drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invocations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They call copy_[to|from]_bap() and
  66 *                       cmd_access(). These functions operate on the
  67 *                       RIDs and buffers without validation. The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 #include <linux/module.h>
 114 #include <linux/kernel.h>
 115 #include <linux/sched.h>
 116 #include <linux/types.h>
 117 #include <linux/slab.h>
 118 #include <linux/wireless.h>
 119 #include <linux/netdevice.h>
 120 #include <linux/timer.h>
 121 #include <linux/io.h>
 122 #include <linux/delay.h>
 123 #include <asm/byteorder.h>
 124 #include <linux/bitops.h>
 125 #include <linux/list.h>
 126 #include <linux/usb.h>
 127 #include <linux/byteorder/generic.h>
 128
 129 #define SUBMIT_URB(u, f)  usb_submit_urb(u, f)
 130
 131 #include "p80211types.h"
 132 #include "p80211hdr.h"
 133 #include "p80211mgmt.h"
 134 #include "p80211conv.h"
 135 #include "p80211msg.h"
 136 #include "p80211netdev.h"
 137 #include "p80211req.h"
 138 #include "p80211metadef.h"
 139 #include "p80211metastruct.h"
 140 #include "hfa384x.h"
 141 #include "prism2mgmt.h"
 142
 143 enum cmd_mode {
 144         DOWAIT = 0,
 145         DOASYNC
 146 };
 147
 148 #define THROTTLE_JIFFIES        (HZ/8)
 149 #define URB_ASYNC_UNLINK 0
 150 #define USB_QUEUE_BULK 0
 151
 152 #define ROUNDUP64(a) (((a)+63)&~63)
 153
 154 #ifdef DEBUG_USB
 155 static void dbprint_urb(struct urb *urb);
 156 #endif
 157
 158 static void
 159 hfa384x_int_rxmonitor(wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm);
 160
 161 static void hfa384x_usb_defer(struct work_struct *data);
 162
 163 static int submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 164
 165 static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 166
 167 /*---------------------------------------------------*/
 168 /* Callbacks */
 169 static void hfa384x_usbout_callback(struct urb *urb);
 170 static void hfa384x_ctlxout_callback(struct urb *urb);
 171 static void hfa384x_usbin_callback(struct urb *urb);
 172
 173 static void
 174 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 175
 176 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 177
 178 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 179
 180 static void
 181 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 182
 183 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 184                                int urb_status);
 185
 186 /*---------------------------------------------------*/
 187 /* Functions to support the prism2 usb command queue */
 188
 189 static void hfa384x_usbctlxq_run(hfa384x_t *hw);
 190
 191 static void hfa384x_usbctlx_reqtimerfn(unsigned long data);
 192
 193 static void hfa384x_usbctlx_resptimerfn(unsigned long data);
 194
 195 static void hfa384x_usb_throttlefn(unsigned long data);
 196
 197 static void hfa384x_usbctlx_completion_task(unsigned long data);
 198
 199 static void hfa384x_usbctlx_reaper_task(unsigned long data);
 200
 201 static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 202
 203 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 204
 205 struct usbctlx_completor {
 206         int (*complete)(struct usbctlx_completor *);
 207 };
 208
 209 static int
 210 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 211                               hfa384x_usbctlx_t *ctlx,
 212                               struct usbctlx_completor *completor);
 213
 214 static int
 215 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 216
 217 static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 218
 219 static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 220
 221 static int
 222 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 223                    hfa384x_cmdresult_t *result);
 224
 225 static void
 226 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 227                        hfa384x_rridresult_t *result);
 228
 229 /*---------------------------------------------------*/
 230 /* Low level req/resp CTLX formatters and submitters */
 231 static int
 232 hfa384x_docmd(hfa384x_t *hw,
 233               enum cmd_mode mode,
 234               hfa384x_metacmd_t *cmd,
 235               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 236
 237 static int
 238 hfa384x_dorrid(hfa384x_t *hw,
 239                enum cmd_mode mode,
 240                u16 rid,
 241                void *riddata,
 242                unsigned int riddatalen,
 243                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 244
 245 static int
 246 hfa384x_dowrid(hfa384x_t *hw,
 247                enum cmd_mode mode,
 248                u16 rid,
 249                void *riddata,
 250                unsigned int riddatalen,
 251                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 252
 253 static int
 254 hfa384x_dormem(hfa384x_t *hw,
 255                enum cmd_mode mode,
 256                u16 page,
 257                u16 offset,
 258                void *data,
 259                unsigned int len,
 260                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 261
 262 static int
 263 hfa384x_dowmem(hfa384x_t *hw,
 264                enum cmd_mode mode,
 265                u16 page,
 266                u16 offset,
 267                void *data,
 268                unsigned int len,
 269                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 270
 271 static int hfa384x_isgood_pdrcode(u16 pdrcode);
 272
 273 static inline const char *ctlxstr(CTLX_STATE s)
 274 {
 275         static const char * const ctlx_str[] = {
 276                 "Initial state",
 277                 "Complete",
 278                 "Request failed",
 279                 "Request pending",
 280                 "Request packet submitted",
 281                 "Request packet completed",
 282                 "Response packet completed"
 283         };
 284
 285         return ctlx_str[s];
 286 };
 287
 288 static inline hfa384x_usbctlx_t *get_active_ctlx(hfa384x_t *hw)
 289 {
 290         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 291 }
 292
 293 #ifdef DEBUG_USB
 294 void dbprint_urb(struct urb *urb)
 295 {
 296         pr_debug("urb->pipe=0x%08x\n", urb->pipe);
 297         pr_debug("urb->status=0x%08x\n", urb->status);
 298         pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 299         pr_debug("urb->transfer_buffer=0x%08x\n",
 300                  (unsigned int)urb->transfer_buffer);
 301         pr_debug("urb->transfer_buffer_length=0x%08x\n",
 302                  urb->transfer_buffer_length);
 303         pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
 304         pr_debug("urb->bandwidth=0x%08x\n", urb->bandwidth);
 305         pr_debug("urb->setup_packet(ctl)=0x%08x\n",
 306                  (unsigned int)urb->setup_packet);
 307         pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 308         pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
 309         pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
 310         pr_debug("urb->timeout=0x%08x\n", urb->timeout);
 311         pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
 312         pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
 313 }
 314 #endif
 315
 316 /*----------------------------------------------------------------
 317 * submit_rx_urb
 318 *
 319 * Listen for input data on the BULK-IN pipe. If the pipe has
 320 * stalled then schedule it to be reset.
 321 *
 322 * Arguments:
 323 *       hw              device struct
 324 *       memflags        memory allocation flags
 325 *
 326 * Returns:
 327 *       error code from submission
 328 *
 329 * Call context:
 330 *       Any
 331 ----------------------------------------------------------------*/
 332 static int submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 333 {
 334         struct sk_buff *skb;
 335         int result;
 336
 337         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 338         if (skb == NULL) {
 339                 result = -ENOMEM;
 340                 goto done;
 341         }
 342
 343         /* Post the IN urb */
 344         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 345                           hw->endp_in,
 346                           skb->data, sizeof(hfa384x_usbin_t),
 347                           hfa384x_usbin_callback, hw->wlandev);
 348
 349         hw->rx_urb_skb = skb;
 350
 351         result = -ENOLINK;
 352         if (!hw->wlandev->hwremoved &&
 353             !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 354                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 355
 356                 /* Check whether we need to reset the RX pipe */
 357                 if (result == -EPIPE) {
 358                         netdev_warn(hw->wlandev->netdev,
 359                                     "%s rx pipe stalled: requesting reset\n",
 360                                     hw->wlandev->netdev->name);
 361                         if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
 362                                 schedule_work(&hw->usb_work);
 363                 }
 364         }
 365
 366         /* Don't leak memory if anything should go wrong */
 367         if (result != 0) {
 368                 dev_kfree_skb(skb);
 369                 hw->rx_urb_skb = NULL;
 370         }
 371
 372 done:
 373         return result;
 374 }
 375
 376 /*----------------------------------------------------------------
 377 * submit_tx_urb
 378 *
 379 * Prepares and submits the URB of transmitted data. If the
 380 * submission fails then it will schedule the output pipe to
 381 * be reset.
 382 *
 383 * Arguments:
 384 *       hw              device struct
 385 *       tx_urb          URB of data for transmission
 386 *       memflags        memory allocation flags
 387 *
 388 * Returns:
 389 *       error code from submission
 390 *
 391 * Call context:
 392 *       Any
 393 ----------------------------------------------------------------*/
 394 static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 395 {
 396         struct net_device *netdev = hw->wlandev->netdev;
 397         int result;
 398
 399         result = -ENOLINK;
 400         if (netif_running(netdev)) {
 401                 if (!hw->wlandev->hwremoved &&
 402                     !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 403                         result = SUBMIT_URB(tx_urb, memflags);
 404
 405                         /* Test whether we need to reset the TX pipe */
 406                         if (result == -EPIPE) {
 407                                 netdev_warn(hw->wlandev->netdev,
 408                                             "%s tx pipe stalled: requesting reset\n",
 409                                             netdev->name);
 410                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 411                                 schedule_work(&hw->usb_work);
 412                         } else if (result == 0) {
 413                                 netif_stop_queue(netdev);
 414                         }
 415                 }
 416         }
 417
 418         return result;
 419 }
 420
 421 /*----------------------------------------------------------------
 422 * hfa394x_usb_defer
 423 *
 424 * There are some things that the USB stack cannot do while
 425 * in interrupt context, so we arrange this function to run
 426 * in process context.
 427 *
 428 * Arguments:
 429 *       hw      device structure
 430 *
 431 * Returns:
 432 *       nothing
 433 *
 434 * Call context:
 435 *       process (by design)
 436 ----------------------------------------------------------------*/
 437 static void hfa384x_usb_defer(struct work_struct *data)
 438 {
 439         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 440         struct net_device *netdev = hw->wlandev->netdev;
 441
 442         /* Don't bother trying to reset anything if the plug
 443          * has been pulled ...
 444          */
 445         if (hw->wlandev->hwremoved)
 446                 return;
 447
 448         /* Reception has stopped: try to reset the input pipe */
 449         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 450                 int ret;
 451
 452                 usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
 453
 454                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 455                 if (ret != 0) {
 456                         netdev_err(hw->wlandev->netdev,
 457                                    "Failed to clear rx pipe for %s: err=%d\n",
 458                                    netdev->name, ret);
 459                 } else {
 460                         netdev_info(hw->wlandev->netdev, "%s rx pipe reset complete.\n",
 461                                     netdev->name);
 462                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 463                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 464                 }
 465         }
 466
 467         /* Resume receiving data back from the device. */
 468         if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
 469                 int ret;
 470
 471                 ret = submit_rx_urb(hw, GFP_KERNEL);
 472                 if (ret != 0) {
 473                         netdev_err(hw->wlandev->netdev,
 474                                    "Failed to resume %s rx pipe.\n",
 475                                    netdev->name);
 476                 } else {
 477                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 478                 }
 479         }
 480
 481         /* Transmission has stopped: try to reset the output pipe */
 482         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 483                 int ret;
 484
 485                 usb_kill_urb(&hw->tx_urb);
 486                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 487                 if (ret != 0) {
 488                         netdev_err(hw->wlandev->netdev,
 489                                    "Failed to clear tx pipe for %s: err=%d\n",
 490                                    netdev->name, ret);
 491                 } else {
 492                         netdev_info(hw->wlandev->netdev, "%s tx pipe reset complete.\n",
 493                                     netdev->name);
 494                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 495                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 496
 497                         /* Stopping the BULK-OUT pipe also blocked
 498                          * us from sending any more CTLX URBs, so
 499                          * we need to re-run our queue ...
 500                          */
 501                         hfa384x_usbctlxq_run(hw);
 502                 }
 503         }
 504
 505         /* Resume transmitting. */
 506         if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
 507                 netif_wake_queue(hw->wlandev->netdev);
 508 }
 509
 510 /*----------------------------------------------------------------
 511 * hfa384x_create
 512 *
 513 * Sets up the hfa384x_t data structure for use.  Note this
 514 * does _not_ initialize the actual hardware, just the data structures
 515 * we use to keep track of its state.
 516 *
 517 * Arguments:
 518 *       hw              device structure
 519 *       irq             device irq number
 520 *       iobase          i/o base address for register access
 521 *       membase         memory base address for register access
 522 *
 523 * Returns:
 524 *       nothing
 525 *
 526 * Side effects:
 527 *
 528 * Call context:
 529 *       process
 530 ----------------------------------------------------------------*/
 531 void hfa384x_create(hfa384x_t *hw, struct usb_device *usb)
 532 {
 533         hw->usb = usb;
 534
 535         /* Set up the waitq */
 536         init_waitqueue_head(&hw->cmdq);
 537
 538         /* Initialize the command queue */
 539         spin_lock_init(&hw->ctlxq.lock);
 540         INIT_LIST_HEAD(&hw->ctlxq.pending);
 541         INIT_LIST_HEAD(&hw->ctlxq.active);
 542         INIT_LIST_HEAD(&hw->ctlxq.completing);
 543         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 544
 545         /* Initialize the authentication queue */
 546         skb_queue_head_init(&hw->authq);
 547
 548         tasklet_init(&hw->reaper_bh,
 549                      hfa384x_usbctlx_reaper_task, (unsigned long)hw);
 550         tasklet_init(&hw->completion_bh,
 551                      hfa384x_usbctlx_completion_task, (unsigned long)hw);
 552         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 553         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 554
 555         setup_timer(&hw->throttle, hfa384x_usb_throttlefn, (unsigned long)hw);
 556
 557         setup_timer(&hw->resptimer, hfa384x_usbctlx_resptimerfn,
 558                     (unsigned long)hw);
 559
 560         setup_timer(&hw->reqtimer, hfa384x_usbctlx_reqtimerfn,
 561                     (unsigned long)hw);
 562
 563         usb_init_urb(&hw->rx_urb);
 564         usb_init_urb(&hw->tx_urb);
 565         usb_init_urb(&hw->ctlx_urb);
 566
 567         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 568         hw->state = HFA384x_STATE_INIT;
 569
 570         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 571         setup_timer(&hw->commsqual_timer, prism2sta_commsqual_timer,
 572                     (unsigned long)hw);
 573 }
 574
 575 /*----------------------------------------------------------------
 576 * hfa384x_destroy
 577 *
 578 * Partner to hfa384x_create().  This function cleans up the hw
 579 * structure so that it can be freed by the caller using a simple
 580 * kfree.  Currently, this function is just a placeholder.  If, at some
 581 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 582 * kfree, this is where it should be done.  Note that if this function
 583 * is called on a _running_ hw structure, the drvr_stop() function is
 584 * called.
 585 *
 586 * Arguments:
 587 *       hw              device structure
 588 *
 589 * Returns:
 590 *       nothing, this function is not allowed to fail.
