drivers/staging/wlan-ng/hfa384x_usb.c

   1 // SPDX-License-Identifier: (GPL-2.0 OR MPL-1.1)
   2 /* src/prism2/driver/hfa384x_usb.c
   3  *
   4  * Functions that talk to the USB variant of the Intersil hfa384x MAC
   5  *
   6  * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   7  * --------------------------------------------------------------------
   8  *
   9  * linux-wlan
  10  *
  11  *   The contents of this file are subject to the Mozilla Public
  12  *   License Version 1.1 (the "License"); you may not use this file
  13  *   except in compliance with the License. You may obtain a copy of
  14  *   the License at http://www.mozilla.org/MPL/
  15  *
  16  *   Software distributed under the License is distributed on an "AS
  17  *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  18  *   implied. See the License for the specific language governing
  19  *   rights and limitations under the License.
  20  *
  21  *   Alternatively, the contents of this file may be used under the
  22  *   terms of the GNU Public License version 2 (the "GPL"), in which
  23  *   case the provisions of the GPL are applicable instead of the
  24  *   above.  If you wish to allow the use of your version of this file
  25  *   only under the terms of the GPL and not to allow others to use
  26  *   your version of this file under the MPL, indicate your decision
  27  *   by deleting the provisions above and replace them with the notice
  28  *   and other provisions required by the GPL.  If you do not delete
  29  *   the provisions above, a recipient may use your version of this
  30  *   file under either the MPL or the GPL.
  31  *
  32  * --------------------------------------------------------------------
  33  *
  34  * Inquiries regarding the linux-wlan Open Source project can be
  35  * made directly to:
  36  *
  37  * AbsoluteValue Systems Inc.
  38  * info@linux-wlan.com
  39  * http://www.linux-wlan.com
  40  *
  41  * --------------------------------------------------------------------
  42  *
  43  * Portions of the development of this software were funded by
  44  * Intersil Corporation as part of PRISM(R) chipset product development.
  45  *
  46  * --------------------------------------------------------------------
  47  *
  48  * This file implements functions that correspond to the prism2/hfa384x
  49  * 802.11 MAC hardware and firmware host interface.
  50  *
  51  * The functions can be considered to represent several levels of
  52  * abstraction.  The lowest level functions are simply C-callable wrappers
  53  * around the register accesses.  The next higher level represents C-callable
  54  * prism2 API functions that match the Intersil documentation as closely
  55  * as is reasonable.  The next higher layer implements common sequences
  56  * of invocations of the API layer (e.g. write to bap, followed by cmd).
  57  *
  58  * Common sequences:
  59  * hfa384x_drvr_xxx     Highest level abstractions provided by the
  60  *                      hfa384x code.  They are driver defined wrappers
  61  *                      for common sequences.  These functions generally
  62  *                      use the services of the lower levels.
  63  *
  64  * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  65  *                      functions are wrappers for the RID get/set
  66  *                      sequence. They call copy_[to|from]_bap() and
  67  *                      cmd_access(). These functions operate on the
  68  *                      RIDs and buffers without validation. The caller
  69  *                      is responsible for that.
  70  *
  71  * API wrapper functions:
  72  * hfa384x_cmd_xxx      functions that provide access to the f/w commands.
  73  *                      The function arguments correspond to each command
  74  *                      argument, even command arguments that get packed
  75  *                      into single registers.  These functions _just_
  76  *                      issue the command by setting the cmd/parm regs
  77  *                      & reading the status/resp regs.  Additional
  78  *                      activities required to fully use a command
  79  *                      (read/write from/to bap, get/set int status etc.)
  80  *                      are implemented separately.  Think of these as
  81  *                      C-callable prism2 commands.
  82  *
  83  * Lowest Layer Functions:
  84  * hfa384x_docmd_xxx    These functions implement the sequence required
  85  *                      to issue any prism2 command.  Primarily used by the
  86  *                      hfa384x_cmd_xxx functions.
  87  *
  88  * hfa384x_bap_xxx      BAP read/write access functions.
  89  *                      Note: we usually use BAP0 for non-interrupt context
  90  *                       and BAP1 for interrupt context.
  91  *
  92  * hfa384x_dl_xxx       download related functions.
  93  *
  94  * Driver State Issues:
  95  * Note that there are two pairs of functions that manage the
  96  * 'initialized' and 'running' states of the hw/MAC combo.  The four
  97  * functions are create(), destroy(), start(), and stop().  create()
  98  * sets up the data structures required to support the hfa384x_*
  99  * functions and destroy() cleans them up.  The start() function gets
 100  * the actual hardware running and enables the interrupts.  The stop()
 101  * function shuts the hardware down.  The sequence should be:
 102  * create()
 103  * start()
 104  *  .
 105  *  .  Do interesting things w/ the hardware
 106  *  .
 107  * stop()
 108  * destroy()
 109  *
 110  * Note that destroy() can be called without calling stop() first.
 111  * --------------------------------------------------------------------
 112  */
 113
 114 #include <linux/module.h>
 115 #include <linux/kernel.h>
 116 #include <linux/sched.h>
 117 #include <linux/types.h>
 118 #include <linux/slab.h>
 119 #include <linux/wireless.h>
 120 #include <linux/netdevice.h>
 121 #include <linux/timer.h>
 122 #include <linux/io.h>
 123 #include <linux/delay.h>
 124 #include <asm/byteorder.h>
 125 #include <linux/bitops.h>
 126 #include <linux/list.h>
 127 #include <linux/usb.h>
 128 #include <linux/byteorder/generic.h>
 129
 130 #include "p80211types.h"
 131 #include "p80211hdr.h"
 132 #include "p80211mgmt.h"
 133 #include "p80211conv.h"
 134 #include "p80211msg.h"
 135 #include "p80211netdev.h"
 136 #include "p80211req.h"
 137 #include "p80211metadef.h"
 138 #include "p80211metastruct.h"
 139 #include "hfa384x.h"
 140 #include "prism2mgmt.h"
 141
 142 enum cmd_mode {
 143         DOWAIT = 0,
 144         DOASYNC
 145 };
 146
 147 #define THROTTLE_JIFFIES        (HZ / 8)
 148 #define URB_ASYNC_UNLINK 0
 149 #define USB_QUEUE_BULK 0
 150
 151 #define ROUNDUP64(a) (((a) + 63) & ~63)
 152
 153 #ifdef DEBUG_USB
 154 static void dbprint_urb(struct urb *urb);
 155 #endif
 156
 157 static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
 158                                   struct hfa384x_usb_rxfrm *rxfrm);
 159
 160 static void hfa384x_usb_defer(struct work_struct *data);
 161
 162 static int submit_rx_urb(struct hfa384x *hw, gfp_t flags);
 163
 164 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t flags);
 165
 166 /*---------------------------------------------------*/
 167 /* Callbacks */
 168 static void hfa384x_usbout_callback(struct urb *urb);
 169 static void hfa384x_ctlxout_callback(struct urb *urb);
 170 static void hfa384x_usbin_callback(struct urb *urb);
 171
 172 static void
 173 hfa384x_usbin_txcompl(struct wlandevice *wlandev, union hfa384x_usbin *usbin);
 174
 175 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb);
 176
 177 static void hfa384x_usbin_info(struct wlandevice *wlandev,
 178                                union hfa384x_usbin *usbin);
 179
 180 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
 181                                int urb_status);
 182
 183 /*---------------------------------------------------*/
 184 /* Functions to support the prism2 usb command queue */
 185
 186 static void hfa384x_usbctlxq_run(struct hfa384x *hw);
 187
 188 static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t);
 189
 190 static void hfa384x_usbctlx_resptimerfn(struct timer_list *t);
 191
 192 static void hfa384x_usb_throttlefn(struct timer_list *t);
 193
 194 static void hfa384x_usbctlx_completion_task(unsigned long data);
 195
 196 static void hfa384x_usbctlx_reaper_task(unsigned long data);
 197
 198 static int hfa384x_usbctlx_submit(struct hfa384x *hw,
 199                                   struct hfa384x_usbctlx *ctlx);
 200
 201 static void unlocked_usbctlx_complete(struct hfa384x *hw,
 202                                       struct hfa384x_usbctlx *ctlx);
 203
 204 struct usbctlx_completor {
 205         int (*complete)(struct usbctlx_completor *completor);
 206 };
 207
 208 static int
 209 hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
 210                               struct hfa384x_usbctlx *ctlx,
 211                               struct usbctlx_completor *completor);
 212
 213 static int
 214 unlocked_usbctlx_cancel_async(struct hfa384x *hw, struct hfa384x_usbctlx *ctlx);
 215
 216 static void hfa384x_cb_status(struct hfa384x *hw,
 217                               const struct hfa384x_usbctlx *ctlx);
 218
 219 static int
 220 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
 221                    struct hfa384x_cmdresult *result);
 222
 223 static void
 224 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
 225                        struct hfa384x_rridresult *result);
 226
 227 /*---------------------------------------------------*/
 228 /* Low level req/resp CTLX formatters and submitters */
 229 static inline int
 230 hfa384x_docmd(struct hfa384x *hw,
 231               struct hfa384x_metacmd *cmd);
 232
 233 static int
 234 hfa384x_dorrid(struct hfa384x *hw,
 235                enum cmd_mode mode,
 236                u16 rid,
 237                void *riddata,
 238                unsigned int riddatalen,
 239                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 240
 241 static int
 242 hfa384x_dowrid(struct hfa384x *hw,
 243                enum cmd_mode mode,
 244                u16 rid,
 245                void *riddata,
 246                unsigned int riddatalen,
 247                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 248
 249 static int
 250 hfa384x_dormem(struct hfa384x *hw,
 251                u16 page,
 252                u16 offset,
 253                void *data,
 254                unsigned int len);
 255
 256 static int
 257 hfa384x_dowmem(struct hfa384x *hw,
 258                u16 page,
 259                u16 offset,
 260                void *data,
 261                unsigned int len);
 262
 263 static int hfa384x_isgood_pdrcode(u16 pdrcode);
 264
 265 static inline const char *ctlxstr(enum ctlx_state s)
 266 {
 267         static const char * const ctlx_str[] = {
 268                 "Initial state",
 269                 "Complete",
 270                 "Request failed",
 271                 "Request pending",
 272                 "Request packet submitted",
 273                 "Request packet completed",
 274                 "Response packet completed"
 275         };
 276
 277         return ctlx_str[s];
 278 };
 279
 280 static inline struct hfa384x_usbctlx *get_active_ctlx(struct hfa384x *hw)
 281 {
 282         return list_entry(hw->ctlxq.active.next, struct hfa384x_usbctlx, list);
 283 }
 284
 285 #ifdef DEBUG_USB
 286 void dbprint_urb(struct urb *urb)
 287 {
 288         pr_debug("urb->pipe=0x%08x\n", urb->pipe);
 289         pr_debug("urb->status=0x%08x\n", urb->status);
 290         pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 291         pr_debug("urb->transfer_buffer=0x%08x\n",
 292                  (unsigned int)urb->transfer_buffer);
 293         pr_debug("urb->transfer_buffer_length=0x%08x\n",
 294                  urb->transfer_buffer_length);
 295         pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
 296         pr_debug("urb->bandwidth=0x%08x\n", urb->bandwidth);
 297         pr_debug("urb->setup_packet(ctl)=0x%08x\n",
 298                  (unsigned int)urb->setup_packet);
 299         pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 300         pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
 301         pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
 302         pr_debug("urb->timeout=0x%08x\n", urb->timeout);
 303         pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
 304         pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
 305 }
 306 #endif
 307
 308 /*----------------------------------------------------------------
 309  * submit_rx_urb
 310  *
 311  * Listen for input data on the BULK-IN pipe. If the pipe has
 312  * stalled then schedule it to be reset.
 313  *
 314  * Arguments:
 315  *      hw              device struct
 316  *      memflags        memory allocation flags
 317  *
 318  * Returns:
 319  *      error code from submission
 320  *
 321  * Call context:
 322  *      Any
 323  *----------------------------------------------------------------
 324  */
 325 static int submit_rx_urb(struct hfa384x *hw, gfp_t memflags)
 326 {
 327         struct sk_buff *skb;
 328         int result;
 329
 330         skb = dev_alloc_skb(sizeof(union hfa384x_usbin));
 331         if (!skb) {
 332                 result = -ENOMEM;
 333                 goto done;
 334         }
 335
 336         /* Post the IN urb */
 337         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 338                           hw->endp_in,
 339                           skb->data, sizeof(union hfa384x_usbin),
 340                           hfa384x_usbin_callback, hw->wlandev);
 341
 342         hw->rx_urb_skb = skb;
 343
 344         result = -ENOLINK;
 345         if (!hw->wlandev->hwremoved &&
 346             !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 347                 result = usb_submit_urb(&hw->rx_urb, memflags);
 348
 349                 /* Check whether we need to reset the RX pipe */
 350                 if (result == -EPIPE) {
 351                         netdev_warn(hw->wlandev->netdev,
 352                                     "%s rx pipe stalled: requesting reset\n",
 353                                     hw->wlandev->netdev->name);
 354                         if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
 355                                 schedule_work(&hw->usb_work);
 356                 }
 357         }
 358
 359         /* Don't leak memory if anything should go wrong */
 360         if (result != 0) {
 361                 dev_kfree_skb(skb);
 362                 hw->rx_urb_skb = NULL;
 363         }
 364
 365 done:
 366         return result;
 367 }
 368
 369 /*----------------------------------------------------------------
 370  * submit_tx_urb
 371  *
 372  * Prepares and submits the URB of transmitted data. If the
 373  * submission fails then it will schedule the output pipe to
 374  * be reset.
 375  *
 376  * Arguments:
 377  *      hw              device struct
 378  *      tx_urb          URB of data for transmission
 379  *      memflags        memory allocation flags
 380  *
 381  * Returns:
 382  *      error code from submission
 383  *
 384  * Call context:
 385  *      Any
 386  *----------------------------------------------------------------
 387  */
 388 static int submit_tx_urb(struct hfa384x *hw, struct urb *tx_urb, gfp_t memflags)
 389 {
 390         struct net_device *netdev = hw->wlandev->netdev;
 391         int result;
 392
 393         result = -ENOLINK;
 394         if (netif_running(netdev)) {
 395                 if (!hw->wlandev->hwremoved &&
 396                     !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 397                         result = usb_submit_urb(tx_urb, memflags);
 398
 399                         /* Test whether we need to reset the TX pipe */
 400                         if (result == -EPIPE) {
 401                                 netdev_warn(hw->wlandev->netdev,
 402                                             "%s tx pipe stalled: requesting reset\n",
 403                                             netdev->name);
 404                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 405                                 schedule_work(&hw->usb_work);
 406                         } else if (result == 0) {
 407                                 netif_stop_queue(netdev);
 408                         }
 409                 }
 410         }
 411
 412         return result;
 413 }
 414
 415 /*----------------------------------------------------------------
 416  * hfa394x_usb_defer
 417  *
 418  * There are some things that the USB stack cannot do while
 419  * in interrupt context, so we arrange this function to run
 420  * in process context.
 421  *
 422  * Arguments:
 423  *      hw      device structure
 424  *
 425  * Returns:
 426  *      nothing
 427  *
 428  * Call context:
 429  *      process (by design)
 430  *----------------------------------------------------------------
 431  */
 432 static void hfa384x_usb_defer(struct work_struct *data)
 433 {
 434         struct hfa384x *hw = container_of(data, struct hfa384x, usb_work);
 435         struct net_device *netdev = hw->wlandev->netdev;
 436
 437         /* Don't bother trying to reset anything if the plug
 438          * has been pulled ...
