drivers/staging/wlan-ng/hfa384x_usb.c

   1 /* src/prism2/driver/hfa384x_usb.c
   2 *
   3 * Functions that talk to the USB variantof the Intersil hfa384x MAC
   4 *
   5 * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
   6 * --------------------------------------------------------------------
   7 *
   8 * linux-wlan
   9 *
  10 *   The contents of this file are subject to the Mozilla Public
  11 *   License Version 1.1 (the "License"); you may not use this file
  12 *   except in compliance with the License. You may obtain a copy of
  13 *   the License at http://www.mozilla.org/MPL/
  14 *
  15 *   Software distributed under the License is distributed on an "AS
  16 *   IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
  17 *   implied. See the License for the specific language governing
  18 *   rights and limitations under the License.
  19 *
  20 *   Alternatively, the contents of this file may be used under the
  21 *   terms of the GNU Public License version 2 (the "GPL"), in which
  22 *   case the provisions of the GPL are applicable instead of the
  23 *   above.  If you wish to allow the use of your version of this file
  24 *   only under the terms of the GPL and not to allow others to use
  25 *   your version of this file under the MPL, indicate your decision
  26 *   by deleting the provisions above and replace them with the notice
  27 *   and other provisions required by the GPL.  If you do not delete
  28 *   the provisions above, a recipient may use your version of this
  29 *   file under either the MPL or the GPL.
  30 *
  31 * --------------------------------------------------------------------
  32 *
  33 * Inquiries regarding the linux-wlan Open Source project can be
  34 * made directly to:
  35 *
  36 * AbsoluteValue Systems Inc.
  37 * info@linux-wlan.com
  38 * http://www.linux-wlan.com
  39 *
  40 * --------------------------------------------------------------------
  41 *
  42 * Portions of the development of this software were funded by
  43 * Intersil Corporation as part of PRISM(R) chipset product development.
  44 *
  45 * --------------------------------------------------------------------
  46 *
  47 * This file implements functions that correspond to the prism2/hfa384x
  48 * 802.11 MAC hardware and firmware host interface.
  49 *
  50 * The functions can be considered to represent several levels of
  51 * abstraction.  The lowest level functions are simply C-callable wrappers
  52 * around the register accesses.  The next higher level represents C-callable
  53 * prism2 API functions that match the Intersil documentation as closely
  54 * as is reasonable.  The next higher layer implements common sequences
  55 * of invocations of the API layer (e.g. write to bap, followed by cmd).
  56 *
  57 * Common sequences:
  58 * hfa384x_drvr_xxx      Highest level abstractions provided by the
  59 *                       hfa384x code.  They are driver defined wrappers
  60 *                       for common sequences.  These functions generally
  61 *                       use the services of the lower levels.
  62 *
  63 * hfa384x_drvr_xxxconfig  An example of the drvr level abstraction. These
  64 *                       functions are wrappers for the RID get/set
  65 *                       sequence. They call copy_[to|from]_bap() and
  66 *                       cmd_access(). These functions operate on the
  67 *                       RIDs and buffers without validation. The caller
  68 *                       is responsible for that.
  69 *
  70 * API wrapper functions:
  71 * hfa384x_cmd_xxx       functions that provide access to the f/w commands.
  72 *                       The function arguments correspond to each command
  73 *                       argument, even command arguments that get packed
  74 *                       into single registers.  These functions _just_
  75 *                       issue the command by setting the cmd/parm regs
  76 *                       & reading the status/resp regs.  Additional
  77 *                       activities required to fully use a command
  78 *                       (read/write from/to bap, get/set int status etc.)
  79 *                       are implemented separately.  Think of these as
  80 *                       C-callable prism2 commands.
  81 *
  82 * Lowest Layer Functions:
  83 * hfa384x_docmd_xxx     These functions implement the sequence required
  84 *                       to issue any prism2 command.  Primarily used by the
  85 *                       hfa384x_cmd_xxx functions.
  86 *
  87 * hfa384x_bap_xxx       BAP read/write access functions.
  88 *                       Note: we usually use BAP0 for non-interrupt context
  89 *                        and BAP1 for interrupt context.
  90 *
  91 * hfa384x_dl_xxx        download related functions.
  92 *
  93 * Driver State Issues:
  94 * Note that there are two pairs of functions that manage the
  95 * 'initialized' and 'running' states of the hw/MAC combo.  The four
  96 * functions are create(), destroy(), start(), and stop().  create()
  97 * sets up the data structures required to support the hfa384x_*
  98 * functions and destroy() cleans them up.  The start() function gets
  99 * the actual hardware running and enables the interrupts.  The stop()
 100 * function shuts the hardware down.  The sequence should be:
 101 * create()
 102 * start()
 103 *  .
 104 *  .  Do interesting things w/ the hardware
 105 *  .
 106 * stop()
 107 * destroy()
 108 *
 109 * Note that destroy() can be called without calling stop() first.
 110 * --------------------------------------------------------------------
 111 */
 112
 113 #include <linux/module.h>
 114 #include <linux/kernel.h>
 115 #include <linux/sched.h>
 116 #include <linux/types.h>
 117 #include <linux/slab.h>
 118 #include <linux/wireless.h>
 119 #include <linux/netdevice.h>
 120 #include <linux/timer.h>
 121 #include <linux/io.h>
 122 #include <linux/delay.h>
 123 #include <asm/byteorder.h>
 124 #include <linux/bitops.h>
 125 #include <linux/list.h>
 126 #include <linux/usb.h>
 127 #include <linux/byteorder/generic.h>
 128
 129 #define SUBMIT_URB(u, f)  usb_submit_urb(u, f)
 130
 131 #include "p80211types.h"
 132 #include "p80211hdr.h"
 133 #include "p80211mgmt.h"
 134 #include "p80211conv.h"
 135 #include "p80211msg.h"
 136 #include "p80211netdev.h"
 137 #include "p80211req.h"
 138 #include "p80211metadef.h"
 139 #include "p80211metastruct.h"
 140 #include "hfa384x.h"
 141 #include "prism2mgmt.h"
 142
 143 enum cmd_mode {
 144         DOWAIT = 0,
 145         DOASYNC
 146 };
 147
 148 #define THROTTLE_JIFFIES        (HZ/8)
 149 #define URB_ASYNC_UNLINK 0
 150 #define USB_QUEUE_BULK 0
 151
 152 #define ROUNDUP64(a) (((a)+63)&~63)
 153
 154 #ifdef DEBUG_USB
 155 static void dbprint_urb(struct urb *urb);
 156 #endif
 157
 158 static void
 159 hfa384x_int_rxmonitor(wlandevice_t *wlandev, hfa384x_usb_rxfrm_t *rxfrm);
 160
 161 static void hfa384x_usb_defer(struct work_struct *data);
 162
 163 static int submit_rx_urb(hfa384x_t *hw, gfp_t flags);
 164
 165 static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t flags);
 166
 167 /*---------------------------------------------------*/
 168 /* Callbacks */
 169 static void hfa384x_usbout_callback(struct urb *urb);
 170 static void hfa384x_ctlxout_callback(struct urb *urb);
 171 static void hfa384x_usbin_callback(struct urb *urb);
 172
 173 static void
 174 hfa384x_usbin_txcompl(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 175
 176 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb);
 177
 178 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin);
 179
 180 static void
 181 hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout);
 182
 183 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
 184                                int urb_status);
 185
 186 /*---------------------------------------------------*/
 187 /* Functions to support the prism2 usb command queue */
 188
 189 static void hfa384x_usbctlxq_run(hfa384x_t *hw);
 190
 191 static void hfa384x_usbctlx_reqtimerfn(unsigned long data);
 192
 193 static void hfa384x_usbctlx_resptimerfn(unsigned long data);
 194
 195 static void hfa384x_usb_throttlefn(unsigned long data);
 196
 197 static void hfa384x_usbctlx_completion_task(unsigned long data);
 198
 199 static void hfa384x_usbctlx_reaper_task(unsigned long data);
 200
 201 static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 202
 203 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 204
 205 struct usbctlx_completor {
 206         int (*complete)(struct usbctlx_completor *);
 207 };
 208
 209 static int
 210 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 211                               hfa384x_usbctlx_t *ctlx,
 212                               struct usbctlx_completor *completor);
 213
 214 static int
 215 unlocked_usbctlx_cancel_async(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
 216
 217 static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 218
 219 static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx);
 220
 221 static int
 222 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 223                    hfa384x_cmdresult_t *result);
 224
 225 static void
 226 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 227                        hfa384x_rridresult_t *result);
 228
 229 /*---------------------------------------------------*/
 230 /* Low level req/resp CTLX formatters and submitters */
 231 static int
 232 hfa384x_docmd(hfa384x_t *hw,
 233               enum cmd_mode mode,
 234               hfa384x_metacmd_t *cmd,
 235               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 236
 237 static int
 238 hfa384x_dorrid(hfa384x_t *hw,
 239                enum cmd_mode mode,
 240                u16 rid,
 241                void *riddata,
 242                unsigned int riddatalen,
 243                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 244
 245 static int
 246 hfa384x_dowrid(hfa384x_t *hw,
 247                enum cmd_mode mode,
 248                u16 rid,
 249                void *riddata,
 250                unsigned int riddatalen,
 251                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 252
 253 static int
 254 hfa384x_dormem(hfa384x_t *hw,
 255                enum cmd_mode mode,
 256                u16 page,
 257                u16 offset,
 258                void *data,
 259                unsigned int len,
 260                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 261
 262 static int
 263 hfa384x_dowmem(hfa384x_t *hw,
 264                enum cmd_mode mode,
 265                u16 page,
 266                u16 offset,
 267                void *data,
 268                unsigned int len,
 269                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data);
 270
 271 static int hfa384x_isgood_pdrcode(u16 pdrcode);
 272
 273 static inline const char *ctlxstr(CTLX_STATE s)
 274 {
 275         static const char * const ctlx_str[] = {
 276                 "Initial state",
 277                 "Complete",
 278                 "Request failed",
 279                 "Request pending",
 280                 "Request packet submitted",
 281                 "Request packet completed",
 282                 "Response packet completed"
 283         };
 284
 285         return ctlx_str[s];
 286 };
 287
 288 static inline hfa384x_usbctlx_t *get_active_ctlx(hfa384x_t *hw)
 289 {
 290         return list_entry(hw->ctlxq.active.next, hfa384x_usbctlx_t, list);
 291 }
 292
 293 #ifdef DEBUG_USB
 294 void dbprint_urb(struct urb *urb)
 295 {
 296         pr_debug("urb->pipe=0x%08x\n", urb->pipe);
 297         pr_debug("urb->status=0x%08x\n", urb->status);
 298         pr_debug("urb->transfer_flags=0x%08x\n", urb->transfer_flags);
 299         pr_debug("urb->transfer_buffer=0x%08x\n",
 300                  (unsigned int)urb->transfer_buffer);
 301         pr_debug("urb->transfer_buffer_length=0x%08x\n",
 302                  urb->transfer_buffer_length);
 303         pr_debug("urb->actual_length=0x%08x\n", urb->actual_length);
 304         pr_debug("urb->bandwidth=0x%08x\n", urb->bandwidth);
 305         pr_debug("urb->setup_packet(ctl)=0x%08x\n",
 306                  (unsigned int)urb->setup_packet);
 307         pr_debug("urb->start_frame(iso/irq)=0x%08x\n", urb->start_frame);
 308         pr_debug("urb->interval(irq)=0x%08x\n", urb->interval);
 309         pr_debug("urb->error_count(iso)=0x%08x\n", urb->error_count);
 310         pr_debug("urb->timeout=0x%08x\n", urb->timeout);
 311         pr_debug("urb->context=0x%08x\n", (unsigned int)urb->context);
 312         pr_debug("urb->complete=0x%08x\n", (unsigned int)urb->complete);
 313 }
 314 #endif
 315
 316 /*----------------------------------------------------------------
 317 * submit_rx_urb
 318 *
 319 * Listen for input data on the BULK-IN pipe. If the pipe has
 320 * stalled then schedule it to be reset.