 591 *
 592 * Side effects:
 593 *
 594 * Call context:
 595 *       process
 596 ----------------------------------------------------------------*/
 597 void hfa384x_destroy(hfa384x_t *hw)
 598 {
 599         struct sk_buff *skb;
 600
 601         if (hw->state == HFA384x_STATE_RUNNING)
 602                 hfa384x_drvr_stop(hw);
 603         hw->state = HFA384x_STATE_PREINIT;
 604
 605         kfree(hw->scanresults);
 606         hw->scanresults = NULL;
 607
 608         /* Now to clean out the auth queue */
 609         while ((skb = skb_dequeue(&hw->authq)))
 610                 dev_kfree_skb(skb);
 611 }
 612
 613 static hfa384x_usbctlx_t *usbctlx_alloc(void)
 614 {
 615         hfa384x_usbctlx_t *ctlx;
 616
 617         ctlx = kzalloc(sizeof(*ctlx),
 618                        in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 619         if (ctlx != NULL)
 620                 init_completion(&ctlx->done);
 621
 622         return ctlx;
 623 }
 624
 625 static int
 626 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 627                    hfa384x_cmdresult_t *result)
 628 {
 629         result->status = le16_to_cpu(cmdresp->status);
 630         result->resp0 = le16_to_cpu(cmdresp->resp0);
 631         result->resp1 = le16_to_cpu(cmdresp->resp1);
 632         result->resp2 = le16_to_cpu(cmdresp->resp2);
 633
 634         pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 635                  result->status, result->resp0, result->resp1, result->resp2);
 636
 637         return result->status & HFA384x_STATUS_RESULT;
 638 }
 639
 640 static void
 641 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 642                        hfa384x_rridresult_t *result)
 643 {
 644         result->rid = le16_to_cpu(rridresp->rid);
 645         result->riddata = rridresp->data;
 646         result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
 647 }
 648
 649 /*----------------------------------------------------------------
 650 * Completor object:
 651 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 652 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 653 ----------------------------------------------------------------*/
 654 struct usbctlx_cmd_completor {
 655         struct usbctlx_completor head;
 656
 657         const hfa384x_usb_cmdresp_t *cmdresp;
 658         hfa384x_cmdresult_t *result;
 659 };
 660
 661 static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
 662 {
 663         struct usbctlx_cmd_completor *complete;
 664
 665         complete = (struct usbctlx_cmd_completor *)head;
 666         return usbctlx_get_status(complete->cmdresp, complete->result);
 667 }
 668
 669 static inline struct usbctlx_completor *init_cmd_completor(
 670                                                 struct usbctlx_cmd_completor
 671                                                         *completor,
 672                                                 const hfa384x_usb_cmdresp_t
 673                                                         *cmdresp,
 674                                                 hfa384x_cmdresult_t *result)
 675 {
 676         completor->head.complete = usbctlx_cmd_completor_fn;
 677         completor->cmdresp = cmdresp;
 678         completor->result = result;
 679         return &(completor->head);
 680 }
 681
 682 /*----------------------------------------------------------------
 683 * Completor object:
 684 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 685 * when processing a CTLX that reads a RID.
 686 ----------------------------------------------------------------*/
 687 struct usbctlx_rrid_completor {
 688         struct usbctlx_completor head;
 689
 690         const hfa384x_usb_rridresp_t *rridresp;
 691         void *riddata;
 692         unsigned int riddatalen;
 693 };
 694
 695 static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
 696 {
 697         struct usbctlx_rrid_completor *complete;
 698         hfa384x_rridresult_t rridresult;
 699
 700         complete = (struct usbctlx_rrid_completor *)head;
 701         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 702
 703         /* Validate the length, note body len calculation in bytes */
 704         if (rridresult.riddata_len != complete->riddatalen) {
 705                 pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 706                         rridresult.rid,
 707                         complete->riddatalen, rridresult.riddata_len);
 708                 return -ENODATA;
 709         }
 710
 711         memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
 712         return 0;
 713 }
 714
 715 static inline struct usbctlx_completor *init_rrid_completor(
 716                                                 struct usbctlx_rrid_completor
 717                                                         *completor,
 718                                                 const hfa384x_usb_rridresp_t
 719                                                         *rridresp,
 720                                                 void *riddata,
 721                                                 unsigned int riddatalen)
 722 {
 723         completor->head.complete = usbctlx_rrid_completor_fn;
 724         completor->rridresp = rridresp;
 725         completor->riddata = riddata;
 726         completor->riddatalen = riddatalen;
 727         return &(completor->head);
 728 }
 729
 730 /*----------------------------------------------------------------
 731 * Completor object:
 732 * Interprets the results of a synchronous RID-write
 733 ----------------------------------------------------------------*/
 734 #define init_wrid_completor  init_cmd_completor
 735
 736 /*----------------------------------------------------------------
 737 * Completor object:
 738 * Interprets the results of a synchronous memory-write
 739 ----------------------------------------------------------------*/
 740 #define init_wmem_completor  init_cmd_completor
 741
 742 /*----------------------------------------------------------------
 743 * Completor object:
 744 * Interprets the results of a synchronous memory-read
 745 ----------------------------------------------------------------*/
 746 struct usbctlx_rmem_completor {
 747         struct usbctlx_completor head;
 748
 749         const hfa384x_usb_rmemresp_t *rmemresp;
 750         void *data;
 751         unsigned int len;
 752 };
 753
 754 static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
 755 {
 756         struct usbctlx_rmem_completor *complete =
 757                 (struct usbctlx_rmem_completor *)head;
 758
 759         pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
 760         memcpy(complete->data, complete->rmemresp->data, complete->len);
 761         return 0;
 762 }
 763
 764 static inline struct usbctlx_completor *init_rmem_completor(
 765                                                 struct usbctlx_rmem_completor
 766                                                         *completor,
 767                                                 hfa384x_usb_rmemresp_t
 768                                                         *rmemresp,
 769                                                 void *data,
 770                                                 unsigned int len)
 771 {
 772         completor->head.complete = usbctlx_rmem_completor_fn;
 773         completor->rmemresp = rmemresp;
 774         completor->data = data;
 775         completor->len = len;
 776         return &(completor->head);
 777 }
 778
 779 /*----------------------------------------------------------------
 780 * hfa384x_cb_status
 781 *
 782 * Ctlx_complete handler for async CMD type control exchanges.
 783 * mark the hw struct as such.
 784 *
 785 * Note: If the handling is changed here, it should probably be
 786 *       changed in docmd as well.
 787 *
 788 * Arguments:
 789 *       hw              hw struct
 790 *       ctlx            completed CTLX
 791 *
 792 * Returns:
 793 *       nothing
 794 *
 795 * Side effects:
 796 *
 797 * Call context:
 798 *       interrupt
 799 ----------------------------------------------------------------*/
 800 static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 801 {
 802         if (ctlx->usercb != NULL) {
 803                 hfa384x_cmdresult_t cmdresult;
 804
 805                 if (ctlx->state != CTLX_COMPLETE) {
 806                         memset(&cmdresult, 0, sizeof(cmdresult));
 807                         cmdresult.status =
 808                             HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 809                 } else {
 810                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 811                 }
 812
 813                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 814         }
 815 }
 816
 817 /*----------------------------------------------------------------
 818 * hfa384x_cb_rrid
 819 *
 820 * CTLX completion handler for async RRID type control exchanges.
 821 *
 822 * Note: If the handling is changed here, it should probably be
 823 *       changed in dorrid as well.
 824 *
 825 * Arguments:
 826 *       hw              hw struct
 827 *       ctlx            completed CTLX
 828 *
 829 * Returns:
 830 *       nothing
 831 *
 832 * Side effects:
 833 *
 834 * Call context:
 835 *       interrupt
 836 ----------------------------------------------------------------*/
 837 static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 838 {
 839         if (ctlx->usercb != NULL) {
 840                 hfa384x_rridresult_t rridresult;
 841
 842                 if (ctlx->state != CTLX_COMPLETE) {
 843                         memset(&rridresult, 0, sizeof(rridresult));
 844                         rridresult.rid = le16_to_cpu(ctlx->outbuf.rridreq.rid);
 845                 } else {
 846                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp,
 847                                                &rridresult);
 848                 }
 849
 850                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
 851         }
 852 }
 853
 854 static inline int hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
 855 {
 856         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
 857 }
 858
 859 static inline int
 860 hfa384x_docmd_async(hfa384x_t *hw,
 861                     hfa384x_metacmd_t *cmd,
 862                     ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
 863 {
 864         return hfa384x_docmd(hw, DOASYNC, cmd, cmdcb, usercb, usercb_data);
 865 }
 866
 867 static inline int
 868 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
 869                     unsigned int riddatalen)
 870 {
 871         return hfa384x_dorrid(hw, DOWAIT,
 872                               rid, riddata, riddatalen, NULL, NULL, NULL);
 873 }
 874
 875 static inline int
 876 hfa384x_dorrid_async(hfa384x_t *hw,
 877                      u16 rid, void *riddata, unsigned int riddatalen,
 878                      ctlx_cmdcb_t cmdcb,
 879                      ctlx_usercb_t usercb, void *usercb_data)
 880 {
 881         return hfa384x_dorrid(hw, DOASYNC,
 882                               rid, riddata, riddatalen,
 883                               cmdcb, usercb, usercb_data);
 884 }
 885
 886 static inline int
 887 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
 888                     unsigned int riddatalen)
 889 {
 890         return hfa384x_dowrid(hw, DOWAIT,
 891                               rid, riddata, riddatalen, NULL, NULL, NULL);
 892 }
 893
 894 static inline int
 895 hfa384x_dowrid_async(hfa384x_t *hw,
 896                      u16 rid, void *riddata, unsigned int riddatalen,
 897                      ctlx_cmdcb_t cmdcb,
 898                      ctlx_usercb_t usercb, void *usercb_data)
 899 {
 900         return hfa384x_dowrid(hw, DOASYNC,
 901                               rid, riddata, riddatalen,
 902                               cmdcb, usercb, usercb_data);
 903 }
 904
 905 static inline int
 906 hfa384x_dormem_wait(hfa384x_t *hw,
 907                     u16 page, u16 offset, void *data, unsigned int len)
 908 {
 909         return hfa384x_dormem(hw, DOWAIT,
 910                               page, offset, data, len, NULL, NULL, NULL);
 911 }
 912
 913 static inline int
 914 hfa384x_dormem_async(hfa384x_t *hw,
 915                      u16 page, u16 offset, void *data, unsigned int len,
 916                      ctlx_cmdcb_t cmdcb,
 917                      ctlx_usercb_t usercb, void *usercb_data)
 918 {
 919         return hfa384x_dormem(hw, DOASYNC,
 920                               page, offset, data, len,
 921                               cmdcb, usercb, usercb_data);
 922 }
 923
 924 static inline int
 925 hfa384x_dowmem_wait(hfa384x_t *hw,
 926                     u16 page, u16 offset, void *data, unsigned int len)
 927 {
 928         return hfa384x_dowmem(hw, DOWAIT,
 929                               page, offset, data, len, NULL, NULL, NULL);
 930 }
 931
 932 static inline int
 933 hfa384x_dowmem_async(hfa384x_t *hw,
 934                      u16 page,
 935                      u16 offset,
 936                      void *data,
 937                      unsigned int len,
 938                      ctlx_cmdcb_t cmdcb,
 939                      ctlx_usercb_t usercb, void *usercb_data)
 940 {
 941         return hfa384x_dowmem(hw, DOASYNC,
 942                               page, offset, data, len,
 943                               cmdcb, usercb, usercb_data);
 944 }
 945
 946 /*----------------------------------------------------------------
 947 * hfa384x_cmd_initialize
 948 *
 949 * Issues the initialize command and sets the hw->state based
 950 * on the result.
 951 *
 952 * Arguments:
 953 *       hw              device structure
 954 *
 955 * Returns:
 956 *       0               success
 957 *       >0              f/w reported error - f/w status code
 958 *       <0              driver reported error
 959 *
 960 * Side effects:
 961 *
 962 * Call context:
 963 *       process
 964 ----------------------------------------------------------------*/
 965 int hfa384x_cmd_initialize(hfa384x_t *hw)
 966 {
 967         int result = 0;
 968         int i;
 969         hfa384x_metacmd_t cmd;
 970
 971         cmd.cmd = HFA384x_CMDCODE_INIT;
 972         cmd.parm0 = 0;
 973         cmd.parm1 = 0;
 974         cmd.parm2 = 0;
 975
 976         result = hfa384x_docmd_wait(hw, &cmd);
 977
 978         pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
 979                  cmd.result.status,
 980                  cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
 981         if (result == 0) {
 982                 for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
 983                         hw->port_enabled[i] = 0;
 984         }
 985
 986         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 987
 988         return result;
 989 }
 990
 991 /*----------------------------------------------------------------
 992 * hfa384x_cmd_disable
 993 *
 994 * Issues the disable command to stop communications on one of
 995 * the MACs 'ports'.
 996 *
 997 * Arguments:
 998 *       hw              device structure
 999 *       macport         MAC port number (host order)
1000 *
1001 * Returns:
1002 *       0               success
1003 *       >0              f/w reported failure - f/w status code
1004 *       <0              driver reported error (timeout|bad arg)
1005 *
1006 * Side effects:
1007 *
1008 * Call context:
1009 *       process
1010 ----------------------------------------------------------------*/
1011 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1012 {
1013         int result = 0;
1014         hfa384x_metacmd_t cmd;
1015
1016         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1017             HFA384x_CMD_MACPORT_SET(macport);
1018         cmd.parm0 = 0;
1019         cmd.parm1 = 0;
1020         cmd.parm2 = 0;
1021
1022         result = hfa384x_docmd_wait(hw, &cmd);
1023
1024         return result;
1025 }
1026
1027 /*----------------------------------------------------------------
1028 * hfa384x_cmd_enable
1029 *
1030 * Issues the enable command to enable communications on one of
1031 * the MACs 'ports'.
1032 *
1033 * Arguments:
1034 *       hw              device structure
1035 *       macport         MAC port number
1036 *
1037 * Returns:
1038 *       0               success
1039 *       >0              f/w reported failure - f/w status code
1040 *       <0              driver reported error (timeout|bad arg)
1041 *
1042 * Side effects:
1043 *
1044 * Call context:
1045 *       process
1046 ----------------------------------------------------------------*/
1047 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1048 {
1049         int result = 0;
1050         hfa384x_metacmd_t cmd;
1051
1052         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1053             HFA384x_CMD_MACPORT_SET(macport);
1054         cmd.parm0 = 0;
1055         cmd.parm1 = 0;
1056         cmd.parm2 = 0;
1057
1058         result = hfa384x_docmd_wait(hw, &cmd);
1059
1060         return result;
1061 }
1062
1063 /*----------------------------------------------------------------
1064 * hfa384x_cmd_monitor
1065 *
1066 * Enables the 'monitor mode' of the MAC.  Here's the description of
1067 * monitor mode that I've received thus far:
1068 *
1069 *  "The "monitor mode" of operation is that the MAC passes all
1070 *  frames for which the PLCP checks are correct. All received
1071 *  MPDUs are passed to the host with MAC Port = 7, with a
1072 *  receive status of good, FCS error, or undecryptable. Passing
1073 *  certain MPDUs is a violation of the 802.11 standard, but useful
1074 *  for a debugging tool."  Normal communication is not possible
1075 *  while monitor mode is enabled.
1076 *
1077 * Arguments:
1078 *       hw              device structure
1079 *       enable          a code (0x0b|0x0f) that enables/disables
1080 *                       monitor mode. (host order)
1081 *
1082 * Returns:
1083 *       0               success
1084 *       >0              f/w reported failure - f/w status code
1085 *       <0              driver reported error (timeout|bad arg)
1086 *
1087 * Side effects:
1088 *
1089 * Call context:
1090 *       process
1091 ----------------------------------------------------------------*/
1092 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1093 {
1094         int result = 0;
1095         hfa384x_metacmd_t cmd;
1096
1097         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1098             HFA384x_CMD_AINFO_SET(enable);
1099         cmd.parm0 = 0;
1100         cmd.parm1 = 0;
1101         cmd.parm2 = 0;
1102
1103         result = hfa384x_docmd_wait(hw, &cmd);
1104
1105         return result;
1106 }
1107
1108 /*----------------------------------------------------------------
1109 * hfa384x_cmd_download
1110 *
1111 * Sets the controls for the MAC controller code/data download
1112 * process.  The arguments set the mode and address associated
1113 * with a download.  Note that the aux registers should be enabled
1114 * prior to setting one of the download enable modes.
1115 *
1116 * Arguments:
1117 *       hw              device structure
1118 *       mode            0 - Disable programming and begin code exec
1119 *                       1 - Enable volatile mem programming
1120 *                       2 - Enable non-volatile mem programming
1121 *                       3 - Program non-volatile section from NV download
1122 *                           buffer.