 439          */
 440         if (hw->wlandev->hwremoved)
 441                 return;
 442
 443         /* Reception has stopped: try to reset the input pipe */
 444         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 445                 int ret;
 446
 447                 usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
 448
 449                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 450                 if (ret != 0) {
 451                         netdev_err(hw->wlandev->netdev,
 452                                    "Failed to clear rx pipe for %s: err=%d\n",
 453                                    netdev->name, ret);
 454                 } else {
 455                         netdev_info(hw->wlandev->netdev, "%s rx pipe reset complete.\n",
 456                                     netdev->name);
 457                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 458                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 459                 }
 460         }
 461
 462         /* Resume receiving data back from the device. */
 463         if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
 464                 int ret;
 465
 466                 ret = submit_rx_urb(hw, GFP_KERNEL);
 467                 if (ret != 0) {
 468                         netdev_err(hw->wlandev->netdev,
 469                                    "Failed to resume %s rx pipe.\n",
 470                                    netdev->name);
 471                 } else {
 472                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 473                 }
 474         }
 475
 476         /* Transmission has stopped: try to reset the output pipe */
 477         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 478                 int ret;
 479
 480                 usb_kill_urb(&hw->tx_urb);
 481                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 482                 if (ret != 0) {
 483                         netdev_err(hw->wlandev->netdev,
 484                                    "Failed to clear tx pipe for %s: err=%d\n",
 485                                    netdev->name, ret);
 486                 } else {
 487                         netdev_info(hw->wlandev->netdev, "%s tx pipe reset complete.\n",
 488                                     netdev->name);
 489                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 490                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 491
 492                         /* Stopping the BULK-OUT pipe also blocked
 493                          * us from sending any more CTLX URBs, so
 494                          * we need to re-run our queue ...
 495                          */
 496                         hfa384x_usbctlxq_run(hw);
 497                 }
 498         }
 499
 500         /* Resume transmitting. */
 501         if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
 502                 netif_wake_queue(hw->wlandev->netdev);
 503 }
 504
 505 /*----------------------------------------------------------------
 506  * hfa384x_create
 507  *
 508  * Sets up the struct hfa384x data structure for use.  Note this
 509  * does _not_ initialize the actual hardware, just the data structures
 510  * we use to keep track of its state.
 511  *
 512  * Arguments:
 513  *      hw              device structure
 514  *      irq             device irq number
 515  *      iobase          i/o base address for register access
 516  *      membase         memory base address for register access
 517  *
 518  * Returns:
 519  *      nothing
 520  *
 521  * Side effects:
 522  *
 523  * Call context:
 524  *      process
 525  *----------------------------------------------------------------
 526  */
 527 void hfa384x_create(struct hfa384x *hw, struct usb_device *usb)
 528 {
 529         memset(hw, 0, sizeof(*hw));
 530         hw->usb = usb;
 531
 532         /* set up the endpoints */
 533         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 534         hw->endp_out = usb_sndbulkpipe(usb, 2);
 535
 536         /* Set up the waitq */
 537         init_waitqueue_head(&hw->cmdq);
 538
 539         /* Initialize the command queue */
 540         spin_lock_init(&hw->ctlxq.lock);
 541         INIT_LIST_HEAD(&hw->ctlxq.pending);
 542         INIT_LIST_HEAD(&hw->ctlxq.active);
 543         INIT_LIST_HEAD(&hw->ctlxq.completing);
 544         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 545
 546         /* Initialize the authentication queue */
 547         skb_queue_head_init(&hw->authq);
 548
 549         tasklet_init(&hw->reaper_bh,
 550                      hfa384x_usbctlx_reaper_task, (unsigned long)hw);
 551         tasklet_init(&hw->completion_bh,
 552                      hfa384x_usbctlx_completion_task, (unsigned long)hw);
 553         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 554         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 555
 556         timer_setup(&hw->throttle, hfa384x_usb_throttlefn, 0);
 557
 558         timer_setup(&hw->resptimer, hfa384x_usbctlx_resptimerfn, 0);
 559
 560         timer_setup(&hw->reqtimer, hfa384x_usbctlx_reqtimerfn, 0);
 561
 562         usb_init_urb(&hw->rx_urb);
 563         usb_init_urb(&hw->tx_urb);
 564         usb_init_urb(&hw->ctlx_urb);
 565
 566         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 567         hw->state = HFA384x_STATE_INIT;
 568
 569         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 570         timer_setup(&hw->commsqual_timer, prism2sta_commsqual_timer, 0);
 571 }
 572
 573 /*----------------------------------------------------------------
 574  * hfa384x_destroy
 575  *
 576  * Partner to hfa384x_create().  This function cleans up the hw
 577  * structure so that it can be freed by the caller using a simple
 578  * kfree.  Currently, this function is just a placeholder.  If, at some
 579  * point in the future, an hw in the 'shutdown' state requires a 'deep'
 580  * kfree, this is where it should be done.  Note that if this function
 581  * is called on a _running_ hw structure, the drvr_stop() function is
 582  * called.
 583  *
 584  * Arguments:
 585  *      hw              device structure
 586  *
 587  * Returns:
 588  *      nothing, this function is not allowed to fail.
 589  *
 590  * Side effects:
 591  *
 592  * Call context:
 593  *      process
 594  *----------------------------------------------------------------
 595  */
 596 void hfa384x_destroy(struct hfa384x *hw)
 597 {
 598         struct sk_buff *skb;
 599
 600         if (hw->state == HFA384x_STATE_RUNNING)
 601                 hfa384x_drvr_stop(hw);
 602         hw->state = HFA384x_STATE_PREINIT;
 603
 604         kfree(hw->scanresults);
 605         hw->scanresults = NULL;
 606
 607         /* Now to clean out the auth queue */
 608         while ((skb = skb_dequeue(&hw->authq)))
 609                 dev_kfree_skb(skb);
 610 }
 611
 612 static struct hfa384x_usbctlx *usbctlx_alloc(void)
 613 {
 614         struct hfa384x_usbctlx *ctlx;
 615
 616         ctlx = kzalloc(sizeof(*ctlx),
 617                        in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 618         if (ctlx)
 619                 init_completion(&ctlx->done);
 620
 621         return ctlx;
 622 }
 623
 624 static int
 625 usbctlx_get_status(const struct hfa384x_usb_statusresp *cmdresp,
 626                    struct hfa384x_cmdresult *result)
 627 {
 628         result->status = le16_to_cpu(cmdresp->status);
 629         result->resp0 = le16_to_cpu(cmdresp->resp0);
 630         result->resp1 = le16_to_cpu(cmdresp->resp1);
 631         result->resp2 = le16_to_cpu(cmdresp->resp2);
 632
 633         pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 634                  result->status, result->resp0, result->resp1, result->resp2);
 635
 636         return result->status & HFA384x_STATUS_RESULT;
 637 }
 638
 639 static void
 640 usbctlx_get_rridresult(const struct hfa384x_usb_rridresp *rridresp,
 641                        struct hfa384x_rridresult *result)
 642 {
 643         result->rid = le16_to_cpu(rridresp->rid);
 644         result->riddata = rridresp->data;
 645         result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
 646 }
 647
 648 /*----------------------------------------------------------------
 649  * Completor object:
 650  * This completor must be passed to hfa384x_usbctlx_complete_sync()
 651  * when processing a CTLX that returns a struct hfa384x_cmdresult structure.
 652  *----------------------------------------------------------------
 653  */
 654 struct usbctlx_cmd_completor {
 655         struct usbctlx_completor head;
 656
 657         const struct hfa384x_usb_statusresp *cmdresp;
 658         struct hfa384x_cmdresult *result;
 659 };
 660
 661 static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
 662 {
 663         struct usbctlx_cmd_completor *complete;
 664
 665         complete = (struct usbctlx_cmd_completor *)head;
 666         return usbctlx_get_status(complete->cmdresp, complete->result);
 667 }
 668
 669 static inline struct usbctlx_completor *
 670 init_cmd_completor(struct usbctlx_cmd_completor *completor,
 671                    const struct hfa384x_usb_statusresp *cmdresp,
 672                    struct hfa384x_cmdresult *result)
 673 {
 674         completor->head.complete = usbctlx_cmd_completor_fn;
 675         completor->cmdresp = cmdresp;
 676         completor->result = result;
 677         return &completor->head;
 678 }
 679
 680 /*----------------------------------------------------------------
 681  * Completor object:
 682  * This completor must be passed to hfa384x_usbctlx_complete_sync()
 683  * when processing a CTLX that reads a RID.
 684  *----------------------------------------------------------------
 685  */
 686 struct usbctlx_rrid_completor {
 687         struct usbctlx_completor head;
 688
 689         const struct hfa384x_usb_rridresp *rridresp;
 690         void *riddata;
 691         unsigned int riddatalen;
 692 };
 693
 694 static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
 695 {
 696         struct usbctlx_rrid_completor *complete;
 697         struct hfa384x_rridresult rridresult;
 698
 699         complete = (struct usbctlx_rrid_completor *)head;
 700         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 701
 702         /* Validate the length, note body len calculation in bytes */
 703         if (rridresult.riddata_len != complete->riddatalen) {
 704                 pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 705                         rridresult.rid,
 706                         complete->riddatalen, rridresult.riddata_len);
 707                 return -ENODATA;
 708         }
 709
 710         memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
 711         return 0;
 712 }
 713
 714 static inline struct usbctlx_completor *
 715 init_rrid_completor(struct usbctlx_rrid_completor *completor,
 716                     const struct hfa384x_usb_rridresp *rridresp,
 717                     void *riddata,
 718                     unsigned int riddatalen)
 719 {
 720         completor->head.complete = usbctlx_rrid_completor_fn;
 721         completor->rridresp = rridresp;
 722         completor->riddata = riddata;
 723         completor->riddatalen = riddatalen;
 724         return &completor->head;
 725 }
 726
 727 /*----------------------------------------------------------------
 728  * Completor object:
 729  * Interprets the results of a synchronous RID-write
 730  *----------------------------------------------------------------
 731  */
 732 #define init_wrid_completor  init_cmd_completor
 733
 734 /*----------------------------------------------------------------
 735  * Completor object:
 736  * Interprets the results of a synchronous memory-write
 737  *----------------------------------------------------------------
 738  */
 739 #define init_wmem_completor  init_cmd_completor
 740
 741 /*----------------------------------------------------------------
 742  * Completor object:
 743  * Interprets the results of a synchronous memory-read
 744  *----------------------------------------------------------------
 745  */
 746 struct usbctlx_rmem_completor {
 747         struct usbctlx_completor head;
 748
 749         const struct hfa384x_usb_rmemresp *rmemresp;
 750         void *data;
 751         unsigned int len;
 752 };
 753
 754 static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
 755 {
 756         struct usbctlx_rmem_completor *complete =
 757                 (struct usbctlx_rmem_completor *)head;
 758
 759         pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
 760         memcpy(complete->data, complete->rmemresp->data, complete->len);
 761         return 0;
 762 }
 763
 764 static inline struct usbctlx_completor *
 765 init_rmem_completor(struct usbctlx_rmem_completor *completor,
 766                     struct hfa384x_usb_rmemresp *rmemresp,
 767                     void *data,
 768                     unsigned int len)
 769 {
 770         completor->head.complete = usbctlx_rmem_completor_fn;
 771         completor->rmemresp = rmemresp;
 772         completor->data = data;
 773         completor->len = len;
 774         return &completor->head;
 775 }
 776
 777 /*----------------------------------------------------------------
 778  * hfa384x_cb_status
 779  *
 780  * Ctlx_complete handler for async CMD type control exchanges.
 781  * mark the hw struct as such.
 782  *
 783  * Note: If the handling is changed here, it should probably be
 784  *       changed in docmd as well.
 785  *
 786  * Arguments:
 787  *      hw              hw struct
 788  *      ctlx            completed CTLX
 789  *
 790  * Returns:
 791  *      nothing
 792  *
 793  * Side effects:
 794  *
 795  * Call context:
 796  *      interrupt
 797  *----------------------------------------------------------------
 798  */
 799 static void hfa384x_cb_status(struct hfa384x *hw,
 800                               const struct hfa384x_usbctlx *ctlx)
 801 {
 802         if (ctlx->usercb) {
 803                 struct hfa384x_cmdresult cmdresult;
 804
 805                 if (ctlx->state != CTLX_COMPLETE) {
 806                         memset(&cmdresult, 0, sizeof(cmdresult));
 807                         cmdresult.status =
 808                             HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 809                 } else {
 810                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 811                 }
 812
 813                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 814         }
 815 }
 816
 817 /*----------------------------------------------------------------
 818  * hfa384x_cmd_initialize
 819  *
 820  * Issues the initialize command and sets the hw->state based
 821  * on the result.
 822  *
 823  * Arguments:
 824  *      hw              device structure
 825  *
 826  * Returns:
 827  *      0               success
 828  *      >0              f/w reported error - f/w status code
 829  *      <0              driver reported error
 830  *
 831  * Side effects:
 832  *
 833  * Call context:
 834  *      process
 835  *----------------------------------------------------------------
 836  */
 837 int hfa384x_cmd_initialize(struct hfa384x *hw)
 838 {
 839         int result = 0;
 840         int i;
 841         struct hfa384x_metacmd cmd;
 842
 843         cmd.cmd = HFA384x_CMDCODE_INIT;
 844         cmd.parm0 = 0;
 845         cmd.parm1 = 0;
 846         cmd.parm2 = 0;
 847
 848         result = hfa384x_docmd(hw, &cmd);
 849
 850         pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
 851                  cmd.result.status,
 852                  cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
 853         if (result == 0) {
 854                 for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
 855                         hw->port_enabled[i] = 0;
 856         }
 857
 858         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 859
 860         return result;
 861 }
 862
 863 /*----------------------------------------------------------------
 864  * hfa384x_cmd_disable
 865  *
 866  * Issues the disable command to stop communications on one of
 867  * the MACs 'ports'.
 868  *
 869  * Arguments:
 870  *      hw              device structure
 871  *      macport         MAC port number (host order)
 872  *
 873  * Returns:
 874  *      0               success
 875  *      >0              f/w reported failure - f/w status code
 876  *      <0              driver reported error (timeout|bad arg)
 877  *
 878  * Side effects:
 879  *
 880  * Call context:
 881  *      process
 882  *----------------------------------------------------------------
 883  */
 884 int hfa384x_cmd_disable(struct hfa384x *hw, u16 macport)
 885 {
 886         struct hfa384x_metacmd cmd;
 887
 888         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
 889             HFA384x_CMD_MACPORT_SET(macport);
 890         cmd.parm0 = 0;
 891         cmd.parm1 = 0;
 892         cmd.parm2 = 0;
 893
 894         return hfa384x_docmd(hw, &cmd);
 895 }
 896
 897 /*----------------------------------------------------------------
 898  * hfa384x_cmd_enable
 899  *
 900  * Issues the enable command to enable communications on one of
 901  * the MACs 'ports'.
 902  *
 903  * Arguments:
 904  *      hw              device structure
 905  *      macport         MAC port number
 906  *
 907  * Returns:
 908  *      0               success
 909  *      >0              f/w reported failure - f/w status code
 910  *      <0              driver reported error (timeout|bad arg)
 911  *
 912  * Side effects:
 913  *
 914  * Call context:
 915  *      process
 916  *----------------------------------------------------------------
 917  */
 918 int hfa384x_cmd_enable(struct hfa384x *hw, u16 macport)
 919 {
 920         struct hfa384x_metacmd cmd;
 921
 922         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
 923             HFA384x_CMD_MACPORT_SET(macport);
 924         cmd.parm0 = 0;
 925         cmd.parm1 = 0;
 926         cmd.parm2 = 0;
 927
 928         return hfa384x_docmd(hw, &cmd);
 929 }
 930
 931 /*----------------------------------------------------------------
 932  * hfa384x_cmd_monitor
 933  *
 934  * Enables the 'monitor mode' of the MAC.  Here's the description of
 935  * monitor mode that I've received thus far:
 936  *
 937  *  "The "monitor mode" of operation is that the MAC passes all
 938  *  frames for which the PLCP checks are correct. All received
 939  *  MPDUs are passed to the host with MAC Port = 7, with a
 940  *  receive status of good, FCS error, or undecryptable. Passing
 941  *  certain MPDUs is a violation of the 802.11 standard, but useful
 942  *  for a debugging tool."  Normal communication is not possible
 943  *  while monitor mode is enabled.