 321 *
 322 * Arguments:
 323 *       hw              device struct
 324 *       memflags        memory allocation flags
 325 *
 326 * Returns:
 327 *       error code from submission
 328 *
 329 * Call context:
 330 *       Any
 331 ----------------------------------------------------------------*/
 332 static int submit_rx_urb(hfa384x_t *hw, gfp_t memflags)
 333 {
 334         struct sk_buff *skb;
 335         int result;
 336
 337         skb = dev_alloc_skb(sizeof(hfa384x_usbin_t));
 338         if (skb == NULL) {
 339                 result = -ENOMEM;
 340                 goto done;
 341         }
 342
 343         /* Post the IN urb */
 344         usb_fill_bulk_urb(&hw->rx_urb, hw->usb,
 345                           hw->endp_in,
 346                           skb->data, sizeof(hfa384x_usbin_t),
 347                           hfa384x_usbin_callback, hw->wlandev);
 348
 349         hw->rx_urb_skb = skb;
 350
 351         result = -ENOLINK;
 352         if (!hw->wlandev->hwremoved &&
 353             !test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 354                 result = SUBMIT_URB(&hw->rx_urb, memflags);
 355
 356                 /* Check whether we need to reset the RX pipe */
 357                 if (result == -EPIPE) {
 358                         netdev_warn(hw->wlandev->netdev,
 359                                     "%s rx pipe stalled: requesting reset\n",
 360                                     hw->wlandev->netdev->name);
 361                         if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
 362                                 schedule_work(&hw->usb_work);
 363                 }
 364         }
 365
 366         /* Don't leak memory if anything should go wrong */
 367         if (result != 0) {
 368                 dev_kfree_skb(skb);
 369                 hw->rx_urb_skb = NULL;
 370         }
 371
 372 done:
 373         return result;
 374 }
 375
 376 /*----------------------------------------------------------------
 377 * submit_tx_urb
 378 *
 379 * Prepares and submits the URB of transmitted data. If the
 380 * submission fails then it will schedule the output pipe to
 381 * be reset.
 382 *
 383 * Arguments:
 384 *       hw              device struct
 385 *       tx_urb          URB of data for tranmission
 386 *       memflags        memory allocation flags
 387 *
 388 * Returns:
 389 *       error code from submission
 390 *
 391 * Call context:
 392 *       Any
 393 ----------------------------------------------------------------*/
 394 static int submit_tx_urb(hfa384x_t *hw, struct urb *tx_urb, gfp_t memflags)
 395 {
 396         struct net_device *netdev = hw->wlandev->netdev;
 397         int result;
 398
 399         result = -ENOLINK;
 400         if (netif_running(netdev)) {
 401                 if (!hw->wlandev->hwremoved &&
 402                     !test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 403                         result = SUBMIT_URB(tx_urb, memflags);
 404
 405                         /* Test whether we need to reset the TX pipe */
 406                         if (result == -EPIPE) {
 407                                 netdev_warn(hw->wlandev->netdev,
 408                                             "%s tx pipe stalled: requesting reset\n",
 409                                             netdev->name);
 410                                 set_bit(WORK_TX_HALT, &hw->usb_flags);
 411                                 schedule_work(&hw->usb_work);
 412                         } else if (result == 0) {
 413                                 netif_stop_queue(netdev);
 414                         }
 415                 }
 416         }
 417
 418         return result;
 419 }
 420
 421 /*----------------------------------------------------------------
 422 * hfa394x_usb_defer
 423 *
 424 * There are some things that the USB stack cannot do while
 425 * in interrupt context, so we arrange this function to run
 426 * in process context.
 427 *
 428 * Arguments:
 429 *       hw      device structure
 430 *
 431 * Returns:
 432 *       nothing
 433 *
 434 * Call context:
 435 *       process (by design)
 436 ----------------------------------------------------------------*/
 437 static void hfa384x_usb_defer(struct work_struct *data)
 438 {
 439         hfa384x_t *hw = container_of(data, struct hfa384x, usb_work);
 440         struct net_device *netdev = hw->wlandev->netdev;
 441
 442         /* Don't bother trying to reset anything if the plug
 443          * has been pulled ...
 444          */
 445         if (hw->wlandev->hwremoved)
 446                 return;
 447
 448         /* Reception has stopped: try to reset the input pipe */
 449         if (test_bit(WORK_RX_HALT, &hw->usb_flags)) {
 450                 int ret;
 451
 452                 usb_kill_urb(&hw->rx_urb); /* Cannot be holding spinlock! */
 453
 454                 ret = usb_clear_halt(hw->usb, hw->endp_in);
 455                 if (ret != 0) {
 456                         netdev_err(hw->wlandev->netdev,
 457                                    "Failed to clear rx pipe for %s: err=%d\n",
 458                                    netdev->name, ret);
 459                 } else {
 460                         netdev_info(hw->wlandev->netdev, "%s rx pipe reset complete.\n",
 461                                     netdev->name);
 462                         clear_bit(WORK_RX_HALT, &hw->usb_flags);
 463                         set_bit(WORK_RX_RESUME, &hw->usb_flags);
 464                 }
 465         }
 466
 467         /* Resume receiving data back from the device. */
 468         if (test_bit(WORK_RX_RESUME, &hw->usb_flags)) {
 469                 int ret;
 470
 471                 ret = submit_rx_urb(hw, GFP_KERNEL);
 472                 if (ret != 0) {
 473                         netdev_err(hw->wlandev->netdev,
 474                                    "Failed to resume %s rx pipe.\n",
 475                                    netdev->name);
 476                 } else {
 477                         clear_bit(WORK_RX_RESUME, &hw->usb_flags);
 478                 }
 479         }
 480
 481         /* Transmission has stopped: try to reset the output pipe */
 482         if (test_bit(WORK_TX_HALT, &hw->usb_flags)) {
 483                 int ret;
 484
 485                 usb_kill_urb(&hw->tx_urb);
 486                 ret = usb_clear_halt(hw->usb, hw->endp_out);
 487                 if (ret != 0) {
 488                         netdev_err(hw->wlandev->netdev,
 489                                    "Failed to clear tx pipe for %s: err=%d\n",
 490                                    netdev->name, ret);
 491                 } else {
 492                         netdev_info(hw->wlandev->netdev, "%s tx pipe reset complete.\n",
 493                                     netdev->name);
 494                         clear_bit(WORK_TX_HALT, &hw->usb_flags);
 495                         set_bit(WORK_TX_RESUME, &hw->usb_flags);
 496
 497                         /* Stopping the BULK-OUT pipe also blocked
 498                          * us from sending any more CTLX URBs, so
 499                          * we need to re-run our queue ...
 500                          */
 501                         hfa384x_usbctlxq_run(hw);
 502                 }
 503         }
 504
 505         /* Resume transmitting. */
 506         if (test_and_clear_bit(WORK_TX_RESUME, &hw->usb_flags))
 507                 netif_wake_queue(hw->wlandev->netdev);
 508 }
 509
 510 /*----------------------------------------------------------------
 511 * hfa384x_create
 512 *
 513 * Sets up the hfa384x_t data structure for use.  Note this
 514 * does _not_ initialize the actual hardware, just the data structures
 515 * we use to keep track of its state.