1123 *                       (host order)
1124 *       lowaddr
1125 *       highaddr        For mode 1, sets the high & low order bits of
1126 *                       the "destination address".  This address will be
1127 *                       the execution start address when download is
1128 *                       subsequently disabled.
1129 *                       For mode 2, sets the high & low order bits of
1130 *                       the destination in NV ram.
1131 *                       For modes 0 & 3, should be zero. (host order)
1132 *                       NOTE: these are CMD format.
1133 *       codelen         Length of the data to write in mode 2,
1134 *                       zero otherwise. (host order)
1135 *
1136 * Returns:
1137 *       0               success
1138 *       >0              f/w reported failure - f/w status code
1139 *       <0              driver reported error (timeout|bad arg)
1140 *
1141 * Side effects:
1142 *
1143 * Call context:
1144 *       process
1145 ----------------------------------------------------------------*/
1146 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1147                          u16 highaddr, u16 codelen)
1148 {
1149         int result = 0;
1150         hfa384x_metacmd_t cmd;
1151
1152         pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1153                  mode, lowaddr, highaddr, codelen);
1154
1155         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1156                    HFA384x_CMD_PROGMODE_SET(mode));
1157
1158         cmd.parm0 = lowaddr;
1159         cmd.parm1 = highaddr;
1160         cmd.parm2 = codelen;
1161
1162         result = hfa384x_docmd_wait(hw, &cmd);
1163
1164         return result;
1165 }
1166
1167 /*----------------------------------------------------------------
1168 * hfa384x_corereset
1169 *
1170 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1171 * structure is in its "created" state.  That is, it is initialized
1172 * with proper values.  Note that if a reset is done after the
1173 * device has been active for awhile, the caller might have to clean
1174 * up some leftover cruft in the hw structure.
1175 *
1176 * Arguments:
1177 *       hw              device structure
1178 *       holdtime        how long (in ms) to hold the reset
1179 *       settletime      how long (in ms) to wait after releasing
1180 *                       the reset
1181 *
1182 * Returns:
1183 *       nothing
1184 *
1185 * Side effects:
1186 *
1187 * Call context:
1188 *       process
1189 ----------------------------------------------------------------*/
1190 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1191 {
1192         int result;
1193
1194         result = usb_reset_device(hw->usb);
1195         if (result < 0) {
1196                 netdev_err(hw->wlandev->netdev, "usb_reset_device() failed, result=%d.\n",
1197                            result);
1198         }
1199
1200         return result;
1201 }
1202
1203 /*----------------------------------------------------------------
1204 * hfa384x_usbctlx_complete_sync
1205 *
1206 * Waits for a synchronous CTLX object to complete,
1207 * and then handles the response.
1208 *
1209 * Arguments:
1210 *       hw              device structure
1211 *       ctlx            CTLX ptr
1212 *       completor       functor object to decide what to
1213 *                       do with the CTLX's result.
1214 *
1215 * Returns:
1216 *       0               Success
1217 *       -ERESTARTSYS    Interrupted by a signal
1218 *       -EIO            CTLX failed
1219 *       -ENODEV         Adapter was unplugged
1220 *       ???             Result from completor
1221 *
1222 * Side effects:
1223 *
1224 * Call context:
1225 *       process
1226 ----------------------------------------------------------------*/
1227 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1228                                          hfa384x_usbctlx_t *ctlx,
1229                                          struct usbctlx_completor *completor)
1230 {
1231         unsigned long flags;
1232         int result;
1233
1234         result = wait_for_completion_interruptible(&ctlx->done);
1235
1236         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1237
1238         /*
1239          * We can only handle the CTLX if the USB disconnect
1240          * function has not run yet ...
1241          */
1242 cleanup:
1243         if (hw->wlandev->hwremoved) {
1244                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1245                 result = -ENODEV;
1246         } else if (result != 0) {
1247                 int runqueue = 0;
1248
1249                 /*
1250                  * We were probably interrupted, so delete
1251                  * this CTLX asynchronously, kill the timers
1252                  * and the URB, and then start the next
1253                  * pending CTLX.
1254                  *
1255                  * NOTE: We can only delete the timers and
1256                  *       the URB if this CTLX is active.
1257                  */
1258                 if (ctlx == get_active_ctlx(hw)) {
1259                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1260
1261                         del_singleshot_timer_sync(&hw->reqtimer);
1262                         del_singleshot_timer_sync(&hw->resptimer);
1263                         hw->req_timer_done = 1;
1264                         hw->resp_timer_done = 1;
1265                         usb_kill_urb(&hw->ctlx_urb);
1266
1267                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1268
1269                         runqueue = 1;
1270
1271                         /*
1272                          * This scenario is so unlikely that I'm
1273                          * happy with a grubby "goto" solution ...
1274                          */
1275                         if (hw->wlandev->hwremoved)
1276                                 goto cleanup;
1277                 }
1278
1279                 /*
1280                  * The completion task will send this CTLX
1281                  * to the reaper the next time it runs. We
1282                  * are no longer in a hurry.
1283                  */
1284                 ctlx->reapable = 1;
1285                 ctlx->state = CTLX_REQ_FAILED;
1286                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1287
1288                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1289
1290                 if (runqueue)
1291                         hfa384x_usbctlxq_run(hw);
1292         } else {
1293                 if (ctlx->state == CTLX_COMPLETE) {
1294                         result = completor->complete(completor);
1295                 } else {
1296                         netdev_warn(hw->wlandev->netdev, "CTLX[%d] error: state(%s)\n",
1297                                     le16_to_cpu(ctlx->outbuf.type),
1298                                     ctlxstr(ctlx->state));
1299                         result = -EIO;
1300                 }
1301
1302                 list_del(&ctlx->list);
1303                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1304                 kfree(ctlx);
1305         }
1306
1307         return result;
1308 }
1309
1310 /*----------------------------------------------------------------
1311 * hfa384x_docmd
1312 *
1313 * Constructs a command CTLX and submits it.
1314 *
1315 * NOTE: Any changes to the 'post-submit' code in this function
1316 *       need to be carried over to hfa384x_cbcmd() since the handling
1317 *       is virtually identical.
1318 *
1319 * Arguments:
1320 *       hw              device structure
1321 *       mode            DOWAIT or DOASYNC
1322 *       cmd             cmd structure.  Includes all arguments and result
1323 *                       data points.  All in host order. in host order
1324 *       cmdcb           command-specific callback
1325 *       usercb          user callback for async calls, NULL for DOWAIT calls
1326 *       usercb_data     user supplied data pointer for async calls, NULL
1327 *                       for DOASYNC calls
1328 *
1329 * Returns:
1330 *       0               success
1331 *       -EIO            CTLX failure
1332 *       -ERESTARTSYS    Awakened on signal
1333 *       >0              command indicated error, Status and Resp0-2 are
1334 *                       in hw structure.
1335 *
1336 * Side effects:
1337 *
1338 *
1339 * Call context:
1340 *       process
1341 ----------------------------------------------------------------*/
1342 static int
1343 hfa384x_docmd(hfa384x_t *hw,
1344               enum cmd_mode mode,
1345               hfa384x_metacmd_t *cmd,
1346               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1347 {
1348         int result;
1349         hfa384x_usbctlx_t *ctlx;
1350
1351         ctlx = usbctlx_alloc();
1352         if (ctlx == NULL) {
1353                 result = -ENOMEM;
1354                 goto done;
1355         }
1356
1357         /* Initialize the command */
1358         ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1359         ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1360         ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1361         ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1362         ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1363
1364         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1365
1366         pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1367                  cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1368
1369         ctlx->reapable = mode;
1370         ctlx->cmdcb = cmdcb;
1371         ctlx->usercb = usercb;
1372         ctlx->usercb_data = usercb_data;
1373
1374         result = hfa384x_usbctlx_submit(hw, ctlx);
1375         if (result != 0) {
1376                 kfree(ctlx);
1377         } else if (mode == DOWAIT) {
1378                 struct usbctlx_cmd_completor completor;
1379
1380                 result =
1381                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1382                                                   init_cmd_completor(&completor,
1383                                                                      &ctlx->
1384                                                                      inbuf.
1385                                                                      cmdresp,
1386                                                                      &cmd->
1387                                                                      result));
1388         }
1389
1390 done:
1391         return result;
1392 }
1393
1394 /*----------------------------------------------------------------
1395 * hfa384x_dorrid
1396 *
1397 * Constructs a read rid CTLX and issues it.
1398 *
1399 * NOTE: Any changes to the 'post-submit' code in this function
1400 *       need to be carried over to hfa384x_cbrrid() since the handling
1401 *       is virtually identical.
1402 *
1403 * Arguments:
1404 *       hw              device structure
1405 *       mode            DOWAIT or DOASYNC
1406 *       rid             Read RID number (host order)
1407 *       riddata         Caller supplied buffer that MAC formatted RID.data
1408 *                       record will be written to for DOWAIT calls. Should
1409 *                       be NULL for DOASYNC calls.
1410 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1411 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1412 *       usercb          user callback for async calls, NULL for DOWAIT calls
1413 *       usercb_data     user supplied data pointer for async calls, NULL
1414 *                       for DOWAIT calls
1415 *
1416 * Returns:
1417 *       0               success
1418 *       -EIO            CTLX failure
1419 *       -ERESTARTSYS    Awakened on signal
1420 *       -ENODATA        riddatalen != macdatalen
1421 *       >0              command indicated error, Status and Resp0-2 are
1422 *                       in hw structure.
1423 *
1424 * Side effects:
1425 *
1426 * Call context:
1427 *       interrupt (DOASYNC)
1428 *       process (DOWAIT or DOASYNC)
1429 ----------------------------------------------------------------*/
1430 static int
1431 hfa384x_dorrid(hfa384x_t *hw,
1432                enum cmd_mode mode,
1433                u16 rid,
1434                void *riddata,
1435                unsigned int riddatalen,
1436                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1437 {
1438         int result;
1439         hfa384x_usbctlx_t *ctlx;
1440
1441         ctlx = usbctlx_alloc();
1442         if (ctlx == NULL) {
1443                 result = -ENOMEM;
1444                 goto done;
1445         }
1446
1447         /* Initialize the command */
1448         ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1449         ctlx->outbuf.rridreq.frmlen =
1450             cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1451         ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1452
1453         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1454
1455         ctlx->reapable = mode;
1456         ctlx->cmdcb = cmdcb;
1457         ctlx->usercb = usercb;
1458         ctlx->usercb_data = usercb_data;
1459
1460         /* Submit the CTLX */
1461         result = hfa384x_usbctlx_submit(hw, ctlx);
1462         if (result != 0) {
1463                 kfree(ctlx);
1464         } else if (mode == DOWAIT) {
1465                 struct usbctlx_rrid_completor completor;
1466
1467                 result =
1468                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1469                                                   init_rrid_completor
1470                                                   (&completor,
1471                                                    &ctlx->inbuf.rridresp,
1472                                                    riddata, riddatalen));
1473         }
1474
1475 done:
1476         return result;
1477 }
1478
1479 /*----------------------------------------------------------------
1480 * hfa384x_dowrid
1481 *
1482 * Constructs a write rid CTLX and issues it.
1483 *
1484 * NOTE: Any changes to the 'post-submit' code in this function
1485 *       need to be carried over to hfa384x_cbwrid() since the handling
1486 *       is virtually identical.
1487 *
1488 * Arguments:
1489 *       hw              device structure
1490 *       enum cmd_mode   DOWAIT or DOASYNC
1491 *       rid             RID code
1492 *       riddata         Data portion of RID formatted for MAC
1493 *       riddatalen      Length of the data portion in bytes
1494 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1495 *       usercb          user callback for async calls, NULL for DOWAIT calls
1496 *       usercb_data     user supplied data pointer for async calls
1497 *
1498 * Returns:
1499 *       0               success
1500 *       -ETIMEDOUT      timed out waiting for register ready or
1501 *                       command completion
1502 *       >0              command indicated error, Status and Resp0-2 are
1503 *                       in hw structure.
1504 *
1505 * Side effects:
1506 *
1507 * Call context:
1508 *       interrupt (DOASYNC)
1509 *       process (DOWAIT or DOASYNC)
1510 ----------------------------------------------------------------*/
1511 static int
1512 hfa384x_dowrid(hfa384x_t *hw,
1513                enum cmd_mode mode,
1514                u16 rid,
1515                void *riddata,
1516                unsigned int riddatalen,
1517                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1518 {
1519         int result;
1520         hfa384x_usbctlx_t *ctlx;
1521
1522         ctlx = usbctlx_alloc();
1523         if (ctlx == NULL) {
1524                 result = -ENOMEM;
1525                 goto done;
1526         }
1527
1528         /* Initialize the command */
1529         ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1530         ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1531                                                    (ctlx->outbuf.wridreq.rid) +
1532                                                    riddatalen + 1) / 2);
1533         ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1534         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1535
1536         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1537             sizeof(ctlx->outbuf.wridreq.frmlen) +
1538             sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1539
1540         ctlx->reapable = mode;
1541         ctlx->cmdcb = cmdcb;
1542         ctlx->usercb = usercb;
1543         ctlx->usercb_data = usercb_data;
1544
1545         /* Submit the CTLX */
1546         result = hfa384x_usbctlx_submit(hw, ctlx);
1547         if (result != 0) {
1548                 kfree(ctlx);
1549         } else if (mode == DOWAIT) {
1550                 struct usbctlx_cmd_completor completor;
1551                 hfa384x_cmdresult_t wridresult;
1552
1553                 result = hfa384x_usbctlx_complete_sync(hw,
1554                                                        ctlx,
1555                                                        init_wrid_completor
1556                                                        (&completor,
1557                                                         &ctlx->inbuf.wridresp,
1558                                                         &wridresult));
1559         }
1560
1561 done:
1562         return result;
1563 }
1564
1565 /*----------------------------------------------------------------
1566 * hfa384x_dormem
1567 *
1568 * Constructs a readmem CTLX and issues it.
1569 *
1570 * NOTE: Any changes to the 'post-submit' code in this function
1571 *       need to be carried over to hfa384x_cbrmem() since the handling
1572 *       is virtually identical.
1573 *
1574 * Arguments:
1575 *       hw              device structure
1576 *       mode            DOWAIT or DOASYNC
1577 *       page            MAC address space page (CMD format)
1578 *       offset          MAC address space offset
1579 *       data            Ptr to data buffer to receive read
1580 *       len             Length of the data to read (max == 2048)
1581 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1582 *       usercb          user callback for async calls, NULL for DOWAIT calls
1583 *       usercb_data     user supplied data pointer for async calls
1584 *
1585 * Returns:
1586 *       0               success
1587 *       -ETIMEDOUT      timed out waiting for register ready or
1588 *                       command completion
1589 *       >0              command indicated error, Status and Resp0-2 are
1590 *                       in hw structure.
1591 *
1592 * Side effects:
1593 *
1594 * Call context:
1595 *       interrupt (DOASYNC)
1596 *       process (DOWAIT or DOASYNC)
1597 ----------------------------------------------------------------*/
1598 static int
1599 hfa384x_dormem(hfa384x_t *hw,
1600                enum cmd_mode mode,
1601                u16 page,
1602                u16 offset,
1603                void *data,
1604                unsigned int len,
1605                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1606 {
1607         int result;
1608         hfa384x_usbctlx_t *ctlx;
1609
1610         ctlx = usbctlx_alloc();
1611         if (ctlx == NULL) {
1612                 result = -ENOMEM;
1613                 goto done;
1614         }
1615
1616         /* Initialize the command */
1617         ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1618         ctlx->outbuf.rmemreq.frmlen =
1619             cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1620                         sizeof(ctlx->outbuf.rmemreq.page) + len);
1621         ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1622         ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1623
1624         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1625
1626         pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1627                  ctlx->outbuf.rmemreq.type,
1628                  ctlx->outbuf.rmemreq.frmlen,
1629                  ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1630
1631         pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1632
1633         ctlx->reapable = mode;
1634         ctlx->cmdcb = cmdcb;
1635         ctlx->usercb = usercb;
1636         ctlx->usercb_data = usercb_data;
1637
1638         result = hfa384x_usbctlx_submit(hw, ctlx);
1639         if (result != 0) {
1640                 kfree(ctlx);
1641         } else if (mode == DOWAIT) {
1642                 struct usbctlx_rmem_completor completor;
1643
1644                 result =
1645                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1646                                                   init_rmem_completor
1647                                                   (&completor,
1648                                                    &ctlx->inbuf.rmemresp, data,
1649                                                    len));
1650         }
1651
1652 done:
1653         return result;
1654 }
1655
1656 /*----------------------------------------------------------------
1657 * hfa384x_dowmem
1658 *
1659 * Constructs a writemem CTLX and issues it.