 944  *
 945  * Arguments:
 946  *      hw              device structure
 947  *      enable          a code (0x0b|0x0f) that enables/disables
 948  *                      monitor mode. (host order)
 949  *
 950  * Returns:
 951  *      0               success
 952  *      >0              f/w reported failure - f/w status code
 953  *      <0              driver reported error (timeout|bad arg)
 954  *
 955  * Side effects:
 956  *
 957  * Call context:
 958  *      process
 959  *----------------------------------------------------------------
 960  */
 961 int hfa384x_cmd_monitor(struct hfa384x *hw, u16 enable)
 962 {
 963         struct hfa384x_metacmd cmd;
 964
 965         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
 966             HFA384x_CMD_AINFO_SET(enable);
 967         cmd.parm0 = 0;
 968         cmd.parm1 = 0;
 969         cmd.parm2 = 0;
 970
 971         return hfa384x_docmd(hw, &cmd);
 972 }
 973
 974 /*----------------------------------------------------------------
 975  * hfa384x_cmd_download
 976  *
 977  * Sets the controls for the MAC controller code/data download
 978  * process.  The arguments set the mode and address associated
 979  * with a download.  Note that the aux registers should be enabled
 980  * prior to setting one of the download enable modes.
 981  *
 982  * Arguments:
 983  *      hw              device structure
 984  *      mode            0 - Disable programming and begin code exec
 985  *                      1 - Enable volatile mem programming
 986  *                      2 - Enable non-volatile mem programming
 987  *                      3 - Program non-volatile section from NV download
 988  *                          buffer.
 989  *                      (host order)
 990  *      lowaddr
 991  *      highaddr        For mode 1, sets the high & low order bits of
 992  *                      the "destination address".  This address will be
 993  *                      the execution start address when download is
 994  *                      subsequently disabled.
 995  *                      For mode 2, sets the high & low order bits of
 996  *                      the destination in NV ram.
 997  *                      For modes 0 & 3, should be zero. (host order)
 998  *                      NOTE: these are CMD format.
 999  *      codelen         Length of the data to write in mode 2,
1000  *                      zero otherwise. (host order)
1001  *
1002  * Returns:
1003  *      0               success
1004  *      >0              f/w reported failure - f/w status code
1005  *      <0              driver reported error (timeout|bad arg)
1006  *
1007  * Side effects:
1008  *
1009  * Call context:
1010  *      process
1011  *----------------------------------------------------------------
1012  */
1013 int hfa384x_cmd_download(struct hfa384x *hw, u16 mode, u16 lowaddr,
1014                          u16 highaddr, u16 codelen)
1015 {
1016         struct hfa384x_metacmd cmd;
1017
1018         pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1019                  mode, lowaddr, highaddr, codelen);
1020
1021         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1022                    HFA384x_CMD_PROGMODE_SET(mode));
1023
1024         cmd.parm0 = lowaddr;
1025         cmd.parm1 = highaddr;
1026         cmd.parm2 = codelen;
1027
1028         return hfa384x_docmd(hw, &cmd);
1029 }
1030
1031 /*----------------------------------------------------------------
1032  * hfa384x_corereset
1033  *
1034  * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1035  * structure is in its "created" state.  That is, it is initialized
1036  * with proper values.  Note that if a reset is done after the
1037  * device has been active for awhile, the caller might have to clean
1038  * up some leftover cruft in the hw structure.
1039  *
1040  * Arguments:
1041  *      hw              device structure
1042  *      holdtime        how long (in ms) to hold the reset
1043  *      settletime      how long (in ms) to wait after releasing
1044  *                      the reset
1045  *
1046  * Returns:
1047  *      nothing
1048  *
1049  * Side effects:
1050  *
1051  * Call context:
1052  *      process
1053  *----------------------------------------------------------------
1054  */
1055 int hfa384x_corereset(struct hfa384x *hw, int holdtime,
1056                       int settletime, int genesis)
1057 {
1058         int result;
1059
1060         result = usb_reset_device(hw->usb);
1061         if (result < 0) {
1062                 netdev_err(hw->wlandev->netdev, "usb_reset_device() failed, result=%d.\n",
1063                            result);
1064         }
1065
1066         return result;
1067 }
1068
1069 /*----------------------------------------------------------------
1070  * hfa384x_usbctlx_complete_sync
1071  *
1072  * Waits for a synchronous CTLX object to complete,
1073  * and then handles the response.
1074  *
1075  * Arguments:
1076  *      hw              device structure
1077  *      ctlx            CTLX ptr
1078  *      completor       functor object to decide what to
1079  *                      do with the CTLX's result.
1080  *
1081  * Returns:
1082  *      0               Success
1083  *      -ERESTARTSYS    Interrupted by a signal
1084  *      -EIO            CTLX failed
1085  *      -ENODEV         Adapter was unplugged
1086  *      ???             Result from completor
1087  *
1088  * Side effects:
1089  *
1090  * Call context:
1091  *      process
1092  *----------------------------------------------------------------
1093  */
1094 static int hfa384x_usbctlx_complete_sync(struct hfa384x *hw,
1095                                          struct hfa384x_usbctlx *ctlx,
1096                                          struct usbctlx_completor *completor)
1097 {
1098         unsigned long flags;
1099         int result;
1100
1101         result = wait_for_completion_interruptible(&ctlx->done);
1102
1103         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1104
1105         /*
1106          * We can only handle the CTLX if the USB disconnect
1107          * function has not run yet ...
1108          */
1109 cleanup:
1110         if (hw->wlandev->hwremoved) {
1111                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1112                 result = -ENODEV;
1113         } else if (result != 0) {
1114                 int runqueue = 0;
1115
1116                 /*
1117                  * We were probably interrupted, so delete
1118                  * this CTLX asynchronously, kill the timers
1119                  * and the URB, and then start the next
1120                  * pending CTLX.
1121                  *
1122                  * NOTE: We can only delete the timers and
1123                  *       the URB if this CTLX is active.
1124                  */
1125                 if (ctlx == get_active_ctlx(hw)) {
1126                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1127
1128                         del_singleshot_timer_sync(&hw->reqtimer);
1129                         del_singleshot_timer_sync(&hw->resptimer);
1130                         hw->req_timer_done = 1;
1131                         hw->resp_timer_done = 1;
1132                         usb_kill_urb(&hw->ctlx_urb);
1133
1134                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1135
1136                         runqueue = 1;
1137
1138                         /*
1139                          * This scenario is so unlikely that I'm
1140                          * happy with a grubby "goto" solution ...
1141                          */
1142                         if (hw->wlandev->hwremoved)
1143                                 goto cleanup;
1144                 }
1145
1146                 /*
1147                  * The completion task will send this CTLX
1148                  * to the reaper the next time it runs. We
1149                  * are no longer in a hurry.
1150                  */
1151                 ctlx->reapable = 1;
1152                 ctlx->state = CTLX_REQ_FAILED;
1153                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1154
1155                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1156
1157                 if (runqueue)
1158                         hfa384x_usbctlxq_run(hw);
1159         } else {
1160                 if (ctlx->state == CTLX_COMPLETE) {
1161                         result = completor->complete(completor);
1162                 } else {
1163                         netdev_warn(hw->wlandev->netdev, "CTLX[%d] error: state(%s)\n",
1164                                     le16_to_cpu(ctlx->outbuf.type),
1165                                     ctlxstr(ctlx->state));
1166                         result = -EIO;
1167                 }
1168
1169                 list_del(&ctlx->list);
1170                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1171                 kfree(ctlx);
1172         }
1173
1174         return result;
1175 }
1176
1177 /*----------------------------------------------------------------
1178  * hfa384x_docmd
1179  *
1180  * Constructs a command CTLX and submits it.
1181  *
1182  * NOTE: Any changes to the 'post-submit' code in this function
1183  *       need to be carried over to hfa384x_cbcmd() since the handling
1184  *       is virtually identical.
1185  *
1186  * Arguments:
1187  *      hw              device structure
1188  *       cmd             cmd structure.  Includes all arguments and result
1189  *                       data points.  All in host order. in host order
1190  *
1191  * Returns:
1192  *      0               success
1193  *      -EIO            CTLX failure
1194  *      -ERESTARTSYS    Awakened on signal
1195  *      >0              command indicated error, Status and Resp0-2 are
1196  *                      in hw structure.
1197  *
1198  * Side effects:
1199  *
1200  *
1201  * Call context:
1202  *      process
1203  *----------------------------------------------------------------
1204  */
1205 static inline int
1206 hfa384x_docmd(struct hfa384x *hw,
1207               struct hfa384x_metacmd *cmd)
1208 {
1209         int result;
1210         struct hfa384x_usbctlx *ctlx;
1211
1212         ctlx = usbctlx_alloc();
1213         if (!ctlx) {
1214                 result = -ENOMEM;
1215                 goto done;
1216         }
1217
1218         /* Initialize the command */
1219         ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1220         ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1221         ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1222         ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1223         ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1224
1225         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1226
1227         pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1228                  cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1229
1230         ctlx->reapable = DOWAIT;
1231         ctlx->cmdcb = NULL;
1232         ctlx->usercb = NULL;
1233         ctlx->usercb_data = NULL;
1234
1235         result = hfa384x_usbctlx_submit(hw, ctlx);
1236         if (result != 0) {
1237                 kfree(ctlx);
1238         } else {
1239                 struct usbctlx_cmd_completor cmd_completor;
1240                 struct usbctlx_completor *completor;
1241
1242                 completor = init_cmd_completor(&cmd_completor,
1243                                                &ctlx->inbuf.cmdresp,
1244                                                &cmd->result);
1245
1246                 result = hfa384x_usbctlx_complete_sync(hw, ctlx, completor);
1247         }
1248
1249 done:
1250         return result;
1251 }
1252
1253 /*----------------------------------------------------------------
1254  * hfa384x_dorrid
1255  *
1256  * Constructs a read rid CTLX and issues it.
1257  *
1258  * NOTE: Any changes to the 'post-submit' code in this function
1259  *       need to be carried over to hfa384x_cbrrid() since the handling
1260  *       is virtually identical.
1261  *
1262  * Arguments:
1263  *      hw              device structure
1264  *      mode            DOWAIT or DOASYNC
1265  *      rid             Read RID number (host order)
1266  *      riddata         Caller supplied buffer that MAC formatted RID.data
1267  *                      record will be written to for DOWAIT calls. Should
1268  *                      be NULL for DOASYNC calls.
1269  *      riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1270  *      cmdcb           command callback for async calls, NULL for DOWAIT calls
1271  *      usercb          user callback for async calls, NULL for DOWAIT calls
1272  *      usercb_data     user supplied data pointer for async calls, NULL
1273  *                      for DOWAIT calls
1274  *
1275  * Returns:
1276  *      0               success
1277  *      -EIO            CTLX failure
1278  *      -ERESTARTSYS    Awakened on signal
1279  *      -ENODATA        riddatalen != macdatalen
1280  *      >0              command indicated error, Status and Resp0-2 are
1281  *                      in hw structure.
1282  *
1283  * Side effects:
1284  *
1285  * Call context:
1286  *      interrupt (DOASYNC)
1287  *      process (DOWAIT or DOASYNC)
1288  *----------------------------------------------------------------
1289  */
1290 static int
1291 hfa384x_dorrid(struct hfa384x *hw,
1292                enum cmd_mode mode,
1293                u16 rid,
1294                void *riddata,
1295                unsigned int riddatalen,
1296                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1297 {
1298         int result;
1299         struct hfa384x_usbctlx *ctlx;
1300
1301         ctlx = usbctlx_alloc();
1302         if (!ctlx) {
1303                 result = -ENOMEM;
1304                 goto done;
1305         }
1306
1307         /* Initialize the command */
1308         ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1309         ctlx->outbuf.rridreq.frmlen =
1310             cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1311         ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1312
1313         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1314
1315         ctlx->reapable = mode;
1316         ctlx->cmdcb = cmdcb;
1317         ctlx->usercb = usercb;
1318         ctlx->usercb_data = usercb_data;
1319
1320         /* Submit the CTLX */
1321         result = hfa384x_usbctlx_submit(hw, ctlx);
1322         if (result != 0) {
1323                 kfree(ctlx);
1324         } else if (mode == DOWAIT) {
1325                 struct usbctlx_rrid_completor completor;
1326
1327                 result =
1328                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1329                                                   init_rrid_completor
1330                                                   (&completor,
1331                                                    &ctlx->inbuf.rridresp,
1332                                                    riddata, riddatalen));
1333         }
1334
1335 done:
1336         return result;
1337 }
1338
1339 /*----------------------------------------------------------------
1340  * hfa384x_dowrid
1341  *
1342  * Constructs a write rid CTLX and issues it.
1343  *
1344  * NOTE: Any changes to the 'post-submit' code in this function
1345  *       need to be carried over to hfa384x_cbwrid() since the handling
1346  *       is virtually identical.
1347  *
1348  * Arguments:
1349  *      hw              device structure
1350  *      enum cmd_mode   DOWAIT or DOASYNC
1351  *      rid             RID code
1352  *      riddata         Data portion of RID formatted for MAC
1353  *      riddatalen      Length of the data portion in bytes
1354  *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1355  *      usercb          user callback for async calls, NULL for DOWAIT calls
1356  *      usercb_data     user supplied data pointer for async calls
1357  *
1358  * Returns:
1359  *      0               success
1360  *      -ETIMEDOUT      timed out waiting for register ready or
1361  *                      command completion
1362  *      >0              command indicated error, Status and Resp0-2 are
1363  *                      in hw structure.
1364  *
1365  * Side effects:
1366  *
1367  * Call context:
1368  *      interrupt (DOASYNC)
1369  *      process (DOWAIT or DOASYNC)
1370  *----------------------------------------------------------------
1371  */
1372 static int
1373 hfa384x_dowrid(struct hfa384x *hw,
1374                enum cmd_mode mode,
1375                u16 rid,
1376                void *riddata,
1377                unsigned int riddatalen,
1378                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1379 {
1380         int result;
1381         struct hfa384x_usbctlx *ctlx;
1382
1383         ctlx = usbctlx_alloc();
1384         if (!ctlx) {
1385                 result = -ENOMEM;
1386                 goto done;
1387         }
1388
1389         /* Initialize the command */
1390         ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1391         ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1392                                                    (ctlx->outbuf.wridreq.rid) +
1393                                                    riddatalen + 1) / 2);
1394         ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1395         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1396
1397         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1398             sizeof(ctlx->outbuf.wridreq.frmlen) +
1399             sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1400
1401         ctlx->reapable = mode;
1402         ctlx->cmdcb = cmdcb;
1403         ctlx->usercb = usercb;
1404         ctlx->usercb_data = usercb_data;
1405
1406         /* Submit the CTLX */
1407         result = hfa384x_usbctlx_submit(hw, ctlx);
1408         if (result != 0) {
1409                 kfree(ctlx);
1410         } else if (mode == DOWAIT) {
1411                 struct usbctlx_cmd_completor completor;
1412                 struct hfa384x_cmdresult wridresult;
1413
1414                 result = hfa384x_usbctlx_complete_sync(hw,
1415                                                        ctlx,
1416                                                        init_wrid_completor
1417                                                        (&completor,
1418                                                         &ctlx->inbuf.wridresp,
1419                                                         &wridresult));
1420         }
1421
1422 done:
1423         return result;
1424 }
1425
1426 /*----------------------------------------------------------------
1427  * hfa384x_dormem
1428  *
1429  * Constructs a readmem CTLX and issues it.
1430  *
1431  * NOTE: Any changes to the 'post-submit' code in this function
1432  *       need to be carried over to hfa384x_cbrmem() since the handling
1433  *       is virtually identical.