 516 *
 517 * Arguments:
 518 *       hw              device structure
 519 *       irq             device irq number
 520 *       iobase          i/o base address for register access
 521 *       membase         memory base address for register access
 522 *
 523 * Returns:
 524 *       nothing
 525 *
 526 * Side effects:
 527 *
 528 * Call context:
 529 *       process
 530 ----------------------------------------------------------------*/
 531 void hfa384x_create(hfa384x_t *hw, struct usb_device *usb)
 532 {
 533         memset(hw, 0, sizeof(hfa384x_t));
 534         hw->usb = usb;
 535
 536         /* set up the endpoints */
 537         hw->endp_in = usb_rcvbulkpipe(usb, 1);
 538         hw->endp_out = usb_sndbulkpipe(usb, 2);
 539
 540         /* Set up the waitq */
 541         init_waitqueue_head(&hw->cmdq);
 542
 543         /* Initialize the command queue */
 544         spin_lock_init(&hw->ctlxq.lock);
 545         INIT_LIST_HEAD(&hw->ctlxq.pending);
 546         INIT_LIST_HEAD(&hw->ctlxq.active);
 547         INIT_LIST_HEAD(&hw->ctlxq.completing);
 548         INIT_LIST_HEAD(&hw->ctlxq.reapable);
 549
 550         /* Initialize the authentication queue */
 551         skb_queue_head_init(&hw->authq);
 552
 553         tasklet_init(&hw->reaper_bh,
 554                      hfa384x_usbctlx_reaper_task, (unsigned long)hw);
 555         tasklet_init(&hw->completion_bh,
 556                      hfa384x_usbctlx_completion_task, (unsigned long)hw);
 557         INIT_WORK(&hw->link_bh, prism2sta_processing_defer);
 558         INIT_WORK(&hw->usb_work, hfa384x_usb_defer);
 559
 560         init_timer(&hw->throttle);
 561         hw->throttle.function = hfa384x_usb_throttlefn;
 562         hw->throttle.data = (unsigned long)hw;
 563
 564         init_timer(&hw->resptimer);
 565         hw->resptimer.function = hfa384x_usbctlx_resptimerfn;
 566         hw->resptimer.data = (unsigned long)hw;
 567
 568         init_timer(&hw->reqtimer);
 569         hw->reqtimer.function = hfa384x_usbctlx_reqtimerfn;
 570         hw->reqtimer.data = (unsigned long)hw;
 571
 572         usb_init_urb(&hw->rx_urb);
 573         usb_init_urb(&hw->tx_urb);
 574         usb_init_urb(&hw->ctlx_urb);
 575
 576         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 577         hw->state = HFA384x_STATE_INIT;
 578
 579         INIT_WORK(&hw->commsqual_bh, prism2sta_commsqual_defer);
 580         init_timer(&hw->commsqual_timer);
 581         hw->commsqual_timer.data = (unsigned long)hw;
 582         hw->commsqual_timer.function = prism2sta_commsqual_timer;
 583 }
 584
 585 /*----------------------------------------------------------------
 586 * hfa384x_destroy
 587 *
 588 * Partner to hfa384x_create().  This function cleans up the hw
 589 * structure so that it can be freed by the caller using a simple
 590 * kfree.  Currently, this function is just a placeholder.  If, at some
 591 * point in the future, an hw in the 'shutdown' state requires a 'deep'
 592 * kfree, this is where it should be done.  Note that if this function
 593 * is called on a _running_ hw structure, the drvr_stop() function is
 594 * called.
 595 *
 596 * Arguments:
 597 *       hw              device structure
 598 *
 599 * Returns:
 600 *       nothing, this function is not allowed to fail.
 601 *
 602 * Side effects:
 603 *
 604 * Call context:
 605 *       process
 606 ----------------------------------------------------------------*/
 607 void hfa384x_destroy(hfa384x_t *hw)
 608 {
 609         struct sk_buff *skb;
 610
 611         if (hw->state == HFA384x_STATE_RUNNING)
 612                 hfa384x_drvr_stop(hw);
 613         hw->state = HFA384x_STATE_PREINIT;
 614
 615         kfree(hw->scanresults);
 616         hw->scanresults = NULL;
 617
 618         /* Now to clean out the auth queue */
 619         while ((skb = skb_dequeue(&hw->authq)))
 620                 dev_kfree_skb(skb);
 621 }
 622
 623 static hfa384x_usbctlx_t *usbctlx_alloc(void)
 624 {
 625         hfa384x_usbctlx_t *ctlx;
 626
 627         ctlx = kmalloc(sizeof(*ctlx), in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 628         if (ctlx != NULL) {
 629                 memset(ctlx, 0, sizeof(*ctlx));
 630                 init_completion(&ctlx->done);
 631         }
 632
 633         return ctlx;
 634 }
 635
 636 static int
 637 usbctlx_get_status(const hfa384x_usb_cmdresp_t *cmdresp,
 638                    hfa384x_cmdresult_t *result)
 639 {
 640         result->status = le16_to_cpu(cmdresp->status);
 641         result->resp0 = le16_to_cpu(cmdresp->resp0);
 642         result->resp1 = le16_to_cpu(cmdresp->resp1);
 643         result->resp2 = le16_to_cpu(cmdresp->resp2);
 644
 645         pr_debug("cmdresult:status=0x%04x resp0=0x%04x resp1=0x%04x resp2=0x%04x\n",
 646                  result->status, result->resp0, result->resp1, result->resp2);
 647
 648         return result->status & HFA384x_STATUS_RESULT;
 649 }
 650
 651 static void
 652 usbctlx_get_rridresult(const hfa384x_usb_rridresp_t *rridresp,
 653                        hfa384x_rridresult_t *result)
 654 {
 655         result->rid = le16_to_cpu(rridresp->rid);
 656         result->riddata = rridresp->data;
 657         result->riddata_len = ((le16_to_cpu(rridresp->frmlen) - 1) * 2);
 658 }
 659
 660 /*----------------------------------------------------------------
 661 * Completor object:
 662 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 663 * when processing a CTLX that returns a hfa384x_cmdresult_t structure.
 664 ----------------------------------------------------------------*/
 665 struct usbctlx_cmd_completor {
 666         struct usbctlx_completor head;
 667
 668         const hfa384x_usb_cmdresp_t *cmdresp;
 669         hfa384x_cmdresult_t *result;
 670 };
 671
 672 static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
 673 {
 674         struct usbctlx_cmd_completor *complete;
 675
 676         complete = (struct usbctlx_cmd_completor *)head;
 677         return usbctlx_get_status(complete->cmdresp, complete->result);
 678 }
 679
 680 static inline struct usbctlx_completor *init_cmd_completor(
 681                                                 struct usbctlx_cmd_completor
 682                                                         *completor,
 683                                                 const hfa384x_usb_cmdresp_t
 684                                                         *cmdresp,
 685                                                 hfa384x_cmdresult_t *result)
 686 {
 687         completor->head.complete = usbctlx_cmd_completor_fn;
 688         completor->cmdresp = cmdresp;
 689         completor->result = result;
 690         return &(completor->head);
 691 }
 692
 693 /*----------------------------------------------------------------
 694 * Completor object:
 695 * This completor must be passed to hfa384x_usbctlx_complete_sync()
 696 * when processing a CTLX that reads a RID.
 697 ----------------------------------------------------------------*/
 698 struct usbctlx_rrid_completor {
 699         struct usbctlx_completor head;
 700
 701         const hfa384x_usb_rridresp_t *rridresp;
 702         void *riddata;
 703         unsigned int riddatalen;
 704 };
 705
 706 static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
 707 {
 708         struct usbctlx_rrid_completor *complete;
 709         hfa384x_rridresult_t rridresult;
 710
 711         complete = (struct usbctlx_rrid_completor *)head;
 712         usbctlx_get_rridresult(complete->rridresp, &rridresult);
 713
 714         /* Validate the length, note body len calculation in bytes */
 715         if (rridresult.riddata_len != complete->riddatalen) {
 716                 pr_warn("RID len mismatch, rid=0x%04x hlen=%d fwlen=%d\n",
 717                         rridresult.rid,
 718                         complete->riddatalen, rridresult.riddata_len);
 719                 return -ENODATA;
 720         }
 721
 722         memcpy(complete->riddata, rridresult.riddata, complete->riddatalen);
 723         return 0;
 724 }
 725
 726 static inline struct usbctlx_completor *init_rrid_completor(
 727                                                 struct usbctlx_rrid_completor
 728                                                         *completor,
 729                                                 const hfa384x_usb_rridresp_t
 730                                                         *rridresp,
 731                                                 void *riddata,
 732                                                 unsigned int riddatalen)
 733 {
 734         completor->head.complete = usbctlx_rrid_completor_fn;
 735         completor->rridresp = rridresp;
 736         completor->riddata = riddata;
 737         completor->riddatalen = riddatalen;
 738         return &(completor->head);
 739 }
 740
 741 /*----------------------------------------------------------------
 742 * Completor object:
 743 * Interprets the results of a synchronous RID-write
 744 ----------------------------------------------------------------*/
 745 #define init_wrid_completor  init_cmd_completor
 746
 747 /*----------------------------------------------------------------
 748 * Completor object:
 749 * Interprets the results of a synchronous memory-write
 750 ----------------------------------------------------------------*/
 751 #define init_wmem_completor  init_cmd_completor
 752
 753 /*----------------------------------------------------------------
 754 * Completor object:
 755 * Interprets the results of a synchronous memory-read
 756 ----------------------------------------------------------------*/
 757 struct usbctlx_rmem_completor {
 758         struct usbctlx_completor head;
 759
 760         const hfa384x_usb_rmemresp_t *rmemresp;
 761         void *data;
 762         unsigned int len;
 763 };
 764
 765 static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
 766 {
 767         struct usbctlx_rmem_completor *complete =
 768                 (struct usbctlx_rmem_completor *)head;
 769
 770         pr_debug("rmemresp:len=%d\n", complete->rmemresp->frmlen);
 771         memcpy(complete->data, complete->rmemresp->data, complete->len);
 772         return 0;
 773 }
 774
 775 static inline struct usbctlx_completor *init_rmem_completor(
 776                                                 struct usbctlx_rmem_completor
 777                                                         *completor,
 778                                                 hfa384x_usb_rmemresp_t
 779                                                         *rmemresp,
 780                                                 void *data,
 781                                                 unsigned int len)
 782 {
 783         completor->head.complete = usbctlx_rmem_completor_fn;
 784         completor->rmemresp = rmemresp;
 785         completor->data = data;
 786         completor->len = len;
 787         return &(completor->head);
 788 }
 789
 790 /*----------------------------------------------------------------
 791 * hfa384x_cb_status
 792 *
 793 * Ctlx_complete handler for async CMD type control exchanges.