1660 *
1661 * NOTE: Any changes to the 'post-submit' code in this function
1662 *       need to be carried over to hfa384x_cbwmem() since the handling
1663 *       is virtually identical.
1664 *
1665 * Arguments:
1666 *       hw              device structure
1667 *       mode            DOWAIT or DOASYNC
1668 *       page            MAC address space page (CMD format)
1669 *       offset          MAC address space offset
1670 *       data            Ptr to data buffer containing write data
1671 *       len             Length of the data to read (max == 2048)
1672 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1673 *       usercb          user callback for async calls, NULL for DOWAIT calls
1674 *       usercb_data     user supplied data pointer for async calls.
1675 *
1676 * Returns:
1677 *       0               success
1678 *       -ETIMEDOUT      timed out waiting for register ready or
1679 *                       command completion
1680 *       >0              command indicated error, Status and Resp0-2 are
1681 *                       in hw structure.
1682 *
1683 * Side effects:
1684 *
1685 * Call context:
1686 *       interrupt (DOWAIT)
1687 *       process (DOWAIT or DOASYNC)
1688 ----------------------------------------------------------------*/
1689 static int
1690 hfa384x_dowmem(hfa384x_t *hw,
1691                enum cmd_mode mode,
1692                u16 page,
1693                u16 offset,
1694                void *data,
1695                unsigned int len,
1696                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1697 {
1698         int result;
1699         hfa384x_usbctlx_t *ctlx;
1700
1701         pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1702
1703         ctlx = usbctlx_alloc();
1704         if (ctlx == NULL) {
1705                 result = -ENOMEM;
1706                 goto done;
1707         }
1708
1709         /* Initialize the command */
1710         ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1711         ctlx->outbuf.wmemreq.frmlen =
1712             cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1713                         sizeof(ctlx->outbuf.wmemreq.page) + len);
1714         ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1715         ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1716         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1717
1718         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1719             sizeof(ctlx->outbuf.wmemreq.frmlen) +
1720             sizeof(ctlx->outbuf.wmemreq.offset) +
1721             sizeof(ctlx->outbuf.wmemreq.page) + len;
1722
1723         ctlx->reapable = mode;
1724         ctlx->cmdcb = cmdcb;
1725         ctlx->usercb = usercb;
1726         ctlx->usercb_data = usercb_data;
1727
1728         result = hfa384x_usbctlx_submit(hw, ctlx);
1729         if (result != 0) {
1730                 kfree(ctlx);
1731         } else if (mode == DOWAIT) {
1732                 struct usbctlx_cmd_completor completor;
1733                 hfa384x_cmdresult_t wmemresult;
1734
1735                 result = hfa384x_usbctlx_complete_sync(hw,
1736                                                        ctlx,
1737                                                        init_wmem_completor
1738                                                        (&completor,
1739                                                         &ctlx->inbuf.wmemresp,
1740                                                         &wmemresult));
1741         }
1742
1743 done:
1744         return result;
1745 }
1746
1747 /*----------------------------------------------------------------
1748 * hfa384x_drvr_commtallies
1749 *
1750 * Send a commtallies inquiry to the MAC.  Note that this is an async
1751 * call that will result in an info frame arriving sometime later.
1752 *
1753 * Arguments:
1754 *       hw              device structure
1755 *
1756 * Returns:
1757 *       zero            success.
1758 *
1759 * Side effects:
1760 *
1761 * Call context:
1762 *       process
1763 ----------------------------------------------------------------*/
1764 int hfa384x_drvr_commtallies(hfa384x_t *hw)
1765 {
1766         hfa384x_metacmd_t cmd;
1767
1768         cmd.cmd = HFA384x_CMDCODE_INQ;
1769         cmd.parm0 = HFA384x_IT_COMMTALLIES;
1770         cmd.parm1 = 0;
1771         cmd.parm2 = 0;
1772
1773         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
1774
1775         return 0;
1776 }
1777
1778 /*----------------------------------------------------------------
1779 * hfa384x_drvr_disable
1780 *
1781 * Issues the disable command to stop communications on one of
1782 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1783 * APs may also disable macports 1-6.  Only ports that have been
1784 * previously enabled may be disabled.
1785 *
1786 * Arguments:
1787 *       hw              device structure
1788 *       macport         MAC port number (host order)
1789 *
1790 * Returns:
1791 *       0               success
1792 *       >0              f/w reported failure - f/w status code
1793 *       <0              driver reported error (timeout|bad arg)
1794 *
1795 * Side effects:
1796 *
1797 * Call context:
1798 *       process
1799 ----------------------------------------------------------------*/
1800 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
1801 {
1802         int result = 0;
1803
1804         if ((!hw->isap && macport != 0) ||
1805             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1806             !(hw->port_enabled[macport])) {
1807                 result = -EINVAL;
1808         } else {
1809                 result = hfa384x_cmd_disable(hw, macport);
1810                 if (result == 0)
1811                         hw->port_enabled[macport] = 0;
1812         }
1813         return result;
1814 }
1815
1816 /*----------------------------------------------------------------
1817 * hfa384x_drvr_enable
1818 *
1819 * Issues the enable command to enable communications on one of
1820 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1821 * APs may also enable macports 1-6.  Only ports that are currently
1822 * disabled may be enabled.
1823 *
1824 * Arguments:
1825 *       hw              device structure
1826 *       macport         MAC port number
1827 *
1828 * Returns:
1829 *       0               success
1830 *       >0              f/w reported failure - f/w status code
1831 *       <0              driver reported error (timeout|bad arg)
1832 *
1833 * Side effects:
1834 *
1835 * Call context:
1836 *       process
1837 ----------------------------------------------------------------*/
1838 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
1839 {
1840         int result = 0;
1841
1842         if ((!hw->isap && macport != 0) ||
1843             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1844             (hw->port_enabled[macport])) {
1845                 result = -EINVAL;
1846         } else {
1847                 result = hfa384x_cmd_enable(hw, macport);
1848                 if (result == 0)
1849                         hw->port_enabled[macport] = 1;
1850         }
1851         return result;
1852 }
1853
1854 /*----------------------------------------------------------------
1855 * hfa384x_drvr_flashdl_enable
1856 *
1857 * Begins the flash download state.  Checks to see that we're not
1858 * already in a download state and that a port isn't enabled.
1859 * Sets the download state and retrieves the flash download
1860 * buffer location, buffer size, and timeout length.
1861 *
1862 * Arguments:
1863 *       hw              device structure
1864 *
1865 * Returns:
1866 *       0               success
1867 *       >0              f/w reported error - f/w status code
1868 *       <0              driver reported error
1869 *
1870 * Side effects:
1871 *
1872 * Call context:
1873 *       process
1874 ----------------------------------------------------------------*/
1875 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
1876 {
1877         int result = 0;
1878         int i;
1879
1880         /* Check that a port isn't active */
1881         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1882                 if (hw->port_enabled[i]) {
1883                         pr_debug("called when port enabled.\n");
1884                         return -EINVAL;
1885                 }
1886         }
1887
1888         /* Check that we're not already in a download state */
1889         if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1890                 return -EINVAL;
1891
1892         /* Retrieve the buffer loc&size and timeout */
1893         result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1894                                         &(hw->bufinfo), sizeof(hw->bufinfo));
1895         if (result)
1896                 return result;
1897
1898         hw->bufinfo.page = le16_to_cpu(hw->bufinfo.page);
1899         hw->bufinfo.offset = le16_to_cpu(hw->bufinfo.offset);
1900         hw->bufinfo.len = le16_to_cpu(hw->bufinfo.len);
1901         result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1902                                           &(hw->dltimeout));
1903         if (result)
1904                 return result;
1905
1906         hw->dltimeout = le16_to_cpu(hw->dltimeout);
1907
1908         pr_debug("flashdl_enable\n");
1909
1910         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1911
1912         return result;
1913 }
1914
1915 /*----------------------------------------------------------------
1916 * hfa384x_drvr_flashdl_disable
1917 *
1918 * Ends the flash download state.  Note that this will cause the MAC
1919 * firmware to restart.
1920 *
1921 * Arguments:
1922 *       hw              device structure
1923 *
1924 * Returns:
1925 *       0               success
1926 *       >0              f/w reported error - f/w status code
1927 *       <0              driver reported error
1928 *
1929 * Side effects:
1930 *
1931 * Call context:
1932 *       process
1933 ----------------------------------------------------------------*/
1934 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
1935 {
1936         /* Check that we're already in the download state */
1937         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1938                 return -EINVAL;
1939
1940         pr_debug("flashdl_enable\n");
1941
1942         /* There isn't much we can do at this point, so I don't */
1943         /*  bother  w/ the return value */
1944         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1945         hw->dlstate = HFA384x_DLSTATE_DISABLED;
1946
1947         return 0;
1948 }
1949
1950 /*----------------------------------------------------------------
1951 * hfa384x_drvr_flashdl_write
1952 *
1953 * Performs a FLASH download of a chunk of data. First checks to see
1954 * that we're in the FLASH download state, then sets the download
1955 * mode, uses the aux functions to 1) copy the data to the flash
1956 * buffer, 2) sets the download 'write flash' mode, 3) readback and
1957 * compare.  Lather rinse, repeat as many times an necessary to get
1958 * all the given data into flash.
1959 * When all data has been written using this function (possibly
1960 * repeatedly), call drvr_flashdl_disable() to end the download state
1961 * and restart the MAC.
1962 *
1963 * Arguments:
1964 *       hw              device structure
1965 *       daddr           Card address to write to. (host order)
1966 *       buf             Ptr to data to write.
1967 *       len             Length of data (host order).
1968 *
1969 * Returns:
1970 *       0               success
1971 *       >0              f/w reported error - f/w status code
1972 *       <0              driver reported error
1973 *
1974 * Side effects:
1975 *
1976 * Call context:
1977 *       process
1978 ----------------------------------------------------------------*/
1979 int hfa384x_drvr_flashdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
1980 {
1981         int result = 0;
1982         u32 dlbufaddr;
1983         int nburns;
1984         u32 burnlen;
1985         u32 burndaddr;
1986         u16 burnlo;
1987         u16 burnhi;
1988         int nwrites;
1989         u8 *writebuf;
1990         u16 writepage;
1991         u16 writeoffset;
1992         u32 writelen;
1993         int i;
1994         int j;
1995
1996         pr_debug("daddr=0x%08x len=%d\n", daddr, len);
1997
1998         /* Check that we're in the flash download state */
1999         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
2000                 return -EINVAL;
2001
2002         netdev_info(hw->wlandev->netdev,
2003                     "Download %d bytes to flash @0x%06x\n", len, daddr);
2004
2005         /* Convert to flat address for arithmetic */
2006         /* NOTE: dlbuffer RID stores the address in AUX format */
2007         dlbufaddr =
2008             HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
2009         pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2010                  hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2011         /* Calculations to determine how many fills of the dlbuffer to do
2012          * and how many USB wmemreq's to do for each fill.  At this point
2013          * in time, the dlbuffer size and the wmemreq size are the same.
2014          * Therefore, nwrites should always be 1.  The extra complexity
2015          * here is a hedge against future changes.
2016          */
2017
2018         /* Figure out how many times to do the flash programming */
2019         nburns = len / hw->bufinfo.len;
2020         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2021
2022         /* For each flash program cycle, how many USB wmemreq's are needed? */
2023         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2024         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2025
2026         /* For each burn */
2027         for (i = 0; i < nburns; i++) {
2028                 /* Get the dest address and len */
2029                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2030                     hw->bufinfo.len : (len - (hw->bufinfo.len * i));
2031                 burndaddr = daddr + (hw->bufinfo.len * i);
2032                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2033                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2034
2035                 netdev_info(hw->wlandev->netdev, "Writing %d bytes to flash @0x%06x\n",
2036                             burnlen, burndaddr);
2037
2038                 /* Set the download mode */
2039                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2040                                               burnlo, burnhi, burnlen);
2041                 if (result) {
2042                         netdev_err(hw->wlandev->netdev,
2043                                    "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
2044                                    burnlo, burnhi, burnlen, result);
2045                         goto exit_proc;
2046                 }
2047
2048                 /* copy the data to the flash download buffer */
2049                 for (j = 0; j < nwrites; j++) {
2050                         writebuf = buf +
2051                             (i * hw->bufinfo.len) +
2052                             (j * HFA384x_USB_RWMEM_MAXLEN);
2053
2054                         writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
2055                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
2056                         writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
2057                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
2058
2059                         writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
2060                         writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
2061                             HFA384x_USB_RWMEM_MAXLEN : writelen;
2062
2063                         result = hfa384x_dowmem_wait(hw,
2064                                                      writepage,
2065                                                      writeoffset,
2066                                                      writebuf, writelen);
2067                 }
2068
2069                 /* set the download 'write flash' mode */
2070                 result = hfa384x_cmd_download(hw,
2071                                               HFA384x_PROGMODE_NVWRITE,
2072                                               0, 0, 0);
2073                 if (result) {
2074                         netdev_err(hw->wlandev->netdev,
2075                                    "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
2076                                    burnlo, burnhi, burnlen, result);
2077                         goto exit_proc;
2078                 }
2079
2080                 /* TODO: We really should do a readback and compare. */
2081         }
2082
2083 exit_proc:
2084
2085         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2086         /*  actually disable programming mode.  Remember, that will cause the */
2087         /*  the firmware to effectively reset itself. */
2088
2089         return result;
2090 }
2091
2092 /*----------------------------------------------------------------
2093 * hfa384x_drvr_getconfig
2094 *
2095 * Performs the sequence necessary to read a config/info item.
2096 *
2097 * Arguments:
2098 *       hw              device structure
2099 *       rid             config/info record id (host order)
2100 *       buf             host side record buffer.  Upon return it will
2101 *                       contain the body portion of the record (minus the
2102 *                       RID and len).
2103 *       len             buffer length (in bytes, should match record length)
2104 *
2105 * Returns:
2106 *       0               success
2107 *       >0              f/w reported error - f/w status code
2108 *       <0              driver reported error
2109 *       -ENODATA        length mismatch between argument and retrieved
2110 *                       record.
2111 *
2112 * Side effects:
2113 *
2114 * Call context:
2115 *       process
2116 ----------------------------------------------------------------*/
2117 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2118 {
2119         return hfa384x_dorrid_wait(hw, rid, buf, len);
2120 }
2121
2122 /*----------------------------------------------------------------
2123  * hfa384x_drvr_getconfig_async
2124  *
2125  * Performs the sequence necessary to perform an async read of
2126  * of a config/info item.
2127  *
2128  * Arguments:
2129  *       hw              device structure
2130  *       rid             config/info record id (host order)
2131  *       buf             host side record buffer.  Upon return it will
2132  *                       contain the body portion of the record (minus the
2133  *                       RID and len).
2134  *       len             buffer length (in bytes, should match record length)
2135  *       cbfn            caller supplied callback, called when the command
2136  *                       is done (successful or not).
2137  *       cbfndata        pointer to some caller supplied data that will be
2138  *                       passed in as an argument to the cbfn.