1434  *
1435  * Arguments:
1436  *      hw              device structure
1437  *      page            MAC address space page (CMD format)
1438  *      offset          MAC address space offset
1439  *      data            Ptr to data buffer to receive read
1440  *      len             Length of the data to read (max == 2048)
1441  *
1442  * Returns:
1443  *      0               success
1444  *      -ETIMEDOUT      timed out waiting for register ready or
1445  *                      command completion
1446  *      >0              command indicated error, Status and Resp0-2 are
1447  *                      in hw structure.
1448  *
1449  * Side effects:
1450  *
1451  * Call context:
1452  *      process (DOWAIT)
1453  *----------------------------------------------------------------
1454  */
1455 static int
1456 hfa384x_dormem(struct hfa384x *hw,
1457                u16 page,
1458                u16 offset,
1459                void *data,
1460                unsigned int len)
1461 {
1462         int result;
1463         struct hfa384x_usbctlx *ctlx;
1464
1465         ctlx = usbctlx_alloc();
1466         if (!ctlx) {
1467                 result = -ENOMEM;
1468                 goto done;
1469         }
1470
1471         /* Initialize the command */
1472         ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1473         ctlx->outbuf.rmemreq.frmlen =
1474             cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1475                         sizeof(ctlx->outbuf.rmemreq.page) + len);
1476         ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1477         ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1478
1479         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1480
1481         pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1482                  ctlx->outbuf.rmemreq.type,
1483                  ctlx->outbuf.rmemreq.frmlen,
1484                  ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1485
1486         pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1487
1488         ctlx->reapable = DOWAIT;
1489         ctlx->cmdcb = NULL;
1490         ctlx->usercb = NULL;
1491         ctlx->usercb_data = NULL;
1492
1493         result = hfa384x_usbctlx_submit(hw, ctlx);
1494         if (result != 0) {
1495                 kfree(ctlx);
1496         } else {
1497                 struct usbctlx_rmem_completor completor;
1498
1499                 result =
1500                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1501                                                   init_rmem_completor
1502                                                   (&completor,
1503                                                    &ctlx->inbuf.rmemresp, data,
1504                                                    len));
1505         }
1506
1507 done:
1508         return result;
1509 }
1510
1511 /*----------------------------------------------------------------
1512  * hfa384x_dowmem
1513  *
1514  * Constructs a writemem CTLX and issues it.
1515  *
1516  * NOTE: Any changes to the 'post-submit' code in this function
1517  *       need to be carried over to hfa384x_cbwmem() since the handling
1518  *       is virtually identical.
1519  *
1520  * Arguments:
1521  *      hw              device structure
1522  *      page            MAC address space page (CMD format)
1523  *      offset          MAC address space offset
1524  *      data            Ptr to data buffer containing write data
1525  *      len             Length of the data to read (max == 2048)
1526  *
1527  * Returns:
1528  *      0               success
1529  *      -ETIMEDOUT      timed out waiting for register ready or
1530  *                      command completion
1531  *      >0              command indicated error, Status and Resp0-2 are
1532  *                      in hw structure.
1533  *
1534  * Side effects:
1535  *
1536  * Call context:
1537  *      interrupt (DOWAIT)
1538  *      process (DOWAIT)
1539  *----------------------------------------------------------------
1540  */
1541 static int
1542 hfa384x_dowmem(struct hfa384x *hw,
1543                u16 page,
1544                u16 offset,
1545                void *data,
1546                unsigned int len)
1547 {
1548         int result;
1549         struct hfa384x_usbctlx *ctlx;
1550
1551         pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1552
1553         ctlx = usbctlx_alloc();
1554         if (!ctlx) {
1555                 result = -ENOMEM;
1556                 goto done;
1557         }
1558
1559         /* Initialize the command */
1560         ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1561         ctlx->outbuf.wmemreq.frmlen =
1562             cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1563                         sizeof(ctlx->outbuf.wmemreq.page) + len);
1564         ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1565         ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1566         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1567
1568         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1569             sizeof(ctlx->outbuf.wmemreq.frmlen) +
1570             sizeof(ctlx->outbuf.wmemreq.offset) +
1571             sizeof(ctlx->outbuf.wmemreq.page) + len;
1572
1573         ctlx->reapable = DOWAIT;
1574         ctlx->cmdcb = NULL;
1575         ctlx->usercb = NULL;
1576         ctlx->usercb_data = NULL;
1577
1578         result = hfa384x_usbctlx_submit(hw, ctlx);
1579         if (result != 0) {
1580                 kfree(ctlx);
1581         } else {
1582                 struct usbctlx_cmd_completor completor;
1583                 struct hfa384x_cmdresult wmemresult;
1584
1585                 result = hfa384x_usbctlx_complete_sync(hw,
1586                                                        ctlx,
1587                                                        init_wmem_completor
1588                                                        (&completor,
1589                                                         &ctlx->inbuf.wmemresp,
1590                                                         &wmemresult));
1591         }
1592
1593 done:
1594         return result;
1595 }
1596
1597 /*----------------------------------------------------------------
1598  * hfa384x_drvr_disable
1599  *
1600  * Issues the disable command to stop communications on one of
1601  * the MACs 'ports'.  Only macport 0 is valid  for stations.
1602  * APs may also disable macports 1-6.  Only ports that have been
1603  * previously enabled may be disabled.
1604  *
1605  * Arguments:
1606  *      hw              device structure
1607  *      macport         MAC port number (host order)
1608  *
1609  * Returns:
1610  *      0               success
1611  *      >0              f/w reported failure - f/w status code
1612  *      <0              driver reported error (timeout|bad arg)
1613  *
1614  * Side effects:
1615  *
1616  * Call context:
1617  *      process
1618  *----------------------------------------------------------------
1619  */
1620 int hfa384x_drvr_disable(struct hfa384x *hw, u16 macport)
1621 {
1622         int result = 0;
1623
1624         if ((!hw->isap && macport != 0) ||
1625             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1626             !(hw->port_enabled[macport])) {
1627                 result = -EINVAL;
1628         } else {
1629                 result = hfa384x_cmd_disable(hw, macport);
1630                 if (result == 0)
1631                         hw->port_enabled[macport] = 0;
1632         }
1633         return result;
1634 }
1635
1636 /*----------------------------------------------------------------
1637  * hfa384x_drvr_enable
1638  *
1639  * Issues the enable command to enable communications on one of
1640  * the MACs 'ports'.  Only macport 0 is valid  for stations.
1641  * APs may also enable macports 1-6.  Only ports that are currently
1642  * disabled may be enabled.
1643  *
1644  * Arguments:
1645  *      hw              device structure
1646  *      macport         MAC port number
1647  *
1648  * Returns:
1649  *      0               success
1650  *      >0              f/w reported failure - f/w status code
1651  *      <0              driver reported error (timeout|bad arg)
1652  *
1653  * Side effects:
1654  *
1655  * Call context:
1656  *      process
1657  *----------------------------------------------------------------
1658  */
1659 int hfa384x_drvr_enable(struct hfa384x *hw, u16 macport)
1660 {
1661         int result = 0;
1662
1663         if ((!hw->isap && macport != 0) ||
1664             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1665             (hw->port_enabled[macport])) {
1666                 result = -EINVAL;
1667         } else {
1668                 result = hfa384x_cmd_enable(hw, macport);
1669                 if (result == 0)
1670                         hw->port_enabled[macport] = 1;
1671         }
1672         return result;
1673 }
1674
1675 /*----------------------------------------------------------------
1676  * hfa384x_drvr_flashdl_enable
1677  *
1678  * Begins the flash download state.  Checks to see that we're not
1679  * already in a download state and that a port isn't enabled.
1680  * Sets the download state and retrieves the flash download
1681  * buffer location, buffer size, and timeout length.
1682  *
1683  * Arguments:
1684  *      hw              device structure
1685  *
1686  * Returns:
1687  *      0               success
1688  *      >0              f/w reported error - f/w status code
1689  *      <0              driver reported error
1690  *
1691  * Side effects:
1692  *
1693  * Call context:
1694  *      process
1695  *----------------------------------------------------------------
1696  */
1697 int hfa384x_drvr_flashdl_enable(struct hfa384x *hw)
1698 {
1699         int result = 0;
1700         int i;
1701
1702         /* Check that a port isn't active */
1703         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1704                 if (hw->port_enabled[i]) {
1705                         pr_debug("called when port enabled.\n");
1706                         return -EINVAL;
1707                 }
1708         }
1709
1710         /* Check that we're not already in a download state */
1711         if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1712                 return -EINVAL;
1713
1714         /* Retrieve the buffer loc&size and timeout */
1715         result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1716                                         &hw->bufinfo, sizeof(hw->bufinfo));
1717         if (result)
1718                 return result;
1719
1720         le16_to_cpus(&hw->bufinfo.page);
1721         le16_to_cpus(&hw->bufinfo.offset);
1722         le16_to_cpus(&hw->bufinfo.len);
1723         result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1724                                           &hw->dltimeout);
1725         if (result)
1726                 return result;
1727
1728         le16_to_cpus(&hw->dltimeout);
1729
1730         pr_debug("flashdl_enable\n");
1731
1732         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1733
1734         return result;
1735 }
1736
1737 /*----------------------------------------------------------------
1738  * hfa384x_drvr_flashdl_disable
1739  *
1740  * Ends the flash download state.  Note that this will cause the MAC
1741  * firmware to restart.
1742  *
1743  * Arguments:
1744  *      hw              device structure
1745  *
1746  * Returns:
1747  *      0               success
1748  *      >0              f/w reported error - f/w status code
1749  *      <0              driver reported error
1750  *
1751  * Side effects:
1752  *
1753  * Call context:
1754  *      process
1755  *----------------------------------------------------------------
1756  */
1757 int hfa384x_drvr_flashdl_disable(struct hfa384x *hw)
1758 {
1759         /* Check that we're already in the download state */
1760         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1761                 return -EINVAL;
1762
1763         pr_debug("flashdl_enable\n");
1764
1765         /* There isn't much we can do at this point, so I don't */
1766         /*  bother  w/ the return value */
1767         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1768         hw->dlstate = HFA384x_DLSTATE_DISABLED;
1769
1770         return 0;
1771 }
1772
1773 /*----------------------------------------------------------------
1774  * hfa384x_drvr_flashdl_write
1775  *
1776  * Performs a FLASH download of a chunk of data. First checks to see
1777  * that we're in the FLASH download state, then sets the download
1778  * mode, uses the aux functions to 1) copy the data to the flash
1779  * buffer, 2) sets the download 'write flash' mode, 3) readback and
1780  * compare.  Lather rinse, repeat as many times an necessary to get
1781  * all the given data into flash.
1782  * When all data has been written using this function (possibly
1783  * repeatedly), call drvr_flashdl_disable() to end the download state
1784  * and restart the MAC.
1785  *
1786  * Arguments:
1787  *      hw              device structure
1788  *      daddr           Card address to write to. (host order)
1789  *      buf             Ptr to data to write.
1790  *      len             Length of data (host order).
1791  *
1792  * Returns:
1793  *      0               success
1794  *      >0              f/w reported error - f/w status code
1795  *      <0              driver reported error
1796  *
1797  * Side effects:
1798  *
1799  * Call context:
1800  *      process
1801  *----------------------------------------------------------------
1802  */
1803 int hfa384x_drvr_flashdl_write(struct hfa384x *hw, u32 daddr,
1804                                void *buf, u32 len)
1805 {
1806         int result = 0;
1807         u32 dlbufaddr;
1808         int nburns;
1809         u32 burnlen;
1810         u32 burndaddr;
1811         u16 burnlo;
1812         u16 burnhi;
1813         int nwrites;
1814         u8 *writebuf;
1815         u16 writepage;
1816         u16 writeoffset;
1817         u32 writelen;
1818         int i;
1819         int j;
1820
1821         pr_debug("daddr=0x%08x len=%d\n", daddr, len);
1822
1823         /* Check that we're in the flash download state */
1824         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1825                 return -EINVAL;
1826
1827         netdev_info(hw->wlandev->netdev,
1828                     "Download %d bytes to flash @0x%06x\n", len, daddr);
1829
1830         /* Convert to flat address for arithmetic */
1831         /* NOTE: dlbuffer RID stores the address in AUX format */
1832         dlbufaddr =
1833             HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
1834         pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
1835                  hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
1836         /* Calculations to determine how many fills of the dlbuffer to do
1837          * and how many USB wmemreq's to do for each fill.  At this point
1838          * in time, the dlbuffer size and the wmemreq size are the same.
1839          * Therefore, nwrites should always be 1.  The extra complexity
1840          * here is a hedge against future changes.
1841          */
1842
1843         /* Figure out how many times to do the flash programming */
1844         nburns = len / hw->bufinfo.len;
1845         nburns += (len % hw->bufinfo.len) ? 1 : 0;
1846
1847         /* For each flash program cycle, how many USB wmemreq's are needed? */
1848         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
1849         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
1850
1851         /* For each burn */
1852         for (i = 0; i < nburns; i++) {
1853                 /* Get the dest address and len */
1854                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
1855                     hw->bufinfo.len : (len - (hw->bufinfo.len * i));
1856                 burndaddr = daddr + (hw->bufinfo.len * i);
1857                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
1858                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
1859
1860                 netdev_info(hw->wlandev->netdev, "Writing %d bytes to flash @0x%06x\n",
1861                             burnlen, burndaddr);
1862
1863                 /* Set the download mode */
1864                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
1865                                               burnlo, burnhi, burnlen);
1866                 if (result) {
1867                         netdev_err(hw->wlandev->netdev,
1868                                    "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1869                                    burnlo, burnhi, burnlen, result);
1870                         goto exit_proc;
1871                 }
1872
1873                 /* copy the data to the flash download buffer */
1874                 for (j = 0; j < nwrites; j++) {
1875                         writebuf = buf +
1876                             (i * hw->bufinfo.len) +
1877                             (j * HFA384x_USB_RWMEM_MAXLEN);
1878
1879                         writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
1880                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
1881                         writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
1882                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
1883
1884                         writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
1885                         writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
1886                             HFA384x_USB_RWMEM_MAXLEN : writelen;
1887
1888                         result = hfa384x_dowmem(hw,
1889                                                 writepage,
1890                                                 writeoffset,
1891                                                 writebuf, writelen);
1892                 }
1893
1894                 /* set the download 'write flash' mode */
1895                 result = hfa384x_cmd_download(hw,
1896                                               HFA384x_PROGMODE_NVWRITE,
1897                                               0, 0, 0);
1898                 if (result) {
1899                         netdev_err(hw->wlandev->netdev,
1900                                    "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
1901                                    burnlo, burnhi, burnlen, result);
1902                         goto exit_proc;
1903                 }
1904
1905                 /* TODO: We really should do a readback and compare. */
1906         }
1907
1908 exit_proc:
1909
1910         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
1911         /*  actually disable programming mode.  Remember, that will cause the */
1912         /*  the firmware to effectively reset itself. */
1913
1914         return result;
1915 }
1916
1917 /*----------------------------------------------------------------
1918  * hfa384x_drvr_getconfig
1919  *
1920  * Performs the sequence necessary to read a config/info item.
1921  *
1922  * Arguments:
1923  *      hw              device structure
1924  *      rid             config/info record id (host order)
1925  *      buf             host side record buffer.  Upon return it will
1926  *                      contain the body portion of the record (minus the
1927  *                      RID and len).
1928  *      len             buffer length (in bytes, should match record length)
1929  *
1930  * Returns:
1931  *      0               success
1932  *      >0              f/w reported error - f/w status code
1933  *      <0              driver reported error
1934  *      -ENODATA        length mismatch between argument and retrieved
1935  *                      record.
1936  *
1937  * Side effects:
1938  *
1939  * Call context:
1940  *      process
1941  *----------------------------------------------------------------
1942  */
1943 int hfa384x_drvr_getconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
1944 {
1945         return hfa384x_dorrid(hw, DOWAIT, rid, buf, len, NULL, NULL, NULL);
1946 }
1947
1948 /*----------------------------------------------------------------
1949  * hfa384x_drvr_setconfig_async
1950  *
1951  * Performs the sequence necessary to write a config/info item.