 794 * mark the hw struct as such.
 795 *
 796 * Note: If the handling is changed here, it should probably be
 797 *       changed in docmd as well.
 798 *
 799 * Arguments:
 800 *       hw              hw struct
 801 *       ctlx            completed CTLX
 802 *
 803 * Returns:
 804 *       nothing
 805 *
 806 * Side effects:
 807 *
 808 * Call context:
 809 *       interrupt
 810 ----------------------------------------------------------------*/
 811 static void hfa384x_cb_status(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 812 {
 813         if (ctlx->usercb != NULL) {
 814                 hfa384x_cmdresult_t cmdresult;
 815
 816                 if (ctlx->state != CTLX_COMPLETE) {
 817                         memset(&cmdresult, 0, sizeof(cmdresult));
 818                         cmdresult.status =
 819                             HFA384x_STATUS_RESULT_SET(HFA384x_CMD_ERR);
 820                 } else {
 821                         usbctlx_get_status(&ctlx->inbuf.cmdresp, &cmdresult);
 822                 }
 823
 824                 ctlx->usercb(hw, &cmdresult, ctlx->usercb_data);
 825         }
 826 }
 827
 828 /*----------------------------------------------------------------
 829 * hfa384x_cb_rrid
 830 *
 831 * CTLX completion handler for async RRID type control exchanges.
 832 *
 833 * Note: If the handling is changed here, it should probably be
 834 *       changed in dorrid as well.
 835 *
 836 * Arguments:
 837 *       hw              hw struct
 838 *       ctlx            completed CTLX
 839 *
 840 * Returns:
 841 *       nothing
 842 *
 843 * Side effects:
 844 *
 845 * Call context:
 846 *       interrupt
 847 ----------------------------------------------------------------*/
 848 static void hfa384x_cb_rrid(hfa384x_t *hw, const hfa384x_usbctlx_t *ctlx)
 849 {
 850         if (ctlx->usercb != NULL) {
 851                 hfa384x_rridresult_t rridresult;
 852
 853                 if (ctlx->state != CTLX_COMPLETE) {
 854                         memset(&rridresult, 0, sizeof(rridresult));
 855                         rridresult.rid = le16_to_cpu(ctlx->outbuf.rridreq.rid);
 856                 } else {
 857                         usbctlx_get_rridresult(&ctlx->inbuf.rridresp,
 858                                                &rridresult);
 859                 }
 860
 861                 ctlx->usercb(hw, &rridresult, ctlx->usercb_data);
 862         }
 863 }
 864
 865 static inline int hfa384x_docmd_wait(hfa384x_t *hw, hfa384x_metacmd_t *cmd)
 866 {
 867         return hfa384x_docmd(hw, DOWAIT, cmd, NULL, NULL, NULL);
 868 }
 869
 870 static inline int
 871 hfa384x_docmd_async(hfa384x_t *hw,
 872                     hfa384x_metacmd_t *cmd,
 873                     ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
 874 {
 875         return hfa384x_docmd(hw, DOASYNC, cmd, cmdcb, usercb, usercb_data);
 876 }
 877
 878 static inline int
 879 hfa384x_dorrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
 880                     unsigned int riddatalen)
 881 {
 882         return hfa384x_dorrid(hw, DOWAIT,
 883                               rid, riddata, riddatalen, NULL, NULL, NULL);
 884 }
 885
 886 static inline int
 887 hfa384x_dorrid_async(hfa384x_t *hw,
 888                      u16 rid, void *riddata, unsigned int riddatalen,
 889                      ctlx_cmdcb_t cmdcb,
 890                      ctlx_usercb_t usercb, void *usercb_data)
 891 {
 892         return hfa384x_dorrid(hw, DOASYNC,
 893                               rid, riddata, riddatalen,
 894                               cmdcb, usercb, usercb_data);
 895 }
 896
 897 static inline int
 898 hfa384x_dowrid_wait(hfa384x_t *hw, u16 rid, void *riddata,
 899                     unsigned int riddatalen)
 900 {
 901         return hfa384x_dowrid(hw, DOWAIT,
 902                               rid, riddata, riddatalen, NULL, NULL, NULL);
 903 }
 904
 905 static inline int
 906 hfa384x_dowrid_async(hfa384x_t *hw,
 907                      u16 rid, void *riddata, unsigned int riddatalen,
 908                      ctlx_cmdcb_t cmdcb,
 909                      ctlx_usercb_t usercb, void *usercb_data)
 910 {
 911         return hfa384x_dowrid(hw, DOASYNC,
 912                               rid, riddata, riddatalen,
 913                               cmdcb, usercb, usercb_data);
 914 }
 915
 916 static inline int
 917 hfa384x_dormem_wait(hfa384x_t *hw,
 918                     u16 page, u16 offset, void *data, unsigned int len)
 919 {
 920         return hfa384x_dormem(hw, DOWAIT,
 921                               page, offset, data, len, NULL, NULL, NULL);
 922 }
 923
 924 static inline int
 925 hfa384x_dormem_async(hfa384x_t *hw,
 926                      u16 page, u16 offset, void *data, unsigned int len,
 927                      ctlx_cmdcb_t cmdcb,
 928                      ctlx_usercb_t usercb, void *usercb_data)
 929 {
 930         return hfa384x_dormem(hw, DOASYNC,
 931                               page, offset, data, len,
 932                               cmdcb, usercb, usercb_data);
 933 }
 934
 935 static inline int
 936 hfa384x_dowmem_wait(hfa384x_t *hw,
 937                     u16 page, u16 offset, void *data, unsigned int len)
 938 {
 939         return hfa384x_dowmem(hw, DOWAIT,
 940                               page, offset, data, len, NULL, NULL, NULL);
 941 }
 942
 943 static inline int
 944 hfa384x_dowmem_async(hfa384x_t *hw,
 945                      u16 page,
 946                      u16 offset,
 947                      void *data,
 948                      unsigned int len,
 949                      ctlx_cmdcb_t cmdcb,
 950                      ctlx_usercb_t usercb, void *usercb_data)
 951 {
 952         return hfa384x_dowmem(hw, DOASYNC,
 953                               page, offset, data, len,
 954                               cmdcb, usercb, usercb_data);
 955 }
 956
 957 /*----------------------------------------------------------------
 958 * hfa384x_cmd_initialize
 959 *
 960 * Issues the initialize command and sets the hw->state based
 961 * on the result.
 962 *
 963 * Arguments:
 964 *       hw              device structure
 965 *
 966 * Returns:
 967 *       0               success
 968 *       >0              f/w reported error - f/w status code
 969 *       <0              driver reported error
 970 *
 971 * Side effects:
 972 *
 973 * Call context:
 974 *       process
 975 ----------------------------------------------------------------*/
 976 int hfa384x_cmd_initialize(hfa384x_t *hw)
 977 {
 978         int result = 0;
 979         int i;
 980         hfa384x_metacmd_t cmd;
 981
 982         cmd.cmd = HFA384x_CMDCODE_INIT;
 983         cmd.parm0 = 0;
 984         cmd.parm1 = 0;
 985         cmd.parm2 = 0;
 986
 987         result = hfa384x_docmd_wait(hw, &cmd);
 988
 989         pr_debug("cmdresp.init: status=0x%04x, resp0=0x%04x, resp1=0x%04x, resp2=0x%04x\n",
 990                  cmd.result.status,
 991                  cmd.result.resp0, cmd.result.resp1, cmd.result.resp2);
 992         if (result == 0) {
 993                 for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
 994                         hw->port_enabled[i] = 0;
 995         }
 996
 997         hw->link_status = HFA384x_LINK_NOTCONNECTED;
 998
 999         return result;
1000 }
1001
1002 /*----------------------------------------------------------------
1003 * hfa384x_cmd_disable
1004 *
1005 * Issues the disable command to stop communications on one of
1006 * the MACs 'ports'.
1007 *
1008 * Arguments:
1009 *       hw              device structure
1010 *       macport         MAC port number (host order)
1011 *
1012 * Returns:
1013 *       0               success
1014 *       >0              f/w reported failure - f/w status code
1015 *       <0              driver reported error (timeout|bad arg)
1016 *
1017 * Side effects:
1018 *
1019 * Call context:
1020 *       process
1021 ----------------------------------------------------------------*/
1022 int hfa384x_cmd_disable(hfa384x_t *hw, u16 macport)
1023 {
1024         int result = 0;
1025         hfa384x_metacmd_t cmd;
1026
1027         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DISABLE) |
1028             HFA384x_CMD_MACPORT_SET(macport);
1029         cmd.parm0 = 0;
1030         cmd.parm1 = 0;
1031         cmd.parm2 = 0;
1032
1033         result = hfa384x_docmd_wait(hw, &cmd);
1034
1035         return result;
1036 }
1037
1038 /*----------------------------------------------------------------
1039 * hfa384x_cmd_enable
1040 *
1041 * Issues the enable command to enable communications on one of
1042 * the MACs 'ports'.