2139  *
2140  * Returns:
2141  *       nothing         the cbfn gets a status argument identifying if
2142  *                       any errors occur.
2143  * Side effects:
2144  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2145  *
2146  * Call context:
2147  *       Any
2148  ----------------------------------------------------------------*/
2149 int
2150 hfa384x_drvr_getconfig_async(hfa384x_t *hw,
2151                              u16 rid, ctlx_usercb_t usercb, void *usercb_data)
2152 {
2153         return hfa384x_dorrid_async(hw, rid, NULL, 0,
2154                                     hfa384x_cb_rrid, usercb, usercb_data);
2155 }
2156
2157 /*----------------------------------------------------------------
2158  * hfa384x_drvr_setconfig_async
2159  *
2160  * Performs the sequence necessary to write a config/info item.
2161  *
2162  * Arguments:
2163  *       hw              device structure
2164  *       rid             config/info record id (in host order)
2165  *       buf             host side record buffer
2166  *       len             buffer length (in bytes)
2167  *       usercb          completion callback
2168  *       usercb_data     completion callback argument
2169  *
2170  * Returns:
2171  *       0               success
2172  *       >0              f/w reported error - f/w status code
2173  *       <0              driver reported error
2174  *
2175  * Side effects:
2176  *
2177  * Call context:
2178  *       process
2179  ----------------------------------------------------------------*/
2180 int
2181 hfa384x_drvr_setconfig_async(hfa384x_t *hw,
2182                              u16 rid,
2183                              void *buf,
2184                              u16 len, ctlx_usercb_t usercb, void *usercb_data)
2185 {
2186         return hfa384x_dowrid_async(hw, rid, buf, len,
2187                                     hfa384x_cb_status, usercb, usercb_data);
2188 }
2189
2190 /*----------------------------------------------------------------
2191 * hfa384x_drvr_ramdl_disable
2192 *
2193 * Ends the ram download state.
2194 *
2195 * Arguments:
2196 *       hw              device structure
2197 *
2198 * Returns:
2199 *       0               success
2200 *       >0              f/w reported error - f/w status code
2201 *       <0              driver reported error
2202 *
2203 * Side effects:
2204 *
2205 * Call context:
2206 *       process
2207 ----------------------------------------------------------------*/
2208 int hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2209 {
2210         /* Check that we're already in the download state */
2211         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2212                 return -EINVAL;
2213
2214         pr_debug("ramdl_disable()\n");
2215
2216         /* There isn't much we can do at this point, so I don't */
2217         /*  bother  w/ the return value */
2218         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
2219         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2220
2221         return 0;
2222 }
2223
2224 /*----------------------------------------------------------------
2225 * hfa384x_drvr_ramdl_enable
2226 *
2227 * Begins the ram download state.  Checks to see that we're not
2228 * already in a download state and that a port isn't enabled.
2229 * Sets the download state and calls cmd_download with the
2230 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2231 *
2232 * Arguments:
2233 *       hw              device structure
2234 *       exeaddr         the card execution address that will be
2235 *                       jumped to when ramdl_disable() is called
2236 *                       (host order).
2237 *
2238 * Returns:
2239 *       0               success
2240 *       >0              f/w reported error - f/w status code
2241 *       <0              driver reported error
2242 *
2243 * Side effects:
2244 *
2245 * Call context:
2246 *       process
2247 ----------------------------------------------------------------*/
2248 int hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2249 {
2250         int result = 0;
2251         u16 lowaddr;
2252         u16 hiaddr;
2253         int i;
2254
2255         /* Check that a port isn't active */
2256         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2257                 if (hw->port_enabled[i]) {
2258                         netdev_err(hw->wlandev->netdev,
2259                                    "Can't download with a macport enabled.\n");
2260                         return -EINVAL;
2261                 }
2262         }
2263
2264         /* Check that we're not already in a download state */
2265         if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2266                 netdev_err(hw->wlandev->netdev, "Download state not disabled.\n");
2267                 return -EINVAL;
2268         }
2269
2270         pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2271
2272         /* Call the download(1,addr) function */
2273         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2274         hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2275
2276         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2277                                       lowaddr, hiaddr, 0);
2278
2279         if (result == 0) {
2280                 /* Set the download state */
2281                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2282         } else {
2283                 pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2284                          lowaddr, hiaddr, result);
2285         }
2286
2287         return result;
2288 }
2289
2290 /*----------------------------------------------------------------
2291 * hfa384x_drvr_ramdl_write
2292 *
2293 * Performs a RAM download of a chunk of data. First checks to see
2294 * that we're in the RAM download state, then uses the [read|write]mem USB
2295 * commands to 1) copy the data, 2) readback and compare.  The download
2296 * state is unaffected.  When all data has been written using
2297 * this function, call drvr_ramdl_disable() to end the download state
2298 * and restart the MAC.
2299 *
2300 * Arguments:
2301 *       hw              device structure
2302 *       daddr           Card address to write to. (host order)
2303 *       buf             Ptr to data to write.
2304 *       len             Length of data (host order).
2305 *
2306 * Returns:
2307 *       0               success
2308 *       >0              f/w reported error - f/w status code
2309 *       <0              driver reported error
2310 *
2311 * Side effects:
2312 *
2313 * Call context:
2314 *       process
2315 ----------------------------------------------------------------*/
2316 int hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
2317 {
2318         int result = 0;
2319         int nwrites;
2320         u8 *data = buf;
2321         int i;
2322         u32 curraddr;
2323         u16 currpage;
2324         u16 curroffset;
2325         u16 currlen;
2326
2327         /* Check that we're in the ram download state */
2328         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2329                 return -EINVAL;
2330
2331         netdev_info(hw->wlandev->netdev, "Writing %d bytes to ram @0x%06x\n",
2332                     len, daddr);
2333
2334         /* How many dowmem calls?  */
2335         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2336         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2337
2338         /* Do blocking wmem's */
2339         for (i = 0; i < nwrites; i++) {
2340                 /* make address args */
2341                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2342                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2343                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2344                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2345                 if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2346                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2347
2348                 /* Do blocking ctlx */
2349                 result = hfa384x_dowmem_wait(hw,
2350                                              currpage,
2351                                              curroffset,
2352                                              data +
2353                                              (i * HFA384x_USB_RWMEM_MAXLEN),
2354                                              currlen);
2355
2356                 if (result)
2357                         break;
2358
2359                 /* TODO: We really should have a readback. */
2360         }
2361
2362         return result;
2363 }
2364
2365 /*----------------------------------------------------------------
2366 * hfa384x_drvr_readpda
2367 *
2368 * Performs the sequence to read the PDA space.  Note there is no
2369 * drvr_writepda() function.  Writing a PDA is
2370 * generally implemented by a calling component via calls to
2371 * cmd_download and writing to the flash download buffer via the
2372 * aux regs.
2373 *
2374 * Arguments:
2375 *       hw              device structure
2376 *       buf             buffer to store PDA in
2377 *       len             buffer length
2378 *
2379 * Returns:
2380 *       0               success
2381 *       >0              f/w reported error - f/w status code
2382 *       <0              driver reported error
2383 *       -ETIMEDOUT      timeout waiting for the cmd regs to become
2384 *                       available, or waiting for the control reg
2385 *                       to indicate the Aux port is enabled.
2386 *       -ENODATA        the buffer does NOT contain a valid PDA.
2387 *                       Either the card PDA is bad, or the auxdata
2388 *                       reads are giving us garbage.
2389
2390 *
2391 * Side effects:
2392 *
2393 * Call context:
2394 *       process or non-card interrupt.
2395 ----------------------------------------------------------------*/
2396 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2397 {
2398         int result = 0;
2399         u16 *pda = buf;
2400         int pdaok = 0;
2401         int morepdrs = 1;
2402         int currpdr = 0;        /* word offset of the current pdr */
2403         size_t i;
2404         u16 pdrlen;             /* pdr length in bytes, host order */
2405         u16 pdrcode;            /* pdr code, host order */
2406         u16 currpage;
2407         u16 curroffset;
2408         struct pdaloc {
2409                 u32 cardaddr;
2410                 u16 auxctl;
2411         } pdaloc[] = {
2412                 {
2413                 HFA3842_PDA_BASE, 0}, {
2414                 HFA3841_PDA_BASE, 0}, {
2415                 HFA3841_PDA_BOGUS_BASE, 0}
2416         };
2417
2418         /* Read the pda from each known address.  */
2419         for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2420                 /* Make address */
2421                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2422                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2423
2424                 /* units of bytes */
2425                 result = hfa384x_dormem_wait(hw, currpage, curroffset, buf,
2426                                                 len);
2427
2428                 if (result) {
2429                         netdev_warn(hw->wlandev->netdev,
2430                                     "Read from index %zd failed, continuing\n",
2431                                     i);
2432                         continue;
2433                 }
2434
2435                 /* Test for garbage */
2436                 pdaok = 1;      /* initially assume good */
2437                 morepdrs = 1;
2438                 while (pdaok && morepdrs) {
2439                         pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2440                         pdrcode = le16_to_cpu(pda[currpdr + 1]);
2441                         /* Test the record length */
2442                         if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2443                                 netdev_err(hw->wlandev->netdev,
2444                                            "pdrlen invalid=%d\n", pdrlen);
2445                                 pdaok = 0;
2446                                 break;
2447                         }
2448                         /* Test the code */
2449                         if (!hfa384x_isgood_pdrcode(pdrcode)) {
2450                                 netdev_err(hw->wlandev->netdev, "pdrcode invalid=%d\n",
2451                                            pdrcode);
2452                                 pdaok = 0;
2453                                 break;
2454                         }
2455                         /* Test for completion */
2456                         if (pdrcode == HFA384x_PDR_END_OF_PDA)
2457                                 morepdrs = 0;
2458
2459                         /* Move to the next pdr (if necessary) */
2460                         if (morepdrs) {
2461                                 /* note the access to pda[], need words here */
2462                                 currpdr += le16_to_cpu(pda[currpdr]) + 1;
2463                         }
2464                 }
2465                 if (pdaok) {
2466                         netdev_info(hw->wlandev->netdev,
2467                                     "PDA Read from 0x%08x in %s space.\n",
2468                                     pdaloc[i].cardaddr,
2469                                     pdaloc[i].auxctl == 0 ? "EXTDS" :
2470                                     pdaloc[i].auxctl == 1 ? "NV" :
2471                                     pdaloc[i].auxctl == 2 ? "PHY" :
2472                                     pdaloc[i].auxctl == 3 ? "ICSRAM" :
2473                                     "<bogus auxctl>");
2474                         break;
2475                 }
2476         }
2477         result = pdaok ? 0 : -ENODATA;
2478
2479         if (result)
2480                 pr_debug("Failure: pda is not okay\n");
2481
2482         return result;
2483 }
2484
2485 /*----------------------------------------------------------------
2486 * hfa384x_drvr_setconfig
2487 *
2488 * Performs the sequence necessary to write a config/info item.
2489 *
2490 * Arguments:
2491 *       hw              device structure
2492 *       rid             config/info record id (in host order)
2493 *       buf             host side record buffer
2494 *       len             buffer length (in bytes)
2495 *
2496 * Returns:
2497 *       0               success
2498 *       >0              f/w reported error - f/w status code
2499 *       <0              driver reported error
2500 *
2501 * Side effects:
2502 *
2503 * Call context:
2504 *       process
2505 ----------------------------------------------------------------*/
2506 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2507 {
2508         return hfa384x_dowrid_wait(hw, rid, buf, len);
2509 }
2510
2511 /*----------------------------------------------------------------
2512 * hfa384x_drvr_start
2513 *
2514 * Issues the MAC initialize command, sets up some data structures,
2515 * and enables the interrupts.  After this function completes, the
2516 * low-level stuff should be ready for any/all commands.
2517 *
2518 * Arguments:
2519 *       hw              device structure
2520 * Returns:
2521 *       0               success
2522 *       >0              f/w reported error - f/w status code
2523 *       <0              driver reported error
2524 *
2525 * Side effects:
2526 *
2527 * Call context:
2528 *       process
2529 ----------------------------------------------------------------*/
2530
2531 int hfa384x_drvr_start(hfa384x_t *hw)
2532 {
2533         int result, result1, result2;
2534         u16 status;
2535
2536         might_sleep();
2537
2538         /* Clear endpoint stalls - but only do this if the endpoint
2539          * is showing a stall status. Some prism2 cards seem to behave
2540          * badly if a clear_halt is called when the endpoint is already
2541          * ok
2542          */
2543         result =
2544             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2545         if (result < 0) {
2546                 netdev_err(hw->wlandev->netdev, "Cannot get bulk in endpoint status.\n");
2547                 goto done;
2548         }
2549         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2550                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk in endpoint.\n");
2551
2552         result =
2553             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2554         if (result < 0) {
2555                 netdev_err(hw->wlandev->netdev, "Cannot get bulk out endpoint status.\n");
2556                 goto done;
2557         }
2558         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2559                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk out endpoint.\n");
2560
2561         /* Synchronous unlink, in case we're trying to restart the driver */
2562         usb_kill_urb(&hw->rx_urb);
2563
2564         /* Post the IN urb */
2565         result = submit_rx_urb(hw, GFP_KERNEL);
2566         if (result != 0) {
2567                 netdev_err(hw->wlandev->netdev,
2568                            "Fatal, failed to submit RX URB, result=%d\n",
2569                            result);
2570                 goto done;
2571         }
2572
2573         /* Call initialize twice, with a 1 second sleep in between.
2574          * This is a nasty work-around since many prism2 cards seem to
2575          * need time to settle after an init from cold. The second
2576          * call to initialize in theory is not necessary - but we call
2577          * it anyway as a double insurance policy:
2578          * 1) If the first init should fail, the second may well succeed
2579          *    and the card can still be used
2580          * 2) It helps ensures all is well with the card after the first
2581          *    init and settle time.
2582          */
2583         result1 = hfa384x_cmd_initialize(hw);
2584         msleep(1000);
2585         result = hfa384x_cmd_initialize(hw);
2586         result2 = result;
2587         if (result1 != 0) {
2588                 if (result2 != 0) {
2589                         netdev_err(hw->wlandev->netdev,
2590                                    "cmd_initialize() failed on two attempts, results %d and %d\n",
2591                                    result1, result2);
2592                         usb_kill_urb(&hw->rx_urb);
2593                         goto done;
2594                 } else {
2595                         pr_debug("First cmd_initialize() failed (result %d),\n",
2596                                  result1);
2597                         pr_debug("but second attempt succeeded. All should be ok\n");
2598                 }
2599         } else if (result2 != 0) {
2600                 netdev_warn(hw->wlandev->netdev, "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2601                             result2);
2602                 netdev_warn(hw->wlandev->netdev,
2603                             "Most likely the card will be functional\n");
2604                 goto done;
2605         }
2606
2607         hw->state = HFA384x_STATE_RUNNING;
2608
2609 done:
2610         return result;
2611 }
2612
2613 /*----------------------------------------------------------------
2614 * hfa384x_drvr_stop
2615 *
2616 * Shuts down the MAC to the point where it is safe to unload the
2617 * driver.  Any subsystem that may be holding a data or function
2618 * ptr into the driver must be cleared/deinitialized.
2619 *
2620 * Arguments:
2621 *       hw              device structure
2622 * Returns:
2623 *       0               success
2624 *       >0              f/w reported error - f/w status code
2625 *       <0              driver reported error
2626 *
2627 * Side effects:
2628 *
2629 * Call context:
2630 *       process
2631 ----------------------------------------------------------------*/
2632 int hfa384x_drvr_stop(hfa384x_t *hw)
2633 {
2634         int i;
2635
2636         might_sleep();
2637
2638         /* There's no need for spinlocks here. The USB "disconnect"
2639          * function sets this "removed" flag and then calls us.