1952  *
1953  * Arguments:
1954  *       hw              device structure
1955  *       rid             config/info record id (in host order)
1956  *       buf             host side record buffer
1957  *       len             buffer length (in bytes)
1958  *       usercb          completion callback
1959  *       usercb_data     completion callback argument
1960  *
1961  * Returns:
1962  *       0               success
1963  *       >0              f/w reported error - f/w status code
1964  *       <0              driver reported error
1965  *
1966  * Side effects:
1967  *
1968  * Call context:
1969  *       process
1970  *----------------------------------------------------------------
1971  */
1972 int
1973 hfa384x_drvr_setconfig_async(struct hfa384x *hw,
1974                              u16 rid,
1975                              void *buf,
1976                              u16 len, ctlx_usercb_t usercb, void *usercb_data)
1977 {
1978         return hfa384x_dowrid(hw, DOASYNC, rid, buf, len, hfa384x_cb_status,
1979                               usercb, usercb_data);
1980 }
1981
1982 /*----------------------------------------------------------------
1983  * hfa384x_drvr_ramdl_disable
1984  *
1985  * Ends the ram download state.
1986  *
1987  * Arguments:
1988  *      hw              device structure
1989  *
1990  * Returns:
1991  *      0               success
1992  *      >0              f/w reported error - f/w status code
1993  *      <0              driver reported error
1994  *
1995  * Side effects:
1996  *
1997  * Call context:
1998  *      process
1999  *----------------------------------------------------------------
2000  */
2001 int hfa384x_drvr_ramdl_disable(struct hfa384x *hw)
2002 {
2003         /* Check that we're already in the download state */
2004         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2005                 return -EINVAL;
2006
2007         pr_debug("ramdl_disable()\n");
2008
2009         /* There isn't much we can do at this point, so I don't */
2010         /*  bother  w/ the return value */
2011         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
2012         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2013
2014         return 0;
2015 }
2016
2017 /*----------------------------------------------------------------
2018  * hfa384x_drvr_ramdl_enable
2019  *
2020  * Begins the ram download state.  Checks to see that we're not
2021  * already in a download state and that a port isn't enabled.
2022  * Sets the download state and calls cmd_download with the
2023  * ENABLE_VOLATILE subcommand and the exeaddr argument.
2024  *
2025  * Arguments:
2026  *      hw              device structure
2027  *      exeaddr         the card execution address that will be
2028  *                       jumped to when ramdl_disable() is called
2029  *                      (host order).
2030  *
2031  * Returns:
2032  *      0               success
2033  *      >0              f/w reported error - f/w status code
2034  *      <0              driver reported error
2035  *
2036  * Side effects:
2037  *
2038  * Call context:
2039  *      process
2040  *----------------------------------------------------------------
2041  */
2042 int hfa384x_drvr_ramdl_enable(struct hfa384x *hw, u32 exeaddr)
2043 {
2044         int result = 0;
2045         u16 lowaddr;
2046         u16 hiaddr;
2047         int i;
2048
2049         /* Check that a port isn't active */
2050         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2051                 if (hw->port_enabled[i]) {
2052                         netdev_err(hw->wlandev->netdev,
2053                                    "Can't download with a macport enabled.\n");
2054                         return -EINVAL;
2055                 }
2056         }
2057
2058         /* Check that we're not already in a download state */
2059         if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2060                 netdev_err(hw->wlandev->netdev,
2061                            "Download state not disabled.\n");
2062                 return -EINVAL;
2063         }
2064
2065         pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2066
2067         /* Call the download(1,addr) function */
2068         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2069         hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2070
2071         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2072                                       lowaddr, hiaddr, 0);
2073
2074         if (result == 0) {
2075                 /* Set the download state */
2076                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2077         } else {
2078                 pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2079                          lowaddr, hiaddr, result);
2080         }
2081
2082         return result;
2083 }
2084
2085 /*----------------------------------------------------------------
2086  * hfa384x_drvr_ramdl_write
2087  *
2088  * Performs a RAM download of a chunk of data. First checks to see
2089  * that we're in the RAM download state, then uses the [read|write]mem USB
2090  * commands to 1) copy the data, 2) readback and compare.  The download
2091  * state is unaffected.  When all data has been written using
2092  * this function, call drvr_ramdl_disable() to end the download state
2093  * and restart the MAC.
2094  *
2095  * Arguments:
2096  *      hw              device structure
2097  *      daddr           Card address to write to. (host order)
2098  *      buf             Ptr to data to write.
2099  *      len             Length of data (host order).
2100  *
2101  * Returns:
2102  *      0               success
2103  *      >0              f/w reported error - f/w status code
2104  *      <0              driver reported error
2105  *
2106  * Side effects:
2107  *
2108  * Call context:
2109  *      process
2110  *----------------------------------------------------------------
2111  */
2112 int hfa384x_drvr_ramdl_write(struct hfa384x *hw, u32 daddr, void *buf, u32 len)
2113 {
2114         int result = 0;
2115         int nwrites;
2116         u8 *data = buf;
2117         int i;
2118         u32 curraddr;
2119         u16 currpage;
2120         u16 curroffset;
2121         u16 currlen;
2122
2123         /* Check that we're in the ram download state */
2124         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2125                 return -EINVAL;
2126
2127         netdev_info(hw->wlandev->netdev, "Writing %d bytes to ram @0x%06x\n",
2128                     len, daddr);
2129
2130         /* How many dowmem calls?  */
2131         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2132         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2133
2134         /* Do blocking wmem's */
2135         for (i = 0; i < nwrites; i++) {
2136                 /* make address args */
2137                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2138                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2139                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2140                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2141                 if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2142                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2143
2144                 /* Do blocking ctlx */
2145                 result = hfa384x_dowmem(hw,
2146                                         currpage,
2147                                         curroffset,
2148                                         data + (i * HFA384x_USB_RWMEM_MAXLEN),
2149                                         currlen);
2150
2151                 if (result)
2152                         break;
2153
2154                 /* TODO: We really should have a readback. */
2155         }
2156
2157         return result;
2158 }
2159
2160 /*----------------------------------------------------------------
2161  * hfa384x_drvr_readpda
2162  *
2163  * Performs the sequence to read the PDA space.  Note there is no
2164  * drvr_writepda() function.  Writing a PDA is
2165  * generally implemented by a calling component via calls to
2166  * cmd_download and writing to the flash download buffer via the
2167  * aux regs.
2168  *
2169  * Arguments:
2170  *      hw              device structure
2171  *      buf             buffer to store PDA in
2172  *      len             buffer length
2173  *
2174  * Returns:
2175  *      0               success
2176  *      >0              f/w reported error - f/w status code
2177  *      <0              driver reported error
2178  *      -ETIMEDOUT      timeout waiting for the cmd regs to become
2179  *                      available, or waiting for the control reg
2180  *                      to indicate the Aux port is enabled.
2181  *      -ENODATA        the buffer does NOT contain a valid PDA.
2182  *                      Either the card PDA is bad, or the auxdata
2183  *                      reads are giving us garbage.
2184  *
2185  *
2186  * Side effects:
2187  *
2188  * Call context:
2189  *      process or non-card interrupt.
2190  *----------------------------------------------------------------
2191  */
2192 int hfa384x_drvr_readpda(struct hfa384x *hw, void *buf, unsigned int len)
2193 {
2194         int result = 0;
2195         __le16 *pda = buf;
2196         int pdaok = 0;
2197         int morepdrs = 1;
2198         int currpdr = 0;        /* word offset of the current pdr */
2199         size_t i;
2200         u16 pdrlen;             /* pdr length in bytes, host order */
2201         u16 pdrcode;            /* pdr code, host order */
2202         u16 currpage;
2203         u16 curroffset;
2204         struct pdaloc {
2205                 u32 cardaddr;
2206                 u16 auxctl;
2207         } pdaloc[] = {
2208                 {
2209                 HFA3842_PDA_BASE, 0}, {
2210                 HFA3841_PDA_BASE, 0}, {
2211                 HFA3841_PDA_BOGUS_BASE, 0}
2212         };
2213
2214         /* Read the pda from each known address.  */
2215         for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2216                 /* Make address */
2217                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2218                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2219
2220                 /* units of bytes */
2221                 result = hfa384x_dormem(hw, currpage, curroffset, buf,
2222                                         len);
2223
2224                 if (result) {
2225                         netdev_warn(hw->wlandev->netdev,
2226                                     "Read from index %zd failed, continuing\n",
2227                                     i);
2228                         continue;
2229                 }
2230
2231                 /* Test for garbage */
2232                 pdaok = 1;      /* initially assume good */
2233                 morepdrs = 1;
2234                 while (pdaok && morepdrs) {
2235                         pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2236                         pdrcode = le16_to_cpu(pda[currpdr + 1]);
2237                         /* Test the record length */
2238                         if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2239                                 netdev_err(hw->wlandev->netdev,
2240                                            "pdrlen invalid=%d\n", pdrlen);
2241                                 pdaok = 0;
2242                                 break;
2243                         }
2244                         /* Test the code */
2245                         if (!hfa384x_isgood_pdrcode(pdrcode)) {
2246                                 netdev_err(hw->wlandev->netdev, "pdrcode invalid=%d\n",
2247                                            pdrcode);
2248                                 pdaok = 0;
2249                                 break;
2250                         }
2251                         /* Test for completion */
2252                         if (pdrcode == HFA384x_PDR_END_OF_PDA)
2253                                 morepdrs = 0;
2254
2255                         /* Move to the next pdr (if necessary) */
2256                         if (morepdrs) {
2257                                 /* note the access to pda[], need words here */
2258                                 currpdr += le16_to_cpu(pda[currpdr]) + 1;
2259                         }
2260                 }
2261                 if (pdaok) {
2262                         netdev_info(hw->wlandev->netdev,
2263                                     "PDA Read from 0x%08x in %s space.\n",
2264                                     pdaloc[i].cardaddr,
2265                                     pdaloc[i].auxctl == 0 ? "EXTDS" :
2266                                     pdaloc[i].auxctl == 1 ? "NV" :
2267                                     pdaloc[i].auxctl == 2 ? "PHY" :
2268                                     pdaloc[i].auxctl == 3 ? "ICSRAM" :
2269                                     "<bogus auxctl>");
2270                         break;
2271                 }
2272         }
2273         result = pdaok ? 0 : -ENODATA;
2274
2275         if (result)
2276                 pr_debug("Failure: pda is not okay\n");
2277
2278         return result;
2279 }
2280
2281 /*----------------------------------------------------------------
2282  * hfa384x_drvr_setconfig
2283  *
2284  * Performs the sequence necessary to write a config/info item.
2285  *
2286  * Arguments:
2287  *      hw              device structure
2288  *      rid             config/info record id (in host order)
2289  *      buf             host side record buffer
2290  *      len             buffer length (in bytes)
2291  *
2292  * Returns:
2293  *      0               success
2294  *      >0              f/w reported error - f/w status code
2295  *      <0              driver reported error
2296  *
2297  * Side effects:
2298  *
2299  * Call context:
2300  *      process
2301  *----------------------------------------------------------------
2302  */
2303 int hfa384x_drvr_setconfig(struct hfa384x *hw, u16 rid, void *buf, u16 len)
2304 {
2305         return hfa384x_dowrid(hw, DOWAIT, rid, buf, len, NULL, NULL, NULL);
2306 }
2307
2308 /*----------------------------------------------------------------
2309  * hfa384x_drvr_start
2310  *
2311  * Issues the MAC initialize command, sets up some data structures,
2312  * and enables the interrupts.  After this function completes, the
2313  * low-level stuff should be ready for any/all commands.
2314  *
2315  * Arguments:
2316  *      hw              device structure
2317  * Returns:
2318  *      0               success
2319  *      >0              f/w reported error - f/w status code
2320  *      <0              driver reported error
2321  *
2322  * Side effects:
2323  *
2324  * Call context:
2325  *      process
2326  *----------------------------------------------------------------
2327  */
2328 int hfa384x_drvr_start(struct hfa384x *hw)
2329 {
2330         int result, result1, result2;
2331         u16 status;
2332
2333         might_sleep();
2334
2335         /* Clear endpoint stalls - but only do this if the endpoint
2336          * is showing a stall status. Some prism2 cards seem to behave
2337          * badly if a clear_halt is called when the endpoint is already
2338          * ok
2339          */
2340         result =
2341             usb_get_std_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in,
2342                                &status);
2343         if (result < 0) {
2344                 netdev_err(hw->wlandev->netdev, "Cannot get bulk in endpoint status.\n");
2345                 goto done;
2346         }
2347         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2348                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk in endpoint.\n");
2349
2350         result =
2351             usb_get_std_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out,
2352                                &status);
2353         if (result < 0) {
2354                 netdev_err(hw->wlandev->netdev, "Cannot get bulk out endpoint status.\n");
2355                 goto done;
2356         }
2357         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2358                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk out endpoint.\n");
2359
2360         /* Synchronous unlink, in case we're trying to restart the driver */
2361         usb_kill_urb(&hw->rx_urb);
2362
2363         /* Post the IN urb */
2364         result = submit_rx_urb(hw, GFP_KERNEL);
2365         if (result != 0) {
2366                 netdev_err(hw->wlandev->netdev,
2367                            "Fatal, failed to submit RX URB, result=%d\n",
2368                            result);
2369                 goto done;
2370         }
2371
2372         /* Call initialize twice, with a 1 second sleep in between.
2373          * This is a nasty work-around since many prism2 cards seem to
2374          * need time to settle after an init from cold. The second
2375          * call to initialize in theory is not necessary - but we call
2376          * it anyway as a double insurance policy:
2377          * 1) If the first init should fail, the second may well succeed
2378          *    and the card can still be used
2379          * 2) It helps ensures all is well with the card after the first
2380          *    init and settle time.
2381          */
2382         result1 = hfa384x_cmd_initialize(hw);
2383         msleep(1000);
2384         result = hfa384x_cmd_initialize(hw);
2385         result2 = result;
2386         if (result1 != 0) {
2387                 if (result2 != 0) {
2388                         netdev_err(hw->wlandev->netdev,
2389                                    "cmd_initialize() failed on two attempts, results %d and %d\n",
2390                                    result1, result2);
2391                         usb_kill_urb(&hw->rx_urb);
2392                         goto done;
2393                 } else {
2394                         pr_debug("First cmd_initialize() failed (result %d),\n",
2395                                  result1);
2396                         pr_debug("but second attempt succeeded. All should be ok\n");
2397                 }
2398         } else if (result2 != 0) {
2399                 netdev_warn(hw->wlandev->netdev, "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2400                             result2);
2401                 netdev_warn(hw->wlandev->netdev,
2402                             "Most likely the card will be functional\n");
2403                 goto done;
2404         }
2405
2406         hw->state = HFA384x_STATE_RUNNING;
2407
2408 done:
2409         return result;
2410 }
2411
2412 /*----------------------------------------------------------------
2413  * hfa384x_drvr_stop
2414  *
2415  * Shuts down the MAC to the point where it is safe to unload the
2416  * driver.  Any subsystem that may be holding a data or function
2417  * ptr into the driver must be cleared/deinitialized.
2418  *
2419  * Arguments:
2420  *      hw              device structure
2421  * Returns:
2422  *      0               success
2423  *      >0              f/w reported error - f/w status code
2424  *      <0              driver reported error
2425  *
2426  * Side effects:
2427  *
2428  * Call context:
2429  *      process
2430  *----------------------------------------------------------------
2431  */
2432 int hfa384x_drvr_stop(struct hfa384x *hw)
2433 {
2434         int i;
2435
2436         might_sleep();
2437
2438         /* There's no need for spinlocks here. The USB "disconnect"
2439          * function sets this "removed" flag and then calls us.