1043 *
1044 * Arguments:
1045 *       hw              device structure
1046 *       macport         MAC port number
1047 *
1048 * Returns:
1049 *       0               success
1050 *       >0              f/w reported failure - f/w status code
1051 *       <0              driver reported error (timeout|bad arg)
1052 *
1053 * Side effects:
1054 *
1055 * Call context:
1056 *       process
1057 ----------------------------------------------------------------*/
1058 int hfa384x_cmd_enable(hfa384x_t *hw, u16 macport)
1059 {
1060         int result = 0;
1061         hfa384x_metacmd_t cmd;
1062
1063         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_ENABLE) |
1064             HFA384x_CMD_MACPORT_SET(macport);
1065         cmd.parm0 = 0;
1066         cmd.parm1 = 0;
1067         cmd.parm2 = 0;
1068
1069         result = hfa384x_docmd_wait(hw, &cmd);
1070
1071         return result;
1072 }
1073
1074 /*----------------------------------------------------------------
1075 * hfa384x_cmd_monitor
1076 *
1077 * Enables the 'monitor mode' of the MAC.  Here's the description of
1078 * monitor mode that I've received thus far:
1079 *
1080 *  "The "monitor mode" of operation is that the MAC passes all
1081 *  frames for which the PLCP checks are correct. All received
1082 *  MPDUs are passed to the host with MAC Port = 7, with a
1083 *  receive status of good, FCS error, or undecryptable. Passing
1084 *  certain MPDUs is a violation of the 802.11 standard, but useful
1085 *  for a debugging tool."  Normal communication is not possible
1086 *  while monitor mode is enabled.
1087 *
1088 * Arguments:
1089 *       hw              device structure
1090 *       enable          a code (0x0b|0x0f) that enables/disables
1091 *                       monitor mode. (host order)
1092 *
1093 * Returns:
1094 *       0               success
1095 *       >0              f/w reported failure - f/w status code
1096 *       <0              driver reported error (timeout|bad arg)
1097 *
1098 * Side effects:
1099 *
1100 * Call context:
1101 *       process
1102 ----------------------------------------------------------------*/
1103 int hfa384x_cmd_monitor(hfa384x_t *hw, u16 enable)
1104 {
1105         int result = 0;
1106         hfa384x_metacmd_t cmd;
1107
1108         cmd.cmd = HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_MONITOR) |
1109             HFA384x_CMD_AINFO_SET(enable);
1110         cmd.parm0 = 0;
1111         cmd.parm1 = 0;
1112         cmd.parm2 = 0;
1113
1114         result = hfa384x_docmd_wait(hw, &cmd);
1115
1116         return result;
1117 }
1118
1119 /*----------------------------------------------------------------
1120 * hfa384x_cmd_download
1121 *
1122 * Sets the controls for the MAC controller code/data download
1123 * process.  The arguments set the mode and address associated
1124 * with a download.  Note that the aux registers should be enabled
1125 * prior to setting one of the download enable modes.
1126 *
1127 * Arguments:
1128 *       hw              device structure
1129 *       mode            0 - Disable programming and begin code exec
1130 *                       1 - Enable volatile mem programming
1131 *                       2 - Enable non-volatile mem programming
1132 *                       3 - Program non-volatile section from NV download
1133 *                           buffer.
1134 *                       (host order)
1135 *       lowaddr
1136 *       highaddr        For mode 1, sets the high & low order bits of
1137 *                       the "destination address".  This address will be
1138 *                       the execution start address when download is
1139 *                       subsequently disabled.
1140 *                       For mode 2, sets the high & low order bits of
1141 *                       the destination in NV ram.
1142 *                       For modes 0 & 3, should be zero. (host order)
1143 *                       NOTE: these are CMD format.
1144 *       codelen         Length of the data to write in mode 2,
1145 *                       zero otherwise. (host order)
1146 *
1147 * Returns:
1148 *       0               success
1149 *       >0              f/w reported failure - f/w status code
1150 *       <0              driver reported error (timeout|bad arg)
1151 *
1152 * Side effects:
1153 *
1154 * Call context:
1155 *       process
1156 ----------------------------------------------------------------*/
1157 int hfa384x_cmd_download(hfa384x_t *hw, u16 mode, u16 lowaddr,
1158                          u16 highaddr, u16 codelen)
1159 {
1160         int result = 0;
1161         hfa384x_metacmd_t cmd;
1162
1163         pr_debug("mode=%d, lowaddr=0x%04x, highaddr=0x%04x, codelen=%d\n",
1164                  mode, lowaddr, highaddr, codelen);
1165
1166         cmd.cmd = (HFA384x_CMD_CMDCODE_SET(HFA384x_CMDCODE_DOWNLD) |
1167                    HFA384x_CMD_PROGMODE_SET(mode));
1168
1169         cmd.parm0 = lowaddr;
1170         cmd.parm1 = highaddr;
1171         cmd.parm2 = codelen;
1172
1173         result = hfa384x_docmd_wait(hw, &cmd);
1174
1175         return result;
1176 }
1177
1178 /*----------------------------------------------------------------
1179 * hfa384x_corereset
1180 *
1181 * Perform a reset of the hfa38xx MAC core.  We assume that the hw
1182 * structure is in its "created" state.  That is, it is initialized
1183 * with proper values.  Note that if a reset is done after the
1184 * device has been active for awhile, the caller might have to clean
1185 * up some leftover cruft in the hw structure.
1186 *
1187 * Arguments:
1188 *       hw              device structure
1189 *       holdtime        how long (in ms) to hold the reset
1190 *       settletime      how long (in ms) to wait after releasing
1191 *                       the reset
1192 *
1193 * Returns:
1194 *       nothing
1195 *
1196 * Side effects:
1197 *
1198 * Call context:
1199 *       process
1200 ----------------------------------------------------------------*/
1201 int hfa384x_corereset(hfa384x_t *hw, int holdtime, int settletime, int genesis)
1202 {
1203         int result = 0;
1204
1205         result = usb_reset_device(hw->usb);
1206         if (result < 0) {
1207                 netdev_err(hw->wlandev->netdev, "usb_reset_device() failed, result=%d.\n",
1208                            result);
1209         }
1210
1211         return result;
1212 }
1213
1214 /*----------------------------------------------------------------
1215 * hfa384x_usbctlx_complete_sync
1216 *
1217 * Waits for a synchronous CTLX object to complete,
1218 * and then handles the response.
1219 *
1220 * Arguments:
1221 *       hw              device structure
1222 *       ctlx            CTLX ptr
1223 *       completor       functor object to decide what to
1224 *                       do with the CTLX's result.
1225 *
1226 * Returns:
1227 *       0               Success
1228 *       -ERESTARTSYS    Interrupted by a signal
1229 *       -EIO            CTLX failed
1230 *       -ENODEV         Adapter was unplugged
1231 *       ???             Result from completor
1232 *
1233 * Side effects:
1234 *
1235 * Call context:
1236 *       process
1237 ----------------------------------------------------------------*/
1238 static int hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
1239                                          hfa384x_usbctlx_t *ctlx,
1240                                          struct usbctlx_completor *completor)
1241 {
1242         unsigned long flags;
1243         int result;
1244
1245         result = wait_for_completion_interruptible(&ctlx->done);
1246
1247         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1248
1249         /*
1250          * We can only handle the CTLX if the USB disconnect
1251          * function has not run yet ...
1252          */
1253 cleanup:
1254         if (hw->wlandev->hwremoved) {
1255                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1256                 result = -ENODEV;
1257         } else if (result != 0) {
1258                 int runqueue = 0;
1259
1260                 /*
1261                  * We were probably interrupted, so delete
1262                  * this CTLX asynchronously, kill the timers
1263                  * and the URB, and then start the next
1264                  * pending CTLX.
1265                  *
1266                  * NOTE: We can only delete the timers and
1267                  *       the URB if this CTLX is active.
1268                  */
1269                 if (ctlx == get_active_ctlx(hw)) {
1270                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1271
1272                         del_singleshot_timer_sync(&hw->reqtimer);
1273                         del_singleshot_timer_sync(&hw->resptimer);
1274                         hw->req_timer_done = 1;
1275                         hw->resp_timer_done = 1;
1276                         usb_kill_urb(&hw->ctlx_urb);
1277
1278                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
1279
1280                         runqueue = 1;
1281
1282                         /*
1283                          * This scenario is so unlikely that I'm
1284                          * happy with a grubby "goto" solution ...
1285                          */
1286                         if (hw->wlandev->hwremoved)
1287                                 goto cleanup;
1288                 }
1289
1290                 /*
1291                  * The completion task will send this CTLX
1292                  * to the reaper the next time it runs. We
1293                  * are no longer in a hurry.
1294                  */
1295                 ctlx->reapable = 1;
1296                 ctlx->state = CTLX_REQ_FAILED;
1297                 list_move_tail(&ctlx->list, &hw->ctlxq.completing);
1298
1299                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1300
1301                 if (runqueue)
1302                         hfa384x_usbctlxq_run(hw);
1303         } else {
1304                 if (ctlx->state == CTLX_COMPLETE) {
1305                         result = completor->complete(completor);
1306                 } else {
1307                         netdev_warn(hw->wlandev->netdev, "CTLX[%d] error: state(%s)\n",
1308                                     le16_to_cpu(ctlx->outbuf.type),
1309                                     ctlxstr(ctlx->state));
1310                         result = -EIO;
1311                 }
1312
1313                 list_del(&ctlx->list);
1314                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
1315                 kfree(ctlx);
1316         }
1317
1318         return result;
1319 }
1320
1321 /*----------------------------------------------------------------
1322 * hfa384x_docmd
1323 *
1324 * Constructs a command CTLX and submits it.