2640          */
2641         if (!hw->wlandev->hwremoved) {
2642                 /* Call initialize to leave the MAC in its 'reset' state */
2643                 hfa384x_cmd_initialize(hw);
2644
2645                 /* Cancel the rxurb */
2646                 usb_kill_urb(&hw->rx_urb);
2647         }
2648
2649         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2650         hw->state = HFA384x_STATE_INIT;
2651
2652         del_timer_sync(&hw->commsqual_timer);
2653
2654         /* Clear all the port status */
2655         for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2656                 hw->port_enabled[i] = 0;
2657
2658         return 0;
2659 }
2660
2661 /*----------------------------------------------------------------
2662 * hfa384x_drvr_txframe
2663 *
2664 * Takes a frame from prism2sta and queues it for transmission.
2665 *
2666 * Arguments:
2667 *       hw              device structure
2668 *       skb             packet buffer struct.  Contains an 802.11
2669 *                       data frame.
2670 *       p80211_hdr      points to the 802.11 header for the packet.
2671 * Returns:
2672 *       0               Success and more buffs available
2673 *       1               Success but no more buffs
2674 *       2               Allocation failure
2675 *       4               Buffer full or queue busy
2676 *
2677 * Side effects:
2678 *
2679 * Call context:
2680 *       interrupt
2681 ----------------------------------------------------------------*/
2682 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb,
2683                          union p80211_hdr *p80211_hdr,
2684                          struct p80211_metawep *p80211_wep)
2685 {
2686         int usbpktlen = sizeof(hfa384x_tx_frame_t);
2687         int result;
2688         int ret;
2689         char *ptr;
2690
2691         if (hw->tx_urb.status == -EINPROGRESS) {
2692                 netdev_warn(hw->wlandev->netdev, "TX URB already in use\n");
2693                 result = 3;
2694                 goto exit;
2695         }
2696
2697         /* Build Tx frame structure */
2698         /* Set up the control field */
2699         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2700
2701         /* Setup the usb type field */
2702         hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2703
2704         /* Set up the sw_support field to identify this frame */
2705         hw->txbuff.txfrm.desc.sw_support = 0x0123;
2706
2707 /* Tx complete and Tx exception disable per dleach.  Might be causing
2708  * buf depletion
2709  */
2710 /* #define DOEXC  SLP -- doboth breaks horribly under load, doexc less so. */
2711 #if defined(DOBOTH)
2712         hw->txbuff.txfrm.desc.tx_control =
2713             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2714             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2715 #elif defined(DOEXC)
2716         hw->txbuff.txfrm.desc.tx_control =
2717             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2718             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2719 #else
2720         hw->txbuff.txfrm.desc.tx_control =
2721             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2722             HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2723 #endif
2724         hw->txbuff.txfrm.desc.tx_control =
2725             cpu_to_le16(hw->txbuff.txfrm.desc.tx_control);
2726
2727         /* copy the header over to the txdesc */
2728         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr,
2729                sizeof(union p80211_hdr));
2730
2731         /* if we're using host WEP, increase size by IV+ICV */
2732         if (p80211_wep->data) {
2733                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2734                 usbpktlen += 8;
2735         } else {
2736                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2737         }
2738
2739         usbpktlen += skb->len;
2740
2741         /* copy over the WEP IV if we are using host WEP */
2742         ptr = hw->txbuff.txfrm.data;
2743         if (p80211_wep->data) {
2744                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2745                 ptr += sizeof(p80211_wep->iv);
2746                 memcpy(ptr, p80211_wep->data, skb->len);
2747         } else {
2748                 memcpy(ptr, skb->data, skb->len);
2749         }
2750         /* copy over the packet data */
2751         ptr += skb->len;
2752
2753         /* copy over the WEP ICV if we are using host WEP */
2754         if (p80211_wep->data)
2755                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2756
2757         /* Send the USB packet */
2758         usb_fill_bulk_urb(&(hw->tx_urb), hw->usb,
2759                           hw->endp_out,
2760                           &(hw->txbuff), ROUNDUP64(usbpktlen),
2761                           hfa384x_usbout_callback, hw->wlandev);
2762         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2763
2764         result = 1;
2765         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2766         if (ret != 0) {
2767                 netdev_err(hw->wlandev->netdev,
2768                            "submit_tx_urb() failed, error=%d\n", ret);
2769                 result = 3;
2770         }
2771
2772 exit:
2773         return result;
2774 }
2775
2776 void hfa384x_tx_timeout(wlandevice_t *wlandev)
2777 {
2778         hfa384x_t *hw = wlandev->priv;
2779         unsigned long flags;
2780
2781         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2782
2783         if (!hw->wlandev->hwremoved) {
2784                 int sched;
2785
2786                 sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2787                 sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2788                 if (sched)
2789                         schedule_work(&hw->usb_work);
2790         }
2791
2792         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2793 }
2794
2795 /*----------------------------------------------------------------
2796 * hfa384x_usbctlx_reaper_task
2797 *
2798 * Tasklet to delete dead CTLX objects
2799 *
2800 * Arguments:
2801 *       data    ptr to a hfa384x_t
2802 *
2803 * Returns:
2804 *
2805 * Call context:
2806 *       Interrupt
2807 ----------------------------------------------------------------*/
2808 static void hfa384x_usbctlx_reaper_task(unsigned long data)
2809 {
2810         hfa384x_t *hw = (hfa384x_t *)data;
2811         struct list_head *entry;
2812         struct list_head *temp;
2813         unsigned long flags;
2814
2815         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2816
2817         /* This list is guaranteed to be empty if someone
2818          * has unplugged the adapter.
2819          */
2820         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
2821                 hfa384x_usbctlx_t *ctlx;
2822
2823                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2824                 list_del(&ctlx->list);
2825                 kfree(ctlx);
2826         }
2827
2828         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2829 }
2830
2831 /*----------------------------------------------------------------
2832 * hfa384x_usbctlx_completion_task
2833 *
2834 * Tasklet to call completion handlers for returned CTLXs
2835 *
2836 * Arguments:
2837 *       data    ptr to hfa384x_t
2838 *
2839 * Returns:
2840 *       Nothing
2841 *
2842 * Call context:
2843 *       Interrupt
2844 ----------------------------------------------------------------*/
2845 static void hfa384x_usbctlx_completion_task(unsigned long data)
2846 {
2847         hfa384x_t *hw = (hfa384x_t *)data;
2848         struct list_head *entry;
2849         struct list_head *temp;
2850         unsigned long flags;
2851
2852         int reap = 0;
2853
2854         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2855
2856         /* This list is guaranteed to be empty if someone
2857          * has unplugged the adapter ...
2858          */
2859         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
2860                 hfa384x_usbctlx_t *ctlx;
2861
2862                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2863
2864                 /* Call the completion function that this
2865                  * command was assigned, assuming it has one.
2866                  */
2867                 if (ctlx->cmdcb != NULL) {
2868                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2869                         ctlx->cmdcb(hw, ctlx);
2870                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2871
2872                         /* Make sure we don't try and complete
2873                          * this CTLX more than once!
2874                          */
2875                         ctlx->cmdcb = NULL;
2876
2877                         /* Did someone yank the adapter out
2878                          * while our list was (briefly) unlocked?
2879                          */
2880                         if (hw->wlandev->hwremoved) {
2881                                 reap = 0;
2882                                 break;
2883                         }
2884                 }
2885
2886                 /*
2887                  * "Reapable" CTLXs are ones which don't have any
2888                  * threads waiting for them to die. Hence they must
2889                  * be delivered to The Reaper!
2890                  */
2891                 if (ctlx->reapable) {
2892                         /* Move the CTLX off the "completing" list (hopefully)
2893                          * on to the "reapable" list where the reaper task
2894                          * can find it. And "reapable" means that this CTLX
2895                          * isn't sitting on a wait-queue somewhere.
2896                          */
2897                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2898                         reap = 1;
2899                 }
2900
2901                 complete(&ctlx->done);
2902         }
2903         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2904
2905         if (reap)
2906                 tasklet_schedule(&hw->reaper_bh);
2907 }
2908
2909 /*----------------------------------------------------------------
2910 * unlocked_usbctlx_cancel_async
2911 *
2912 * Mark the CTLX dead asynchronously, and ensure that the
2913 * next command on the queue is run afterwards.
2914 *
2915 * Arguments:
2916 *       hw      ptr to the hfa384x_t structure
2917 *       ctlx    ptr to a CTLX structure
2918 *
2919 * Returns:
2920 *       0       the CTLX's URB is inactive
2921 * -EINPROGRESS  the URB is currently being unlinked
2922 *
2923 * Call context:
2924 *       Either process or interrupt, but presumably interrupt
2925 ----------------------------------------------------------------*/
2926 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw,
2927                                          hfa384x_usbctlx_t *ctlx)
2928 {
2929         int ret;
2930
2931         /*
2932          * Try to delete the URB containing our request packet.
2933          * If we succeed, then its completion handler will be
2934          * called with a status of -ECONNRESET.
2935          */
2936         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2937         ret = usb_unlink_urb(&hw->ctlx_urb);
2938
2939         if (ret != -EINPROGRESS) {
2940                 /*
2941                  * The OUT URB had either already completed
2942                  * or was still in the pending queue, so the
2943                  * URB's completion function will not be called.
2944                  * We will have to complete the CTLX ourselves.
2945                  */
2946                 ctlx->state = CTLX_REQ_FAILED;
2947                 unlocked_usbctlx_complete(hw, ctlx);
2948                 ret = 0;
2949         }
2950
2951         return ret;
2952 }
2953
2954 /*----------------------------------------------------------------
2955 * unlocked_usbctlx_complete
2956 *
2957 * A CTLX has completed.  It may have been successful, it may not
2958 * have been. At this point, the CTLX should be quiescent.  The URBs
2959 * aren't active and the timers should have been stopped.
2960 *
2961 * The CTLX is migrated to the "completing" queue, and the completing
2962 * tasklet is scheduled.
2963 *
2964 * Arguments:
2965 *       hw              ptr to a hfa384x_t structure
2966 *       ctlx            ptr to a ctlx structure
2967 *
2968 * Returns:
2969 *       nothing
2970 *
2971 * Side effects:
2972 *
2973 * Call context:
2974 *       Either, assume interrupt
2975 ----------------------------------------------------------------*/
2976 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
2977 {
2978         /* Timers have been stopped, and ctlx should be in
2979          * a terminal state. Retire it from the "active"
2980          * queue.
2981          */
2982         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
2983         tasklet_schedule(&hw->completion_bh);
2984
2985         switch (ctlx->state) {
2986         case CTLX_COMPLETE:
2987         case CTLX_REQ_FAILED:
2988                 /* This are the correct terminating states. */
2989                 break;
2990
2991         default:
2992                 netdev_err(hw->wlandev->netdev, "CTLX[%d] not in a terminating state(%s)\n",
2993                            le16_to_cpu(ctlx->outbuf.type),
2994                            ctlxstr(ctlx->state));
2995                 break;
2996         }                       /* switch */
2997 }
2998
2999 /*----------------------------------------------------------------
3000 * hfa384x_usbctlxq_run
3001 *
3002 * Checks to see if the head item is running.  If not, starts it.
3003 *
3004 * Arguments:
3005 *       hw      ptr to hfa384x_t
3006 *
3007 * Returns:
3008 *       nothing
3009 *
3010 * Side effects:
3011 *
3012 * Call context:
3013 *       any
3014 ----------------------------------------------------------------*/
3015 static void hfa384x_usbctlxq_run(hfa384x_t *hw)
3016 {
3017         unsigned long flags;
3018
3019         /* acquire lock */
3020         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3021
3022         /* Only one active CTLX at any one time, because there's no
3023          * other (reliable) way to match the response URB to the
3024          * correct CTLX.
3025          *
3026          * Don't touch any of these CTLXs if the hardware
3027          * has been removed or the USB subsystem is stalled.
3028          */
3029         if (!list_empty(&hw->ctlxq.active) ||
3030             test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
3031                 goto unlock;
3032
3033         while (!list_empty(&hw->ctlxq.pending)) {
3034                 hfa384x_usbctlx_t *head;
3035                 int result;
3036
3037                 /* This is the first pending command */
3038                 head = list_entry(hw->ctlxq.pending.next,
3039                                   hfa384x_usbctlx_t, list);
3040
3041                 /* We need to split this off to avoid a race condition */
3042                 list_move_tail(&head->list, &hw->ctlxq.active);
3043
3044                 /* Fill the out packet */
3045                 usb_fill_bulk_urb(&(hw->ctlx_urb), hw->usb,
3046                                   hw->endp_out,
3047                                   &(head->outbuf), ROUNDUP64(head->outbufsize),
3048                                   hfa384x_ctlxout_callback, hw);
3049                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3050
3051                 /* Now submit the URB and update the CTLX's state */
3052                 result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC);
3053                 if (result == 0) {
3054                         /* This CTLX is now running on the active queue */
3055                         head->state = CTLX_REQ_SUBMITTED;
3056
3057                         /* Start the OUT wait timer */
3058                         hw->req_timer_done = 0;
3059                         hw->reqtimer.expires = jiffies + HZ;
3060                         add_timer(&hw->reqtimer);
3061
3062                         /* Start the IN wait timer */
3063                         hw->resp_timer_done = 0;
3064                         hw->resptimer.expires = jiffies + 2 * HZ;
3065                         add_timer(&hw->resptimer);
3066
3067                         break;
3068                 }
3069
3070                 if (result == -EPIPE) {
3071                         /* The OUT pipe needs resetting, so put
3072                          * this CTLX back in the "pending" queue
3073                          * and schedule a reset ...
3074                          */
3075                         netdev_warn(hw->wlandev->netdev,
3076                                     "%s tx pipe stalled: requesting reset\n",
3077                                     hw->wlandev->netdev->name);
3078                         list_move(&head->list, &hw->ctlxq.pending);
3079                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3080                         schedule_work(&hw->usb_work);
3081                         break;
3082                 }
3083
3084                 if (result == -ESHUTDOWN) {
3085                         netdev_warn(hw->wlandev->netdev, "%s urb shutdown!\n",
3086                                     hw->wlandev->netdev->name);
3087                         break;
3088                 }
3089
3090                 netdev_err(hw->wlandev->netdev, "Failed to submit CTLX[%d]: error=%d\n",
3091                            le16_to_cpu(head->outbuf.type), result);
3092                 unlocked_usbctlx_complete(hw, head);
3093         }                       /* while */
3094
3095 unlock:
3096         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3097 }
3098
3099 /*----------------------------------------------------------------
3100 * hfa384x_usbin_callback
3101 *
3102 * Callback for URBs on the BULKIN endpoint.
