Root/drivers/staging/wlan-ng/hfa384x_usb.c

1/* src/prism2/driver/hfa384x_usb.c
2*
3* Functions that talk to the USB variantof the Intersil hfa384x MAC
4*
5* Copyright (C) 1999 AbsoluteValue Systems, Inc. All Rights Reserved.
6* --------------------------------------------------------------------
7*
8* linux-wlan
9*
10* The contents of this file are subject to the Mozilla Public
11* License Version 1.1 (the "License"); you may not use this file
12* except in compliance with the License. You may obtain a copy of
13* the License at http://www.mozilla.org/MPL/
14*
15* Software distributed under the License is distributed on an "AS
16* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
17* implied. See the License for the specific language governing
18* rights and limitations under the License.
19*
20* Alternatively, the contents of this file may be used under the
21* terms of the GNU Public License version 2 (the "GPL"), in which
22* case the provisions of the GPL are applicable instead of the
23* above. If you wish to allow the use of your version of this file
24* only under the terms of the GPL and not to allow others to use
25* your version of this file under the MPL, indicate your decision
26* by deleting the provisions above and replace them with the notice
27* and other provisions required by the GPL. If you do not delete
28* the provisions above, a recipient may use your version of this
29* file under either the MPL or the GPL.
30*
31* --------------------------------------------------------------------
32*
33* Inquiries regarding the linux-wlan Open Source project can be
34* made directly to:
35*
36* AbsoluteValue Systems Inc.
37* info@linux-wlan.com
38* http://www.linux-wlan.com
39*
40* --------------------------------------------------------------------
41*
42* Portions of the development of this software were funded by
43* Intersil Corporation as part of PRISM(R) chipset product development.
44*
45* --------------------------------------------------------------------
46*
47* This file implements functions that correspond to the prism2/hfa384x
48* 802.11 MAC hardware and firmware host interface.
49*
50* The functions can be considered to represent several levels of
51* abstraction. The lowest level functions are simply C-callable wrappers
52* around the register accesses. The next higher level represents C-callable
53* prism2 API functions that match the Intersil documentation as closely
54* as is reasonable. The next higher layer implements common sequences
55* of invocations of the API layer (e.g. write to bap, followed by cmd).
56*
57* Common sequences:
58* hfa384x_drvr_xxx Highest level abstractions provided by the
59* hfa384x code. They are driver defined wrappers
60* for common sequences. These functions generally
61* use the services of the lower levels.
62*
63* hfa384x_drvr_xxxconfig An example of the drvr level abstraction. These
64* functions are wrappers for the RID get/set
65* sequence. They call copy_[to|from]_bap() and
66* cmd_access(). These functions operate on the
67* RIDs and buffers without validation. The caller
68* is responsible for that.
69*
70* API wrapper functions:
71* hfa384x_cmd_xxx functions that provide access to the f/w commands.
72* The function arguments correspond to each command
73* argument, even command arguments that get packed
74* into single registers. These functions _just_
75* issue the command by setting the cmd/parm regs
76* & reading the status/resp regs. Additional
77* activities required to fully use a command
78* (read/write from/to bap, get/set int status etc.)
79* are implemented separately. Think of these as
80* C-callable prism2 commands.
81*
82* Lowest Layer Functions:
83* hfa384x_docmd_xxx These functions implement the sequence required
84* to issue any prism2 command. Primarily used by the
85* hfa384x_cmd_xxx functions.
86*
87* hfa384x_bap_xxx BAP read/write access functions.
88* Note: we usually use BAP0 for non-interrupt context
89* and BAP1 for interrupt context.
90*
91* hfa384x_dl_xxx download related functions.
92*
93* Driver State Issues:
94* Note that there are two pairs of functions that manage the
95* 'initialized' and 'running' states of the hw/MAC combo. The four
96* functions are create(), destroy(), start(), and stop(). create()
97* sets up the data structures required to support the hfa384x_*
98* functions and destroy() cleans them up. The start() function gets
99* the actual hardware running and enables the interrupts. The stop()
100* function shuts the hardware down. The sequence should be:
101* create()
102* start()
103* .
104* . Do interesting things w/ the hardware
105* .
106* stop()
107* destroy()
108*
109* Note that destroy() can be called without calling stop() first.
110* --------------------------------------------------------------------
111*/
112
113#include <linux/module.h>
114#include <linux/kernel.h>
115#include <linux/sched.h>
116#include <linux/types.h>
117#include <linux/slab.h>
118#include <linux/wireless.h>
119#include <linux/netdevice.h>
120#include <linux/timer.h>
121#include <linux/io.h>
122#include <linux/delay.h>
123#include <asm/byteorder.h>
124#include <linux/bitops.h>
125#include <linux/list.h>
126#include <linux/usb.h>
127#include <linux/byteorder/generic.h>
128
129#define SUBMIT_URB(u, f) usb_submit_urb(u, f)
130
131#include "p80211types.h"
132#include "p80211hdr.h"
133#include "p80211mgmt.h"
134#include "p80211conv.h"
135#include "p80211msg.h"
136#include "p80211netdev.h"
137#include "p80211req.h"
138#include "p80211metadef.h"
139#include "p80211metastruct.h"
140#include "hfa384x.h"
141#include "prism2mgmt.h"
142
143enum cmd_mode {
144    DOWAIT = 0,
145    DOASYNC
146};
147
148#define THROTTLE_JIFFIES (HZ/8)
149#define URB_ASYNC_UNLINK 0
150#define USB_QUEUE_BULK 0
151
152#define ROUNDUP64(a) (((a)+63)&~63)
153
154#ifdef DEBUG_USB
155static void dbprint_urb(struct urb *urb);
156#endif
157
158static void
159hfa384x_int_rxmonitor(wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm);
160
161static void hfa384x_usb_defer(struct work_struct *data);
162
163static int submit_rx_urb(hfa384x_t *hw, gfp_t flags);
164
165static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
166
167/*---------------------------------------------------*/
168/* Callbacks */
169static void hfa384x_usbout_callback(struct urb *urb);
170static void hfa384x_ctlxout_callback(struct urb *urb);
171static void hfa384x_usbin_callback(struct urb *urb);
172
173static void
174hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t * usbin);
175
176static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
177
178static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t * usbin);
179
180static void
181hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
182
183static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
184                   int urb_status);
185
186/*---------------------------------------------------*/
187/* Functions to support the prism2 usb command queue */
188
189static void hfa384x_usbctlxq_run(hfa384x_t *hw);
190
191static void hfa384x_usbctlx_reqtimerfn(unsigned long data);
192
193static void hfa384x_usbctlx_resptimerfn(unsigned long data);
194
195static void hfa384x_usb_throttlefn(unsigned long data);
196
197static void hfa384x_usbctlx_completion_task(unsigned long data);
198
199static void hfa384x_usbctlx_reaper_task(unsigned long data);
200
201static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
202
203static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
204
205struct usbctlx_completor {
206    int (*complete) (struct usbctlx_completor *);
207};
208
209static int
210hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
211                  hfa384x_usbctlx_t *ctlx,
212                  struct usbctlx_completor *completor);
213
214static int
215unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
216
217static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
218
219static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
220
221static int
222usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
223           hfa384x_cmdresult_t *result);
224
225static void
226usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
227               hfa384x_rridresult_t *result);
228
229/*---------------------------------------------------*/
230/* Low level req/resp CTLX formatters and submitters */
231static int
232hfa384x_docmd(hfa384x_t *hw,
233          enum cmd_mode mode,
234          hfa384x_metacmd_t *cmd,
235          ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
236
237static int
238hfa384x_dorrid(hfa384x_t *hw,
239           enum cmd_mode mode,
240           u16 rid,
241           void *riddata,
242           unsigned int riddatalen,
243           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
244
245static int
246hfa384x_dowrid(hfa384x_t *hw,
247           enum cmd_mode mode,
248           u16 rid,
249           void *riddata,
250           unsigned int riddatalen,
251           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
252
253static int
254hfa384x_dormem(hfa384x_t *hw,
255           enum cmd_mode mode,
256           u16 page,
257           u16 offset,
258           void *data,
259           unsigned int len,
260           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
261
262static int
263hfa384x_dowmem(hfa384x_t *hw,
264           enum cmd_mode mode,
265           u16 page,
266           u16 offset,
267           void *data,
268           unsigned int len,
269           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
270
271static int hfa384x_isgood_pdrcode(u16 pdrcode);
272
273static inline const char *ctlxstr(CTLX_STATE s)
274{
275    static const char *ctlx_str[] = {
276        "Initial state",
277        "Complete",
278        "Request failed",
279        "Request pending",
280        "Request packet submitted",
281        "Request packet completed",
282        "Response packet completed"
283    };
284
285    return ctlx_str[s];
286};
287
288static inline hfa384x_usbctlx_t *get_active_ctlx(hfa384x_t * hw)
289{
290    return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
291}
292
293#ifdef DEBUG_USB
294void dbprint_urb(struct urb *urb)
295{
296    pr_debug("urb->pipe=0x%08x\n", urb->pipe);
297    pr_debug("urb->status=0x%08x\n", urb->status);
298    pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
299    pr_debug("urb->transfer_buffer=0x%08x\n",
300         (unsigned int)urb->transfer_buffer);
301    pr_debug("urb->transfer_buffer_length=0x%08x\n",
302         urb->transfer_buffer_length);
303    pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
304    pr_debug("urb->bandwidth=0x%08x\n", urb->bandwidth);
305    pr_debug("urb->setup_packet(ctl)=0x%08x\n",
306         (unsigned int)urb->setup_packet);
307    pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
308    pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
309    pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
310    pr_debug("urb->timeout=0x%08x\n", urb->timeout);
311    pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
312    pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
313}
314#endif
315
316/*----------------------------------------------------------------
317* submit_rx_urb
318*
319* Listen for input data on the BULK-IN pipe. If the pipe has
320* stalled then schedule it to be reset.
321*
322* Arguments:
323* hw device struct
324* memflags memory allocation flags
325*
326* Returns:
327* error code from submission
328*
329* Call context:
330* Any
331----------------------------------------------------------------*/
332static int submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
333{
334    struct sk_buff *skb;
335    int result;
336
337    skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
338    if (skb == NULL) {
339        result = -ENOMEM;
340        goto done;
341    }
342
343    /* Post the IN urb */
344    usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
345              hw->endp_in,
346              skb->data, sizeof(hfa384x_usbin_t),
347              hfa384x_usbin_callback, hw->wlandev);
348
349    hw->rx_urb_skb = skb;
350
351    result = -ENOLINK;
352    if (!hw->wlandev->hwremoved &&
353            !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
354        result = SUBMIT_URB(&hw->rx_urb, memflags);
355
356        /* Check whether we need to reset the RX pipe */
357        if (result == -EPIPE) {
358            printk(KERN_WARNING
359                   "%s rx pipe stalled: requesting reset\n",
360                   hw->wlandev->netdev->name);
361            if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
362                schedule_work(&hw->usb_work);
363        }
364    }
365
366    /* Don't leak memory if anything should go wrong */
367    if (result != 0) {
368        dev_kfree_skb(skb);
369        hw->rx_urb_skb = NULL;
370    }
371
372done:
373    return result;
374}
375
376/*----------------------------------------------------------------
377* submit_tx_urb
378*
379* Prepares and submits the URB of transmitted data. If the
380* submission fails then it will schedule the output pipe to
381* be reset.
382*
383* Arguments:
384* hw device struct
385* tx_urb URB of data for tranmission
386* memflags memory allocation flags
387*
388* Returns:
389* error code from submission
390*
391* Call context:
392* Any
393----------------------------------------------------------------*/
394static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
395{
396    struct net_device *netdev = hw->wlandev->netdev;
397    int result;
398
399    result = -ENOLINK;
400    if (netif_running(netdev)) {
401
402        if (!hw->wlandev->hwremoved
403            && !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
404            result = SUBMIT_URB(tx_urb, memflags);
405
406            /* Test whether we need to reset the TX pipe */
407            if (result == -EPIPE) {
408                printk(KERN_WARNING
409                       "%s tx pipe stalled: requesting reset\n",
410                       netdev->name);
411                set_bit(WORK_TX_HALT, &hw->usb_flags);
412                schedule_work(&hw->usb_work);
413            } else if (result == 0) {
414                netif_stop_queue(netdev);
415            }
416        }
417    }
418
419    return result;
420}
421
422/*----------------------------------------------------------------
423* hfa394x_usb_defer
424*
425* There are some things that the USB stack cannot do while
426* in interrupt context, so we arrange this function to run
427* in process context.
428*
429* Arguments:
430* hw device structure
431*
432* Returns:
433* nothing
434*
435* Call context:
436* process (by design)
437----------------------------------------------------------------*/
438static void hfa384x_usb_defer(struct work_struct *data)
439{
440    hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
441    struct net_device *netdev = hw->wlandev->netdev;
442
443    /* Don't bother trying to reset anything if the plug
444     * has been pulled ...
445     */
446    if (hw->wlandev->hwremoved)
447        return;
448
449    /* Reception has stopped: try to reset the input pipe */
450    if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
451        int ret;
452
453        usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
454
455        ret = usb_clear_halt(hw->usb, hw->endp_in);
456        if (ret != 0) {
457            printk(KERN_ERR
458                   "Failed to clear rx pipe for %s: err=%d\n",
459                   netdev->name, ret);
460        } else {
461            printk(KERN_INFO "%s rx pipe reset complete.\n",
462                   netdev->name);
463            clear_bit(WORK_RX_HALT, &hw->usb_flags);
464            set_bit(WORK_RX_RESUME, &hw->usb_flags);
465        }
466    }
467
468    /* Resume receiving data back from the device. */
469    if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
470        int ret;
471
472        ret = submit_rx_urb(hw, GFP_KERNEL);
473        if (ret != 0) {
474            printk(KERN_ERR
475                   "Failed to resume %s rx pipe.\n", netdev->name);
476        } else {
477            clear_bit(WORK_RX_RESUME, &hw->usb_flags);
478        }
479    }
480
481    /* Transmission has stopped: try to reset the output pipe */
482    if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
483        int ret;
484
485        usb_kill_urb(&hw->tx_urb);
486        ret = usb_clear_halt(hw->usb, hw->endp_out);
487        if (ret != 0) {
488            printk(KERN_ERR
489                   "Failed to clear tx pipe for %s: err=%d\n",
490                   netdev->name, ret);
491        } else {
492            printk(KERN_INFO "%s tx pipe reset complete.\n",
493                   netdev->name);
494            clear_bit(WORK_TX_HALT, &hw->usb_flags);
495            set_bit(WORK_TX_RESUME, &hw->usb_flags);
496
497            /* Stopping the BULK-OUT pipe also blocked
498             * us from sending any more CTLX URBs, so
499             * we need to re-run our queue ...
500             */
501            hfa384x_usbctlxq_run(hw);
502        }
503    }
504
505    /* Resume transmitting. */
506    if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
507        netif_wake_queue(hw->wlandev->netdev);
508}
509
510/*----------------------------------------------------------------
511* hfa384x_create
512*
513* Sets up the hfa384x_t data structure for use. Note this
514* does _not_ initialize the actual hardware, just the data structures
515* we use to keep track of its state.
