {
4672                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4673                         hfa384x_usbctlxq_run(hw);
4674                         goto done;
4675                 }
4676         }
4677
4678         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4679
4680  done:
4681         DBFEXIT;
4682 }
4683
4684 /*----------------------------------------------------------------
4685 * hfa384x_usb_throttlefn
4686 *
4687 *
4688 * Arguments:
4689 *       data    ptr to hw
4690 *
4691 * Returns:
4692 *       Nothing
4693 *
4694 * Side effects:
4695 *
4696 * Call context:
4697 *       Interrupt
4698 ----------------------------------------------------------------*/
4699 static void
4700 hfa384x_usb_throttlefn(unsigned long data)
4701 {
4702         hfa384x_t *hw = (hfa384x_t*)data;
4703         unsigned long   flags;
4704
4705         DBFENTER;
4706
4707         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4708
4709         /*
4710          * We need to check BOTH the RX and the TX throttle controls,
4711          * so we use the bitwise OR instead of the logical OR.
4712          */
4713         WLAN_LOG_DEBUG(3, "flags=0x%lx\n", hw->usb_flags);
4714         if ( !hw->wlandev->hwremoved &&
4715              (
4716                (test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4717                !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4718                |
4719                (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4720                 !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4721              ) )
4722         {
4723                 schedule_work(&hw->usb_work);
4724         }
4725
4726         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4727
4728         DBFEXIT;
4729 }
4730
4731
4732 /*----------------------------------------------------------------
4733 * hfa384x_usbctlx_submit
4734 *
4735 * Called from the doxxx functions to submit a CTLX to the queue
4736 *
4737 * Arguments:
4738 *       hw              ptr to the hw struct
4739 *       ctlx            ctlx structure to enqueue
4740 *
4741 * Returns:
4742 *       -ENODEV if the adapter is unplugged
4743 *       0
4744 *
4745 * Side effects:
4746 *
4747 * Call context:
4748 *       process or interrupt
4749 ----------------------------------------------------------------*/
4750 static int
4751 hfa384x_usbctlx_submit(
4752         hfa384x_t               *hw,
4753         hfa384x_usbctlx_t       *ctlx)
4754 {
4755         unsigned long flags;
4756         int ret;
4757
4758         DBFENTER;
4759
4760         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4761
4762         if (hw->wlandev->hwremoved) {
4763                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4764                 ret = -ENODEV;
4765         } else {
4766                 ctlx->state = CTLX_PENDING;
4767                 list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4768
4769                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4770                 hfa384x_usbctlxq_run(hw);
4771                 ret = 0;
4772         }
4773
4774         DBFEXIT;
4775         return ret;
4776 }
4777
4778
4779 /*----------------------------------------------------------------
4780 * hfa384x_usbout_tx
4781 *
4782 * At this point we have finished a send of a frame.  Mark the URB
4783 * as available and call ev_alloc to notify higher layers we're
4784 * ready for more.
4785 *
4786 * Arguments:
4787 *       wlandev         wlan device
4788 *       usbout          ptr to the usb transfer buffer
4789 *
4790 * Returns:
4791 *       nothing
4792 *
4793 * Side effects:
4794 *
4795 * Call context:
4796 *       interrupt
4797 ----------------------------------------------------------------*/
4798 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4799 {
4800         DBFENTER;
4801
4802         prism2sta_ev_alloc(wlandev);
4803
4804         DBFEXIT;
4805 }
4806
4807 /*----------------------------------------------------------------
4808 * hfa384x_isgood_pdrcore
4809 *
4810 * Quick check of PDR codes.
4811 *
4812 * Arguments:
4813 *       pdrcode         PDR code number (host order)
4814 *
4815 * Returns:
4816 *       zero            not good.
4817 *       one             is good.
4818 *
4819 * Side effects:
4820 *
4821 * Call context:
4822 ----------------------------------------------------------------*/
4823 static int
4824 hfa384x_isgood_pdrcode(u16 pdrcode)
4825 {
4826         switch(pdrcode) {
4827         case HFA384x_PDR_END_OF_PDA:
4828         case HFA384x_PDR_PCB_PARTNUM:
4829         case HFA384x_PDR_PDAVER:
4830         case HFA384x_PDR_NIC_SERIAL:
4831         case HFA384x_PDR_MKK_MEASUREMENTS:
4832         case HFA384x_PDR_NIC_RAMSIZE:
4833         case HFA384x_PDR_MFISUPRANGE:
4834         case HFA384x_PDR_CFISUPRANGE:
4835         case HFA384x_PDR_NICID:
4836         case HFA384x_PDR_MAC_ADDRESS:
4837         case HFA384x_PDR_REGDOMAIN:
4838         case HFA384x_PDR_ALLOWED_CHANNEL:
4839         case HFA384x_PDR_DEFAULT_CHANNEL:
4840         case HFA384x_PDR_TEMPTYPE:
4841         case HFA384x_PDR_IFR_SETTING:
4842         case HFA384x_PDR_RFR_SETTING:
4843         case HFA384x_PDR_HFA3861_BASELINE:
4844         case HFA384x_PDR_HFA3861_SHADOW:
4845         case HFA384x_PDR_HFA3861_IFRF:
4846         case HFA384x_PDR_HFA3861_CHCALSP:
4847         case HFA384x_PDR_HFA3861_CHCALI:
4848         case HFA384x_PDR_3842_NIC_CONFIG:
4849         case HFA384x_PDR_USB_ID:
4850         case HFA384x_PDR_PCI_ID:
4851         case HFA384x_PDR_PCI_IFCONF:
4852         case HFA384x_PDR_PCI_PMCONF:
4853         case HFA384x_PDR_RFENRGY:
4854         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4855         case HFA384x_PDR_HFA3861_MANF_TESTI:
4856                 /* code is OK */
4857                 return 1;
4858                 break;
4859         default:
4860                 if ( pdrcode < 0x1000 ) {
4861                         /* code is OK, but we don't know exactly what it is */
4862                         WLAN_LOG_DEBUG(3,
4863                                 "Encountered unknown PDR#=0x%04x, "
4864                                 "assuming it's ok.\n",
4865                                 pdrcode);
4866                         return 1;
4867                 } else {
4868                         /* bad code */
4869                         WLAN_LOG_DEBUG(3,
4870                                 "Encountered unknown PDR#=0x%04x, "
4871                                 "(>=0x1000), assuming it's bad.\n",
4872                                 pdrcode);
4873                         return 0;
4874                 }
4875                 break;
4876         }
4877         return 0; /* avoid compiler warnings */
4878 }
4879