2440          */
2441         if (!hw->wlandev->hwremoved) {
2442                 /* Call initialize to leave the MAC in its 'reset' state */
2443                 hfa384x_cmd_initialize(hw);
2444
2445                 /* Cancel the rxurb */
2446                 usb_kill_urb(&hw->rx_urb);
2447         }
2448
2449         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2450         hw->state = HFA384x_STATE_INIT;
2451
2452         del_timer_sync(&hw->commsqual_timer);
2453
2454         /* Clear all the port status */
2455         for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2456                 hw->port_enabled[i] = 0;
2457
2458         return 0;
2459 }
2460
2461 /*----------------------------------------------------------------
2462  * hfa384x_drvr_txframe
2463  *
2464  * Takes a frame from prism2sta and queues it for transmission.
2465  *
2466  * Arguments:
2467  *      hw              device structure
2468  *      skb             packet buffer struct.  Contains an 802.11
2469  *                      data frame.
2470  *       p80211_hdr      points to the 802.11 header for the packet.
2471  * Returns:
2472  *      0               Success and more buffs available
2473  *      1               Success but no more buffs
2474  *      2               Allocation failure
2475  *      4               Buffer full or queue busy
2476  *
2477  * Side effects:
2478  *
2479  * Call context:
2480  *      interrupt
2481  *----------------------------------------------------------------
2482  */
2483 int hfa384x_drvr_txframe(struct hfa384x *hw, struct sk_buff *skb,
2484                          union p80211_hdr *p80211_hdr,
2485                          struct p80211_metawep *p80211_wep)
2486 {
2487         int usbpktlen = sizeof(struct hfa384x_tx_frame);
2488         int result;
2489         int ret;
2490         char *ptr;
2491
2492         if (hw->tx_urb.status == -EINPROGRESS) {
2493                 netdev_warn(hw->wlandev->netdev, "TX URB already in use\n");
2494                 result = 3;
2495                 goto exit;
2496         }
2497
2498         /* Build Tx frame structure */
2499         /* Set up the control field */
2500         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2501
2502         /* Setup the usb type field */
2503         hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2504
2505         /* Set up the sw_support field to identify this frame */
2506         hw->txbuff.txfrm.desc.sw_support = 0x0123;
2507
2508 /* Tx complete and Tx exception disable per dleach.  Might be causing
2509  * buf depletion
2510  */
2511 /* #define DOEXC  SLP -- doboth breaks horribly under load, doexc less so. */
2512 #if defined(DOBOTH)
2513         hw->txbuff.txfrm.desc.tx_control =
2514             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2515             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2516 #elif defined(DOEXC)
2517         hw->txbuff.txfrm.desc.tx_control =
2518             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2519             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2520 #else
2521         hw->txbuff.txfrm.desc.tx_control =
2522             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2523             HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2524 #endif
2525         cpu_to_le16s(&hw->txbuff.txfrm.desc.tx_control);
2526
2527         /* copy the header over to the txdesc */
2528         memcpy(&hw->txbuff.txfrm.desc.frame_control, p80211_hdr,
2529                sizeof(union p80211_hdr));
2530
2531         /* if we're using host WEP, increase size by IV+ICV */
2532         if (p80211_wep->data) {
2533                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2534                 usbpktlen += 8;
2535         } else {
2536                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2537         }
2538
2539         usbpktlen += skb->len;
2540
2541         /* copy over the WEP IV if we are using host WEP */
2542         ptr = hw->txbuff.txfrm.data;
2543         if (p80211_wep->data) {
2544                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2545                 ptr += sizeof(p80211_wep->iv);
2546                 memcpy(ptr, p80211_wep->data, skb->len);
2547         } else {
2548                 memcpy(ptr, skb->data, skb->len);
2549         }
2550         /* copy over the packet data */
2551         ptr += skb->len;
2552
2553         /* copy over the WEP ICV if we are using host WEP */
2554         if (p80211_wep->data)
2555                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2556
2557         /* Send the USB packet */
2558         usb_fill_bulk_urb(&hw->tx_urb, hw->usb,
2559                           hw->endp_out,
2560                           &hw->txbuff, ROUNDUP64(usbpktlen),
2561                           hfa384x_usbout_callback, hw->wlandev);
2562         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2563
2564         result = 1;
2565         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2566         if (ret != 0) {
2567                 netdev_err(hw->wlandev->netdev,
2568                            "submit_tx_urb() failed, error=%d\n", ret);
2569                 result = 3;
2570         }
2571
2572 exit:
2573         return result;
2574 }
2575
2576 void hfa384x_tx_timeout(struct wlandevice *wlandev)
2577 {
2578         struct hfa384x *hw = wlandev->priv;
2579         unsigned long flags;
2580
2581         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2582
2583         if (!hw->wlandev->hwremoved) {
2584                 int sched;
2585
2586                 sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2587                 sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2588                 if (sched)
2589                         schedule_work(&hw->usb_work);
2590         }
2591
2592         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2593 }
2594
2595 /*----------------------------------------------------------------
2596  * hfa384x_usbctlx_reaper_task
2597  *
2598  * Tasklet to delete dead CTLX objects
2599  *
2600  * Arguments:
2601  *      data    ptr to a struct hfa384x
2602  *
2603  * Returns:
2604  *
2605  * Call context:
2606  *      Interrupt
2607  *----------------------------------------------------------------
2608  */
2609 static void hfa384x_usbctlx_reaper_task(unsigned long data)
2610 {
2611         struct hfa384x *hw = (struct hfa384x *)data;
2612         struct hfa384x_usbctlx *ctlx, *temp;
2613         unsigned long flags;
2614
2615         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2616
2617         /* This list is guaranteed to be empty if someone
2618          * has unplugged the adapter.
2619          */
2620         list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.reapable, list) {
2621                 list_del(&ctlx->list);
2622                 kfree(ctlx);
2623         }
2624
2625         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2626 }
2627
2628 /*----------------------------------------------------------------
2629  * hfa384x_usbctlx_completion_task
2630  *
2631  * Tasklet to call completion handlers for returned CTLXs
2632  *
2633  * Arguments:
2634  *      data    ptr to struct hfa384x
2635  *
2636  * Returns:
2637  *      Nothing
2638  *
2639  * Call context:
2640  *      Interrupt
2641  *----------------------------------------------------------------
2642  */
2643 static void hfa384x_usbctlx_completion_task(unsigned long data)
2644 {
2645         struct hfa384x *hw = (struct hfa384x *)data;
2646         struct hfa384x_usbctlx *ctlx, *temp;
2647         unsigned long flags;
2648
2649         int reap = 0;
2650
2651         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2652
2653         /* This list is guaranteed to be empty if someone
2654          * has unplugged the adapter ...
2655          */
2656         list_for_each_entry_safe(ctlx, temp, &hw->ctlxq.completing, list) {
2657                 /* Call the completion function that this
2658                  * command was assigned, assuming it has one.
2659                  */
2660                 if (ctlx->cmdcb) {
2661                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2662                         ctlx->cmdcb(hw, ctlx);
2663                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2664
2665                         /* Make sure we don't try and complete
2666                          * this CTLX more than once!
2667                          */
2668                         ctlx->cmdcb = NULL;
2669
2670                         /* Did someone yank the adapter out
2671                          * while our list was (briefly) unlocked?
2672                          */
2673                         if (hw->wlandev->hwremoved) {
2674                                 reap = 0;
2675                                 break;
2676                         }
2677                 }
2678
2679                 /*
2680                  * "Reapable" CTLXs are ones which don't have any
2681                  * threads waiting for them to die. Hence they must
2682                  * be delivered to The Reaper!
2683                  */
2684                 if (ctlx->reapable) {
2685                         /* Move the CTLX off the "completing" list (hopefully)
2686                          * on to the "reapable" list where the reaper task
2687                          * can find it. And "reapable" means that this CTLX
2688                          * isn't sitting on a wait-queue somewhere.
2689                          */
2690                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2691                         reap = 1;
2692                 }
2693
2694                 complete(&ctlx->done);
2695         }
2696         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2697
2698         if (reap)
2699                 tasklet_schedule(&hw->reaper_bh);
2700 }
2701
2702 /*----------------------------------------------------------------
2703  * unlocked_usbctlx_cancel_async
2704  *
2705  * Mark the CTLX dead asynchronously, and ensure that the
2706  * next command on the queue is run afterwards.
2707  *
2708  * Arguments:
2709  *      hw      ptr to the struct hfa384x structure
2710  *      ctlx    ptr to a CTLX structure
2711  *
2712  * Returns:
2713  *      0       the CTLX's URB is inactive
2714  * -EINPROGRESS the URB is currently being unlinked
2715  *
2716  * Call context:
2717  *      Either process or interrupt, but presumably interrupt
2718  *----------------------------------------------------------------
2719  */
2720 static int unlocked_usbctlx_cancel_async(struct hfa384x *hw,
2721                                          struct hfa384x_usbctlx *ctlx)
2722 {
2723         int ret;
2724
2725         /*
2726          * Try to delete the URB containing our request packet.
2727          * If we succeed, then its completion handler will be
2728          * called with a status of -ECONNRESET.
2729          */
2730         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2731         ret = usb_unlink_urb(&hw->ctlx_urb);
2732
2733         if (ret != -EINPROGRESS) {
2734                 /*
2735                  * The OUT URB had either already completed
2736                  * or was still in the pending queue, so the
2737                  * URB's completion function will not be called.
2738                  * We will have to complete the CTLX ourselves.
2739                  */
2740                 ctlx->state = CTLX_REQ_FAILED;
2741                 unlocked_usbctlx_complete(hw, ctlx);
2742                 ret = 0;
2743         }
2744
2745         return ret;
2746 }
2747
2748 /*----------------------------------------------------------------
2749  * unlocked_usbctlx_complete
2750  *
2751  * A CTLX has completed.  It may have been successful, it may not
2752  * have been. At this point, the CTLX should be quiescent.  The URBs
2753  * aren't active and the timers should have been stopped.
2754  *
2755  * The CTLX is migrated to the "completing" queue, and the completing
2756  * tasklet is scheduled.
2757  *
2758  * Arguments:
2759  *      hw              ptr to a struct hfa384x structure
2760  *      ctlx            ptr to a ctlx structure
2761  *
2762  * Returns:
2763  *      nothing
2764  *
2765  * Side effects:
2766  *
2767  * Call context:
2768  *      Either, assume interrupt
2769  *----------------------------------------------------------------
2770  */
2771 static void unlocked_usbctlx_complete(struct hfa384x *hw,
2772                                       struct hfa384x_usbctlx *ctlx)
2773 {
2774         /* Timers have been stopped, and ctlx should be in
2775          * a terminal state. Retire it from the "active"
2776          * queue.
2777          */
2778         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
2779         tasklet_schedule(&hw->completion_bh);
2780
2781         switch (ctlx->state) {
2782         case CTLX_COMPLETE:
2783         case CTLX_REQ_FAILED:
2784                 /* This are the correct terminating states. */
2785                 break;
2786
2787         default:
2788                 netdev_err(hw->wlandev->netdev, "CTLX[%d] not in a terminating state(%s)\n",
2789                            le16_to_cpu(ctlx->outbuf.type),
2790                            ctlxstr(ctlx->state));
2791                 break;
2792         }                       /* switch */
2793 }
2794
2795 /*----------------------------------------------------------------
2796  * hfa384x_usbctlxq_run
2797  *
2798  * Checks to see if the head item is running.  If not, starts it.
2799  *
2800  * Arguments:
2801  *      hw      ptr to struct hfa384x
2802  *
2803  * Returns:
2804  *      nothing
2805  *
2806  * Side effects:
2807  *
2808  * Call context:
2809  *      any
2810  *----------------------------------------------------------------
2811  */
2812 static void hfa384x_usbctlxq_run(struct hfa384x *hw)
2813 {
2814         unsigned long flags;
2815
2816         /* acquire lock */
2817         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2818
2819         /* Only one active CTLX at any one time, because there's no
2820          * other (reliable) way to match the response URB to the
2821          * correct CTLX.
2822          *
2823          * Don't touch any of these CTLXs if the hardware
2824          * has been removed or the USB subsystem is stalled.
2825          */
2826         if (!list_empty(&hw->ctlxq.active) ||
2827             test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
2828                 goto unlock;
2829
2830         while (!list_empty(&hw->ctlxq.pending)) {
2831                 struct hfa384x_usbctlx *head;
2832                 int result;
2833
2834                 /* This is the first pending command */
2835                 head = list_entry(hw->ctlxq.pending.next,
2836                                   struct hfa384x_usbctlx, list);
2837
2838                 /* We need to split this off to avoid a race condition */
2839                 list_move_tail(&head->list, &hw->ctlxq.active);
2840
2841                 /* Fill the out packet */
2842                 usb_fill_bulk_urb(&hw->ctlx_urb, hw->usb,
2843                                   hw->endp_out,
2844                                   &head->outbuf, ROUNDUP64(head->outbufsize),
2845                                   hfa384x_ctlxout_callback, hw);
2846                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
2847
2848                 /* Now submit the URB and update the CTLX's state */
2849                 result = usb_submit_urb(&hw->ctlx_urb, GFP_ATOMIC);
2850                 if (result == 0) {
2851                         /* This CTLX is now running on the active queue */
2852                         head->state = CTLX_REQ_SUBMITTED;
2853
2854                         /* Start the OUT wait timer */
2855                         hw->req_timer_done = 0;
2856                         hw->reqtimer.expires = jiffies + HZ;
2857                         add_timer(&hw->reqtimer);
2858
2859                         /* Start the IN wait timer */
2860                         hw->resp_timer_done = 0;
2861                         hw->resptimer.expires = jiffies + 2 * HZ;
2862                         add_timer(&hw->resptimer);
2863
2864                         break;
2865                 }
2866
2867                 if (result == -EPIPE) {
2868                         /* The OUT pipe needs resetting, so put
2869                          * this CTLX back in the "pending" queue
2870                          * and schedule a reset ...
2871                          */
2872                         netdev_warn(hw->wlandev->netdev,
2873                                     "%s tx pipe stalled: requesting reset\n",
2874                                     hw->wlandev->netdev->name);
2875                         list_move(&head->list, &hw->ctlxq.pending);
2876                         set_bit(WORK_TX_HALT, &hw->usb_flags);
2877                         schedule_work(&hw->usb_work);
2878                         break;
2879                 }
2880
2881                 if (result == -ESHUTDOWN) {
2882                         netdev_warn(hw->wlandev->netdev, "%s urb shutdown!\n",
2883                                     hw->wlandev->netdev->name);
2884                         break;
2885                 }
2886
2887                 netdev_err(hw->wlandev->netdev, "Failed to submit CTLX[%d]: error=%d\n",
2888                            le16_to_cpu(head->outbuf.type), result);
2889                 unlocked_usbctlx_complete(hw, head);
2890         }                       /* while */
2891
2892 unlock:
2893         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2894 }
2895
2896 /*----------------------------------------------------------------
2897  * hfa384x_usbin_callback
2898  *
2899  * Callback for URBs on the BULKIN endpoint.