516*
517* Arguments:
518* hw device structure
519* irq device irq number
520* iobase i/o base address for register access
521* membase memory base address for register access
522*
523* Returns:
524* nothing
525*
526* Side effects:
527*
528* Call context:
529* process
530----------------------------------------------------------------*/
531void hfa384x_create(hfa384x_t *hw, struct usb_device *usb)
532{
533    memset(hw, 0, sizeof(hfa384x_t));
534    hw->usb = usb;
535
536    /* set up the endpoints */
537    hw->endp_in = usb_rcvbulkpipe(usb, 1);
538    hw->endp_out = usb_sndbulkpipe(usb, 2);
539
540    /* Set up the waitq */
541    init_waitqueue_head(&hw->cmdq);
542
543    /* Initialize the command queue */
544    spin_lock_init(&hw->ctlxq.lock);
545    INIT_LIST_HEAD(&hw->ctlxq.pending);
546    INIT_LIST_HEAD(&hw->ctlxq.active);
547    INIT_LIST_HEAD(&hw->ctlxq.completing);
548    INIT_LIST_HEAD(&hw->ctlxq.reapable);
549
550    /* Initialize the authentication queue */
551    skb_queue_head_init(&hw->authq);
552
553    tasklet_init(&hw->reaper_bh,
554             hfa384x_usbctlx_reaper_task, (unsigned long)hw);
555    tasklet_init(&hw->completion_bh,
556             hfa384x_usbctlx_completion_task, (unsigned long)hw);
557    INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
558    INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
559
560    init_timer(&hw->throttle);
561    hw->throttle.function = hfa384x_usb_throttlefn;
562    hw->throttle.data = (unsigned long)hw;
563
564    init_timer(&hw->resptimer);
565    hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
566    hw->resptimer.data = (unsigned long)hw;
567
568    init_timer(&hw->reqtimer);
569    hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
570    hw->reqtimer.data = (unsigned long)hw;
571
572    usb_init_urb(&hw->rx_urb);
573    usb_init_urb(&hw->tx_urb);
574    usb_init_urb(&hw->ctlx_urb);
575
576    hw->link_status = HFA384x_LINK_NOTCONNECTED;
577    hw->state = HFA384x_STATE_INIT;
578
579    INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
580    init_timer(&hw->commsqual_timer);
581    hw->commsqual_timer.data = (unsigned long)hw;
582    hw->commsqual_timer.function = prism2sta_commsqual_timer;
583}
584
585/*----------------------------------------------------------------
586* hfa384x_destroy
587*
588* Partner to hfa384x_create(). This function cleans up the hw
589* structure so that it can be freed by the caller using a simple
590* kfree. Currently, this function is just a placeholder. If, at some
591* point in the future, an hw in the 'shutdown' state requires a 'deep'
592* kfree, this is where it should be done. Note that if this function
593* is called on a _running_ hw structure, the drvr_stop() function is
594* called.
595*
596* Arguments:
597* hw device structure
598*
599* Returns:
600* nothing, this function is not allowed to fail.
601*
602* Side effects:
603*
604* Call context:
605* process
606----------------------------------------------------------------*/
607void hfa384x_destroy(hfa384x_t *hw)
608{
609    struct sk_buff *skb;
610
611    if (hw->state == HFA384x_STATE_RUNNING)
612        hfa384x_drvr_stop(hw);
613    hw->state = HFA384x_STATE_PREINIT;
614
615    kfree(hw->scanresults);
616    hw->scanresults = NULL;
617
618    /* Now to clean out the auth queue */
619    while ((skb = skb_dequeue(&hw->authq)))
620        dev_kfree_skb(skb);
621}
622
623static hfa384x_usbctlx_t *usbctlx_alloc(void)
624{
625    hfa384x_usbctlx_t *ctlx;
626
627    ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
628    if (ctlx != NULL) {
629        memset(ctlx, 0, sizeof(*ctlx));
630        init_completion(&ctlx->done);
631    }
632
633    return ctlx;
634}
635
636static int
637usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
638           hfa384x_cmdresult_t *result)
639{
640    result->status = le16_to_cpu(cmdresp->status);
641    result->resp0 = le16_to_cpu(cmdresp->resp0);
642    result->resp1 = le16_to_cpu(cmdresp->resp1);
643    result->resp2 = le16_to_cpu(cmdresp->resp2);
644
645    pr_debug("cmdresult:status=0x%04x "
646         "resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
647         result->status, result->resp0, result->resp1, result->resp2);
648
649    return result->status & HFA384x_STATUS_RESULT;
650}
651
652static void
653usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
654               hfa384x_rridresult_t *result)
655{
656    result->rid = le16_to_cpu(rridresp->rid);
657    result->riddata = rridresp->data;
658    result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
659
660}
661
662/*----------------------------------------------------------------
663* Completor object:
664* This completor must be passed to hfa384x_usbctlx_complete_sync()
665* when processing a CTLX that returns a hfa384x_cmdresult_t structure.
666----------------------------------------------------------------*/
667struct usbctlx_cmd_completor {
668    struct usbctlx_completor head;
669
670    const hfa384x_usb_cmdresp_t *cmdresp;
671    hfa384x_cmdresult_t *result;
672};
673
674static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
675{
676    struct usbctlx_cmd_completor *complete;
677
678    complete = (struct usbctlx_cmd_completor *) head;
679    return usbctlx_get_status(complete->cmdresp, complete->result);
680}
681
682static inline struct usbctlx_completor *init_cmd_completor(
683                        struct usbctlx_cmd_completor
684                            *completor,
685                        const hfa384x_usb_cmdresp_t
686                            *cmdresp,
687                        hfa384x_cmdresult_t *result)
688{
689    completor->head.complete = usbctlx_cmd_completor_fn;
690    completor->cmdresp = cmdresp;
691    completor->result = result;
692    return &(completor->head);
693}
694
695/*----------------------------------------------------------------
696* Completor object:
697* This completor must be passed to hfa384x_usbctlx_complete_sync()
698* when processing a CTLX that reads a RID.
699----------------------------------------------------------------*/
700struct usbctlx_rrid_completor {
701    struct usbctlx_completor head;
702
703    const hfa384x_usb_rridresp_t *rridresp;
704    void *riddata;
705    unsigned int riddatalen;
706};
707
708static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
709{
710    struct usbctlx_rrid_completor *complete;
711    hfa384x_rridresult_t rridresult;
712
713    complete = (struct usbctlx_rrid_completor *) head;
714    usbctlx_get_rridresult(complete->rridresp, &rridresult);
715
716    /* Validate the length, note body len calculation in bytes */
717    if (rridresult.riddata_len != complete->riddatalen) {
718        printk(KERN_WARNING
719               "RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
720               rridresult.rid,
721               complete->riddatalen, rridresult.riddata_len);
722        return -ENODATA;
723    }
724
725    memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
726    return 0;
727}
728
729static inline struct usbctlx_completor *init_rrid_completor(
730                        struct usbctlx_rrid_completor
731                            *completor,
732                        const hfa384x_usb_rridresp_t
733                            *rridresp,
734                        void *riddata,
735                        unsigned int riddatalen)
736{
737    completor->head.complete = usbctlx_rrid_completor_fn;
738    completor->rridresp = rridresp;
739    completor->riddata = riddata;
740    completor->riddatalen = riddatalen;
741    return &(completor->head);
742}
743
744/*----------------------------------------------------------------
745* Completor object:
746* Interprets the results of a synchronous RID-write
747----------------------------------------------------------------*/
748typedef struct usbctlx_cmd_completor usbctlx_wrid_completor_t;
749#define init_wrid_completor init_cmd_completor
750
751/*----------------------------------------------------------------
752* Completor object:
753* Interprets the results of a synchronous memory-write
754----------------------------------------------------------------*/
755typedef struct usbctlx_cmd_completor usbctlx_wmem_completor_t;
756#define init_wmem_completor init_cmd_completor
757
758/*----------------------------------------------------------------
759* Completor object:
760* Interprets the results of a synchronous memory-read
761----------------------------------------------------------------*/
762struct usbctlx_rmem_completor {
763    struct usbctlx_completor head;
764
765    const hfa384x_usb_rmemresp_t *rmemresp;
766    void *data;
767    unsigned int len;
768};
769typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
770
771static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
772{
773    usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
774
775    pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
776    memcpy(complete->data, complete->rmemresp->data, complete->len);
777    return 0;
778}
779
780static inline struct usbctlx_completor *init_rmem_completor(
781                        usbctlx_rmem_completor_t
782                            *completor,
783                        hfa384x_usb_rmemresp_t
784                            *rmemresp,
785                        void *data,
786                        unsigned int len)
787{
788    completor->head.complete = usbctlx_rmem_completor_fn;
789    completor->rmemresp = rmemresp;
790    completor->data = data;
791    completor->len = len;
792    return &(completor->head);
793}
794
795/*----------------------------------------------------------------
796* hfa384x_cb_status
797*
798* Ctlx_complete handler for async CMD type control exchanges.
799* mark the hw struct as such.
800*
801* Note: If the handling is changed here, it should probably be
802* changed in docmd as well.
803*
804* Arguments:
805* hw hw struct
806* ctlx completed CTLX
807*
808* Returns:
809* nothing
810*
811* Side effects:
812*
813* Call context:
814* interrupt
815----------------------------------------------------------------*/
816static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
817{
818    if (ctlx->usercb != NULL) {
819        hfa384x_cmdresult_t cmdresult;
820
821        if (ctlx->state != CTLX_COMPLETE) {
822            memset(&cmdresult, 0, sizeof(cmdresult));
823            cmdresult.status =
824                HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
825        } else {
826            usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
827        }
828
829        ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
830    }
831}
832
833/*----------------------------------------------------------------
834* hfa384x_cb_rrid
835*
836* CTLX completion handler for async RRID type control exchanges.
837*
838* Note: If the handling is changed here, it should probably be
839* changed in dorrid as well.
840*
841* Arguments:
842* hw hw struct
843* ctlx completed CTLX
844*
845* Returns:
846* nothing
847*
848* Side effects:
849*
850* Call context:
851* interrupt
852----------------------------------------------------------------*/
853static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
854{
855    if (ctlx->usercb != NULL) {
856        hfa384x_rridresult_t rridresult;
857
858        if (ctlx->state != CTLX_COMPLETE) {
859            memset(&rridresult, 0, sizeof(rridresult));
860            rridresult.rid = le16_to_cpu(ctlx->outbuf.rridreq.rid);
861        } else {
862            usbctlx_get_rridresult(&ctlx->inbuf.rridresp,
863                           &rridresult);
864        }
865
866        ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
867    }
868}
869
870static inline int hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
871{
872    return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
873}
874
875static inline int
876hfa384x_docmd_async(hfa384x_t *hw,
877            hfa384x_metacmd_t *cmd,
878            ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
879{
880    return hfa384x_docmd(hw, DOASYNC, cmd, cmdcb, usercb, usercb_data);
881}
882
883static inline int
884hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
885            unsigned int riddatalen)
886{
887    return hfa384x_dorrid(hw, DOWAIT,
888                  rid, riddata, riddatalen, NULL, NULL, NULL);
889}
890
891static inline int
892hfa384x_dorrid_async(hfa384x_t *hw,
893             u16 rid, void *riddata, unsigned int riddatalen,
894             ctlx_cmdcb_t cmdcb,
895             ctlx_usercb_t usercb, void *usercb_data)
896{
897    return hfa384x_dorrid(hw, DOASYNC,
898                  rid, riddata, riddatalen,
899                  cmdcb, usercb, usercb_data);
900}
901
902static inline int
903hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
904            unsigned int riddatalen)
905{
906    return hfa384x_dowrid(hw, DOWAIT,
907                  rid, riddata, riddatalen, NULL, NULL, NULL);
908}
909
910static inline int
911hfa384x_dowrid_async(hfa384x_t *hw,
912             u16 rid, void *riddata, unsigned int riddatalen,
913             ctlx_cmdcb_t cmdcb,
914             ctlx_usercb_t usercb, void *usercb_data)
915{
916    return hfa384x_dowrid(hw, DOASYNC,
917                  rid, riddata, riddatalen,
918                  cmdcb, usercb, usercb_data);
919}
920
921static inline int
922hfa384x_dormem_wait(hfa384x_t *hw,
923            u16 page, u16 offset, void *data, unsigned int len)
924{
925    return hfa384x_dormem(hw, DOWAIT,
926                  page, offset, data, len, NULL, NULL, NULL);
927}
928
929static inline int
930hfa384x_dormem_async(hfa384x_t *hw,
931             u16 page, u16 offset, void *data, unsigned int len,
932             ctlx_cmdcb_t cmdcb,
933             ctlx_usercb_t usercb, void *usercb_data)
934{
935    return hfa384x_dormem(hw, DOASYNC,
936                  page, offset, data, len,
937                  cmdcb, usercb, usercb_data);
938}
939
940static inline int
941hfa384x_dowmem_wait(hfa384x_t *hw,
942            u16 page, u16 offset, void *data, unsigned int len)
943{
944    return hfa384x_dowmem(hw, DOWAIT,
945                  page, offset, data, len, NULL, NULL, NULL);
946}
947
948static inline int
949hfa384x_dowmem_async(hfa384x_t *hw,
950             u16 page,
951             u16 offset,
952             void *data,
953             unsigned int len,
954             ctlx_cmdcb_t cmdcb,
955             ctlx_usercb_t usercb, void *usercb_data)
956{
957    return hfa384x_dowmem(hw, DOASYNC,
958                  page, offset, data, len,
959                  cmdcb, usercb, usercb_data);
960}
961
962/*----------------------------------------------------------------
963* hfa384x_cmd_initialize
964*
965* Issues the initialize command and sets the hw->state based
966* on the result.
967*
968* Arguments:
969* hw device structure
970*
971* Returns:
972* 0 success
973* >0 f/w reported error - f/w status code
974* <0 driver reported error
975*
976* Side effects:
977*
978* Call context:
979* process
980----------------------------------------------------------------*/
981int hfa384x_cmd_initialize(hfa384x_t *hw)
982{
983    int result = 0;
984    int i;
985    hfa384x_metacmd_t cmd;
986
987    cmd.cmd = HFA384x_CMDCODE_INIT;
988    cmd.parm0 = 0;
989    cmd.parm1 = 0;
990    cmd.parm2 = 0;
991
992    result = hfa384x_docmd_wait(hw, &cmd);
993
994    pr_debug("cmdresp.init: "
995         "status=0x%04x, resp0=0x%04x, "
996         "resp1=0x%04x, resp2=0x%04x\n",
997         cmd.result.status,
998         cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
999    if (result == 0) {
1000        for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
1001            hw->port_enabled[i] = 0;
1002    }
1003
1004    hw->link_status = HFA384x_LINK_NOTCONNECTED;
1005
1006    return result;
1007}
1008
1009/*----------------------------------------------------------------
1010* hfa384x_cmd_disable
1011*
1012* Issues the disable command to stop communications on one of
1013* the MACs 'ports'.
1014*
1015* Arguments:
1016* hw device structure
1017* macport MAC port number (host order)
1018*
1019* Returns:
1020* 0 success
1021* >0 f/w reported failure - f/w status code
1022* <0 driver reported error (timeout|bad arg)
1023*
1024* Side effects:
1025*
1026* Call context:
1027* process
1028----------------------------------------------------------------*/
1029int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1030{
1031    int result = 0;
1032    hfa384x_metacmd_t cmd;
1033
1034    cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1035        HFA384x_CMD_MACPORT_SET(macport);
1036    cmd.parm0 = 0;
1037    cmd.parm1 = 0;
1038    cmd.parm2 = 0;
1039
1040    result = hfa384x_docmd_wait(hw, &cmd);
1041
1042    return result;
1043}
1044
1045/*----------------------------------------------------------------
1046* hfa384x_cmd_enable
1047*
1048* Issues the enable command to enable communications on one of
1049* the MACs 'ports'.