1325 *
1326 * NOTE: Any changes to the 'post-submit' code in this function
1327 *       need to be carried over to hfa384x_cbcmd() since the handling
1328 *       is virtually identical.
1329 *
1330 * Arguments:
1331 *       hw              device structure
1332 *       mode            DOWAIT or DOASYNC
1333 *       cmd             cmd structure.  Includes all arguments and result
1334 *                       data points.  All in host order. in host order
1335 *       cmdcb           command-specific callback
1336 *       usercb          user callback for async calls, NULL for DOWAIT calls
1337 *       usercb_data     user supplied data pointer for async calls, NULL
1338 *                       for DOASYNC calls
1339 *
1340 * Returns:
1341 *       0               success
1342 *       -EIO            CTLX failure
1343 *       -ERESTARTSYS    Awakened on signal
1344 *       >0              command indicated error, Status and Resp0-2 are
1345 *                       in hw structure.
1346 *
1347 * Side effects:
1348 *
1349 *
1350 * Call context:
1351 *       process
1352 ----------------------------------------------------------------*/
1353 static int
1354 hfa384x_docmd(hfa384x_t *hw,
1355               enum cmd_mode mode,
1356               hfa384x_metacmd_t *cmd,
1357               ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1358 {
1359         int result;
1360         hfa384x_usbctlx_t *ctlx;
1361
1362         ctlx = usbctlx_alloc();
1363         if (ctlx == NULL) {
1364                 result = -ENOMEM;
1365                 goto done;
1366         }
1367
1368         /* Initialize the command */
1369         ctlx->outbuf.cmdreq.type = cpu_to_le16(HFA384x_USB_CMDREQ);
1370         ctlx->outbuf.cmdreq.cmd = cpu_to_le16(cmd->cmd);
1371         ctlx->outbuf.cmdreq.parm0 = cpu_to_le16(cmd->parm0);
1372         ctlx->outbuf.cmdreq.parm1 = cpu_to_le16(cmd->parm1);
1373         ctlx->outbuf.cmdreq.parm2 = cpu_to_le16(cmd->parm2);
1374
1375         ctlx->outbufsize = sizeof(ctlx->outbuf.cmdreq);
1376
1377         pr_debug("cmdreq: cmd=0x%04x parm0=0x%04x parm1=0x%04x parm2=0x%04x\n",
1378                  cmd->cmd, cmd->parm0, cmd->parm1, cmd->parm2);
1379
1380         ctlx->reapable = mode;
1381         ctlx->cmdcb = cmdcb;
1382         ctlx->usercb = usercb;
1383         ctlx->usercb_data = usercb_data;
1384
1385         result = hfa384x_usbctlx_submit(hw, ctlx);
1386         if (result != 0) {
1387                 kfree(ctlx);
1388         } else if (mode == DOWAIT) {
1389                 struct usbctlx_cmd_completor completor;
1390
1391                 result =
1392                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1393                                                   init_cmd_completor(&completor,
1394                                                                      &ctlx->
1395                                                                      inbuf.
1396                                                                      cmdresp,
1397                                                                      &cmd->
1398                                                                      result));
1399         }
1400
1401 done:
1402         return result;
1403 }
1404
1405 /*----------------------------------------------------------------
1406 * hfa384x_dorrid
1407 *
1408 * Constructs a read rid CTLX and issues it.
1409 *
1410 * NOTE: Any changes to the 'post-submit' code in this function
1411 *       need to be carried over to hfa384x_cbrrid() since the handling
1412 *       is virtually identical.
1413 *
1414 * Arguments:
1415 *       hw              device structure
1416 *       mode            DOWAIT or DOASYNC
1417 *       rid             Read RID number (host order)
1418 *       riddata         Caller supplied buffer that MAC formatted RID.data
1419 *                       record will be written to for DOWAIT calls. Should
1420 *                       be NULL for DOASYNC calls.
1421 *       riddatalen      Buffer length for DOWAIT calls. Zero for DOASYNC calls.
1422 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1423 *       usercb          user callback for async calls, NULL for DOWAIT calls
1424 *       usercb_data     user supplied data pointer for async calls, NULL
1425 *                       for DOWAIT calls
1426 *
1427 * Returns:
1428 *       0               success
1429 *       -EIO            CTLX failure
1430 *       -ERESTARTSYS    Awakened on signal
1431 *       -ENODATA        riddatalen != macdatalen
1432 *       >0              command indicated error, Status and Resp0-2 are
1433 *                       in hw structure.
1434 *
1435 * Side effects:
1436 *
1437 * Call context:
1438 *       interrupt (DOASYNC)
1439 *       process (DOWAIT or DOASYNC)
1440 ----------------------------------------------------------------*/
1441 static int
1442 hfa384x_dorrid(hfa384x_t *hw,
1443                enum cmd_mode mode,
1444                u16 rid,
1445                void *riddata,
1446                unsigned int riddatalen,
1447                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1448 {
1449         int result;
1450         hfa384x_usbctlx_t *ctlx;
1451
1452         ctlx = usbctlx_alloc();
1453         if (ctlx == NULL) {
1454                 result = -ENOMEM;
1455                 goto done;
1456         }
1457
1458         /* Initialize the command */
1459         ctlx->outbuf.rridreq.type = cpu_to_le16(HFA384x_USB_RRIDREQ);
1460         ctlx->outbuf.rridreq.frmlen =
1461             cpu_to_le16(sizeof(ctlx->outbuf.rridreq.rid));
1462         ctlx->outbuf.rridreq.rid = cpu_to_le16(rid);
1463
1464         ctlx->outbufsize = sizeof(ctlx->outbuf.rridreq);
1465
1466         ctlx->reapable = mode;
1467         ctlx->cmdcb = cmdcb;
1468         ctlx->usercb = usercb;
1469         ctlx->usercb_data = usercb_data;
1470
1471         /* Submit the CTLX */
1472         result = hfa384x_usbctlx_submit(hw, ctlx);
1473         if (result != 0) {
1474                 kfree(ctlx);
1475         } else if (mode == DOWAIT) {
1476                 struct usbctlx_rrid_completor completor;
1477
1478                 result =
1479                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1480                                                   init_rrid_completor
1481                                                   (&completor,
1482                                                    &ctlx->inbuf.rridresp,
1483                                                    riddata, riddatalen));
1484         }
1485
1486 done:
1487         return result;
1488 }
1489
1490 /*----------------------------------------------------------------
1491 * hfa384x_dowrid
1492 *
1493 * Constructs a write rid CTLX and issues it.
1494 *
1495 * NOTE: Any changes to the 'post-submit' code in this function
1496 *       need to be carried over to hfa384x_cbwrid() since the handling
1497 *       is virtually identical.
1498 *
1499 * Arguments:
1500 *       hw              device structure
1501 *       enum cmd_mode   DOWAIT or DOASYNC
1502 *       rid             RID code
1503 *       riddata         Data portion of RID formatted for MAC
1504 *       riddatalen      Length of the data portion in bytes
1505 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1506 *       usercb          user callback for async calls, NULL for DOWAIT calls
1507 *       usercb_data     user supplied data pointer for async calls
1508 *
1509 * Returns:
1510 *       0               success
1511 *       -ETIMEDOUT      timed out waiting for register ready or
1512 *                       command completion
1513 *       >0              command indicated error, Status and Resp0-2 are
1514 *                       in hw structure.
1515 *
1516 * Side effects:
1517 *
1518 * Call context:
1519 *       interrupt (DOASYNC)
1520 *       process (DOWAIT or DOASYNC)
1521 ----------------------------------------------------------------*/
1522 static int
1523 hfa384x_dowrid(hfa384x_t *hw,
1524                enum cmd_mode mode,
1525                u16 rid,
1526                void *riddata,
1527                unsigned int riddatalen,
1528                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1529 {
1530         int result;
1531         hfa384x_usbctlx_t *ctlx;
1532
1533         ctlx = usbctlx_alloc();
1534         if (ctlx == NULL) {
1535                 result = -ENOMEM;
1536                 goto done;
1537         }
1538
1539         /* Initialize the command */
1540         ctlx->outbuf.wridreq.type = cpu_to_le16(HFA384x_USB_WRIDREQ);
1541         ctlx->outbuf.wridreq.frmlen = cpu_to_le16((sizeof
1542                                                    (ctlx->outbuf.wridreq.rid) +
1543                                                    riddatalen + 1) / 2);
1544         ctlx->outbuf.wridreq.rid = cpu_to_le16(rid);
1545         memcpy(ctlx->outbuf.wridreq.data, riddata, riddatalen);
1546
1547         ctlx->outbufsize = sizeof(ctlx->outbuf.wridreq.type) +
1548             sizeof(ctlx->outbuf.wridreq.frmlen) +
1549             sizeof(ctlx->outbuf.wridreq.rid) + riddatalen;
1550
1551         ctlx->reapable = mode;
1552         ctlx->cmdcb = cmdcb;
1553         ctlx->usercb = usercb;
1554         ctlx->usercb_data = usercb_data;
1555
1556         /* Submit the CTLX */
1557         result = hfa384x_usbctlx_submit(hw, ctlx);
1558         if (result != 0) {
1559                 kfree(ctlx);
1560         } else if (mode == DOWAIT) {
1561                 struct usbctlx_cmd_completor completor;
1562                 hfa384x_cmdresult_t wridresult;
1563
1564                 result = hfa384x_usbctlx_complete_sync(hw,
1565                                                        ctlx,
1566                                                        init_wrid_completor
1567                                                        (&completor,
1568                                                         &ctlx->inbuf.wridresp,
1569                                                         &wridresult));
1570         }
1571
1572 done:
1573         return result;
1574 }
1575
1576 /*----------------------------------------------------------------
1577 * hfa384x_dormem
1578 *
1579 * Constructs a readmem CTLX and issues it.