3103 *
3104 * Arguments:
3105 *       urb             ptr to the completed urb
3106 *
3107 * Returns:
3108 *       nothing
3109 *
3110 * Side effects:
3111 *
3112 * Call context:
3113 *       interrupt
3114 ----------------------------------------------------------------*/
3115 static void hfa384x_usbin_callback(struct urb *urb)
3116 {
3117         wlandevice_t *wlandev = urb->context;
3118         hfa384x_t *hw;
3119         hfa384x_usbin_t *usbin = (hfa384x_usbin_t *)urb->transfer_buffer;
3120         struct sk_buff *skb = NULL;
3121         int result;
3122         int urb_status;
3123         u16 type;
3124
3125         enum USBIN_ACTION {
3126                 HANDLE,
3127                 RESUBMIT,
3128                 ABORT
3129         } action;
3130
3131         if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
3132                 goto exit;
3133
3134         hw = wlandev->priv;
3135         if (!hw)
3136                 goto exit;
3137
3138         skb = hw->rx_urb_skb;
3139         BUG_ON(!skb || (skb->data != urb->transfer_buffer));
3140
3141         hw->rx_urb_skb = NULL;
3142
3143         /* Check for error conditions within the URB */
3144         switch (urb->status) {
3145         case 0:
3146                 action = HANDLE;
3147
3148                 /* Check for short packet */
3149                 if (urb->actual_length == 0) {
3150                         wlandev->netdev->stats.rx_errors++;
3151                         wlandev->netdev->stats.rx_length_errors++;
3152                         action = RESUBMIT;
3153                 }
3154                 break;
3155
3156         case -EPIPE:
3157                 netdev_warn(hw->wlandev->netdev, "%s rx pipe stalled: requesting reset\n",
3158                             wlandev->netdev->name);
3159                 if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
3160                         schedule_work(&hw->usb_work);
3161                 wlandev->netdev->stats.rx_errors++;
3162                 action = ABORT;
3163                 break;
3164
3165         case -EILSEQ:
3166         case -ETIMEDOUT:
3167         case -EPROTO:
3168                 if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3169                     !timer_pending(&hw->throttle)) {
3170                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3171                 }
3172                 wlandev->netdev->stats.rx_errors++;
3173                 action = ABORT;
3174                 break;
3175
3176         case -EOVERFLOW:
3177                 wlandev->netdev->stats.rx_over_errors++;
3178                 action = RESUBMIT;
3179                 break;
3180
3181         case -ENODEV:
3182         case -ESHUTDOWN:
3183                 pr_debug("status=%d, device removed.\n", urb->status);
3184                 action = ABORT;
3185                 break;
3186
3187         case -ENOENT:
3188         case -ECONNRESET:
3189                 pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
3190                 action = ABORT;
3191                 break;
3192
3193         default:
3194                 pr_debug("urb status=%d, transfer flags=0x%x\n",
3195                          urb->status, urb->transfer_flags);
3196                 wlandev->netdev->stats.rx_errors++;
3197                 action = RESUBMIT;
3198                 break;
3199         }
3200
3201         urb_status = urb->status;
3202
3203         if (action != ABORT) {
3204                 /* Repost the RX URB */
3205                 result = submit_rx_urb(hw, GFP_ATOMIC);
3206
3207                 if (result != 0) {
3208                         netdev_err(hw->wlandev->netdev,
3209                                    "Fatal, failed to resubmit rx_urb. error=%d\n",
3210                                    result);
3211                 }
3212         }
3213
3214         /* Handle any USB-IN packet */
3215         /* Note: the check of the sw_support field, the type field doesn't
3216          *       have bit 12 set like the docs suggest.
3217          */
3218         type = le16_to_cpu(usbin->type);
3219         if (HFA384x_USB_ISRXFRM(type)) {
3220                 if (action == HANDLE) {
3221                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3222                                 hfa384x_usbin_txcompl(wlandev, usbin);
3223                         } else {
3224                                 skb_put(skb, sizeof(*usbin));
3225                                 hfa384x_usbin_rx(wlandev, skb);
3226                                 skb = NULL;
3227                         }
3228                 }
3229                 goto exit;
3230         }
3231         if (HFA384x_USB_ISTXFRM(type)) {
3232                 if (action == HANDLE)
3233                         hfa384x_usbin_txcompl(wlandev, usbin);
3234                 goto exit;
3235         }
3236         switch (type) {
3237         case HFA384x_USB_INFOFRM:
3238                 if (action == ABORT)
3239                         goto exit;
3240                 if (action == HANDLE)
3241                         hfa384x_usbin_info(wlandev, usbin);
3242                 break;
3243
3244         case HFA384x_USB_CMDRESP:
3245         case HFA384x_USB_WRIDRESP:
3246         case HFA384x_USB_RRIDRESP:
3247         case HFA384x_USB_WMEMRESP:
3248         case HFA384x_USB_RMEMRESP:
3249                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3250                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3251                 break;
3252
3253         case HFA384x_USB_BUFAVAIL:
3254                 pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3255                          usbin->bufavail.frmlen);
3256                 break;
3257
3258         case HFA384x_USB_ERROR:
3259                 pr_debug("Received USB_ERROR packet, errortype=%d\n",
3260                          usbin->usberror.errortype);
3261                 break;
3262
3263         default:
3264                 pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3265                          usbin->type, urb_status);
3266                 break;
3267         }                       /* switch */
3268
3269 exit:
3270
3271         if (skb)
3272                 dev_kfree_skb(skb);
3273 }
3274
3275 /*----------------------------------------------------------------
3276 * hfa384x_usbin_ctlx
3277 *
3278 * We've received a URB containing a Prism2 "response" message.
3279 * This message needs to be matched up with a CTLX on the active
3280 * queue and our state updated accordingly.
3281 *
3282 * Arguments:
3283 *       hw              ptr to hfa384x_t
3284 *       usbin           ptr to USB IN packet
3285 *       urb_status      status of this Bulk-In URB
3286 *
3287 * Returns:
3288 *       nothing
3289 *
3290 * Side effects:
3291 *
3292 * Call context:
3293 *       interrupt
3294 ----------------------------------------------------------------*/
3295 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3296                                int urb_status)
3297 {
3298         hfa384x_usbctlx_t *ctlx;
3299         int run_queue = 0;
3300         unsigned long flags;
3301
3302 retry:
3303         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3304
3305         /* There can be only one CTLX on the active queue
3306          * at any one time, and this is the CTLX that the
3307          * timers are waiting for.
3308          */
3309         if (list_empty(&hw->ctlxq.active))
3310                 goto unlock;
3311
3312         /* Remove the "response timeout". It's possible that
3313          * we are already too late, and that the timeout is
3314          * already running. And that's just too bad for us,
3315          * because we could lose our CTLX from the active
3316          * queue here ...
3317          */
3318         if (del_timer(&hw->resptimer) == 0) {
3319                 if (hw->resp_timer_done == 0) {
3320                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3321                         goto retry;
3322                 }
3323         } else {
3324                 hw->resp_timer_done = 1;
3325         }
3326
3327         ctlx = get_active_ctlx(hw);
3328
3329         if (urb_status != 0) {
3330                 /*
3331                  * Bad CTLX, so get rid of it. But we only
3332                  * remove it from the active queue if we're no
3333                  * longer expecting the OUT URB to complete.
3334                  */
3335                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3336                         run_queue = 1;
3337         } else {
3338                 const __le16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3339
3340                 /*
3341                  * Check that our message is what we're expecting ...
3342                  */
3343                 if (ctlx->outbuf.type != intype) {
3344                         netdev_warn(hw->wlandev->netdev,
3345                                     "Expected IN[%d], received IN[%d] - ignored.\n",
3346                                     le16_to_cpu(ctlx->outbuf.type),
3347                                     le16_to_cpu(intype));
3348                         goto unlock;
3349                 }
3350
3351                 /* This URB has succeeded, so grab the data ... */
3352                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3353
3354                 switch (ctlx->state) {
3355                 case CTLX_REQ_SUBMITTED:
3356                         /*
3357                          * We have received our response URB before
3358                          * our request has been acknowledged. Odd,
3359                          * but our OUT URB is still alive...
3360                          */
3361                         pr_debug("Causality violation: please reboot Universe\n");
3362                         ctlx->state = CTLX_RESP_COMPLETE;
3363                         break;
3364
3365                 case CTLX_REQ_COMPLETE:
3366                         /*
3367                          * This is the usual path: our request
3368                          * has already been acknowledged, and
3369                          * now we have received the reply too.
3370                          */
3371                         ctlx->state = CTLX_COMPLETE;
3372                         unlocked_usbctlx_complete(hw, ctlx);
3373                         run_queue = 1;
3374                         break;
3375
3376                 default:
3377                         /*
3378                          * Throw this CTLX away ...
3379                          */
3380                         netdev_err(hw->wlandev->netdev,
3381                                    "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3382                                    le16_to_cpu(ctlx->outbuf.type),
3383                                    ctlxstr(ctlx->state));
3384                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3385                                 run_queue = 1;
3386                         break;
3387                 }               /* switch */
3388         }
3389
3390 unlock:
3391         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3392
3393         if (run_queue)
3394                 hfa384x_usbctlxq_run(hw);
3395 }
3396
3397 /*----------------------------------------------------------------
3398 * hfa384x_usbin_txcompl
3399 *
3400 * At this point we have the results of a previous transmit.
3401 *
3402 * Arguments:
3403 *       wlandev         wlan device
3404 *       usbin           ptr to the usb transfer buffer
3405 *
3406 * Returns:
3407 *       nothing
3408 *
3409 * Side effects:
3410 *
3411 * Call context:
3412 *       interrupt
3413 ----------------------------------------------------------------*/
3414 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev,
3415                                   hfa384x_usbin_t *usbin)
3416 {
3417         u16 status;
3418
3419         status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3420
3421         /* Was there an error? */
3422         if (HFA384x_TXSTATUS_ISERROR(status))
3423                 prism2sta_ev_txexc(wlandev, status);
3424         else
3425                 prism2sta_ev_tx(wlandev, status);
3426 }
3427
3428 /*----------------------------------------------------------------
3429 * hfa384x_usbin_rx
3430 *
3431 * At this point we have a successful received a rx frame packet.
3432 *
3433 * Arguments:
3434 *       wlandev         wlan device
3435 *       usbin           ptr to the usb transfer buffer
3436 *
3437 * Returns:
3438 *       nothing
3439 *
3440 * Side effects:
3441 *
3442 * Call context:
3443 *       interrupt
3444 ----------------------------------------------------------------*/
3445 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
3446 {
3447         hfa384x_usbin_t *usbin = (hfa384x_usbin_t *)skb->data;
3448         hfa384x_t *hw = wlandev->priv;
3449         int hdrlen;
3450         struct p80211_rxmeta *rxmeta;
3451         u16 data_len;
3452         u16 fc;
3453
3454         /* Byte order convert once up front. */
3455         usbin->rxfrm.desc.status = le16_to_cpu(usbin->rxfrm.desc.status);
3456         usbin->rxfrm.desc.time = le32_to_cpu(usbin->rxfrm.desc.time);
3457
3458         /* Now handle frame based on port# */
3459         switch (HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status)) {
3460         case 0:
3461                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3462
3463                 /* If exclude and we receive an unencrypted, drop it */
3464                 if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3465                     !WLAN_GET_FC_ISWEP(fc)) {
3466                         break;
3467                 }
3468
3469                 data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3470
3471                 /* How much header data do we have? */
3472                 hdrlen = p80211_headerlen(fc);
3473
3474                 /* Pull off the descriptor */
3475                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
3476
3477                 /* Now shunt the header block up against the data block
3478                  * with an "overlapping" copy
3479                  */
3480                 memmove(skb_push(skb, hdrlen),
3481                         &usbin->rxfrm.desc.frame_control, hdrlen);
3482
3483                 skb->dev = wlandev->netdev;
3484                 skb->dev->last_rx = jiffies;
3485
3486                 /* And set the frame length properly */
3487                 skb_trim(skb, data_len + hdrlen);
3488
3489                 /* The prism2 series does not return the CRC */
3490                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3491
3492                 skb_reset_mac_header(skb);
3493
3494                 /* Attach the rxmeta, set some stuff */
3495                 p80211skb_rxmeta_attach(wlandev, skb);
3496                 rxmeta = P80211SKB_RXMETA(skb);
3497                 rxmeta->mactime = usbin->rxfrm.desc.time;
3498                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3499                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3500                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3501
3502                 prism2sta_ev_rx(wlandev, skb);
3503
3504                 break;
3505
3506         case 7:
3507                 if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3508                         /* Copy to wlansnif skb */
3509                         hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3510                         dev_kfree_skb(skb);
3511                 } else {
3512                         pr_debug("Received monitor frame: FCSerr set\n");
3513                 }
3514                 break;
3515
3516         default:
3517                 netdev_warn(hw->wlandev->netdev, "Received frame on unsupported port=%d\n",
3518                             HFA384x_RXSTATUS_MACPORT_GET(
3519                                     usbin->rxfrm.desc.status));
3520                 break;
3521         }
3522 }
3523
3524 /*----------------------------------------------------------------
3525 * hfa384x_int_rxmonitor
3526 *
3527 * Helper function for int_rx.  Handles monitor frames.
3528 * Note that this function allocates space for the FCS and sets it
3529 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3530 * higher layers expect it.  0xffffffff is used as a flag to indicate
3531 * the FCS is bogus.
3532 *
3533 * Arguments:
3534 *       wlandev         wlan device structure
3535 *       rxfrm           rx descriptor read from card in int_rx
3536 *
3537 * Returns:
3538 *       nothing
3539 *
3540 * Side effects:
3541 *       Allocates an skb and passes it up via the PF_PACKET interface.
3542 * Call context:
3543 *       interrupt
3544 ----------------------------------------------------------------*/
3545 static void hfa384x_int_rxmonitor(wlandevice_t *wlandev,
3546                                   hfa384x_usb_rxfrm_t *rxfrm)
3547 {
3548         hfa384x_rx_frame_t *rxdesc = &(rxfrm->desc);
3549         unsigned int hdrlen = 0;
3550         unsigned int datalen = 0;
3551         unsigned int skblen = 0;
3552         u8 *datap;
3553         u16 fc;
3554         struct sk_buff *skb;
3555         hfa384x_t *hw = wlandev->priv;
3556
3557         /* Remember the status, time, and data_len fields are in host order */
3558         /* Figure out how big the frame is */
3559         fc = le16_to_cpu(rxdesc->frame_control);
3560         hdrlen = p80211_headerlen(fc);
3561         datalen = le16_to_cpu(rxdesc->data_len);
3562
3563         /* Allocate an ind message+framesize skb */
3564         skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3565
3566         /* sanity check the length */
3567         if (skblen >
3568             (sizeof(struct p80211_caphdr) +
3569              WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3570                 pr_debug("overlen frm: len=%zd\n",
3571                          skblen - sizeof(struct p80211_caphdr));
3572
3573                 return;
3574         }
3575
3576         skb = dev_alloc_skb(skblen);
3577         if (skb == NULL)
3578                 return;
3579
3580         /* only prepend the prism header if in the right mode */
3581         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3582             (hw->sniffhdr != 0)) {
3583                 struct p80211_caphdr *caphdr;
3584                 /* The NEW header format! */
3585                 datap = skb_put(skb, sizeof(struct p80211_caphdr));
3586                 caphdr = (struct p80211_caphdr *)datap;
3587
3588                 caphdr->version = htonl(P80211CAPTURE_VERSION);
3589                 caphdr->length = htonl(sizeof(struct p80211_caphdr));
3590                 caphdr->mactime = __cpu_to_be64(rxdesc->time) * 1000;
3591                 caphdr->hosttime = __cpu_to_be64(jiffies);
3592                 caphdr->phytype = htonl(4);     /* dss_dot11_b */
3593                 caphdr->channel = htonl(hw->sniff_channel);
3594                 caphdr->datarate = htonl(rxdesc->rate);
3595                 caphdr->antenna = htonl(0);     /* unknown */
3596                 caphdr->priority = htonl(0);    /* unknown */
3597                 caphdr->ssi_type = htonl(3);    /* rssi_raw */
3598                 caphdr->ssi_signal = htonl(rxdesc->signal);
3599                 caphdr->ssi_noise = htonl(rxdesc->silence);
3600                 caphdr->preamble = htonl(0);    /* unknown */
3601                 caphdr->encoding = htonl(1);    /* cck */
3602         }
3603
3604         /* Copy the 802.11 header to the skb
3605            (ctl frames may be less than a full header) */
3606         datap = skb_put(skb, hdrlen);
3607         memcpy(datap, &(rxdesc->frame_control), hdrlen);
3608
3609         /* If any, copy the data from the card to the skb */
3610         if (datalen > 0) {
3611                 datap = skb_put(skb, datalen);
3612                 memcpy(datap, rxfrm->data, datalen);
3613
3614                 /* check for unencrypted stuff if WEP bit set. */
3615                 if (*(datap - hdrlen + 1) & 0x40)       /* wep set */
3616                         if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3617                                 /* clear wep; it's the 802.2 header! */
3618                                 *(datap - hdrlen + 1) &= 0xbf;
3619         }
3620
3621         if (hw->sniff_fcs) {
3622                 /* Set the FCS */
3623                 datap = skb_put(skb, WLAN_CRC_LEN);
3624                 memset(datap, 0xff, WLAN_CRC_LEN);
3625         }
3626
3627         /* pass it back up */
3628         prism2sta_ev_rx(wlandev, skb);
3629 }
3630
3631 /*----------------------------------------------------------------
3632 * hfa384x_usbin_info
3633 *
3634 * At this point we have a successful received a Prism2 info frame.