1050*
1051* Arguments:
1052* hw device structure
1053* macport MAC port number
1054*
1055* Returns:
1056* 0 success
1057* >0 f/w reported failure - f/w status code
1058* <0 driver reported error (timeout|bad arg)
1059*
1060* Side effects:
1061*
1062* Call context:
1063* process
1064----------------------------------------------------------------*/
1065int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1066{
1067    int result = 0;
1068    hfa384x_metacmd_t cmd;
1069
1070    cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1071        HFA384x_CMD_MACPORT_SET(macport);
1072    cmd.parm0 = 0;
1073    cmd.parm1 = 0;
1074    cmd.parm2 = 0;
1075
1076    result = hfa384x_docmd_wait(hw, &cmd);
1077
1078    return result;
1079}
1080
1081/*----------------------------------------------------------------
1082* hfa384x_cmd_monitor
1083*
1084* Enables the 'monitor mode' of the MAC. Here's the description of
1085* monitor mode that I've received thus far:
1086*
1087* "The "monitor mode" of operation is that the MAC passes all
1088* frames for which the PLCP checks are correct. All received
1089* MPDUs are passed to the host with MAC Port = 7, with a
1090* receive status of good, FCS error, or undecryptable. Passing
1091* certain MPDUs is a violation of the 802.11 standard, but useful
1092* for a debugging tool." Normal communication is not possible
1093* while monitor mode is enabled.
1094*
1095* Arguments:
1096* hw device structure
1097* enable a code (0x0b|0x0f) that enables/disables
1098* monitor mode. (host order)
1099*
1100* Returns:
1101* 0 success
1102* >0 f/w reported failure - f/w status code
1103* <0 driver reported error (timeout|bad arg)
1104*
1105* Side effects:
1106*
1107* Call context:
1108* process
1109----------------------------------------------------------------*/
1110int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1111{
1112    int result = 0;
1113    hfa384x_metacmd_t cmd;
1114
1115    cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1116        HFA384x_CMD_AINFO_SET(enable);
1117    cmd.parm0 = 0;
1118    cmd.parm1 = 0;
1119    cmd.parm2 = 0;
1120
1121    result = hfa384x_docmd_wait(hw, &cmd);
1122
1123    return result;
1124}
1125
1126/*----------------------------------------------------------------
1127* hfa384x_cmd_download
1128*
1129* Sets the controls for the MAC controller code/data download
1130* process. The arguments set the mode and address associated
1131* with a download. Note that the aux registers should be enabled
1132* prior to setting one of the download enable modes.
1133*
1134* Arguments:
1135* hw device structure
1136* mode 0 - Disable programming and begin code exec
1137* 1 - Enable volatile mem programming
1138* 2 - Enable non-volatile mem programming
1139* 3 - Program non-volatile section from NV download
1140* buffer.
1141* (host order)
1142* lowaddr
1143* highaddr For mode 1, sets the high & low order bits of
1144* the "destination address". This address will be
1145* the execution start address when download is
1146* subsequently disabled.
1147* For mode 2, sets the high & low order bits of
1148* the destination in NV ram.
1149* For modes 0 & 3, should be zero. (host order)
1150* NOTE: these are CMD format.
1151* codelen Length of the data to write in mode 2,
1152* zero otherwise. (host order)
1153*
1154* Returns:
1155* 0 success
1156* >0 f/w reported failure - f/w status code
1157* <0 driver reported error (timeout|bad arg)
1158*
1159* Side effects:
1160*
1161* Call context:
1162* process
1163----------------------------------------------------------------*/
1164int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1165             u16 highaddr, u16 codelen)
1166{
1167    int result = 0;
1168    hfa384x_metacmd_t cmd;
1169
1170    pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1171         mode, lowaddr, highaddr, codelen);
1172
1173    cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1174           HFA384x_CMD_PROGMODE_SET(mode));
1175
1176    cmd.parm0 = lowaddr;
1177    cmd.parm1 = highaddr;
1178    cmd.parm2 = codelen;
1179
1180    result = hfa384x_docmd_wait(hw, &cmd);
1181
1182    return result;
1183}
1184
1185/*----------------------------------------------------------------
1186* hfa384x_corereset
1187*
1188* Perform a reset of the hfa38xx MAC core. We assume that the hw
1189* structure is in its "created" state. That is, it is initialized
1190* with proper values. Note that if a reset is done after the
1191* device has been active for awhile, the caller might have to clean
1192* up some leftover cruft in the hw structure.
1193*
1194* Arguments:
1195* hw device structure
1196* holdtime how long (in ms) to hold the reset
1197* settletime how long (in ms) to wait after releasing
1198* the reset
1199*
1200* Returns:
1201* nothing
1202*
1203* Side effects:
1204*
1205* Call context:
1206* process
1207----------------------------------------------------------------*/
1208int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1209{
1210    int result = 0;
1211
1212    result = usb_reset_device(hw->usb);
1213    if (result < 0) {
1214        printk(KERN_ERR "usb_reset_device() failed, result=%d.\n",
1215               result);
1216    }
1217
1218    return result;
1219}
1220
1221/*----------------------------------------------------------------
1222* hfa384x_usbctlx_complete_sync
1223*
1224* Waits for a synchronous CTLX object to complete,
1225* and then handles the response.
1226*
1227* Arguments:
1228* hw device structure
1229* ctlx CTLX ptr
1230* completor functor object to decide what to
1231* do with the CTLX's result.
1232*
1233* Returns:
1234* 0 Success
1235* -ERESTARTSYS Interrupted by a signal
1236* -EIO CTLX failed
1237* -ENODEV Adapter was unplugged
1238* ??? Result from completor
1239*
1240* Side effects:
1241*
1242* Call context:
1243* process
1244----------------------------------------------------------------*/
1245static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1246                     hfa384x_usbctlx_t *ctlx,
1247                     struct usbctlx_completor *completor)
1248{
1249    unsigned long flags;
1250    int result;
1251
1252    result = wait_for_completion_interruptible(&ctlx->done);
1253
1254    spin_lock_irqsave(&hw->ctlxq.lock, flags);
1255
1256    /*
1257     * We can only handle the CTLX if the USB disconnect
1258     * function has not run yet ...
1259     */
1260cleanup:
1261    if (hw->wlandev->hwremoved) {
1262        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1263        result = -ENODEV;
1264    } else if (result != 0) {
1265        int runqueue = 0;
1266
1267        /*
1268         * We were probably interrupted, so delete
1269         * this CTLX asynchronously, kill the timers
1270         * and the URB, and then start the next
1271         * pending CTLX.
1272         *
1273         * NOTE: We can only delete the timers and
1274         * the URB if this CTLX is active.
1275         */
1276        if (ctlx == get_active_ctlx(hw)) {
1277            spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1278
1279            del_singleshot_timer_sync(&hw->reqtimer);
1280            del_singleshot_timer_sync(&hw->resptimer);
1281            hw->req_timer_done = 1;
1282            hw->resp_timer_done = 1;
1283            usb_kill_urb(&hw->ctlx_urb);
1284
1285            spin_lock_irqsave(&hw->ctlxq.lock, flags);
1286
1287            runqueue = 1;
1288
1289            /*
1290             * This scenario is so unlikely that I'm
1291             * happy with a grubby "goto" solution ...
1292             */
1293            if (hw->wlandev->hwremoved)
1294                goto cleanup;
1295        }
1296
1297        /*
1298         * The completion task will send this CTLX
1299         * to the reaper the next time it runs. We
1300         * are no longer in a hurry.
1301         */
1302        ctlx->reapable = 1;
1303        ctlx->state = CTLX_REQ_FAILED;
1304        list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1305
1306        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1307
1308        if (runqueue)
1309            hfa384x_usbctlxq_run(hw);
1310    } else {
1311        if (ctlx->state == CTLX_COMPLETE) {
1312            result = completor->complete(completor);
1313        } else {
1314            printk(KERN_WARNING "CTLX[%d] error: state(%s)\n",
1315                   le16_to_cpu(ctlx->outbuf.type),
1316                   ctlxstr(ctlx->state));
1317            result = -EIO;
1318        }
1319
1320        list_del(&ctlx->list);
1321        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1322        kfree(ctlx);
1323    }
1324
1325    return result;
1326}
1327
1328/*----------------------------------------------------------------
1329* hfa384x_docmd
1330*
1331* Constructs a command CTLX and submits it.
1332*
1333* NOTE: Any changes to the 'post-submit' code in this function
1334* need to be carried over to hfa384x_cbcmd() since the handling
1335* is virtually identical.
1336*
1337* Arguments:
1338* hw device structure
1339* mode DOWAIT or DOASYNC
1340* cmd cmd structure. Includes all arguments and result
1341* data points. All in host order. in host order
1342* cmdcb command-specific callback
1343* usercb user callback for async calls, NULL for DOWAIT calls
1344* usercb_data user supplied data pointer for async calls, NULL
1345* for DOASYNC calls
1346*
1347* Returns:
1348* 0 success
1349* -EIO CTLX failure
1350* -ERESTARTSYS Awakened on signal
1351* >0 command indicated error, Status and Resp0-2 are
1352* in hw structure.
1353*
1354* Side effects:
1355*
1356*
1357* Call context:
1358* process
1359----------------------------------------------------------------*/
1360static int
1361hfa384x_docmd(hfa384x_t *hw,
1362          enum cmd_mode mode,
1363          hfa384x_metacmd_t *cmd,
1364          ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1365{
1366    int result;
1367    hfa384x_usbctlx_t *ctlx;
1368
1369    ctlx = usbctlx_alloc();
1370    if (ctlx == NULL) {
1371        result = -ENOMEM;
1372        goto done;
1373    }
1374
1375    /* Initialize the command */
1376    ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1377    ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1378    ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1379    ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1380    ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1381
1382    ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1383
1384    pr_debug("cmdreq: cmd=0x%04x "
1385         "parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1386         cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1387
1388    ctlx->reapable = mode;
1389    ctlx->cmdcb = cmdcb;
1390    ctlx->usercb = usercb;
1391    ctlx->usercb_data = usercb_data;
1392
1393    result = hfa384x_usbctlx_submit(hw, ctlx);
1394    if (result != 0) {
1395        kfree(ctlx);
1396    } else if (mode == DOWAIT) {
1397        struct usbctlx_cmd_completor completor;
1398
1399        result =
1400            hfa384x_usbctlx_complete_sync(hw, ctlx,
1401                          init_cmd_completor(&completor,
1402                                     &ctlx->
1403                                     inbuf.
1404                                     cmdresp,
1405                                     &cmd->
1406                                     result));
1407    }
1408
1409done:
1410    return result;
1411}
1412
1413/*----------------------------------------------------------------
1414* hfa384x_dorrid
1415*
1416* Constructs a read rid CTLX and issues it.
1417*
1418* NOTE: Any changes to the 'post-submit' code in this function
1419* need to be carried over to hfa384x_cbrrid() since the handling
1420* is virtually identical.
1421*
1422* Arguments:
1423* hw device structure
1424* mode DOWAIT or DOASYNC
1425* rid Read RID number (host order)
1426* riddata Caller supplied buffer that MAC formatted RID.data
1427* record will be written to for DOWAIT calls. Should
1428* be NULL for DOASYNC calls.
1429* riddatalen Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1430* cmdcb command callback for async calls, NULL for DOWAIT calls
1431* usercb user callback for async calls, NULL for DOWAIT calls
1432* usercb_data user supplied data pointer for async calls, NULL
1433* for DOWAIT calls
1434*
1435* Returns:
1436* 0 success
1437* -EIO CTLX failure
1438* -ERESTARTSYS Awakened on signal
1439* -ENODATA riddatalen != macdatalen
1440* >0 command indicated error, Status and Resp0-2 are
1441* in hw structure.
1442*
1443* Side effects:
1444*
1445* Call context:
1446* interrupt (DOASYNC)
1447* process (DOWAIT or DOASYNC)
1448----------------------------------------------------------------*/
1449static int
1450hfa384x_dorrid(hfa384x_t *hw,
1451           enum cmd_mode mode,
1452           u16 rid,
1453           void *riddata,
1454           unsigned int riddatalen,
1455           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1456{
1457    int result;
1458    hfa384x_usbctlx_t *ctlx;
1459
1460    ctlx = usbctlx_alloc();
1461    if (ctlx == NULL) {
1462        result = -ENOMEM;
1463        goto done;
1464    }
1465
1466    /* Initialize the command */
1467    ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1468    ctlx->outbuf.rridreq.frmlen =
1469        cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1470    ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1471
1472    ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1473
1474    ctlx->reapable = mode;
1475    ctlx->cmdcb = cmdcb;
1476    ctlx->usercb = usercb;
1477    ctlx->usercb_data = usercb_data;
1478
1479    /* Submit the CTLX */
1480    result = hfa384x_usbctlx_submit(hw, ctlx);
1481    if (result != 0) {
1482        kfree(ctlx);
1483    } else if (mode == DOWAIT) {
1484        struct usbctlx_rrid_completor completor;
1485
1486        result =
1487            hfa384x_usbctlx_complete_sync(hw, ctlx,
1488                          init_rrid_completor
1489                          (&completor,
1490                           &ctlx->inbuf.rridresp,
1491                           riddata, riddatalen));
1492    }
1493
1494done:
1495    return result;
1496}
1497
1498/*----------------------------------------------------------------
1499* hfa384x_dowrid
1500*
1501* Constructs a write rid CTLX and issues it.
1502*
1503* NOTE: Any changes to the 'post-submit' code in this function
1504* need to be carried over to hfa384x_cbwrid() since the handling
1505* is virtually identical.
1506*
1507* Arguments:
1508* hw device structure
1509* enum cmd_mode DOWAIT or DOASYNC
1510* rid RID code
1511* riddata Data portion of RID formatted for MAC
1512* riddatalen Length of the data portion in bytes
1513* cmdcb command callback for async calls, NULL for DOWAIT calls
1514* usercb user callback for async calls, NULL for DOWAIT calls
1515* usercb_data user supplied data pointer for async calls
1516*
1517* Returns:
1518* 0 success
1519* -ETIMEDOUT timed out waiting for register ready or
1520* command completion
1521* >0 command indicated error, Status and Resp0-2 are
1522* in hw structure.
1523*
1524* Side effects:
1525*
1526* Call context:
1527* interrupt (DOASYNC)
1528* process (DOWAIT or DOASYNC)
1529----------------------------------------------------------------*/
1530static int
1531hfa384x_dowrid(hfa384x_t *hw,
1532           enum cmd_mode mode,
1533           u16 rid,
1534           void *riddata,
1535           unsigned int riddatalen,
1536           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1537{
1538    int result;
1539    hfa384x_usbctlx_t *ctlx;
1540
1541    ctlx = usbctlx_alloc();
1542    if (ctlx == NULL) {
1543        result = -ENOMEM;
1544        goto done;
1545    }
1546
1547    /* Initialize the command */
1548    ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1549    ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1550                           (ctlx->outbuf.wridreq.rid) +
1551                           riddatalen + 1) / 2);
1552    ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1553    memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1554
1555    ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1556        sizeof(ctlx->outbuf.wridreq.frmlen) +
1557        sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1558
1559    ctlx->reapable = mode;
1560    ctlx->cmdcb = cmdcb;
1561    ctlx->usercb = usercb;
1562    ctlx->usercb_data = usercb_data;
1563
1564    /* Submit the CTLX */
1565    result = hfa384x_usbctlx_submit(hw, ctlx);
1566    if (result != 0) {
1567        kfree(ctlx);
1568    } else if (mode == DOWAIT) {
1569        usbctlx_wrid_completor_t completor;
1570        hfa384x_cmdresult_t wridresult;
1571
1572        result = hfa384x_usbctlx_complete_sync(hw,
1573                               ctlx,
1574                               init_wrid_completor
1575                               (&completor,
1576                            &ctlx->inbuf.wridresp,
1577                            &wridresult));
1578    }
1579
1580done:
1581    return result;
1582}
1583
1584/*----------------------------------------------------------------
1585* hfa384x_dormem
1586*
1587* Constructs a readmem CTLX and issues it.
1588*
1589* NOTE: Any changes to the 'post-submit' code in this function
1590* need to be carried over to hfa384x_cbrmem() since the handling
1591* is virtually identical.