1580 *
1581 * NOTE: Any changes to the 'post-submit' code in this function
1582 *       need to be carried over to hfa384x_cbrmem() since the handling
1583 *       is virtually identical.
1584 *
1585 * Arguments:
1586 *       hw              device structure
1587 *       mode            DOWAIT or DOASYNC
1588 *       page            MAC address space page (CMD format)
1589 *       offset          MAC address space offset
1590 *       data            Ptr to data buffer to receive read
1591 *       len             Length of the data to read (max == 2048)
1592 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1593 *       usercb          user callback for async calls, NULL for DOWAIT calls
1594 *       usercb_data     user supplied data pointer for async calls
1595 *
1596 * Returns:
1597 *       0               success
1598 *       -ETIMEDOUT      timed out waiting for register ready or
1599 *                       command completion
1600 *       >0              command indicated error, Status and Resp0-2 are
1601 *                       in hw structure.
1602 *
1603 * Side effects:
1604 *
1605 * Call context:
1606 *       interrupt (DOASYNC)
1607 *       process (DOWAIT or DOASYNC)
1608 ----------------------------------------------------------------*/
1609 static int
1610 hfa384x_dormem(hfa384x_t *hw,
1611                enum cmd_mode mode,
1612                u16 page,
1613                u16 offset,
1614                void *data,
1615                unsigned int len,
1616                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1617 {
1618         int result;
1619         hfa384x_usbctlx_t *ctlx;
1620
1621         ctlx = usbctlx_alloc();
1622         if (ctlx == NULL) {
1623                 result = -ENOMEM;
1624                 goto done;
1625         }
1626
1627         /* Initialize the command */
1628         ctlx->outbuf.rmemreq.type = cpu_to_le16(HFA384x_USB_RMEMREQ);
1629         ctlx->outbuf.rmemreq.frmlen =
1630             cpu_to_le16(sizeof(ctlx->outbuf.rmemreq.offset) +
1631                         sizeof(ctlx->outbuf.rmemreq.page) + len);
1632         ctlx->outbuf.rmemreq.offset = cpu_to_le16(offset);
1633         ctlx->outbuf.rmemreq.page = cpu_to_le16(page);
1634
1635         ctlx->outbufsize = sizeof(ctlx->outbuf.rmemreq);
1636
1637         pr_debug("type=0x%04x frmlen=%d offset=0x%04x page=0x%04x\n",
1638                  ctlx->outbuf.rmemreq.type,
1639                  ctlx->outbuf.rmemreq.frmlen,
1640                  ctlx->outbuf.rmemreq.offset, ctlx->outbuf.rmemreq.page);
1641
1642         pr_debug("pktsize=%zd\n", ROUNDUP64(sizeof(ctlx->outbuf.rmemreq)));
1643
1644         ctlx->reapable = mode;
1645         ctlx->cmdcb = cmdcb;
1646         ctlx->usercb = usercb;
1647         ctlx->usercb_data = usercb_data;
1648
1649         result = hfa384x_usbctlx_submit(hw, ctlx);
1650         if (result != 0) {
1651                 kfree(ctlx);
1652         } else if (mode == DOWAIT) {
1653                 struct usbctlx_rmem_completor completor;
1654
1655                 result =
1656                     hfa384x_usbctlx_complete_sync(hw, ctlx,
1657                                                   init_rmem_completor
1658                                                   (&completor,
1659                                                    &ctlx->inbuf.rmemresp, data,
1660                                                    len));
1661         }
1662
1663 done:
1664         return result;
1665 }
1666
1667 /*----------------------------------------------------------------
1668 * hfa384x_dowmem
1669 *
1670 * Constructs a writemem CTLX and issues it.
1671 *
1672 * NOTE: Any changes to the 'post-submit' code in this function
1673 *       need to be carried over to hfa384x_cbwmem() since the handling
1674 *       is virtually identical.
1675 *
1676 * Arguments:
1677 *       hw              device structure
1678 *       mode            DOWAIT or DOASYNC
1679 *       page            MAC address space page (CMD format)
1680 *       offset          MAC address space offset
1681 *       data            Ptr to data buffer containing write data
1682 *       len             Length of the data to read (max == 2048)
1683 *       cmdcb           command callback for async calls, NULL for DOWAIT calls
1684 *       usercb          user callback for async calls, NULL for DOWAIT calls
1685 *       usercb_data     user supplied data pointer for async calls.
1686 *
1687 * Returns:
1688 *       0               success
1689 *       -ETIMEDOUT      timed out waiting for register ready or
1690 *                       command completion
1691 *       >0              command indicated error, Status and Resp0-2 are
1692 *                       in hw structure.
1693 *
1694 * Side effects:
1695 *
1696 * Call context:
1697 *       interrupt (DOWAIT)
1698 *       process (DOWAIT or DOASYNC)
1699 ----------------------------------------------------------------*/
1700 static int
1701 hfa384x_dowmem(hfa384x_t *hw,
1702                enum cmd_mode mode,
1703                u16 page,
1704                u16 offset,
1705                void *data,
1706                unsigned int len,
1707                ctlx_cmdcb_t cmdcb, ctlx_usercb_t usercb, void *usercb_data)
1708 {
1709         int result;
1710         hfa384x_usbctlx_t *ctlx;
1711
1712         pr_debug("page=0x%04x offset=0x%04x len=%d\n", page, offset, len);
1713
1714         ctlx = usbctlx_alloc();
1715         if (ctlx == NULL) {
1716                 result = -ENOMEM;
1717                 goto done;
1718         }
1719
1720         /* Initialize the command */
1721         ctlx->outbuf.wmemreq.type = cpu_to_le16(HFA384x_USB_WMEMREQ);
1722         ctlx->outbuf.wmemreq.frmlen =
1723             cpu_to_le16(sizeof(ctlx->outbuf.wmemreq.offset) +
1724                         sizeof(ctlx->outbuf.wmemreq.page) + len);
1725         ctlx->outbuf.wmemreq.offset = cpu_to_le16(offset);
1726         ctlx->outbuf.wmemreq.page = cpu_to_le16(page);
1727         memcpy(ctlx->outbuf.wmemreq.data, data, len);
1728
1729         ctlx->outbufsize = sizeof(ctlx->outbuf.wmemreq.type) +
1730             sizeof(ctlx->outbuf.wmemreq.frmlen) +
1731             sizeof(ctlx->outbuf.wmemreq.offset) +
1732             sizeof(ctlx->outbuf.wmemreq.page) + len;
1733
1734         ctlx->reapable = mode;
1735         ctlx->cmdcb = cmdcb;
1736         ctlx->usercb = usercb;
1737         ctlx->usercb_data = usercb_data;
1738
1739         result = hfa384x_usbctlx_submit(hw, ctlx);
1740         if (result != 0) {
1741                 kfree(ctlx);
1742         } else if (mode == DOWAIT) {
1743                 struct usbctlx_cmd_completor completor;
1744                 hfa384x_cmdresult_t wmemresult;
1745
1746                 result = hfa384x_usbctlx_complete_sync(hw,
1747                                                        ctlx,
1748                                                        init_wmem_completor
1749                                                        (&completor,
1750                                                         &ctlx->inbuf.wmemresp,
1751                                                         &wmemresult));
1752         }
1753
1754 done:
1755         return result;
1756 }
1757
1758 /*----------------------------------------------------------------
1759 * hfa384x_drvr_commtallies
1760 *
1761 * Send a commtallies inquiry to the MAC.  Note that this is an async
1762 * call that will result in an info frame arriving sometime later.
1763 *
1764 * Arguments:
1765 *       hw              device structure
1766 *
1767 * Returns:
1768 *       zero            success.
1769 *
1770 * Side effects:
1771 *
1772 * Call context:
1773 *       process
1774 ----------------------------------------------------------------*/
1775 int hfa384x_drvr_commtallies(hfa384x_t *hw)
1776 {
1777         hfa384x_metacmd_t cmd;
1778
1779         cmd.cmd = HFA384x_CMDCODE_INQ;
1780         cmd.parm0 = HFA384x_IT_COMMTALLIES;
1781         cmd.parm1 = 0;
1782         cmd.parm2 = 0;
1783
1784         hfa384x_docmd_async(hw, &cmd, NULL, NULL, NULL);
1785
1786         return 0;
1787 }
1788
1789 /*----------------------------------------------------------------
1790 * hfa384x_drvr_disable
1791 *
1792 * Issues the disable command to stop communications on one of
1793 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1794 * APs may also disable macports 1-6.  Only ports that have been
1795 * previously enabled may be disabled.
1796 *
1797 * Arguments:
1798 *       hw              device structure
1799 *       macport         MAC port number (host order)
1800 *
1801 * Returns:
1802 *       0               success
1803 *       >0              f/w reported failure - f/w status code
1804 *       <0              driver reported error (timeout|bad arg)
1805 *
1806 * Side effects:
1807 *
1808 * Call context:
1809 *       process
1810 ----------------------------------------------------------------*/
1811 int hfa384x_drvr_disable(hfa384x_t *hw, u16 macport)
1812 {
1813         int result = 0;
1814
1815         if ((!hw->isap && macport != 0) ||
1816             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1817             !(hw->port_enabled[macport])) {
1818                 result = -EINVAL;
1819         } else {
1820                 result = hfa384x_cmd_disable(hw, macport);
1821                 if (result == 0)
1822                         hw->port_enabled[macport] = 0;
1823         }
1824         return result;
1825 }
1826
1827 /*----------------------------------------------------------------
1828 * hfa384x_drvr_enable
1829 *
1830 * Issues the enable command to enable communications on one of
1831 * the MACs 'ports'.  Only macport 0 is valid  for stations.