3635 *
3636 * Arguments:
3637 *       wlandev         wlan device
3638 *       usbin           ptr to the usb transfer buffer
3639 *
3640 * Returns:
3641 *       nothing
3642 *
3643 * Side effects:
3644 *
3645 * Call context:
3646 *       interrupt
3647 ----------------------------------------------------------------*/
3648 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3649 {
3650         usbin->infofrm.info.framelen =
3651             le16_to_cpu(usbin->infofrm.info.framelen);
3652         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3653 }
3654
3655 /*----------------------------------------------------------------
3656 * hfa384x_usbout_callback
3657 *
3658 * Callback for URBs on the BULKOUT endpoint.
3659 *
3660 * Arguments:
3661 *       urb             ptr to the completed urb
3662 *
3663 * Returns:
3664 *       nothing
3665 *
3666 * Side effects:
3667 *
3668 * Call context:
3669 *       interrupt
3670 ----------------------------------------------------------------*/
3671 static void hfa384x_usbout_callback(struct urb *urb)
3672 {
3673         wlandevice_t *wlandev = urb->context;
3674         hfa384x_usbout_t *usbout = urb->transfer_buffer;
3675
3676 #ifdef DEBUG_USB
3677         dbprint_urb(urb);
3678 #endif
3679
3680         if (wlandev && wlandev->netdev) {
3681                 switch (urb->status) {
3682                 case 0:
3683                         hfa384x_usbout_tx(wlandev, usbout);
3684                         break;
3685
3686                 case -EPIPE:
3687                         {
3688                                 hfa384x_t *hw = wlandev->priv;
3689
3690                                 netdev_warn(hw->wlandev->netdev,
3691                                             "%s tx pipe stalled: requesting reset\n",
3692                                             wlandev->netdev->name);
3693                                 if (!test_and_set_bit
3694                                     (WORK_TX_HALT, &hw->usb_flags))
3695                                         schedule_work(&hw->usb_work);
3696                                 wlandev->netdev->stats.tx_errors++;
3697                                 break;
3698                         }
3699
3700                 case -EPROTO:
3701                 case -ETIMEDOUT:
3702                 case -EILSEQ:
3703                         {
3704                                 hfa384x_t *hw = wlandev->priv;
3705
3706                                 if (!test_and_set_bit
3707                                     (THROTTLE_TX, &hw->usb_flags) &&
3708                                     !timer_pending(&hw->throttle)) {
3709                                         mod_timer(&hw->throttle,
3710                                                   jiffies + THROTTLE_JIFFIES);
3711                                 }
3712                                 wlandev->netdev->stats.tx_errors++;
3713                                 netif_stop_queue(wlandev->netdev);
3714                                 break;
3715                         }
3716
3717                 case -ENOENT:
3718                 case -ESHUTDOWN:
3719                         /* Ignorable errors */
3720                         break;
3721
3722                 default:
3723                         netdev_info(wlandev->netdev, "unknown urb->status=%d\n",
3724                                     urb->status);
3725                         wlandev->netdev->stats.tx_errors++;
3726                         break;
3727                 }               /* switch */
3728         }
3729 }
3730
3731 /*----------------------------------------------------------------
3732 * hfa384x_ctlxout_callback
3733 *
3734 * Callback for control data on the BULKOUT endpoint.
3735 *
3736 * Arguments:
3737 *       urb             ptr to the completed urb
3738 *
3739 * Returns:
3740 * nothing
3741 *
3742 * Side effects:
3743 *
3744 * Call context:
3745 * interrupt
3746 ----------------------------------------------------------------*/
3747 static void hfa384x_ctlxout_callback(struct urb *urb)
3748 {
3749         hfa384x_t *hw = urb->context;
3750         int delete_resptimer = 0;
3751         int timer_ok = 1;
3752         int run_queue = 0;
3753         hfa384x_usbctlx_t *ctlx;
3754         unsigned long flags;
3755
3756         pr_debug("urb->status=%d\n", urb->status);
3757 #ifdef DEBUG_USB
3758         dbprint_urb(urb);
3759 #endif
3760         if ((urb->status == -ESHUTDOWN) ||
3761             (urb->status == -ENODEV) || (hw == NULL))
3762                 return;
3763
3764 retry:
3765         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3766
3767         /*
3768          * Only one CTLX at a time on the "active" list, and
3769          * none at all if we are unplugged. However, we can
3770          * rely on the disconnect function to clean everything
3771          * up if someone unplugged the adapter.
3772          */
3773         if (list_empty(&hw->ctlxq.active)) {
3774                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3775                 return;
3776         }
3777
3778         /*
3779          * Having something on the "active" queue means
3780          * that we have timers to worry about ...
3781          */
3782         if (del_timer(&hw->reqtimer) == 0) {
3783                 if (hw->req_timer_done == 0) {
3784                         /*
3785                          * This timer was actually running while we
3786                          * were trying to delete it. Let it terminate
3787                          * gracefully instead.
3788                          */
3789                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3790                         goto retry;
3791                 }
3792         } else {
3793                 hw->req_timer_done = 1;
3794         }
3795
3796         ctlx = get_active_ctlx(hw);
3797
3798         if (urb->status == 0) {
3799                 /* Request portion of a CTLX is successful */
3800                 switch (ctlx->state) {
3801                 case CTLX_REQ_SUBMITTED:
3802                         /* This OUT-ACK received before IN */
3803                         ctlx->state = CTLX_REQ_COMPLETE;
3804                         break;
3805
3806                 case CTLX_RESP_COMPLETE:
3807                         /* IN already received before this OUT-ACK,
3808                          * so this command must now be complete.
3809                          */
3810                         ctlx->state = CTLX_COMPLETE;
3811                         unlocked_usbctlx_complete(hw, ctlx);
3812                         run_queue = 1;
3813                         break;
3814
3815                 default:
3816                         /* This is NOT a valid CTLX "success" state! */
3817                         netdev_err(hw->wlandev->netdev,
3818                                    "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3819                                    le16_to_cpu(ctlx->outbuf.type),
3820                                    ctlxstr(ctlx->state), urb->status);
3821                         break;
3822                 }               /* switch */
3823         } else {
3824                 /* If the pipe has stalled then we need to reset it */
3825                 if ((urb->status == -EPIPE) &&
3826                     !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3827                         netdev_warn(hw->wlandev->netdev,
3828                                     "%s tx pipe stalled: requesting reset\n",
3829                                     hw->wlandev->netdev->name);
3830                         schedule_work(&hw->usb_work);
3831                 }
3832
3833                 /* If someone cancels the OUT URB then its status
3834                  * should be either -ECONNRESET or -ENOENT.
3835                  */
3836                 ctlx->state = CTLX_REQ_FAILED;
3837                 unlocked_usbctlx_complete(hw, ctlx);
3838                 delete_resptimer = 1;
3839                 run_queue = 1;
3840         }
3841
3842 delresp:
3843         if (delete_resptimer) {
3844                 timer_ok = del_timer(&hw->resptimer);
3845                 if (timer_ok != 0)
3846                         hw->resp_timer_done = 1;
3847         }
3848
3849         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3850
3851         if (!timer_ok && (hw->resp_timer_done == 0)) {
3852                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
3853                 goto delresp;
3854         }
3855
3856         if (run_queue)
3857                 hfa384x_usbctlxq_run(hw);
3858 }
3859
3860 /*----------------------------------------------------------------
3861 * hfa384x_usbctlx_reqtimerfn
3862 *
3863 * Timer response function for CTLX request timeouts.  If this
3864 * function is called, it means that the callback for the OUT
3865 * URB containing a Prism2.x XXX_Request was never called.
3866 *
3867 * Arguments:
3868 *       data            a ptr to the hfa384x_t
3869 *
3870 * Returns:
3871 *       nothing
3872 *
3873 * Side effects:
3874 *
3875 * Call context:
3876 *       interrupt
3877 ----------------------------------------------------------------*/
3878 static void hfa384x_usbctlx_reqtimerfn(unsigned long data)
3879 {
3880         hfa384x_t *hw = (hfa384x_t *)data;
3881         unsigned long flags;
3882
3883         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3884
3885         hw->req_timer_done = 1;
3886
3887         /* Removing the hardware automatically empties
3888          * the active list ...
3889          */
3890         if (!list_empty(&hw->ctlxq.active)) {
3891                 /*
3892                  * We must ensure that our URB is removed from
3893                  * the system, if it hasn't already expired.
3894                  */
3895                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3896                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3897                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3898
3899                         ctlx->state = CTLX_REQ_FAILED;
3900
3901                         /* This URB was active, but has now been
3902                          * cancelled. It will now have a status of
3903                          * -ECONNRESET in the callback function.
3904                          *
3905                          * We are cancelling this CTLX, so we're
3906                          * not going to need to wait for a response.
3907                          * The URB's callback function will check
3908                          * that this timer is truly dead.
3909                          */
3910                         if (del_timer(&hw->resptimer) != 0)
3911                                 hw->resp_timer_done = 1;
3912                 }
3913         }
3914
3915         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3916 }
3917
3918 /*----------------------------------------------------------------
3919 * hfa384x_usbctlx_resptimerfn
3920 *
3921 * Timer response function for CTLX response timeouts.  If this
3922 * function is called, it means that the callback for the IN
3923 * URB containing a Prism2.x XXX_Response was never called.
3924 *
3925 * Arguments:
3926 *       data            a ptr to the hfa384x_t
3927 *
3928 * Returns:
3929 *       nothing
3930 *
3931 * Side effects:
3932 *
3933 * Call context:
3934 *       interrupt
3935 ----------------------------------------------------------------*/
3936 static void hfa384x_usbctlx_resptimerfn(unsigned long data)
3937 {
3938         hfa384x_t *hw = (hfa384x_t *)data;
3939         unsigned long flags;
3940
3941         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3942
3943         hw->resp_timer_done = 1;
3944
3945         /* The active list will be empty if the
3946          * adapter has been unplugged ...
3947          */
3948         if (!list_empty(&hw->ctlxq.active)) {
3949                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3950
3951                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3952                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3953                         hfa384x_usbctlxq_run(hw);
3954                         return;
3955                 }
3956         }
3957         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3958 }
3959
3960 /*----------------------------------------------------------------
3961 * hfa384x_usb_throttlefn
3962 *
3963 *
3964 * Arguments:
3965 *       data    ptr to hw
3966 *
3967 * Returns:
3968 *       Nothing
3969 *
3970 * Side effects:
3971 *
3972 * Call context:
3973 *       Interrupt
3974 ----------------------------------------------------------------*/
3975 static void hfa384x_usb_throttlefn(unsigned long data)
3976 {
3977         hfa384x_t *hw = (hfa384x_t *)data;
3978         unsigned long flags;
3979
3980         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3981
3982         /*
3983          * We need to check BOTH the RX and the TX throttle controls,
3984          * so we use the bitwise OR instead of the logical OR.
3985          */
3986         pr_debug("flags=0x%lx\n", hw->usb_flags);
3987         if (!hw->wlandev->hwremoved &&
3988             ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
3989               !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
3990              |
3991              (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
3992               !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
3993             )) {
3994                 schedule_work(&hw->usb_work);
3995         }
3996
3997         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3998 }
3999
4000 /*----------------------------------------------------------------
4001 * hfa384x_usbctlx_submit
4002 *
4003 * Called from the doxxx functions to submit a CTLX to the queue
4004 *
4005 * Arguments:
4006 *       hw              ptr to the hw struct
4007 *       ctlx            ctlx structure to enqueue
4008 *
4009 * Returns:
4010 *       -ENODEV if the adapter is unplugged
4011 *       0
4012 *
4013 * Side effects:
4014 *
4015 * Call context:
4016 *       process or interrupt
4017 ----------------------------------------------------------------*/
4018 static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
4019 {
4020         unsigned long flags;
4021
4022         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4023
4024         if (hw->wlandev->hwremoved) {
4025                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4026                 return -ENODEV;
4027         }
4028
4029         ctlx->state = CTLX_PENDING;
4030         list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4031         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4032         hfa384x_usbctlxq_run(hw);
4033
4034         return 0;
4035 }
4036
4037 /*----------------------------------------------------------------
4038 * hfa384x_usbout_tx
4039 *
4040 * At this point we have finished a send of a frame.  Mark the URB
4041 * as available and call ev_alloc to notify higher layers we're
4042 * ready for more.
4043 *
4044 * Arguments:
4045 *       wlandev         wlan device
4046 *       usbout          ptr to the usb transfer buffer
4047 *
4048 * Returns:
4049 *       nothing
4050 *
4051 * Side effects:
4052 *
4053 * Call context:
4054 *       interrupt
4055 ----------------------------------------------------------------*/
4056 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4057 {
4058         prism2sta_ev_alloc(wlandev);
4059 }
4060
4061 /*----------------------------------------------------------------
4062 * hfa384x_isgood_pdrcore
4063 *
4064 * Quick check of PDR codes.
4065 *
4066 * Arguments:
4067 *       pdrcode         PDR code number (host order)
4068 *
4069 * Returns:
4070 *       zero            not good.
4071 *       one             is good.
4072 *
4073 * Side effects:
4074 *
4075 * Call context:
4076 ----------------------------------------------------------------*/
4077 static int hfa384x_isgood_pdrcode(u16 pdrcode)
4078 {
4079         switch (pdrcode) {
4080         case HFA384x_PDR_END_OF_PDA:
4081         case HFA384x_PDR_PCB_PARTNUM:
4082         case HFA384x_PDR_PDAVER:
4083         case HFA384x_PDR_NIC_SERIAL:
4084         case HFA384x_PDR_MKK_MEASUREMENTS:
4085         case HFA384x_PDR_NIC_RAMSIZE:
4086         case HFA384x_PDR_MFISUPRANGE:
4087         case HFA384x_PDR_CFISUPRANGE:
4088         case HFA384x_PDR_NICID:
4089         case HFA384x_PDR_MAC_ADDRESS:
4090         case HFA384x_PDR_REGDOMAIN:
4091         case HFA384x_PDR_ALLOWED_CHANNEL:
4092         case HFA384x_PDR_DEFAULT_CHANNEL:
4093         case HFA384x_PDR_TEMPTYPE:
4094         case HFA384x_PDR_IFR_SETTING:
4095         case HFA384x_PDR_RFR_SETTING:
4096         case HFA384x_PDR_HFA3861_BASELINE:
4097         case HFA384x_PDR_HFA3861_SHADOW:
4098         case HFA384x_PDR_HFA3861_IFRF:
4099         case HFA384x_PDR_HFA3861_CHCALSP:
4100         case HFA384x_PDR_HFA3861_CHCALI:
4101         case HFA384x_PDR_3842_NIC_CONFIG:
4102         case HFA384x_PDR_USB_ID:
4103         case HFA384x_PDR_PCI_ID:
4104         case HFA384x_PDR_PCI_IFCONF:
4105         case HFA384x_PDR_PCI_PMCONF:
4106         case HFA384x_PDR_RFENRGY:
4107         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4108         case HFA384x_PDR_HFA3861_MANF_TESTI:
4109                 /* code is OK */
4110                 return 1;
4111         default:
4112                 if (pdrcode < 0x1000) {
4113                         /* code is OK, but we don't know exactly what it is */
4114                         pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
4115                                  pdrcode);
4116                         return 1;
4117                 }
4118                 break;
4119         }
4120         /* bad code */
4121         pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
4122                  pdrcode);
4123         return 0;
4124 }