1592*
1593* Arguments:
1594* hw device structure
1595* mode DOWAIT or DOASYNC
1596* page MAC address space page (CMD format)
1597* offset MAC address space offset
1598* data Ptr to data buffer to receive read
1599* len Length of the data to read (max == 2048)
1600* cmdcb command callback for async calls, NULL for DOWAIT calls
1601* usercb user callback for async calls, NULL for DOWAIT calls
1602* usercb_data user supplied data pointer for async calls
1603*
1604* Returns:
1605* 0 success
1606* -ETIMEDOUT timed out waiting for register ready or
1607* command completion
1608* >0 command indicated error, Status and Resp0-2 are
1609* in hw structure.
1610*
1611* Side effects:
1612*
1613* Call context:
1614* interrupt (DOASYNC)
1615* process (DOWAIT or DOASYNC)
1616----------------------------------------------------------------*/
1617static int
1618hfa384x_dormem(hfa384x_t *hw,
1619           enum cmd_mode mode,
1620           u16 page,
1621           u16 offset,
1622           void *data,
1623           unsigned int len,
1624           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1625{
1626    int result;
1627    hfa384x_usbctlx_t *ctlx;
1628
1629    ctlx = usbctlx_alloc();
1630    if (ctlx == NULL) {
1631        result = -ENOMEM;
1632        goto done;
1633    }
1634
1635    /* Initialize the command */
1636    ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1637    ctlx->outbuf.rmemreq.frmlen =
1638        cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1639            sizeof(ctlx->outbuf.rmemreq.page) + len);
1640    ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1641    ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1642
1643    ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1644
1645    pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1646         ctlx->outbuf.rmemreq.type,
1647         ctlx->outbuf.rmemreq.frmlen,
1648         ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1649
1650    pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1651
1652    ctlx->reapable = mode;
1653    ctlx->cmdcb = cmdcb;
1654    ctlx->usercb = usercb;
1655    ctlx->usercb_data = usercb_data;
1656
1657    result = hfa384x_usbctlx_submit(hw, ctlx);
1658    if (result != 0) {
1659        kfree(ctlx);
1660    } else if (mode == DOWAIT) {
1661        usbctlx_rmem_completor_t completor;
1662
1663        result =
1664            hfa384x_usbctlx_complete_sync(hw, ctlx,
1665                          init_rmem_completor
1666                          (&completor,
1667                           &ctlx->inbuf.rmemresp, data,
1668                           len));
1669    }
1670
1671done:
1672    return result;
1673}
1674
1675/*----------------------------------------------------------------
1676* hfa384x_dowmem
1677*
1678* Constructs a writemem CTLX and issues it.
1679*
1680* NOTE: Any changes to the 'post-submit' code in this function
1681* need to be carried over to hfa384x_cbwmem() since the handling
1682* is virtually identical.
1683*
1684* Arguments:
1685* hw device structure
1686* mode DOWAIT or DOASYNC
1687* page MAC address space page (CMD format)
1688* offset MAC address space offset
1689* data Ptr to data buffer containing write data
1690* len Length of the data to read (max == 2048)
1691* cmdcb command callback for async calls, NULL for DOWAIT calls
1692* usercb user callback for async calls, NULL for DOWAIT calls
1693* usercb_data user supplied data pointer for async calls.
1694*
1695* Returns:
1696* 0 success
1697* -ETIMEDOUT timed out waiting for register ready or
1698* command completion
1699* >0 command indicated error, Status and Resp0-2 are
1700* in hw structure.
1701*
1702* Side effects:
1703*
1704* Call context:
1705* interrupt (DOWAIT)
1706* process (DOWAIT or DOASYNC)
1707----------------------------------------------------------------*/
1708static int
1709hfa384x_dowmem(hfa384x_t *hw,
1710           enum cmd_mode mode,
1711           u16 page,
1712           u16 offset,
1713           void *data,
1714           unsigned int len,
1715           ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1716{
1717    int result;
1718    hfa384x_usbctlx_t *ctlx;
1719
1720    pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1721
1722    ctlx = usbctlx_alloc();
1723    if (ctlx == NULL) {
1724        result = -ENOMEM;
1725        goto done;
1726    }
1727
1728    /* Initialize the command */
1729    ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1730    ctlx->outbuf.wmemreq.frmlen =
1731        cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1732            sizeof(ctlx->outbuf.wmemreq.page) + len);
1733    ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1734    ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1735    memcpy(ctlx->outbuf.wmemreq.data, data, len);
1736
1737    ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1738        sizeof(ctlx->outbuf.wmemreq.frmlen) +
1739        sizeof(ctlx->outbuf.wmemreq.offset) +
1740        sizeof(ctlx->outbuf.wmemreq.page) + len;
1741
1742    ctlx->reapable = mode;
1743    ctlx->cmdcb = cmdcb;
1744    ctlx->usercb = usercb;
1745    ctlx->usercb_data = usercb_data;
1746
1747    result = hfa384x_usbctlx_submit(hw, ctlx);
1748    if (result != 0) {
1749        kfree(ctlx);
1750    } else if (mode == DOWAIT) {
1751        usbctlx_wmem_completor_t completor;
1752        hfa384x_cmdresult_t wmemresult;
1753
1754        result = hfa384x_usbctlx_complete_sync(hw,
1755                               ctlx,
1756                               init_wmem_completor
1757                               (&completor,
1758                            &ctlx->inbuf.wmemresp,
1759                            &wmemresult));
1760    }
1761
1762done:
1763    return result;
1764}
1765
1766/*----------------------------------------------------------------
1767* hfa384x_drvr_commtallies
1768*
1769* Send a commtallies inquiry to the MAC. Note that this is an async
1770* call that will result in an info frame arriving sometime later.
1771*
1772* Arguments:
1773* hw device structure
1774*
1775* Returns:
1776* zero success.
1777*
1778* Side effects:
1779*
1780* Call context:
1781* process
1782----------------------------------------------------------------*/
1783int hfa384x_drvr_commtallies(hfa384x_t *hw)
1784{
1785    hfa384x_metacmd_t cmd;
1786
1787    cmd.cmd = HFA384x_CMDCODE_INQ;
1788    cmd.parm0 = HFA384x_IT_COMMTALLIES;
1789    cmd.parm1 = 0;
1790    cmd.parm2 = 0;
1791
1792    hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
1793
1794    return 0;
1795}
1796
1797/*----------------------------------------------------------------
1798* hfa384x_drvr_disable
1799*
1800* Issues the disable command to stop communications on one of
1801* the MACs 'ports'. Only macport 0 is valid for stations.
1802* APs may also disable macports 1-6. Only ports that have been
1803* previously enabled may be disabled.
1804*
1805* Arguments:
1806* hw device structure
1807* macport MAC port number (host order)
1808*
1809* Returns:
1810* 0 success
1811* >0 f/w reported failure - f/w status code
1812* <0 driver reported error (timeout|bad arg)
1813*
1814* Side effects:
1815*
1816* Call context:
1817* process
1818----------------------------------------------------------------*/
1819int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
1820{
1821    int result = 0;
1822
1823    if ((!hw->isap && macport != 0) ||
1824        (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1825        !(hw->port_enabled[macport])) {
1826        result = -EINVAL;
1827    } else {
1828        result = hfa384x_cmd_disable(hw, macport);
1829        if (result == 0)
1830            hw->port_enabled[macport] = 0;
1831    }
1832    return result;
1833}
1834
1835/*----------------------------------------------------------------
1836* hfa384x_drvr_enable
1837*
1838* Issues the enable command to enable communications on one of
1839* the MACs 'ports'. Only macport 0 is valid for stations.
1840* APs may also enable macports 1-6. Only ports that are currently
1841* disabled may be enabled.
1842*
1843* Arguments:
1844* hw device structure
1845* macport MAC port number
1846*
1847* Returns:
1848* 0 success
1849* >0 f/w reported failure - f/w status code
1850* <0 driver reported error (timeout|bad arg)
1851*
1852* Side effects:
1853*
1854* Call context:
1855* process
1856----------------------------------------------------------------*/
1857int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
1858{
1859    int result = 0;
1860
1861    if ((!hw->isap && macport != 0) ||
1862        (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1863        (hw->port_enabled[macport])) {
1864        result = -EINVAL;
1865    } else {
1866        result = hfa384x_cmd_enable(hw, macport);
1867        if (result == 0)
1868            hw->port_enabled[macport] = 1;
1869    }
1870    return result;
1871}
1872
1873/*----------------------------------------------------------------
1874* hfa384x_drvr_flashdl_enable
1875*
1876* Begins the flash download state. Checks to see that we're not
1877* already in a download state and that a port isn't enabled.
1878* Sets the download state and retrieves the flash download
1879* buffer location, buffer size, and timeout length.
1880*
1881* Arguments:
1882* hw device structure
1883*
1884* Returns:
1885* 0 success
1886* >0 f/w reported error - f/w status code
1887* <0 driver reported error
1888*
1889* Side effects:
1890*
1891* Call context:
1892* process
1893----------------------------------------------------------------*/
1894int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
1895{
1896    int result = 0;
1897    int i;
1898
1899    /* Check that a port isn't active */
1900    for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1901        if (hw->port_enabled[i]) {
1902            pr_debug("called when port enabled.\n");
1903            return -EINVAL;
1904        }
1905    }
1906
1907    /* Check that we're not already in a download state */
1908    if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1909        return -EINVAL;
1910
1911    /* Retrieve the buffer loc&size and timeout */
1912    result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1913                    &(hw->bufinfo), sizeof(hw->bufinfo));
1914    if (result)
1915        return result;
1916
1917    hw->bufinfo.page = le16_to_cpu(hw->bufinfo.page);
1918    hw->bufinfo.offset = le16_to_cpu(hw->bufinfo.offset);
1919    hw->bufinfo.len = le16_to_cpu(hw->bufinfo.len);
1920    result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1921                      &(hw->dltimeout));
1922    if (result)
1923        return result;
1924
1925    hw->dltimeout = le16_to_cpu(hw->dltimeout);
1926
1927    pr_debug("flashdl_enable\n");
1928
1929    hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1930
1931    return result;
1932}
1933
1934/*----------------------------------------------------------------
1935* hfa384x_drvr_flashdl_disable
1936*
1937* Ends the flash download state. Note that this will cause the MAC
1938* firmware to restart.
1939*
1940* Arguments:
1941* hw device structure
1942*
1943* Returns:
1944* 0 success
1945* >0 f/w reported error - f/w status code
1946* <0 driver reported error
1947*
1948* Side effects:
1949*
1950* Call context:
1951* process
1952----------------------------------------------------------------*/
1953int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
1954{
1955    /* Check that we're already in the download state */
1956    if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1957        return -EINVAL;
1958
1959    pr_debug("flashdl_enable\n");
1960
1961    /* There isn't much we can do at this point, so I don't */
1962    /* bother w/ the return value */
1963    hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1964    hw->dlstate = HFA384x_DLSTATE_DISABLED;
1965
1966    return 0;
1967}
1968
1969/*----------------------------------------------------------------
1970* hfa384x_drvr_flashdl_write
1971*
1972* Performs a FLASH download of a chunk of data. First checks to see
1973* that we're in the FLASH download state, then sets the download
1974* mode, uses the aux functions to 1) copy the data to the flash
1975* buffer, 2) sets the download 'write flash' mode, 3) readback and
1976* compare. Lather rinse, repeat as many times an necessary to get
1977* all the given data into flash.
1978* When all data has been written using this function (possibly
1979* repeatedly), call drvr_flashdl_disable() to end the download state
1980* and restart the MAC.
1981*
1982* Arguments:
1983* hw device structure
1984* daddr Card address to write to. (host order)
1985* buf Ptr to data to write.
1986* len Length of data (host order).
1987*
1988* Returns:
1989* 0 success
1990* >0 f/w reported error - f/w status code
1991* <0 driver reported error
1992*
1993* Side effects:
1994*
1995* Call context:
1996* process
1997----------------------------------------------------------------*/
1998int hfa384x_drvr_flashdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
1999{
2000    int result = 0;
2001    u32 dlbufaddr;
2002    int nburns;
2003    u32 burnlen;
2004    u32 burndaddr;
2005    u16 burnlo;
2006    u16 burnhi;
2007    int nwrites;
2008    u8 *writebuf;
2009    u16 writepage;
2010    u16 writeoffset;
2011    u32 writelen;
2012    int i;
2013    int j;
2014
2015    pr_debug("daddr=0x%08x len=%d\n", daddr, len);
2016
2017    /* Check that we're in the flash download state */
2018    if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
2019        return -EINVAL;
2020
2021    printk(KERN_INFO "Download %d bytes to flash @0x%06x\n", len, daddr);
2022
2023    /* Convert to flat address for arithmetic */
2024    /* NOTE: dlbuffer RID stores the address in AUX format */
2025    dlbufaddr =
2026        HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
2027    pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2028         hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2029
2030#if 0
2031    printk(KERN_WARNING "dlbuf@0x%06lx len=%d to=%d\n", dlbufaddr,
2032           hw->bufinfo.len, hw->dltimeout);
2033#endif
2034    /* Calculations to determine how many fills of the dlbuffer to do
2035     * and how many USB wmemreq's to do for each fill. At this point
2036     * in time, the dlbuffer size and the wmemreq size are the same.
2037     * Therefore, nwrites should always be 1. The extra complexity
2038     * here is a hedge against future changes.
2039     */
2040
2041    /* Figure out how many times to do the flash programming */
2042    nburns = len / hw->bufinfo.len;
2043    nburns += (len % hw->bufinfo.len) ? 1 : 0;
2044
2045    /* For each flash program cycle, how many USB wmemreq's are needed? */
2046    nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2047    nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2048
2049    /* For each burn */
2050    for (i = 0; i < nburns; i++) {
2051        /* Get the dest address and len */
2052        burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2053            hw->bufinfo.len : (len - (hw->bufinfo.len * i));
2054        burndaddr = daddr + (hw->bufinfo.len * i);
2055        burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2056        burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2057
2058        printk(KERN_INFO "Writing %d bytes to flash @0x%06x\n",
2059               burnlen, burndaddr);
2060
2061        /* Set the download mode */
2062        result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2063                          burnlo, burnhi, burnlen);
2064        if (result) {
2065            printk(KERN_ERR "download(NV,lo=%x,hi=%x,len=%x) "
2066                   "cmd failed, result=%d. Aborting d/l\n",
2067                   burnlo, burnhi, burnlen, result);
2068            goto exit_proc;
2069        }
2070
2071        /* copy the data to the flash download buffer */
2072        for (j = 0; j < nwrites; j++) {
2073            writebuf = buf +
2074                (i * hw->bufinfo.len) +
2075                (j * HFA384x_USB_RWMEM_MAXLEN);
2076
2077            writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
2078                        (j * HFA384x_USB_RWMEM_MAXLEN));
2079            writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
2080                        (j * HFA384x_USB_RWMEM_MAXLEN));
2081
2082            writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
2083            writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
2084                HFA384x_USB_RWMEM_MAXLEN : writelen;
2085
2086            result = hfa384x_dowmem_wait(hw,
2087                             writepage,
2088                             writeoffset,
2089                             writebuf, writelen);
2090        }
2091
2092        /* set the download 'write flash' mode */
2093        result = hfa384x_cmd_download(hw,
2094                          HFA384x_PROGMODE_NVWRITE,
2095                          0, 0, 0);
2096        if (result) {
2097            printk(KERN_ERR
2098                   "download(NVWRITE,lo=%x,hi=%x,len=%x) "
2099                   "cmd failed, result=%d. Aborting d/l\n",
2100                   burnlo, burnhi, burnlen, result);
2101            goto exit_proc;
2102        }
2103
2104        /* TODO: We really should do a readback and compare. */
2105    }
2106
2107exit_proc:
2108
2109    /* Leave the firmware in the 'post-prog' mode. flashdl_disable will */
2110    /* actually disable programming mode. Remember, that will cause the */
2111    /* the firmware to effectively reset itself. */
2112
2113    return result;
2114}
2115
2116/*----------------------------------------------------------------
2117* hfa384x_drvr_getconfig
2118*
2119* Performs the sequence necessary to read a config/info item.