2900  *
2901  * Arguments:
2902  *      urb             ptr to the completed urb
2903  *
2904  * Returns:
2905  *      nothing
2906  *
2907  * Side effects:
2908  *
2909  * Call context:
2910  *      interrupt
2911  *----------------------------------------------------------------
2912  */
2913 static void hfa384x_usbin_callback(struct urb *urb)
2914 {
2915         struct wlandevice *wlandev = urb->context;
2916         struct hfa384x *hw;
2917         union hfa384x_usbin *usbin;
2918         struct sk_buff *skb = NULL;
2919         int result;
2920         int urb_status;
2921         u16 type;
2922
2923         enum USBIN_ACTION {
2924                 HANDLE,
2925                 RESUBMIT,
2926                 ABORT
2927         } action;
2928
2929         if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
2930                 goto exit;
2931
2932         hw = wlandev->priv;
2933         if (!hw)
2934                 goto exit;
2935
2936         skb = hw->rx_urb_skb;
2937         if (!skb || (skb->data != urb->transfer_buffer)) {
2938                 WARN_ON(1);
2939                 return;
2940         }
2941
2942         hw->rx_urb_skb = NULL;
2943
2944         /* Check for error conditions within the URB */
2945         switch (urb->status) {
2946         case 0:
2947                 action = HANDLE;
2948
2949                 /* Check for short packet */
2950                 if (urb->actual_length == 0) {
2951                         wlandev->netdev->stats.rx_errors++;
2952                         wlandev->netdev->stats.rx_length_errors++;
2953                         action = RESUBMIT;
2954                 }
2955                 break;
2956
2957         case -EPIPE:
2958                 netdev_warn(hw->wlandev->netdev, "%s rx pipe stalled: requesting reset\n",
2959                             wlandev->netdev->name);
2960                 if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
2961                         schedule_work(&hw->usb_work);
2962                 wlandev->netdev->stats.rx_errors++;
2963                 action = ABORT;
2964                 break;
2965
2966         case -EILSEQ:
2967         case -ETIMEDOUT:
2968         case -EPROTO:
2969                 if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
2970                     !timer_pending(&hw->throttle)) {
2971                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
2972                 }
2973                 wlandev->netdev->stats.rx_errors++;
2974                 action = ABORT;
2975                 break;
2976
2977         case -EOVERFLOW:
2978                 wlandev->netdev->stats.rx_over_errors++;
2979                 action = RESUBMIT;
2980                 break;
2981
2982         case -ENODEV:
2983         case -ESHUTDOWN:
2984                 pr_debug("status=%d, device removed.\n", urb->status);
2985                 action = ABORT;
2986                 break;
2987
2988         case -ENOENT:
2989         case -ECONNRESET:
2990                 pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
2991                 action = ABORT;
2992                 break;
2993
2994         default:
2995                 pr_debug("urb status=%d, transfer flags=0x%x\n",
2996                          urb->status, urb->transfer_flags);
2997                 wlandev->netdev->stats.rx_errors++;
2998                 action = RESUBMIT;
2999                 break;
3000         }
3001
3002         /* Save values from the RX URB before reposting overwrites it. */
3003         urb_status = urb->status;
3004         usbin = (union hfa384x_usbin *)urb->transfer_buffer;
3005
3006         if (action != ABORT) {
3007                 /* Repost the RX URB */
3008                 result = submit_rx_urb(hw, GFP_ATOMIC);
3009
3010                 if (result != 0) {
3011                         netdev_err(hw->wlandev->netdev,
3012                                    "Fatal, failed to resubmit rx_urb. error=%d\n",
3013                                    result);
3014                 }
3015         }
3016
3017         /* Handle any USB-IN packet */
3018         /* Note: the check of the sw_support field, the type field doesn't
3019          *       have bit 12 set like the docs suggest.
3020          */
3021         type = le16_to_cpu(usbin->type);
3022         if (HFA384x_USB_ISRXFRM(type)) {
3023                 if (action == HANDLE) {
3024                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3025                                 hfa384x_usbin_txcompl(wlandev, usbin);
3026                         } else {
3027                                 skb_put(skb, sizeof(*usbin));
3028                                 hfa384x_usbin_rx(wlandev, skb);
3029                                 skb = NULL;
3030                         }
3031                 }
3032                 goto exit;
3033         }
3034         if (HFA384x_USB_ISTXFRM(type)) {
3035                 if (action == HANDLE)
3036                         hfa384x_usbin_txcompl(wlandev, usbin);
3037                 goto exit;
3038         }
3039         switch (type) {
3040         case HFA384x_USB_INFOFRM:
3041                 if (action == ABORT)
3042                         goto exit;
3043                 if (action == HANDLE)
3044                         hfa384x_usbin_info(wlandev, usbin);
3045                 break;
3046
3047         case HFA384x_USB_CMDRESP:
3048         case HFA384x_USB_WRIDRESP:
3049         case HFA384x_USB_RRIDRESP:
3050         case HFA384x_USB_WMEMRESP:
3051         case HFA384x_USB_RMEMRESP:
3052                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3053                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3054                 break;
3055
3056         case HFA384x_USB_BUFAVAIL:
3057                 pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3058                          usbin->bufavail.frmlen);
3059                 break;
3060
3061         case HFA384x_USB_ERROR:
3062                 pr_debug("Received USB_ERROR packet, errortype=%d\n",
3063                          usbin->usberror.errortype);
3064                 break;
3065
3066         default:
3067                 pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3068                          usbin->type, urb_status);
3069                 break;
3070         }                       /* switch */
3071
3072 exit:
3073
3074         if (skb)
3075                 dev_kfree_skb(skb);
3076 }
3077
3078 /*----------------------------------------------------------------
3079  * hfa384x_usbin_ctlx
3080  *
3081  * We've received a URB containing a Prism2 "response" message.
3082  * This message needs to be matched up with a CTLX on the active
3083  * queue and our state updated accordingly.
3084  *
3085  * Arguments:
3086  *      hw              ptr to struct hfa384x
3087  *      usbin           ptr to USB IN packet
3088  *      urb_status      status of this Bulk-In URB
3089  *
3090  * Returns:
3091  *      nothing
3092  *
3093  * Side effects:
3094  *
3095  * Call context:
3096  *      interrupt
3097  *----------------------------------------------------------------
3098  */
3099 static void hfa384x_usbin_ctlx(struct hfa384x *hw, union hfa384x_usbin *usbin,
3100                                int urb_status)
3101 {
3102         struct hfa384x_usbctlx *ctlx;
3103         int run_queue = 0;
3104         unsigned long flags;
3105
3106 retry:
3107         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3108
3109         /* There can be only one CTLX on the active queue
3110          * at any one time, and this is the CTLX that the
3111          * timers are waiting for.
3112          */
3113         if (list_empty(&hw->ctlxq.active))
3114                 goto unlock;
3115
3116         /* Remove the "response timeout". It's possible that
3117          * we are already too late, and that the timeout is
3118          * already running. And that's just too bad for us,
3119          * because we could lose our CTLX from the active
3120          * queue here ...
3121          */
3122         if (del_timer(&hw->resptimer) == 0) {
3123                 if (hw->resp_timer_done == 0) {
3124                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3125                         goto retry;
3126                 }
3127         } else {
3128                 hw->resp_timer_done = 1;
3129         }
3130
3131         ctlx = get_active_ctlx(hw);
3132
3133         if (urb_status != 0) {
3134                 /*
3135                  * Bad CTLX, so get rid of it. But we only
3136                  * remove it from the active queue if we're no
3137                  * longer expecting the OUT URB to complete.
3138                  */
3139                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3140                         run_queue = 1;
3141         } else {
3142                 const __le16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3143
3144                 /*
3145                  * Check that our message is what we're expecting ...
3146                  */
3147                 if (ctlx->outbuf.type != intype) {
3148                         netdev_warn(hw->wlandev->netdev,
3149                                     "Expected IN[%d], received IN[%d] - ignored.\n",
3150                                     le16_to_cpu(ctlx->outbuf.type),
3151                                     le16_to_cpu(intype));
3152                         goto unlock;
3153                 }
3154
3155                 /* This URB has succeeded, so grab the data ... */
3156                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3157
3158                 switch (ctlx->state) {
3159                 case CTLX_REQ_SUBMITTED:
3160                         /*
3161                          * We have received our response URB before
3162                          * our request has been acknowledged. Odd,
3163                          * but our OUT URB is still alive...
3164                          */
3165                         pr_debug("Causality violation: please reboot Universe\n");
3166                         ctlx->state = CTLX_RESP_COMPLETE;
3167                         break;
3168
3169                 case CTLX_REQ_COMPLETE:
3170                         /*
3171                          * This is the usual path: our request
3172                          * has already been acknowledged, and
3173                          * now we have received the reply too.
3174                          */
3175                         ctlx->state = CTLX_COMPLETE;
3176                         unlocked_usbctlx_complete(hw, ctlx);
3177                         run_queue = 1;
3178                         break;
3179
3180                 default:
3181                         /*
3182                          * Throw this CTLX away ...
3183                          */
3184                         netdev_err(hw->wlandev->netdev,
3185                                    "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3186                                    le16_to_cpu(ctlx->outbuf.type),
3187                                    ctlxstr(ctlx->state));
3188                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3189                                 run_queue = 1;
3190                         break;
3191                 }               /* switch */
3192         }
3193
3194 unlock:
3195         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3196
3197         if (run_queue)
3198                 hfa384x_usbctlxq_run(hw);
3199 }
3200
3201 /*----------------------------------------------------------------
3202  * hfa384x_usbin_txcompl
3203  *
3204  * At this point we have the results of a previous transmit.
3205  *
3206  * Arguments:
3207  *      wlandev         wlan device
3208  *      usbin           ptr to the usb transfer buffer
3209  *
3210  * Returns:
3211  *      nothing
3212  *
3213  * Side effects:
3214  *
3215  * Call context:
3216  *      interrupt
3217  *----------------------------------------------------------------
3218  */
3219 static void hfa384x_usbin_txcompl(struct wlandevice *wlandev,
3220                                   union hfa384x_usbin *usbin)
3221 {
3222         u16 status;
3223
3224         status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3225
3226         /* Was there an error? */
3227         if (HFA384x_TXSTATUS_ISERROR(status))
3228                 prism2sta_ev_txexc(wlandev, status);
3229         else
3230                 prism2sta_ev_tx(wlandev, status);
3231 }
3232
3233 /*----------------------------------------------------------------
3234  * hfa384x_usbin_rx
3235  *
3236  * At this point we have a successful received a rx frame packet.
3237  *
3238  * Arguments:
3239  *      wlandev         wlan device
3240  *      usbin           ptr to the usb transfer buffer
3241  *
3242  * Returns:
3243  *      nothing
3244  *
3245  * Side effects:
3246  *
3247  * Call context:
3248  *      interrupt
3249  *----------------------------------------------------------------
3250  */
3251 static void hfa384x_usbin_rx(struct wlandevice *wlandev, struct sk_buff *skb)
3252 {
3253         union hfa384x_usbin *usbin = (union hfa384x_usbin *)skb->data;
3254         struct hfa384x *hw = wlandev->priv;
3255         int hdrlen;
3256         struct p80211_rxmeta *rxmeta;
3257         u16 data_len;
3258         u16 fc;
3259
3260         /* Byte order convert once up front. */
3261         le16_to_cpus(&usbin->rxfrm.desc.status);
3262         le32_to_cpus(&usbin->rxfrm.desc.time);
3263
3264         /* Now handle frame based on port# */
3265         switch (HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status)) {
3266         case 0:
3267                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3268
3269                 /* If exclude and we receive an unencrypted, drop it */
3270                 if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3271                     !WLAN_GET_FC_ISWEP(fc)) {
3272                         break;
3273                 }
3274
3275                 data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3276
3277                 /* How much header data do we have? */
3278                 hdrlen = p80211_headerlen(fc);
3279
3280                 /* Pull off the descriptor */
3281                 skb_pull(skb, sizeof(struct hfa384x_rx_frame));
3282
3283                 /* Now shunt the header block up against the data block
3284                  * with an "overlapping" copy
3285                  */
3286                 memmove(skb_push(skb, hdrlen),
3287                         &usbin->rxfrm.desc.frame_control, hdrlen);
3288
3289                 skb->dev = wlandev->netdev;
3290
3291                 /* And set the frame length properly */
3292                 skb_trim(skb, data_len + hdrlen);
3293
3294                 /* The prism2 series does not return the CRC */
3295                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3296
3297                 skb_reset_mac_header(skb);
3298
3299                 /* Attach the rxmeta, set some stuff */
3300                 p80211skb_rxmeta_attach(wlandev, skb);
3301                 rxmeta = p80211skb_rxmeta(skb);
3302                 rxmeta->mactime = usbin->rxfrm.desc.time;
3303                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3304                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3305                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3306
3307                 p80211netdev_rx(wlandev, skb);
3308
3309                 break;
3310
3311         case 7:
3312                 if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3313                         /* Copy to wlansnif skb */
3314                         hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3315                         dev_kfree_skb(skb);
3316                 } else {
3317                         pr_debug("Received monitor frame: FCSerr set\n");
3318                 }
3319                 break;
3320
3321         default:
3322                 netdev_warn(hw->wlandev->netdev, "Received frame on unsupported port=%d\n",
3323                             HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status));
3324                 break;
3325         }
3326 }
3327
3328 /*----------------------------------------------------------------
3329  * hfa384x_int_rxmonitor
3330  *
3331  * Helper function for int_rx.  Handles monitor frames.
3332  * Note that this function allocates space for the FCS and sets it
3333  * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3334  * higher layers expect it.  0xffffffff is used as a flag to indicate
3335  * the FCS is bogus.
3336  *
3337  * Arguments:
3338  *      wlandev         wlan device structure
3339  *      rxfrm           rx descriptor read from card in int_rx
3340  *
3341  * Returns:
3342  *      nothing
3343  *
3344  * Side effects:
3345  *      Allocates an skb and passes it up via the PF_PACKET interface.
3346  * Call context:
3347  *      interrupt
3348  *----------------------------------------------------------------
3349  */
3350 static void hfa384x_int_rxmonitor(struct wlandevice *wlandev,
3351                                   struct hfa384x_usb_rxfrm *rxfrm)
3352 {
3353         struct hfa384x_rx_frame *rxdesc = &rxfrm->desc;
3354         unsigned int hdrlen = 0;
3355         unsigned int datalen = 0;
3356         unsigned int skblen = 0;
3357         u8 *datap;
3358         u16 fc;
3359         struct sk_buff *skb;
3360         struct hfa384x *hw = wlandev->priv;
3361
3362         /* Remember the status, time, and data_len fields are in host order */
3363         /* Figure out how big the frame is */
3364         fc = le16_to_cpu(rxdesc->frame_control);
3365         hdrlen = p80211_headerlen(fc);
3366         datalen = le16_to_cpu(rxdesc->data_len);
3367
3368         /* Allocate an ind message+framesize skb */
3369         skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3370
3371         /* sanity check the length */
3372         if (skblen >
3373             (sizeof(struct p80211_caphdr) +
3374              WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3375                 pr_debug("overlen frm: len=%zd\n",
3376                          skblen - sizeof(struct p80211_caphdr));
3377         }
3378
3379         skb = dev_alloc_skb(skblen);
3380         if (!skb)
3381                 return;
3382
3383         /* only prepend the prism header if in the right mode */
3384         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3385             (hw->sniffhdr != 0)) {
3386                 struct p80211_caphdr *caphdr;
3387                 /* The NEW header format! */
3388                 datap = skb_put(skb, sizeof(struct p80211_caphdr));
3389                 caphdr = (struct p80211_caphdr *)datap;
3390
3391                 caphdr->version = htonl(P80211CAPTURE_VERSION);
3392                 caphdr->length = htonl(sizeof(struct p80211_caphdr));
3393                 caphdr->mactime = __cpu_to_be64(rxdesc->time * 1000);
3394                 caphdr->hosttime = __cpu_to_be64(jiffies);
3395                 caphdr->phytype = htonl(4);     /* dss_dot11_b */
3396                 caphdr->channel = htonl(hw->sniff_channel);
3397                 caphdr->datarate = htonl(rxdesc->rate);
3398                 caphdr->antenna = htonl(0);     /* unknown */
3399                 caphdr->priority = htonl(0);    /* unknown */
3400                 caphdr->ssi_type = htonl(3);    /* rssi_raw */
3401                 caphdr->ssi_signal = htonl(rxdesc->signal);
3402                 caphdr->ssi_noise = htonl(rxdesc->silence);
3403                 caphdr->preamble = htonl(0);    /* unknown */
3404                 caphdr->encoding = htonl(1);    /* cck */
3405         }
3406
3407         /* Copy the 802.11 header to the skb
3408          * (ctl frames may be less than a full header)
3409          */
3410         skb_put_data(skb, &rxdesc->frame_control, hdrlen);
3411
3412         /* If any, copy the data from the card to the skb */
3413         if (datalen > 0) {
3414                 datap = skb_put_data(skb, rxfrm->data, datalen);
3415
3416                 /* check for unencrypted stuff if WEP bit set. */
3417                 if (*(datap - hdrlen + 1) & 0x40)       /* wep set */
3418                         if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3419                                 /* clear wep; it's the 802.2 header! */
3420                                 *(datap - hdrlen + 1) &= 0xbf;
3421         }
3422
3423         if (hw->sniff_fcs) {
3424                 /* Set the FCS */
3425                 datap = skb_put(skb, WLAN_CRC_LEN);
3426                 memset(datap, 0xff, WLAN_CRC_LEN);
3427         }
3428
3429         /* pass it back up */
3430         p80211netdev_rx(wlandev, skb);
3431 }
3432
3433 /*----------------------------------------------------------------
3434  * hfa384x_usbin_info
3435  *
3436  * At this point we have a successful received a Prism2 info frame.