2120*
2121* Arguments:
2122* hw device structure
2123* rid config/info record id (host order)
2124* buf host side record buffer. Upon return it will
2125* contain the body portion of the record (minus the
2126* RID and len).
2127* len buffer length (in bytes, should match record length)
2128*
2129* Returns:
2130* 0 success
2131* >0 f/w reported error - f/w status code
2132* <0 driver reported error
2133* -ENODATA length mismatch between argument and retrieved
2134* record.
2135*
2136* Side effects:
2137*
2138* Call context:
2139* process
2140----------------------------------------------------------------*/
2141int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2142{
2143    int result;
2144
2145    result = hfa384x_dorrid_wait(hw, rid, buf, len);
2146
2147    return result;
2148}
2149
2150/*----------------------------------------------------------------
2151 * hfa384x_drvr_getconfig_async
2152 *
2153 * Performs the sequence necessary to perform an async read of
2154 * of a config/info item.
2155 *
2156 * Arguments:
2157 * hw device structure
2158 * rid config/info record id (host order)
2159 * buf host side record buffer. Upon return it will
2160 * contain the body portion of the record (minus the
2161 * RID and len).
2162 * len buffer length (in bytes, should match record length)
2163 * cbfn caller supplied callback, called when the command
2164 * is done (successful or not).
2165 * cbfndata pointer to some caller supplied data that will be
2166 * passed in as an argument to the cbfn.
2167 *
2168 * Returns:
2169 * nothing the cbfn gets a status argument identifying if
2170 * any errors occur.
2171 * Side effects:
2172 * Queues an hfa384x_usbcmd_t for subsequent execution.
2173 *
2174 * Call context:
2175 * Any
2176 ----------------------------------------------------------------*/
2177int
2178hfa384x_drvr_getconfig_async(hfa384x_t *hw,
2179                 u16 rid, ctlx_usercb_t usercb, void *usercb_data)
2180{
2181    return hfa384x_dorrid_async(hw, rid, NULL, 0,
2182                    hfa384x_cb_rrid, usercb, usercb_data);
2183}
2184
2185/*----------------------------------------------------------------
2186 * hfa384x_drvr_setconfig_async
2187 *
2188 * Performs the sequence necessary to write a config/info item.
2189 *
2190 * Arguments:
2191 * hw device structure
2192 * rid config/info record id (in host order)
2193 * buf host side record buffer
2194 * len buffer length (in bytes)
2195 * usercb completion callback
2196 * usercb_data completion callback argument
2197 *
2198 * Returns:
2199 * 0 success
2200 * >0 f/w reported error - f/w status code
2201 * <0 driver reported error
2202 *
2203 * Side effects:
2204 *
2205 * Call context:
2206 * process
2207 ----------------------------------------------------------------*/
2208int
2209hfa384x_drvr_setconfig_async(hfa384x_t *hw,
2210                 u16 rid,
2211                 void *buf,
2212                 u16 len, ctlx_usercb_t usercb, void *usercb_data)
2213{
2214    return hfa384x_dowrid_async(hw, rid, buf, len,
2215                    hfa384x_cb_status, usercb, usercb_data);
2216}
2217
2218/*----------------------------------------------------------------
2219* hfa384x_drvr_ramdl_disable
2220*
2221* Ends the ram download state.
2222*
2223* Arguments:
2224* hw device structure
2225*
2226* Returns:
2227* 0 success
2228* >0 f/w reported error - f/w status code
2229* <0 driver reported error
2230*
2231* Side effects:
2232*
2233* Call context:
2234* process
2235----------------------------------------------------------------*/
2236int hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2237{
2238    /* Check that we're already in the download state */
2239    if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2240        return -EINVAL;
2241
2242    pr_debug("ramdl_disable()\n");
2243
2244    /* There isn't much we can do at this point, so I don't */
2245    /* bother w/ the return value */
2246    hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
2247    hw->dlstate = HFA384x_DLSTATE_DISABLED;
2248
2249    return 0;
2250}
2251
2252/*----------------------------------------------------------------
2253* hfa384x_drvr_ramdl_enable
2254*
2255* Begins the ram download state. Checks to see that we're not
2256* already in a download state and that a port isn't enabled.
2257* Sets the download state and calls cmd_download with the
2258* ENABLE_VOLATILE subcommand and the exeaddr argument.
2259*
2260* Arguments:
2261* hw device structure
2262* exeaddr the card execution address that will be
2263* jumped to when ramdl_disable() is called
2264* (host order).
2265*
2266* Returns:
2267* 0 success
2268* >0 f/w reported error - f/w status code
2269* <0 driver reported error
2270*
2271* Side effects:
2272*
2273* Call context:
2274* process
2275----------------------------------------------------------------*/
2276int hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2277{
2278    int result = 0;
2279    u16 lowaddr;
2280    u16 hiaddr;
2281    int i;
2282
2283    /* Check that a port isn't active */
2284    for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2285        if (hw->port_enabled[i]) {
2286            printk(KERN_ERR
2287                   "Can't download with a macport enabled.\n");
2288            return -EINVAL;
2289        }
2290    }
2291
2292    /* Check that we're not already in a download state */
2293    if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2294        printk(KERN_ERR "Download state not disabled.\n");
2295        return -EINVAL;
2296    }
2297
2298    pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2299
2300    /* Call the download(1,addr) function */
2301    lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2302    hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2303
2304    result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2305                      lowaddr, hiaddr, 0);
2306
2307    if (result == 0) {
2308        /* Set the download state */
2309        hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2310    } else {
2311        pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2312             lowaddr, hiaddr, result);
2313    }
2314
2315    return result;
2316}
2317
2318/*----------------------------------------------------------------
2319* hfa384x_drvr_ramdl_write
2320*
2321* Performs a RAM download of a chunk of data. First checks to see
2322* that we're in the RAM download state, then uses the [read|write]mem USB
2323* commands to 1) copy the data, 2) readback and compare. The download
2324* state is unaffected. When all data has been written using
2325* this function, call drvr_ramdl_disable() to end the download state
2326* and restart the MAC.
2327*
2328* Arguments:
2329* hw device structure
2330* daddr Card address to write to. (host order)
2331* buf Ptr to data to write.
2332* len Length of data (host order).
2333*
2334* Returns:
2335* 0 success
2336* >0 f/w reported error - f/w status code
2337* <0 driver reported error
2338*
2339* Side effects:
2340*
2341* Call context:
2342* process
2343----------------------------------------------------------------*/
2344int hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
2345{
2346    int result = 0;
2347    int nwrites;
2348    u8 *data = buf;
2349    int i;
2350    u32 curraddr;
2351    u16 currpage;
2352    u16 curroffset;
2353    u16 currlen;
2354
2355    /* Check that we're in the ram download state */
2356    if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2357        return -EINVAL;
2358
2359    printk(KERN_INFO "Writing %d bytes to ram @0x%06x\n", len, daddr);
2360
2361    /* How many dowmem calls? */
2362    nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2363    nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2364
2365    /* Do blocking wmem's */
2366    for (i = 0; i < nwrites; i++) {
2367        /* make address args */
2368        curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2369        currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2370        curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2371        currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2372        if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2373            currlen = HFA384x_USB_RWMEM_MAXLEN;
2374
2375        /* Do blocking ctlx */
2376        result = hfa384x_dowmem_wait(hw,
2377                         currpage,
2378                         curroffset,
2379                         data +
2380                         (i * HFA384x_USB_RWMEM_MAXLEN),
2381                         currlen);
2382
2383        if (result)
2384            break;
2385
2386        /* TODO: We really should have a readback. */
2387    }
2388
2389    return result;
2390}
2391
2392/*----------------------------------------------------------------
2393* hfa384x_drvr_readpda
2394*
2395* Performs the sequence to read the PDA space. Note there is no
2396* drvr_writepda() function. Writing a PDA is
2397* generally implemented by a calling component via calls to
2398* cmd_download and writing to the flash download buffer via the
2399* aux regs.
2400*
2401* Arguments:
2402* hw device structure
2403* buf buffer to store PDA in
2404* len buffer length
2405*
2406* Returns:
2407* 0 success
2408* >0 f/w reported error - f/w status code
2409* <0 driver reported error
2410* -ETIMEDOUT timout waiting for the cmd regs to become
2411* available, or waiting for the control reg
2412* to indicate the Aux port is enabled.
2413* -ENODATA the buffer does NOT contain a valid PDA.
2414* Either the card PDA is bad, or the auxdata
2415* reads are giving us garbage.
2416
2417*
2418* Side effects:
2419*
2420* Call context:
2421* process or non-card interrupt.
2422----------------------------------------------------------------*/
2423int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2424{
2425    int result = 0;
2426    u16 *pda = buf;
2427    int pdaok = 0;
2428    int morepdrs = 1;
2429    int currpdr = 0; /* word offset of the current pdr */
2430    size_t i;
2431    u16 pdrlen; /* pdr length in bytes, host order */
2432    u16 pdrcode; /* pdr code, host order */
2433    u16 currpage;
2434    u16 curroffset;
2435    struct pdaloc {
2436        u32 cardaddr;
2437        u16 auxctl;
2438    } pdaloc[] = {
2439        {
2440        HFA3842_PDA_BASE, 0}, {
2441        HFA3841_PDA_BASE, 0}, {
2442        HFA3841_PDA_BOGUS_BASE, 0}
2443    };
2444
2445    /* Read the pda from each known address. */
2446    for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2447        /* Make address */
2448        currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2449        curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2450
2451        /* units of bytes */
2452        result = hfa384x_dormem_wait(hw, currpage, curroffset, buf,
2453                        len);
2454
2455        if (result) {
2456            printk(KERN_WARNING
2457                   "Read from index %zd failed, continuing\n", i);
2458            continue;
2459        }
2460
2461        /* Test for garbage */
2462        pdaok = 1; /* initially assume good */
2463        morepdrs = 1;
2464        while (pdaok && morepdrs) {
2465            pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2466            pdrcode = le16_to_cpu(pda[currpdr + 1]);
2467            /* Test the record length */
2468            if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2469                printk(KERN_ERR "pdrlen invalid=%d\n", pdrlen);
2470                pdaok = 0;
2471                break;
2472            }
2473            /* Test the code */
2474            if (!hfa384x_isgood_pdrcode(pdrcode)) {
2475                printk(KERN_ERR "pdrcode invalid=%d\n",
2476                       pdrcode);
2477                pdaok = 0;
2478                break;
2479            }
2480            /* Test for completion */
2481            if (pdrcode == HFA384x_PDR_END_OF_PDA)
2482                morepdrs = 0;
2483
2484            /* Move to the next pdr (if necessary) */
2485            if (morepdrs) {
2486                /* note the access to pda[], need words here */
2487                currpdr += le16_to_cpu(pda[currpdr]) + 1;
2488            }
2489        }
2490        if (pdaok) {
2491            printk(KERN_INFO
2492                   "PDA Read from 0x%08x in %s space.\n",
2493                   pdaloc[i].cardaddr,
2494                   pdaloc[i].auxctl == 0 ? "EXTDS" :
2495                   pdaloc[i].auxctl == 1 ? "NV" :
2496                   pdaloc[i].auxctl == 2 ? "PHY" :
2497                   pdaloc[i].auxctl == 3 ? "ICSRAM" :
2498                   "<bogus auxctl>");
2499            break;
2500        }
2501    }
2502    result = pdaok ? 0 : -ENODATA;
2503
2504    if (result)
2505        pr_debug("Failure: pda is not okay\n");
2506
2507    return result;
2508}
2509
2510/*----------------------------------------------------------------
2511* hfa384x_drvr_setconfig
2512*
2513* Performs the sequence necessary to write a config/info item.
2514*
2515* Arguments:
2516* hw device structure
2517* rid config/info record id (in host order)
2518* buf host side record buffer
2519* len buffer length (in bytes)
2520*
2521* Returns:
2522* 0 success
2523* >0 f/w reported error - f/w status code
2524* <0 driver reported error
2525*
2526* Side effects:
2527*
2528* Call context:
2529* process
2530----------------------------------------------------------------*/
2531int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2532{
2533    return hfa384x_dowrid_wait(hw, rid, buf, len);
2534}
2535
2536/*----------------------------------------------------------------
2537* hfa384x_drvr_start
2538*
2539* Issues the MAC initialize command, sets up some data structures,
2540* and enables the interrupts. After this function completes, the
2541* low-level stuff should be ready for any/all commands.
2542*
2543* Arguments:
2544* hw device structure
2545* Returns:
2546* 0 success
2547* >0 f/w reported error - f/w status code
2548* <0 driver reported error
2549*
2550* Side effects:
2551*
2552* Call context:
2553* process
2554----------------------------------------------------------------*/
2555
2556int hfa384x_drvr_start(hfa384x_t *hw)
2557{
2558    int result, result1, result2;
2559    u16 status;
2560
2561    might_sleep();
2562
2563    /* Clear endpoint stalls - but only do this if the endpoint
2564     * is showing a stall status. Some prism2 cards seem to behave
2565     * badly if a clear_halt is called when the endpoint is already
2566     * ok
2567     */
2568    result =
2569        usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2570    if (result < 0) {
2571        printk(KERN_ERR "Cannot get bulk in endpoint status.\n");
2572        goto done;
2573    }
2574    if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2575        printk(KERN_ERR "Failed to reset bulk in endpoint.\n");
2576
2577    result =
2578        usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2579    if (result < 0) {
2580        printk(KERN_ERR "Cannot get bulk out endpoint status.\n");
2581        goto done;
2582    }
2583    if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2584        printk(KERN_ERR "Failed to reset bulk out endpoint.\n");
2585
2586    /* Synchronous unlink, in case we're trying to restart the driver */
2587    usb_kill_urb(&hw->rx_urb);
2588
2589    /* Post the IN urb */
2590    result = submit_rx_urb(hw, GFP_KERNEL);
2591    if (result != 0) {
2592        printk(KERN_ERR
2593               "Fatal, failed to submit RX URB, result=%d\n", result);
2594        goto done;
2595    }
2596
2597    /* Call initialize twice, with a 1 second sleep in between.
2598     * This is a nasty work-around since many prism2 cards seem to
2599     * need time to settle after an init from cold. The second
2600     * call to initialize in theory is not necessary - but we call
2601     * it anyway as a double insurance policy:
2602     * 1) If the first init should fail, the second may well succeed
2603     * and the card can still be used
2604     * 2) It helps ensures all is well with the card after the first
2605     * init and settle time.
2606     */
2607    result1 = hfa384x_cmd_initialize(hw);
2608    msleep(1000);
2609    result = result2 = hfa384x_cmd_initialize(hw);
2610    if (result1 != 0) {
2611        if (result2 != 0) {
2612            printk(KERN_ERR
2613                "cmd_initialize() failed on two attempts, results %d and %d\n",
2614                result1, result2);
2615            usb_kill_urb(&hw->rx_urb);
2616            goto done;
2617        } else {
2618            pr_debug("First cmd_initialize() failed (result %d),\n",
2619                 result1);
2620            pr_debug("but second attempt succeeded. All should be ok\n");
2621        }
2622    } else if (result2 != 0) {
2623        printk(KERN_WARNING "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2624            result2);
2625        printk(KERN_WARNING
2626               "Most likely the card will be functional\n");
2627        goto done;
2628    }
2629
2630    hw->state = HFA384x_STATE_RUNNING;
2631
2632done:
2633    return result;
2634}
2635
2636/*----------------------------------------------------------------
2637* hfa384x_drvr_stop
2638*
2639* Shuts down the MAC to the point where it is safe to unload the
2640* driver. Any subsystem that may be holding a data or function
2641* ptr into the driver must be cleared/deinitialized.
2642*
2643* Arguments:
2644* hw device structure
2645* Returns:
2646* 0 success
2647* >0 f/w reported error - f/w status code
2648* <0 driver reported error
2649*
2650* Side effects:
2651*
2652* Call context:
2653* process
2654----------------------------------------------------------------*/
2655int hfa384x_drvr_stop(hfa384x_t *hw)
2656{
2657    int result = 0;
2658    int i;
2659
2660    might_sleep();
2661
2662    /* There's no need for spinlocks here. The USB "disconnect"
2663     * function sets this "removed" flag and then calls us.
2664     */
2665    if (!hw->wlandev->hwremoved) {
2666        /* Call initialize to leave the MAC in its 'reset' state */
2667        hfa384x_cmd_initialize(hw);
2668
2669        /* Cancel the rxurb */
2670        usb_kill_urb(&hw->rx_urb);
2671    }
2672
2673    hw->link_status = HFA384x_LINK_NOTCONNECTED;
2674    hw->state = HFA384x_STATE_INIT;
2675
2676    del_timer_sync(&hw->commsqual_timer);
2677
2678    /* Clear all the port status */
2679    for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2680        hw->port_enabled[i] = 0;
2681
2682    return result;
2683}
2684
2685/*----------------------------------------------------------------
2686* hfa384x_drvr_txframe
2687*
2688* Takes a frame from prism2sta and queues it for transmission.
2689*
2690* Arguments:
2691* hw device structure
2692* skb packet buffer struct. Contains an 802.11
2693* data frame.
2694* p80211_hdr points to the 802.11 header for the packet.
2695* Returns:
2696* 0 Success and more buffs available
2697* 1 Success but no more buffs
2698* 2 Allocation failure
2699* 4 Buffer full or queue busy
2700*
2701* Side effects:
2702*
2703* Call context:
2704* interrupt
2705----------------------------------------------------------------*/
2706int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb,
2707             union p80211_hdr *p80211_hdr,
2708             struct p80211_metawep *p80211_wep)
2709{
2710    int usbpktlen = sizeof(hfa384x_tx_frame_t);
2711    int result;
2712    int ret;
2713    char *ptr;
2714
2715    if (hw->tx_urb.status == -EINPROGRESS) {
2716        printk(KERN_WARNING "TX URB already in use\n");
2717        result = 3;
2718        goto exit;
2719    }
2720
2721    /* Build Tx frame structure */
2722    /* Set up the control field */
2723    memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2724
2725    /* Setup the usb type field */
2726    hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2727
2728    /* Set up the sw_support field to identify this frame */
2729    hw->txbuff.txfrm.desc.sw_support = 0x0123;
2730
2731/* Tx complete and Tx exception disable per dleach. Might be causing
2732 * buf depletion
2733 */
2734/* #define DOEXC SLP -- doboth breaks horribly under load, doexc less so. */
2735#if defined(DOBOTH)
2736    hw->txbuff.txfrm.desc.tx_control =
2737        HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2738        HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2739#elif defined(DOEXC)
2740    hw->txbuff.txfrm.desc.tx_control =
2741        HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2742        HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2743#else
2744    hw->txbuff.txfrm.desc.tx_control =
2745        HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2746        HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2747#endif
2748    hw->txbuff.txfrm.desc.tx_control =
2749        cpu_to_le16(hw->txbuff.txfrm.desc.tx_control);
2750
2751    /* copy the header over to the txdesc */
2752    memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr,
2753           sizeof(union p80211_hdr));
2754
2755    /* if we're using host WEP, increase size by IV+ICV */
2756    if (p80211_wep->data) {
2757        hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2758        usbpktlen += 8;
2759    } else {
2760        hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2761    }
2762
2763    usbpktlen += skb->len;
2764
2765    /* copy over the WEP IV if we are using host WEP */
2766    ptr = hw->txbuff.txfrm.data;
2767    if (p80211_wep->data) {
2768        memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2769        ptr += sizeof(p80211_wep->iv);
2770        memcpy(ptr, p80211_wep->data, skb->len);
2771    } else {
2772        memcpy(ptr, skb->data, skb->len);
2773    }
2774    /* copy over the packet data */
2775    ptr += skb->len;
2776
2777    /* copy over the WEP ICV if we are using host WEP */
2778    if (p80211_wep->data)
2779        memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2780
2781    /* Send the USB packet */
2782    usb_fill_bulk_urb(&(hw->tx_urb), hw->usb,
2783              hw->endp_out,
2784              &(hw->txbuff), ROUNDUP64(usbpktlen),
2785              hfa384x_usbout_callback, hw->wlandev);
2786    hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2787
2788    result = 1;
2789    ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2790    if (ret != 0) {
2791        printk(KERN_ERR "submit_tx_urb() failed, error=%d\n", ret);
2792        result = 3;
2793    }
2794
2795exit:
2796    return result;
2797}
2798
2799void hfa384x_tx_timeout(wlandevice_t *wlandev)
2800{
2801    hfa384x_t *hw = wlandev->priv;
2802    unsigned long flags;
2803
2804    spin_lock_irqsave(&hw->ctlxq.lock, flags);
2805
2806    if (!hw->wlandev->hwremoved) {
2807        int sched;
2808
2809        sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2810        sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2811        if (sched)
2812            schedule_work(&hw->usb_work);
2813    }
2814
2815    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2816}
2817
2818/*----------------------------------------------------------------
2819* hfa384x_usbctlx_reaper_task
2820*
2821* Tasklet to delete dead CTLX objects
2822*
2823* Arguments:
2824* data ptr to a hfa384x_t
2825*
2826* Returns:
2827*
2828* Call context:
2829* Interrupt
2830----------------------------------------------------------------*/
2831static void hfa384x_usbctlx_reaper_task(unsigned long data)
2832{
2833    hfa384x_t *hw = (hfa384x_t *) data;
2834    struct list_head *entry;
2835    struct list_head *temp;
2836    unsigned long flags;
2837
2838    spin_lock_irqsave(&hw->ctlxq.lock, flags);
2839
2840    /* This list is guaranteed to be empty if someone
2841     * has unplugged the adapter.
2842     */
2843    list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
2844        hfa384x_usbctlx_t *ctlx;
2845
2846        ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2847        list_del(&ctlx->list);
2848        kfree(ctlx);
2849    }
2850
2851    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2852
2853}
2854
2855/*----------------------------------------------------------------
2856* hfa384x_usbctlx_completion_task
2857*
2858* Tasklet to call completion handlers for returned CTLXs
2859*
2860* Arguments:
2861* data ptr to hfa384x_t
2862*
2863* Returns:
2864* Nothing
2865*
2866* Call context:
2867* Interrupt
2868----------------------------------------------------------------*/
2869static void hfa384x_usbctlx_completion_task(unsigned long data)
2870{
2871    hfa384x_t *hw = (hfa384x_t *) data;
2872    struct list_head *entry;
2873    struct list_head *temp;
2874    unsigned long flags;
2875
2876    int reap = 0;
2877
2878    spin_lock_irqsave(&hw->ctlxq.lock, flags);
2879
2880    /* This list is guaranteed to be empty if someone
2881     * has unplugged the adapter ...
2882     */
2883    list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
2884        hfa384x_usbctlx_t *ctlx;
2885
2886        ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2887
2888        /* Call the completion function that this
2889         * command was assigned, assuming it has one.
2890         */
2891        if (ctlx->cmdcb != NULL) {
2892            spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2893            ctlx->cmdcb(hw, ctlx);
2894            spin_lock_irqsave(&hw->ctlxq.lock, flags);
2895
2896            /* Make sure we don't try and complete
2897             * this CTLX more than once!
2898             */
2899            ctlx->cmdcb = NULL;
2900
2901            /* Did someone yank the adapter out
2902             * while our list was (briefly) unlocked?
2903             */
2904            if (hw->wlandev->hwremoved) {
2905                reap = 0;
2906                break;
2907            }
2908        }
2909
2910        /*
2911         * "Reapable" CTLXs are ones which don't have any
2912         * threads waiting for them to die. Hence they must
2913         * be delivered to The Reaper!
2914         */
2915        if (ctlx->reapable) {
2916            /* Move the CTLX off the "completing" list (hopefully)
2917             * on to the "reapable" list where the reaper task
2918             * can find it. And "reapable" means that this CTLX
2919             * isn't sitting on a wait-queue somewhere.
2920             */
2921            list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2922            reap = 1;
2923        }
2924
2925        complete(&ctlx->done);
2926    }
2927    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2928
2929    if (reap)
2930        tasklet_schedule(&hw->reaper_bh);
2931}
2932
2933/*----------------------------------------------------------------
2934* unlocked_usbctlx_cancel_async
2935*
2936* Mark the CTLX dead asynchronously, and ensure that the
2937* next command on the queue is run afterwards.
2938*
2939* Arguments:
2940* hw ptr to the hfa384x_t structure
2941* ctlx ptr to a CTLX structure
2942*
2943* Returns:
2944* 0 the CTLX's URB is inactive
2945* -EINPROGRESS the URB is currently being unlinked
2946*
2947* Call context:
2948* Either process or interrupt, but presumably interrupt
2949----------------------------------------------------------------*/
2950static int unlocked_usbctlx_cancel_async(hfa384x_t *hw,
2951                     hfa384x_usbctlx_t *ctlx)
2952{
2953    int ret;
2954
2955    /*
2956     * Try to delete the URB containing our request packet.
2957     * If we succeed, then its completion handler will be
2958     * called with a status of -ECONNRESET.
2959     */
2960    hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2961    ret = usb_unlink_urb(&hw->ctlx_urb);
2962
2963    if (ret != -EINPROGRESS) {
2964        /*
2965         * The OUT URB had either already completed
2966         * or was still in the pending queue, so the
2967         * URB's completion function will not be called.
2968         * We will have to complete the CTLX ourselves.
2969         */
2970        ctlx->state = CTLX_REQ_FAILED;
2971        unlocked_usbctlx_complete(hw, ctlx);
2972        ret = 0;
2973    }
2974
2975    return ret;
2976}
2977
2978/*----------------------------------------------------------------
2979* unlocked_usbctlx_complete
2980*
2981* A CTLX has completed. It may have been successful, it may not
2982* have been. At this point, the CTLX should be quiescent. The URBs
2983* aren't active and the timers should have been stopped.
2984*
2985* The CTLX is migrated to the "completing" queue, and the completing
2986* tasklet is scheduled.
2987*
2988* Arguments:
2989* hw ptr to a hfa384x_t structure
2990* ctlx ptr to a ctlx structure
2991*
2992* Returns:
2993* nothing
2994*
2995* Side effects:
2996*
2997* Call context:
2998* Either, assume interrupt
2999----------------------------------------------------------------*/
3000static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
3001{
3002    /* Timers have been stopped, and ctlx should be in
3003     * a terminal state. Retire it from the "active"
3004     * queue.
3005     */
3006    list_move_tail(&ctlx->list, &hw->ctlxq.completing);
3007    tasklet_schedule(&hw->completion_bh);
3008
3009    switch (ctlx->state) {
3010    case CTLX_COMPLETE:
3011    case CTLX_REQ_FAILED:
3012        /* This are the correct terminating states. */
3013        break;
3014
3015    default:
3016        printk(KERN_ERR "CTLX[%d] not in a terminating state(%s)\n",
3017               le16_to_cpu(ctlx->outbuf.type), ctlxstr(ctlx->state));
3018        break;
3019    } /* switch */
3020}
3021
3022/*----------------------------------------------------------------
3023* hfa384x_usbctlxq_run
3024*
3025* Checks to see if the head item is running. If not, starts it.
3026*
3027* Arguments:
3028* hw ptr to hfa384x_t
3029*
3030* Returns:
3031* nothing
3032*
3033* Side effects:
3034*
3035* Call context:
3036* any
3037----------------------------------------------------------------*/
3038static void hfa384x_usbctlxq_run(hfa384x_t *hw)
3039{
3040    unsigned long flags;
3041
3042    /* acquire lock */
3043    spin_lock_irqsave(&hw->ctlxq.lock, flags);
3044
3045    /* Only one active CTLX at any one time, because there's no
3046     * other (reliable) way to match the response URB to the
3047     * correct CTLX.
3048     *
3049     * Don't touch any of these CTLXs if the hardware
3050     * has been removed or the USB subsystem is stalled.
3051     */
3052    if (!list_empty(&hw->ctlxq.active) ||
3053        test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
3054        goto unlock;
3055
3056    while (!list_empty(&hw->ctlxq.pending)) {
3057        hfa384x_usbctlx_t *head;
3058        int result;
3059
3060        /* This is the first pending command */
3061        head = list_entry(hw->ctlxq.pending.next,
3062                  hfa384x_usbctlx_t, list);
3063
3064        /* We need to split this off to avoid a race condition */
3065        list_move_tail(&head->list, &hw->ctlxq.active);
3066
3067        /* Fill the out packet */
3068        usb_fill_bulk_urb(&(hw->ctlx_urb), hw->usb,
3069                  hw->endp_out,
3070                  &(head->outbuf), ROUNDUP64(head->outbufsize),
3071                  hfa384x_ctlxout_callback, hw);
3072        hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3073
3074        /* Now submit the URB and update the CTLX's state */
3075        result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC);
3076        if (result == 0) {
3077            /* This CTLX is now running on the active queue */
3078            head->state = CTLX_REQ_SUBMITTED;
3079
3080            /* Start the OUT wait timer */
3081            hw->req_timer_done = 0;
3082            hw->reqtimer.expires = jiffies + HZ;
3083            add_timer(&hw->reqtimer);
3084
3085            /* Start the IN wait timer */
3086            hw->resp_timer_done = 0;
3087            hw->resptimer.expires = jiffies + 2 * HZ;
3088            add_timer(&hw->resptimer);
3089
3090            break;
3091        }
3092
3093        if (result == -EPIPE) {
3094            /* The OUT pipe needs resetting, so put
3095             * this CTLX back in the "pending" queue
3096             * and schedule a reset ...
3097             */
3098            printk(KERN_WARNING
3099                   "%s tx pipe stalled: requesting reset\n",
3100                   hw->wlandev->netdev->name);
3101            list_move(&head->list, &hw->ctlxq.pending);
3102            set_bit(WORK_TX_HALT, &hw->usb_flags);
3103            schedule_work(&hw->usb_work);
3104            break;
3105        }
3106
3107        if (result == -ESHUTDOWN) {
3108            printk(KERN_WARNING "%s urb shutdown!\n",
3109                   hw->wlandev->netdev->name);
3110            break;
3111        }
3112
3113        printk(KERN_ERR "Failed to submit CTLX[%d]: error=%d\n",
3114               le16_to_cpu(head->outbuf.type), result);
3115        unlocked_usbctlx_complete(hw, head);
3116    } /* while */
3117
3118unlock:
3119    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3120}
3121
3122/*----------------------------------------------------------------
3123* hfa384x_usbin_callback
3124*
3125* Callback for URBs on the BULKIN endpoint.