3437  *
3438  * Arguments:
3439  *      wlandev         wlan device
3440  *      usbin           ptr to the usb transfer buffer
3441  *
3442  * Returns:
3443  *      nothing
3444  *
3445  * Side effects:
3446  *
3447  * Call context:
3448  *      interrupt
3449  *----------------------------------------------------------------
3450  */
3451 static void hfa384x_usbin_info(struct wlandevice *wlandev,
3452                                union hfa384x_usbin *usbin)
3453 {
3454         le16_to_cpus(&usbin->infofrm.info.framelen);
3455         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3456 }
3457
3458 /*----------------------------------------------------------------
3459  * hfa384x_usbout_callback
3460  *
3461  * Callback for URBs on the BULKOUT endpoint.
3462  *
3463  * Arguments:
3464  *      urb             ptr to the completed urb
3465  *
3466  * Returns:
3467  *      nothing
3468  *
3469  * Side effects:
3470  *
3471  * Call context:
3472  *      interrupt
3473  *----------------------------------------------------------------
3474  */
3475 static void hfa384x_usbout_callback(struct urb *urb)
3476 {
3477         struct wlandevice *wlandev = urb->context;
3478
3479 #ifdef DEBUG_USB
3480         dbprint_urb(urb);
3481 #endif
3482
3483         if (wlandev && wlandev->netdev) {
3484                 switch (urb->status) {
3485                 case 0:
3486                         prism2sta_ev_alloc(wlandev);
3487                         break;
3488
3489                 case -EPIPE: {
3490                         struct hfa384x *hw = wlandev->priv;
3491
3492                         netdev_warn(hw->wlandev->netdev,
3493                                     "%s tx pipe stalled: requesting reset\n",
3494                                     wlandev->netdev->name);
3495                         if (!test_and_set_bit(WORK_TX_HALT, &hw->usb_flags))
3496                                 schedule_work(&hw->usb_work);
3497                         wlandev->netdev->stats.tx_errors++;
3498                         break;
3499                 }
3500
3501                 case -EPROTO:
3502                 case -ETIMEDOUT:
3503                 case -EILSEQ: {
3504                         struct hfa384x *hw = wlandev->priv;
3505
3506                         if (!test_and_set_bit(THROTTLE_TX, &hw->usb_flags) &&
3507                             !timer_pending(&hw->throttle)) {
3508                                 mod_timer(&hw->throttle,
3509                                           jiffies + THROTTLE_JIFFIES);
3510                         }
3511                         wlandev->netdev->stats.tx_errors++;
3512                         netif_stop_queue(wlandev->netdev);
3513                         break;
3514                 }
3515
3516                 case -ENOENT:
3517                 case -ESHUTDOWN:
3518                         /* Ignorable errors */
3519                         break;
3520
3521                 default:
3522                         netdev_info(wlandev->netdev, "unknown urb->status=%d\n",
3523                                     urb->status);
3524                         wlandev->netdev->stats.tx_errors++;
3525                         break;
3526                 }               /* switch */
3527         }
3528 }
3529
3530 /*----------------------------------------------------------------
3531  * hfa384x_ctlxout_callback
3532  *
3533  * Callback for control data on the BULKOUT endpoint.
3534  *
3535  * Arguments:
3536  *      urb             ptr to the completed urb
3537  *
3538  * Returns:
3539  * nothing
3540  *
3541  * Side effects:
3542  *
3543  * Call context:
3544  * interrupt
3545  *----------------------------------------------------------------
3546  */
3547 static void hfa384x_ctlxout_callback(struct urb *urb)
3548 {
3549         struct hfa384x *hw = urb->context;
3550         int delete_resptimer = 0;
3551         int timer_ok = 1;
3552         int run_queue = 0;
3553         struct hfa384x_usbctlx *ctlx;
3554         unsigned long flags;
3555
3556         pr_debug("urb->status=%d\n", urb->status);
3557 #ifdef DEBUG_USB
3558         dbprint_urb(urb);
3559 #endif
3560         if ((urb->status == -ESHUTDOWN) ||
3561             (urb->status == -ENODEV) || !hw)
3562                 return;
3563
3564 retry:
3565         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3566
3567         /*
3568          * Only one CTLX at a time on the "active" list, and
3569          * none at all if we are unplugged. However, we can
3570          * rely on the disconnect function to clean everything
3571          * up if someone unplugged the adapter.
3572          */
3573         if (list_empty(&hw->ctlxq.active)) {
3574                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3575                 return;
3576         }
3577
3578         /*
3579          * Having something on the "active" queue means
3580          * that we have timers to worry about ...
3581          */
3582         if (del_timer(&hw->reqtimer) == 0) {
3583                 if (hw->req_timer_done == 0) {
3584                         /*
3585                          * This timer was actually running while we
3586                          * were trying to delete it. Let it terminate
3587                          * gracefully instead.
3588                          */
3589                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3590                         goto retry;
3591                 }
3592         } else {
3593                 hw->req_timer_done = 1;
3594         }
3595
3596         ctlx = get_active_ctlx(hw);
3597
3598         if (urb->status == 0) {
3599                 /* Request portion of a CTLX is successful */
3600                 switch (ctlx->state) {
3601                 case CTLX_REQ_SUBMITTED:
3602                         /* This OUT-ACK received before IN */
3603                         ctlx->state = CTLX_REQ_COMPLETE;
3604                         break;
3605
3606                 case CTLX_RESP_COMPLETE:
3607                         /* IN already received before this OUT-ACK,
3608                          * so this command must now be complete.
3609                          */
3610                         ctlx->state = CTLX_COMPLETE;
3611                         unlocked_usbctlx_complete(hw, ctlx);
3612                         run_queue = 1;
3613                         break;
3614
3615                 default:
3616                         /* This is NOT a valid CTLX "success" state! */
3617                         netdev_err(hw->wlandev->netdev,
3618                                    "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3619                                    le16_to_cpu(ctlx->outbuf.type),
3620                                    ctlxstr(ctlx->state), urb->status);
3621                         break;
3622                 }               /* switch */
3623         } else {
3624                 /* If the pipe has stalled then we need to reset it */
3625                 if ((urb->status == -EPIPE) &&
3626                     !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3627                         netdev_warn(hw->wlandev->netdev,
3628                                     "%s tx pipe stalled: requesting reset\n",
3629                                     hw->wlandev->netdev->name);
3630                         schedule_work(&hw->usb_work);
3631                 }
3632
3633                 /* If someone cancels the OUT URB then its status
3634                  * should be either -ECONNRESET or -ENOENT.
3635                  */
3636                 ctlx->state = CTLX_REQ_FAILED;
3637                 unlocked_usbctlx_complete(hw, ctlx);
3638                 delete_resptimer = 1;
3639                 run_queue = 1;
3640         }
3641
3642 delresp:
3643         if (delete_resptimer) {
3644                 timer_ok = del_timer(&hw->resptimer);
3645                 if (timer_ok != 0)
3646                         hw->resp_timer_done = 1;
3647         }
3648
3649         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3650
3651         if (!timer_ok && (hw->resp_timer_done == 0)) {
3652                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
3653                 goto delresp;
3654         }
3655
3656         if (run_queue)
3657                 hfa384x_usbctlxq_run(hw);
3658 }
3659
3660 /*----------------------------------------------------------------
3661  * hfa384x_usbctlx_reqtimerfn
3662  *
3663  * Timer response function for CTLX request timeouts.  If this
3664  * function is called, it means that the callback for the OUT
3665  * URB containing a Prism2.x XXX_Request was never called.
3666  *
3667  * Arguments:
3668  *      data            a ptr to the struct hfa384x
3669  *
3670  * Returns:
3671  *      nothing
3672  *
3673  * Side effects:
3674  *
3675  * Call context:
3676  *      interrupt
3677  *----------------------------------------------------------------
3678  */
3679 static void hfa384x_usbctlx_reqtimerfn(struct timer_list *t)
3680 {
3681         struct hfa384x *hw = from_timer(hw, t, reqtimer);
3682         unsigned long flags;
3683
3684         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3685
3686         hw->req_timer_done = 1;
3687
3688         /* Removing the hardware automatically empties
3689          * the active list ...
3690          */
3691         if (!list_empty(&hw->ctlxq.active)) {
3692                 /*
3693                  * We must ensure that our URB is removed from
3694                  * the system, if it hasn't already expired.
3695                  */
3696                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3697                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3698                         struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3699
3700                         ctlx->state = CTLX_REQ_FAILED;
3701
3702                         /* This URB was active, but has now been
3703                          * cancelled. It will now have a status of
3704                          * -ECONNRESET in the callback function.
3705                          *
3706                          * We are cancelling this CTLX, so we're
3707                          * not going to need to wait for a response.
3708                          * The URB's callback function will check
3709                          * that this timer is truly dead.
3710                          */
3711                         if (del_timer(&hw->resptimer) != 0)
3712                                 hw->resp_timer_done = 1;
3713                 }
3714         }
3715
3716         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3717 }
3718
3719 /*----------------------------------------------------------------
3720  * hfa384x_usbctlx_resptimerfn
3721  *
3722  * Timer response function for CTLX response timeouts.  If this
3723  * function is called, it means that the callback for the IN
3724  * URB containing a Prism2.x XXX_Response was never called.
3725  *
3726  * Arguments:
3727  *      data            a ptr to the struct hfa384x
3728  *
3729  * Returns:
3730  *      nothing
3731  *
3732  * Side effects:
3733  *
3734  * Call context:
3735  *      interrupt
3736  *----------------------------------------------------------------
3737  */
3738 static void hfa384x_usbctlx_resptimerfn(struct timer_list *t)
3739 {
3740         struct hfa384x *hw = from_timer(hw, t, resptimer);
3741         unsigned long flags;
3742
3743         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3744
3745         hw->resp_timer_done = 1;
3746
3747         /* The active list will be empty if the
3748          * adapter has been unplugged ...
3749          */
3750         if (!list_empty(&hw->ctlxq.active)) {
3751                 struct hfa384x_usbctlx *ctlx = get_active_ctlx(hw);
3752
3753                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3754                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3755                         hfa384x_usbctlxq_run(hw);
3756                         return;
3757                 }
3758         }
3759         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3760 }
3761
3762 /*----------------------------------------------------------------
3763  * hfa384x_usb_throttlefn
3764  *
3765  *
3766  * Arguments:
3767  *      data    ptr to hw
3768  *
3769  * Returns:
3770  *      Nothing
3771  *
3772  * Side effects:
3773  *
3774  * Call context:
3775  *      Interrupt
3776  *----------------------------------------------------------------
3777  */
3778 static void hfa384x_usb_throttlefn(struct timer_list *t)
3779 {
3780         struct hfa384x *hw = from_timer(hw, t, throttle);
3781         unsigned long flags;
3782
3783         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3784
3785         /*
3786          * We need to check BOTH the RX and the TX throttle controls,
3787          * so we use the bitwise OR instead of the logical OR.
3788          */
3789         pr_debug("flags=0x%lx\n", hw->usb_flags);
3790         if (!hw->wlandev->hwremoved &&
3791             ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
3792               !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) |
3793              (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
3794               !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
3795             )) {
3796                 schedule_work(&hw->usb_work);
3797         }
3798
3799         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3800 }
3801
3802 /*----------------------------------------------------------------
3803  * hfa384x_usbctlx_submit
3804  *
3805  * Called from the doxxx functions to submit a CTLX to the queue
3806  *
3807  * Arguments:
3808  *      hw              ptr to the hw struct
3809  *      ctlx            ctlx structure to enqueue
3810  *
3811  * Returns:
3812  *      -ENODEV if the adapter is unplugged
3813  *      0
3814  *
3815  * Side effects:
3816  *
3817  * Call context:
3818  *      process or interrupt
3819  *----------------------------------------------------------------
3820  */
3821 static int hfa384x_usbctlx_submit(struct hfa384x *hw,
3822                                   struct hfa384x_usbctlx *ctlx)
3823 {
3824         unsigned long flags;
3825
3826         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3827
3828         if (hw->wlandev->hwremoved) {
3829                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3830                 return -ENODEV;
3831         }
3832
3833         ctlx->state = CTLX_PENDING;
3834         list_add_tail(&ctlx->list, &hw->ctlxq.pending);
3835         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3836         hfa384x_usbctlxq_run(hw);
3837
3838         return 0;
3839 }
3840
3841 /*----------------------------------------------------------------
3842  * hfa384x_isgood_pdrcore
3843  *
3844  * Quick check of PDR codes.
3845  *
3846  * Arguments:
3847  *      pdrcode         PDR code number (host order)
3848  *
3849  * Returns:
3850  *      zero            not good.
3851  *      one             is good.
3852  *
3853  * Side effects:
3854  *
3855  * Call context:
3856  *----------------------------------------------------------------
3857  */
3858 static int hfa384x_isgood_pdrcode(u16 pdrcode)
3859 {
3860         switch (pdrcode) {
3861         case HFA384x_PDR_END_OF_PDA:
3862         case HFA384x_PDR_PCB_PARTNUM:
3863         case HFA384x_PDR_PDAVER:
3864         case HFA384x_PDR_NIC_SERIAL:
3865         case HFA384x_PDR_MKK_MEASUREMENTS:
3866         case HFA384x_PDR_NIC_RAMSIZE:
3867         case HFA384x_PDR_MFISUPRANGE:
3868         case HFA384x_PDR_CFISUPRANGE:
3869         case HFA384x_PDR_NICID:
3870         case HFA384x_PDR_MAC_ADDRESS:
3871         case HFA384x_PDR_REGDOMAIN:
3872         case HFA384x_PDR_ALLOWED_CHANNEL:
3873         case HFA384x_PDR_DEFAULT_CHANNEL:
3874         case HFA384x_PDR_TEMPTYPE:
3875         case HFA384x_PDR_IFR_SETTING:
3876         case HFA384x_PDR_RFR_SETTING:
3877         case HFA384x_PDR_HFA3861_BASELINE:
3878         case HFA384x_PDR_HFA3861_SHADOW:
3879         case HFA384x_PDR_HFA3861_IFRF:
3880         case HFA384x_PDR_HFA3861_CHCALSP:
3881         case HFA384x_PDR_HFA3861_CHCALI:
3882         case HFA384x_PDR_3842_NIC_CONFIG:
3883         case HFA384x_PDR_USB_ID:
3884         case HFA384x_PDR_PCI_ID:
3885         case HFA384x_PDR_PCI_IFCONF:
3886         case HFA384x_PDR_PCI_PMCONF:
3887         case HFA384x_PDR_RFENRGY:
3888         case HFA384x_PDR_HFA3861_MANF_TESTSP:
3889         case HFA384x_PDR_HFA3861_MANF_TESTI:
3890                 /* code is OK */
3891                 return 1;
3892         default:
3893                 if (pdrcode < 0x1000) {
3894                         /* code is OK, but we don't know exactly what it is */
3895                         pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
3896                                  pdrcode);
3897                         return 1;
3898                 }
3899                 break;
3900         }
3901         /* bad code */
3902         pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
3903                  pdrcode);
3904         return 0;
3905 }