3126*
3127* Arguments:
3128* urb ptr to the completed urb
3129*
3130* Returns:
3131* nothing
3132*
3133* Side effects:
3134*
3135* Call context:
3136* interrupt
3137----------------------------------------------------------------*/
3138static void hfa384x_usbin_callback(struct urb *urb)
3139{
3140    wlandevice_t *wlandev = urb->context;
3141    hfa384x_t *hw;
3142    hfa384x_usbin_t *usbin = (hfa384x_usbin_t *) urb->transfer_buffer;
3143    struct sk_buff *skb = NULL;
3144    int result;
3145    int urb_status;
3146    u16 type;
3147
3148    enum USBIN_ACTION {
3149        HANDLE,
3150        RESUBMIT,
3151        ABORT
3152    } action;
3153
3154    if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
3155        goto exit;
3156
3157    hw = wlandev->priv;
3158    if (!hw)
3159        goto exit;
3160
3161    skb = hw->rx_urb_skb;
3162    BUG_ON(!skb || (skb->data != urb->transfer_buffer));
3163
3164    hw->rx_urb_skb = NULL;
3165
3166    /* Check for error conditions within the URB */
3167    switch (urb->status) {
3168    case 0:
3169        action = HANDLE;
3170
3171        /* Check for short packet */
3172        if (urb->actual_length == 0) {
3173            ++(wlandev->linux_stats.rx_errors);
3174            ++(wlandev->linux_stats.rx_length_errors);
3175            action = RESUBMIT;
3176        }
3177        break;
3178
3179    case -EPIPE:
3180        printk(KERN_WARNING "%s rx pipe stalled: requesting reset\n",
3181               wlandev->netdev->name);
3182        if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
3183            schedule_work(&hw->usb_work);
3184        ++(wlandev->linux_stats.rx_errors);
3185        action = ABORT;
3186        break;
3187
3188    case -EILSEQ:
3189    case -ETIMEDOUT:
3190    case -EPROTO:
3191        if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3192            !timer_pending(&hw->throttle)) {
3193            mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3194        }
3195        ++(wlandev->linux_stats.rx_errors);
3196        action = ABORT;
3197        break;
3198
3199    case -EOVERFLOW:
3200        ++(wlandev->linux_stats.rx_over_errors);
3201        action = RESUBMIT;
3202        break;
3203
3204    case -ENODEV:
3205    case -ESHUTDOWN:
3206        pr_debug("status=%d, device removed.\n", urb->status);
3207        action = ABORT;
3208        break;
3209
3210    case -ENOENT:
3211    case -ECONNRESET:
3212        pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
3213        action = ABORT;
3214        break;
3215
3216    default:
3217        pr_debug("urb status=%d, transfer flags=0x%x\n",
3218             urb->status, urb->transfer_flags);
3219        ++(wlandev->linux_stats.rx_errors);
3220        action = RESUBMIT;
3221        break;
3222    }
3223
3224    urb_status = urb->status;
3225
3226    if (action != ABORT) {
3227        /* Repost the RX URB */
3228        result = submit_rx_urb(hw, GFP_ATOMIC);
3229
3230        if (result != 0) {
3231            printk(KERN_ERR
3232                   "Fatal, failed to resubmit rx_urb. error=%d\n",
3233                   result);
3234        }
3235    }
3236
3237    /* Handle any USB-IN packet */
3238    /* Note: the check of the sw_support field, the type field doesn't
3239     * have bit 12 set like the docs suggest.
3240     */
3241    type = le16_to_cpu(usbin->type);
3242    if (HFA384x_USB_ISRXFRM(type)) {
3243        if (action == HANDLE) {
3244            if (usbin->txfrm.desc.sw_support == 0x0123) {
3245                hfa384x_usbin_txcompl(wlandev, usbin);
3246            } else {
3247                skb_put(skb, sizeof(*usbin));
3248                hfa384x_usbin_rx(wlandev, skb);
3249                skb = NULL;
3250            }
3251        }
3252        goto exit;
3253    }
3254    if (HFA384x_USB_ISTXFRM(type)) {
3255        if (action == HANDLE)
3256            hfa384x_usbin_txcompl(wlandev, usbin);
3257        goto exit;
3258    }
3259    switch (type) {
3260    case HFA384x_USB_INFOFRM:
3261        if (action == ABORT)
3262            goto exit;
3263        if (action == HANDLE)
3264            hfa384x_usbin_info(wlandev, usbin);
3265        break;
3266
3267    case HFA384x_USB_CMDRESP:
3268    case HFA384x_USB_WRIDRESP:
3269    case HFA384x_USB_RRIDRESP:
3270    case HFA384x_USB_WMEMRESP:
3271    case HFA384x_USB_RMEMRESP:
3272        /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3273        hfa384x_usbin_ctlx(hw, usbin, urb_status);
3274        break;
3275
3276    case HFA384x_USB_BUFAVAIL:
3277        pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3278             usbin->bufavail.frmlen);
3279        break;
3280
3281    case HFA384x_USB_ERROR:
3282        pr_debug("Received USB_ERROR packet, errortype=%d\n",
3283             usbin->usberror.errortype);
3284        break;
3285
3286    default:
3287        pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3288             usbin->type, urb_status);
3289        break;
3290    } /* switch */
3291
3292exit:
3293
3294    if (skb)
3295        dev_kfree_skb(skb);
3296}
3297
3298/*----------------------------------------------------------------
3299* hfa384x_usbin_ctlx
3300*
3301* We've received a URB containing a Prism2 "response" message.
3302* This message needs to be matched up with a CTLX on the active
3303* queue and our state updated accordingly.
3304*
3305* Arguments:
3306* hw ptr to hfa384x_t
3307* usbin ptr to USB IN packet
3308* urb_status status of this Bulk-In URB
3309*
3310* Returns:
3311* nothing
3312*
3313* Side effects:
3314*
3315* Call context:
3316* interrupt
3317----------------------------------------------------------------*/
3318static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3319                   int urb_status)
3320{
3321    hfa384x_usbctlx_t *ctlx;
3322    int run_queue = 0;
3323    unsigned long flags;
3324
3325retry:
3326    spin_lock_irqsave(&hw->ctlxq.lock, flags);
3327
3328    /* There can be only one CTLX on the active queue
3329     * at any one time, and this is the CTLX that the
3330     * timers are waiting for.
3331     */
3332    if (list_empty(&hw->ctlxq.active))
3333        goto unlock;
3334
3335    /* Remove the "response timeout". It's possible that
3336     * we are already too late, and that the timeout is
3337     * already running. And that's just too bad for us,
3338     * because we could lose our CTLX from the active
3339     * queue here ...
3340     */
3341    if (del_timer(&hw->resptimer) == 0) {
3342        if (hw->resp_timer_done == 0) {
3343            spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3344            goto retry;
3345        }
3346    } else {
3347        hw->resp_timer_done = 1;
3348    }
3349
3350    ctlx = get_active_ctlx(hw);
3351
3352    if (urb_status != 0) {
3353        /*
3354         * Bad CTLX, so get rid of it. But we only
3355         * remove it from the active queue if we're no
3356         * longer expecting the OUT URB to complete.
3357         */
3358        if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3359            run_queue = 1;
3360    } else {
3361        const u16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3362
3363        /*
3364         * Check that our message is what we're expecting ...
3365         */
3366        if (ctlx->outbuf.type != intype) {
3367            printk(KERN_WARNING
3368                   "Expected IN[%d], received IN[%d] - ignored.\n",
3369                   le16_to_cpu(ctlx->outbuf.type),
3370                   le16_to_cpu(intype));
3371            goto unlock;
3372        }
3373
3374        /* This URB has succeeded, so grab the data ... */
3375        memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3376
3377        switch (ctlx->state) {
3378        case CTLX_REQ_SUBMITTED:
3379            /*
3380             * We have received our response URB before
3381             * our request has been acknowledged. Odd,
3382             * but our OUT URB is still alive...
3383             */
3384            pr_debug("Causality violation: please reboot Universe\n");
3385            ctlx->state = CTLX_RESP_COMPLETE;
3386            break;
3387
3388        case CTLX_REQ_COMPLETE:
3389            /*
3390             * This is the usual path: our request
3391             * has already been acknowledged, and
3392             * now we have received the reply too.
3393             */
3394            ctlx->state = CTLX_COMPLETE;
3395            unlocked_usbctlx_complete(hw, ctlx);
3396            run_queue = 1;
3397            break;
3398
3399        default:
3400            /*
3401             * Throw this CTLX away ...
3402             */
3403            printk(KERN_ERR
3404                   "Matched IN URB, CTLX[%d] in invalid state(%s)."
3405                   " Discarded.\n",
3406                   le16_to_cpu(ctlx->outbuf.type),
3407                   ctlxstr(ctlx->state));
3408            if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3409                run_queue = 1;
3410            break;
3411        } /* switch */
3412    }
3413
3414unlock:
3415    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3416
3417    if (run_queue)
3418        hfa384x_usbctlxq_run(hw);
3419}
3420
3421/*----------------------------------------------------------------
3422* hfa384x_usbin_txcompl
3423*
3424* At this point we have the results of a previous transmit.
3425*
3426* Arguments:
3427* wlandev wlan device
3428* usbin ptr to the usb transfer buffer
3429*
3430* Returns:
3431* nothing
3432*
3433* Side effects:
3434*
3435* Call context:
3436* interrupt
3437----------------------------------------------------------------*/
3438static void hfa384x_usbin_txcompl(wlandevice_t *wlandev,
3439                  hfa384x_usbin_t *usbin)
3440{
3441    u16 status;
3442
3443    status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3444
3445    /* Was there an error? */
3446    if (HFA384x_TXSTATUS_ISERROR(status))
3447        prism2sta_ev_txexc(wlandev, status);
3448    else
3449        prism2sta_ev_tx(wlandev, status);
3450}
3451
3452/*----------------------------------------------------------------
3453* hfa384x_usbin_rx
3454*
3455* At this point we have a successful received a rx frame packet.
3456*
3457* Arguments:
3458* wlandev wlan device
3459* usbin ptr to the usb transfer buffer
3460*
3461* Returns:
3462* nothing
3463*
3464* Side effects:
3465*
3466* Call context:
3467* interrupt
3468----------------------------------------------------------------*/
3469static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
3470{
3471    hfa384x_usbin_t *usbin = (hfa384x_usbin_t *) skb->data;
3472    hfa384x_t *hw = wlandev->priv;
3473    int hdrlen;
3474    struct p80211_rxmeta *rxmeta;
3475    u16 data_len;
3476    u16 fc;
3477
3478    /* Byte order convert once up front. */
3479    usbin->rxfrm.desc.status = le16_to_cpu(usbin->rxfrm.desc.status);
3480    usbin->rxfrm.desc.time = le32_to_cpu(usbin->rxfrm.desc.time);
3481
3482    /* Now handle frame based on port# */
3483    switch (HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status)) {
3484    case 0:
3485        fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3486
3487        /* If exclude and we receive an unencrypted, drop it */
3488        if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3489            !WLAN_GET_FC_ISWEP(fc)) {
3490            goto done;
3491        }
3492
3493        data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3494
3495        /* How much header data do we have? */
3496        hdrlen = p80211_headerlen(fc);
3497
3498        /* Pull off the descriptor */
3499        skb_pull(skb, sizeof(hfa384x_rx_frame_t));
3500
3501        /* Now shunt the header block up against the data block
3502         * with an "overlapping" copy
3503         */
3504        memmove(skb_push(skb, hdrlen),
3505            &usbin->rxfrm.desc.frame_control, hdrlen);
3506
3507        skb->dev = wlandev->netdev;
3508        skb->dev->last_rx = jiffies;
3509
3510        /* And set the frame length properly */
3511        skb_trim(skb, data_len + hdrlen);
3512
3513        /* The prism2 series does not return the CRC */
3514        memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3515
3516        skb_reset_mac_header(skb);
3517
3518        /* Attach the rxmeta, set some stuff */
3519        p80211skb_rxmeta_attach(wlandev, skb);
3520        rxmeta = P80211SKB_RXMETA(skb);
3521        rxmeta->mactime = usbin->rxfrm.desc.time;
3522        rxmeta->rxrate = usbin->rxfrm.desc.rate;
3523        rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3524        rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3525
3526        prism2sta_ev_rx(wlandev, skb);
3527
3528        break;
3529
3530    case 7:
3531        if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3532            /* Copy to wlansnif skb */
3533            hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3534            dev_kfree_skb(skb);
3535        } else {
3536            pr_debug("Received monitor frame: FCSerr set\n");
3537        }
3538        break;
3539
3540    default:
3541        printk(KERN_WARNING "Received frame on unsupported port=%d\n",
3542               HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status));
3543        goto done;
3544        break;
3545    }
3546
3547done:
3548    return;
3549}
3550
3551/*----------------------------------------------------------------
3552* hfa384x_int_rxmonitor
3553*
3554* Helper function for int_rx. Handles monitor frames.
3555* Note that this function allocates space for the FCS and sets it
3556* to 0xffffffff. The hfa384x doesn't give us the FCS value but the
3557* higher layers expect it. 0xffffffff is used as a flag to indicate
3558* the FCS is bogus.
3559*
3560* Arguments:
3561* wlandev wlan device structure
3562* rxfrm rx descriptor read from card in int_rx
3563*
3564* Returns:
3565* nothing
3566*
3567* Side effects:
3568* Allocates an skb and passes it up via the PF_PACKET interface.
3569* Call context:
3570* interrupt
3571----------------------------------------------------------------*/
3572static void hfa384x_int_rxmonitor(wlandevice_t *wlandev,
3573                  hfa384x_usb_rxfrm_t *rxfrm)
3574{
3575    hfa384x_rx_frame_t *rxdesc = &(rxfrm->desc);
3576    unsigned int hdrlen = 0;
3577    unsigned int datalen = 0;
3578    unsigned int skblen = 0;
3579    u8 *datap;
3580    u16 fc;
3581    struct sk_buff *skb;
3582    hfa384x_t *hw = wlandev->priv;
3583
3584    /* Remember the status, time, and data_len fields are in host order */
3585    /* Figure out how big the frame is */
3586    fc = le16_to_cpu(rxdesc->frame_control);
3587    hdrlen = p80211_headerlen(fc);
3588    datalen = le16_to_cpu(rxdesc->data_len);
3589
3590    /* Allocate an ind message+framesize skb */
3591    skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3592
3593    /* sanity check the length */
3594    if (skblen >
3595        (sizeof(struct p80211_caphdr) +
3596         WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3597        pr_debug("overlen frm: len=%zd\n",
3598             skblen - sizeof(struct p80211_caphdr));
3599    }
3600
3601    skb = dev_alloc_skb(skblen);
3602    if (skb == NULL) {
3603        printk(KERN_ERR
3604               "alloc_skb failed trying to allocate %d bytes\n",
3605               skblen);
3606        return;
3607    }
3608
3609    /* only prepend the prism header if in the right mode */
3610    if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3611        (hw->sniffhdr != 0)) {
3612        struct p80211_caphdr *caphdr;
3613        /* The NEW header format! */
3614        datap = skb_put(skb, sizeof(struct p80211_caphdr));
3615        caphdr = (struct p80211_caphdr *) datap;
3616
3617        caphdr->version = htonl(P80211CAPTURE_VERSION);
3618        caphdr->length = htonl(sizeof(struct p80211_caphdr));
3619        caphdr->mactime = __cpu_to_be64(rxdesc->time) * 1000;
3620        caphdr->hosttime = __cpu_to_be64(jiffies);
3621        caphdr->phytype = htonl(4); /* dss_dot11_b */
3622        caphdr->channel = htonl(hw->sniff_channel);
3623        caphdr->datarate = htonl(rxdesc->rate);
3624        caphdr->antenna = htonl(0); /* unknown */
3625        caphdr->priority = htonl(0); /* unknown */
3626        caphdr->ssi_type = htonl(3); /* rssi_raw */
3627        caphdr->ssi_signal = htonl(rxdesc->signal);
3628        caphdr->ssi_noise = htonl(rxdesc->silence);
3629        caphdr->preamble = htonl(0); /* unknown */
3630        caphdr->encoding = htonl(1); /* cck */
3631    }
3632
3633    /* Copy the 802.11 header to the skb
3634       (ctl frames may be less than a full header) */
3635    datap = skb_put(skb, hdrlen);
3636    memcpy(datap, &(rxdesc->frame_control), hdrlen);
3637
3638    /* If any, copy the data from the card to the skb */
3639    if (datalen > 0) {
3640        datap = skb_put(skb, datalen);
3641        memcpy(datap, rxfrm->data, datalen);
3642
3643        /* check for unencrypted stuff if WEP bit set. */
3644        if (*(datap - hdrlen + 1) & 0x40) /* wep set */
3645            if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3646                /* clear wep; it's the 802.2 header! */
3647                *(datap - hdrlen + 1) &= 0xbf;
3648    }
3649
3650    if (hw->sniff_fcs) {
3651        /* Set the FCS */
3652        datap = skb_put(skb, WLAN_CRC_LEN);
3653        memset(datap, 0xff, WLAN_CRC_LEN);
3654    }
3655
3656    /* pass it back up */
3657    prism2sta_ev_rx(wlandev, skb);
3658
3659    return;
3660}
3661
3662/*----------------------------------------------------------------
3663* hfa384x_usbin_info
3664*
3665* At this point we have a successful received a Prism2 info frame.
3666*
3667* Arguments:
3668* wlandev wlan device
3669* usbin ptr to the usb transfer buffer
3670*
3671* Returns:
3672* nothing
3673*
3674* Side effects:
3675*
3676* Call context:
3677* interrupt
3678----------------------------------------------------------------*/
3679static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3680{
3681    usbin->infofrm.info.framelen =
3682        le16_to_cpu(usbin->infofrm.info.framelen);
3683    prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3684}
3685
3686/*----------------------------------------------------------------
3687* hfa384x_usbout_callback
3688*
3689* Callback for URBs on the BULKOUT endpoint.
3690*
3691* Arguments:
3692* urb ptr to the completed urb
3693*
3694* Returns:
3695* nothing
3696*
3697* Side effects:
3698*
3699* Call context:
3700* interrupt
3701----------------------------------------------------------------*/
3702static void hfa384x_usbout_callback(struct urb *urb)
3703{
3704    wlandevice_t *wlandev = urb->context;
3705    hfa384x_usbout_t *usbout = urb->transfer_buffer;
3706
3707#ifdef DEBUG_USB
3708    dbprint_urb(urb);
3709#endif
3710
3711    if (wlandev && wlandev->netdev) {
3712
3713        switch (urb->status) {
3714        case 0:
3715            hfa384x_usbout_tx(wlandev, usbout);
3716            break;
3717
3718        case -EPIPE:
3719            {
3720                hfa384x_t *hw = wlandev->priv;
3721                printk(KERN_WARNING
3722                       "%s tx pipe stalled: requesting reset\n",
3723                       wlandev->netdev->name);
3724                if (!test_and_set_bit
3725                    (WORK_TX_HALT, &hw->usb_flags))
3726                    schedule_work(&hw->usb_work);
3727                ++(wlandev->linux_stats.tx_errors);
3728                break;
3729            }
3730
3731        case -EPROTO:
3732        case -ETIMEDOUT:
3733        case -EILSEQ:
3734            {
3735                hfa384x_t *hw = wlandev->priv;
3736
3737                if (!test_and_set_bit
3738                    (THROTTLE_TX, &hw->usb_flags)
3739                    && !timer_pending(&hw->throttle)) {
3740                    mod_timer(&hw->throttle,
3741                          jiffies + THROTTLE_JIFFIES);
3742                }
3743                ++(wlandev->linux_stats.tx_errors);
3744                netif_stop_queue(wlandev->netdev);
3745                break;
3746            }
3747
3748        case -ENOENT:
3749        case -ESHUTDOWN:
3750            /* Ignorable errors */
3751            break;
3752
3753        default:
3754            printk(KERN_INFO "unknown urb->status=%d\n",
3755                   urb->status);
3756            ++(wlandev->linux_stats.tx_errors);
3757            break;
3758        } /* switch */
3759    }
3760}
3761
3762/*----------------------------------------------------------------
3763* hfa384x_ctlxout_callback
3764*
3765* Callback for control data on the BULKOUT endpoint.
3766*
3767* Arguments:
3768* urb ptr to the completed urb
3769*
3770* Returns:
3771* nothing
3772*
3773* Side effects:
3774*
3775* Call context:
3776* interrupt
3777----------------------------------------------------------------*/
3778static void hfa384x_ctlxout_callback(struct urb *urb)
3779{
3780    hfa384x_t *hw = urb->context;
3781    int delete_resptimer = 0;
3782    int timer_ok = 1;
3783    int run_queue = 0;
3784    hfa384x_usbctlx_t *ctlx;
3785    unsigned long flags;
3786
3787    pr_debug("urb->status=%d\n", urb->status);
3788#ifdef DEBUG_USB
3789    dbprint_urb(urb);
3790#endif
3791    if ((urb->status == -ESHUTDOWN) ||
3792        (urb->status == -ENODEV) || (hw == NULL))
3793        goto done;
3794
3795retry:
3796    spin_lock_irqsave(&hw->ctlxq.lock, flags);
3797
3798    /*
3799     * Only one CTLX at a time on the "active" list, and
3800     * none at all if we are unplugged. However, we can
3801     * rely on the disconnect function to clean everything
3802     * up if someone unplugged the adapter.
3803     */
3804    if (list_empty(&hw->ctlxq.active)) {
3805        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3806        goto done;
3807    }
3808
3809    /*
3810     * Having something on the "active" queue means
3811     * that we have timers to worry about ...
3812     */
3813    if (del_timer(&hw->reqtimer) == 0) {
3814        if (hw->req_timer_done == 0) {
3815            /*
3816             * This timer was actually running while we
3817             * were trying to delete it. Let it terminate
3818             * gracefully instead.
3819             */
3820            spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3821            goto retry;
3822        }
3823    } else {
3824        hw->req_timer_done = 1;
3825    }
3826
3827    ctlx = get_active_ctlx(hw);
3828
3829    if (urb->status == 0) {
3830        /* Request portion of a CTLX is successful */
3831        switch (ctlx->state) {
3832        case CTLX_REQ_SUBMITTED:
3833            /* This OUT-ACK received before IN */
3834            ctlx->state = CTLX_REQ_COMPLETE;
3835            break;
3836
3837        case CTLX_RESP_COMPLETE:
3838            /* IN already received before this OUT-ACK,
3839             * so this command must now be complete.
3840             */
3841            ctlx->state = CTLX_COMPLETE;
3842            unlocked_usbctlx_complete(hw, ctlx);
3843            run_queue = 1;
3844            break;
3845
3846        default:
3847            /* This is NOT a valid CTLX "success" state! */
3848            printk(KERN_ERR
3849                "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3850                le16_to_cpu(ctlx->outbuf.type),
3851                ctlxstr(ctlx->state), urb->status);
3852            break;
3853        } /* switch */
3854    } else {
3855        /* If the pipe has stalled then we need to reset it */
3856        if ((urb->status == -EPIPE) &&
3857            !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3858            printk(KERN_WARNING
3859                   "%s tx pipe stalled: requesting reset\n",
3860                   hw->wlandev->netdev->name);
3861            schedule_work(&hw->usb_work);
3862        }
3863
3864        /* If someone cancels the OUT URB then its status
3865         * should be either -ECONNRESET or -ENOENT.
3866         */
3867        ctlx->state = CTLX_REQ_FAILED;
3868        unlocked_usbctlx_complete(hw, ctlx);
3869        delete_resptimer = 1;
3870        run_queue = 1;
3871    }
3872
3873delresp:
3874    if (delete_resptimer) {
3875        timer_ok = del_timer(&hw->resptimer);
3876        if (timer_ok != 0)
3877            hw->resp_timer_done = 1;
3878    }
3879
3880    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3881
3882    if (!timer_ok && (hw->resp_timer_done == 0)) {
3883        spin_lock_irqsave(&hw->ctlxq.lock, flags);
3884        goto delresp;
3885    }
3886
3887    if (run_queue)
3888        hfa384x_usbctlxq_run(hw);
3889
3890done:
3891    ;
3892}
3893
3894/*----------------------------------------------------------------
3895* hfa384x_usbctlx_reqtimerfn
3896*
3897* Timer response function for CTLX request timeouts. If this
3898* function is called, it means that the callback for the OUT
3899* URB containing a Prism2.x XXX_Request was never called.
3900*
3901* Arguments:
3902* data a ptr to the hfa384x_t
3903*
3904* Returns:
3905* nothing
3906*
3907* Side effects:
3908*
3909* Call context:
3910* interrupt
3911----------------------------------------------------------------*/
3912static void hfa384x_usbctlx_reqtimerfn(unsigned long data)
3913{
3914    hfa384x_t *hw = (hfa384x_t *) data;
3915    unsigned long flags;
3916
3917    spin_lock_irqsave(&hw->ctlxq.lock, flags);
3918
3919    hw->req_timer_done = 1;
3920
3921    /* Removing the hardware automatically empties
3922     * the active list ...
3923     */
3924    if (!list_empty(&hw->ctlxq.active)) {
3925        /*
3926         * We must ensure that our URB is removed from
3927         * the system, if it hasn't already expired.
3928         */
3929        hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3930        if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3931            hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3932
3933            ctlx->state = CTLX_REQ_FAILED;
3934
3935            /* This URB was active, but has now been
3936             * cancelled. It will now have a status of
3937             * -ECONNRESET in the callback function.
3938             *
3939             * We are cancelling this CTLX, so we're
3940             * not going to need to wait for a response.
3941             * The URB's callback function will check
3942             * that this timer is truly dead.
3943             */
3944            if (del_timer(&hw->resptimer) != 0)
3945                hw->resp_timer_done = 1;
3946        }
3947    }
3948
3949    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3950}
3951
3952/*----------------------------------------------------------------
3953* hfa384x_usbctlx_resptimerfn
3954*
3955* Timer response function for CTLX response timeouts. If this
3956* function is called, it means that the callback for the IN
3957* URB containing a Prism2.x XXX_Response was never called.
3958*
3959* Arguments:
3960* data a ptr to the hfa384x_t
3961*
3962* Returns:
3963* nothing
3964*
3965* Side effects:
3966*
3967* Call context:
3968* interrupt
3969----------------------------------------------------------------*/
3970static void hfa384x_usbctlx_resptimerfn(unsigned long data)
3971{
3972    hfa384x_t *hw = (hfa384x_t *) data;
3973    unsigned long flags;
3974
3975    spin_lock_irqsave(&hw->ctlxq.lock, flags);
3976
3977    hw->resp_timer_done = 1;
3978
3979    /* The active list will be empty if the
3980     * adapter has been unplugged ...
3981     */
3982    if (!list_empty(&hw->ctlxq.active)) {
3983        hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3984
3985        if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3986            spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3987            hfa384x_usbctlxq_run(hw);
3988            goto done;
3989        }
3990    }
3991
3992    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3993
3994done:
3995    ;
3996
3997}
3998
3999/*----------------------------------------------------------------
4000* hfa384x_usb_throttlefn
4001*
4002*
4003* Arguments:
4004* data ptr to hw
4005*
4006* Returns:
4007* Nothing
4008*
4009* Side effects:
4010*
4011* Call context:
4012* Interrupt
4013----------------------------------------------------------------*/
4014static void hfa384x_usb_throttlefn(unsigned long data)
4015{
4016    hfa384x_t *hw = (hfa384x_t *) data;
4017    unsigned long flags;
4018
4019    spin_lock_irqsave(&hw->ctlxq.lock, flags);
4020
4021    /*
4022     * We need to check BOTH the RX and the TX throttle controls,
4023     * so we use the bitwise OR instead of the logical OR.
4024     */
4025    pr_debug("flags=0x%lx\n", hw->usb_flags);
4026    if (!hw->wlandev->hwremoved &&
4027        ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4028          !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4029         |
4030         (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4031          !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4032        )) {
4033        schedule_work(&hw->usb_work);
4034    }
4035
4036    spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4037}
4038
4039/*----------------------------------------------------------------
4040* hfa384x_usbctlx_submit
4041*
4042* Called from the doxxx functions to submit a CTLX to the queue
4043*
4044* Arguments:
4045* hw ptr to the hw struct
4046* ctlx ctlx structure to enqueue
4047*
4048* Returns:
4049* -ENODEV if the adapter is unplugged
4050* 0
4051*
4052* Side effects:
4053*
4054* Call context:
4055* process or interrupt
4056----------------------------------------------------------------*/
4057static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
4058{
4059    unsigned long flags;
4060    int ret;
4061
4062    spin_lock_irqsave(&hw->ctlxq.lock, flags);
4063
4064    if (hw->wlandev->hwremoved) {
4065        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4066        ret = -ENODEV;
4067    } else {
4068        ctlx->state = CTLX_PENDING;
4069        list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4070
4071        spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4072        hfa384x_usbctlxq_run(hw);
4073        ret = 0;
4074    }
4075
4076    return ret;
4077}
4078
4079/*----------------------------------------------------------------
4080* hfa384x_usbout_tx
4081*
4082* At this point we have finished a send of a frame. Mark the URB
4083* as available and call ev_alloc to notify higher layers we're
4084* ready for more.
4085*
4086* Arguments:
4087* wlandev wlan device
4088* usbout ptr to the usb transfer buffer
4089*
4090* Returns:
4091* nothing
4092*
4093* Side effects:
4094*
4095* Call context:
4096* interrupt
4097----------------------------------------------------------------*/
4098static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4099{
4100    prism2sta_ev_alloc(wlandev);
4101}
4102
4103/*----------------------------------------------------------------
4104* hfa384x_isgood_pdrcore
4105*
4106* Quick check of PDR codes.
4107*
4108* Arguments:
4109* pdrcode PDR code number (host order)
4110*
4111* Returns:
4112* zero not good.
4113* one is good.
4114*
4115* Side effects:
4116*
4117* Call context:
4118----------------------------------------------------------------*/
4119static int hfa384x_isgood_pdrcode(u16 pdrcode)
4120{
4121    switch (pdrcode) {
4122    case HFA384x_PDR_END_OF_PDA:
4123    case HFA384x_PDR_PCB_PARTNUM:
4124    case HFA384x_PDR_PDAVER:
4125    case HFA384x_PDR_NIC_SERIAL:
4126    case HFA384x_PDR_MKK_MEASUREMENTS:
4127    case HFA384x_PDR_NIC_RAMSIZE:
4128    case HFA384x_PDR_MFISUPRANGE:
4129    case HFA384x_PDR_CFISUPRANGE:
4130    case HFA384x_PDR_NICID:
4131    case HFA384x_PDR_MAC_ADDRESS:
4132    case HFA384x_PDR_REGDOMAIN:
4133    case HFA384x_PDR_ALLOWED_CHANNEL:
4134    case HFA384x_PDR_DEFAULT_CHANNEL:
4135    case HFA384x_PDR_TEMPTYPE:
4136    case HFA384x_PDR_IFR_SETTING:
4137    case HFA384x_PDR_RFR_SETTING:
4138    case HFA384x_PDR_HFA3861_BASELINE:
4139    case HFA384x_PDR_HFA3861_SHADOW:
4140    case HFA384x_PDR_HFA3861_IFRF:
4141    case HFA384x_PDR_HFA3861_CHCALSP:
4142    case HFA384x_PDR_HFA3861_CHCALI:
4143    case HFA384x_PDR_3842_NIC_CONFIG:
4144    case HFA384x_PDR_USB_ID:
4145    case HFA384x_PDR_PCI_ID:
4146    case HFA384x_PDR_PCI_IFCONF:
4147    case HFA384x_PDR_PCI_PMCONF:
4148    case HFA384x_PDR_RFENRGY:
4149    case HFA384x_PDR_HFA3861_MANF_TESTSP:
4150    case HFA384x_PDR_HFA3861_MANF_TESTI:
4151        /* code is OK */
4152        return 1;
4153        break;
4154    default:
4155        if (pdrcode < 0x1000) {
4156            /* code is OK, but we don't know exactly what it is */
4157            pr_debug("Encountered unknown PDR#=0x%04x, "
4158                 "assuming it's ok.\n", pdrcode);
4159            return 1;
4160        } else {
4161            /* bad code */
4162            pr_debug("Encountered unknown PDR#=0x%04x, "
4163                 "(>=0x1000), assuming it's bad.\n", pdrcode);
4164            return 0;
4165        }
4166        break;
4167    }
4168    return 0; /* avoid compiler warnings */
4169}
4170

Archive Download this file



interactive