1832 * APs may also enable macports 1-6.  Only ports that are currently
1833 * disabled may be enabled.
1834 *
1835 * Arguments:
1836 *       hw              device structure
1837 *       macport         MAC port number
1838 *
1839 * Returns:
1840 *       0               success
1841 *       >0              f/w reported failure - f/w status code
1842 *       <0              driver reported error (timeout|bad arg)
1843 *
1844 * Side effects:
1845 *
1846 * Call context:
1847 *       process
1848 ----------------------------------------------------------------*/
1849 int hfa384x_drvr_enable(hfa384x_t *hw, u16 macport)
1850 {
1851         int result = 0;
1852
1853         if ((!hw->isap && macport != 0) ||
1854             (hw->isap && !(macport <= HFA384x_PORTID_MAX)) ||
1855             (hw->port_enabled[macport])) {
1856                 result = -EINVAL;
1857         } else {
1858                 result = hfa384x_cmd_enable(hw, macport);
1859                 if (result == 0)
1860                         hw->port_enabled[macport] = 1;
1861         }
1862         return result;
1863 }
1864
1865 /*----------------------------------------------------------------
1866 * hfa384x_drvr_flashdl_enable
1867 *
1868 * Begins the flash download state.  Checks to see that we're not
1869 * already in a download state and that a port isn't enabled.
1870 * Sets the download state and retrieves the flash download
1871 * buffer location, buffer size, and timeout length.
1872 *
1873 * Arguments:
1874 *       hw              device structure
1875 *
1876 * Returns:
1877 *       0               success
1878 *       >0              f/w reported error - f/w status code
1879 *       <0              driver reported error
1880 *
1881 * Side effects:
1882 *
1883 * Call context:
1884 *       process
1885 ----------------------------------------------------------------*/
1886 int hfa384x_drvr_flashdl_enable(hfa384x_t *hw)
1887 {
1888         int result = 0;
1889         int i;
1890
1891         /* Check that a port isn't active */
1892         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
1893                 if (hw->port_enabled[i]) {
1894                         pr_debug("called when port enabled.\n");
1895                         return -EINVAL;
1896                 }
1897         }
1898
1899         /* Check that we're not already in a download state */
1900         if (hw->dlstate != HFA384x_DLSTATE_DISABLED)
1901                 return -EINVAL;
1902
1903         /* Retrieve the buffer loc&size and timeout */
1904         result = hfa384x_drvr_getconfig(hw, HFA384x_RID_DOWNLOADBUFFER,
1905                                         &(hw->bufinfo), sizeof(hw->bufinfo));
1906         if (result)
1907                 return result;
1908
1909         hw->bufinfo.page = le16_to_cpu(hw->bufinfo.page);
1910         hw->bufinfo.offset = le16_to_cpu(hw->bufinfo.offset);
1911         hw->bufinfo.len = le16_to_cpu(hw->bufinfo.len);
1912         result = hfa384x_drvr_getconfig16(hw, HFA384x_RID_MAXLOADTIME,
1913                                           &(hw->dltimeout));
1914         if (result)
1915                 return result;
1916
1917         hw->dltimeout = le16_to_cpu(hw->dltimeout);
1918
1919         pr_debug("flashdl_enable\n");
1920
1921         hw->dlstate = HFA384x_DLSTATE_FLASHENABLED;
1922
1923         return result;
1924 }
1925
1926 /*----------------------------------------------------------------
1927 * hfa384x_drvr_flashdl_disable
1928 *
1929 * Ends the flash download state.  Note that this will cause the MAC
1930 * firmware to restart.
1931 *
1932 * Arguments:
1933 *       hw              device structure
1934 *
1935 * Returns:
1936 *       0               success
1937 *       >0              f/w reported error - f/w status code
1938 *       <0              driver reported error
1939 *
1940 * Side effects:
1941 *
1942 * Call context:
1943 *       process
1944 ----------------------------------------------------------------*/
1945 int hfa384x_drvr_flashdl_disable(hfa384x_t *hw)
1946 {
1947         /* Check that we're already in the download state */
1948         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
1949                 return -EINVAL;
1950
1951         pr_debug("flashdl_enable\n");
1952
1953         /* There isn't much we can do at this point, so I don't */
1954         /*  bother  w/ the return value */
1955         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
1956         hw->dlstate = HFA384x_DLSTATE_DISABLED;
1957
1958         return 0;
1959 }
1960
1961 /*----------------------------------------------------------------
1962 * hfa384x_drvr_flashdl_write
1963 *
1964 * Performs a FLASH download of a chunk of data. First checks to see
1965 * that we're in the FLASH download state, then sets the download
1966 * mode, uses the aux functions to 1) copy the data to the flash
1967 * buffer, 2) sets the download 'write flash' mode, 3) readback and
1968 * compare.  Lather rinse, repeat as many times an necessary to get
1969 * all the given data into flash.
1970 * When all data has been written using this function (possibly
1971 * repeatedly), call drvr_flashdl_disable() to end the download state
1972 * and restart the MAC.
1973 *
1974 * Arguments:
1975 *       hw              device structure
1976 *       daddr           Card address to write to. (host order)
1977 *       buf             Ptr to data to write.
1978 *       len             Length of data (host order).
1979 *
1980 * Returns:
1981 *       0               success
1982 *       >0              f/w reported error - f/w status code
1983 *       <0              driver reported error
1984 *
1985 * Side effects:
1986 *
1987 * Call context:
1988 *       process
1989 ----------------------------------------------------------------*/
1990 int hfa384x_drvr_flashdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
1991 {
1992         int result = 0;
1993         u32 dlbufaddr;
1994         int nburns;
1995         u32 burnlen;
1996         u32 burndaddr;
1997         u16 burnlo;
1998         u16 burnhi;
1999         int nwrites;
2000         u8 *writebuf;
2001         u16 writepage;
2002         u16 writeoffset;
2003         u32 writelen;
2004         int i;
2005         int j;
2006
2007         pr_debug("daddr=0x%08x len=%d\n", daddr, len);
2008
2009         /* Check that we're in the flash download state */
2010         if (hw->dlstate != HFA384x_DLSTATE_FLASHENABLED)
2011                 return -EINVAL;
2012
2013         netdev_info(hw->wlandev->netdev,
2014                     "Download %d bytes to flash @0x%06x\n", len, daddr);
2015
2016         /* Convert to flat address for arithmetic */
2017         /* NOTE: dlbuffer RID stores the address in AUX format */
2018         dlbufaddr =
2019             HFA384x_ADDR_AUX_MKFLAT(hw->bufinfo.page, hw->bufinfo.offset);
2020         pr_debug("dlbuf.page=0x%04x dlbuf.offset=0x%04x dlbufaddr=0x%08x\n",
2021                  hw->bufinfo.page, hw->bufinfo.offset, dlbufaddr);
2022         /* Calculations to determine how many fills of the dlbuffer to do
2023          * and how many USB wmemreq's to do for each fill.  At this point
2024          * in time, the dlbuffer size and the wmemreq size are the same.
2025          * Therefore, nwrites should always be 1.  The extra complexity
2026          * here is a hedge against future changes.
2027          */
2028
2029         /* Figure out how many times to do the flash programming */
2030         nburns = len / hw->bufinfo.len;
2031         nburns += (len % hw->bufinfo.len) ? 1 : 0;
2032
2033         /* For each flash program cycle, how many USB wmemreq's are needed? */
2034         nwrites = hw->bufinfo.len / HFA384x_USB_RWMEM_MAXLEN;
2035         nwrites += (hw->bufinfo.len % HFA384x_USB_RWMEM_MAXLEN) ? 1 : 0;
2036
2037         /* For each burn */
2038         for (i = 0; i < nburns; i++) {
2039                 /* Get the dest address and len */
2040                 burnlen = (len - (hw->bufinfo.len * i)) > hw->bufinfo.len ?
2041                     hw->bufinfo.len : (len - (hw->bufinfo.len * i));
2042                 burndaddr = daddr + (hw->bufinfo.len * i);
2043                 burnlo = HFA384x_ADDR_CMD_MKOFF(burndaddr);
2044                 burnhi = HFA384x_ADDR_CMD_MKPAGE(burndaddr);
2045
2046                 netdev_info(hw->wlandev->netdev, "Writing %d bytes to flash @0x%06x\n",
2047                             burnlen, burndaddr);
2048
2049                 /* Set the download mode */
2050                 result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_NV,
2051                                               burnlo, burnhi, burnlen);
2052                 if (result) {
2053                         netdev_err(hw->wlandev->netdev,
2054                                    "download(NV,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
2055                                    burnlo, burnhi, burnlen, result);
2056                         goto exit_proc;
2057                 }
2058
2059                 /* copy the data to the flash download buffer */
2060                 for (j = 0; j < nwrites; j++) {
2061                         writebuf = buf +
2062                             (i * hw->bufinfo.len) +
2063                             (j * HFA384x_USB_RWMEM_MAXLEN);
2064
2065                         writepage = HFA384x_ADDR_CMD_MKPAGE(dlbufaddr +
2066                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
2067                         writeoffset = HFA384x_ADDR_CMD_MKOFF(dlbufaddr +
2068                                                 (j * HFA384x_USB_RWMEM_MAXLEN));
2069
2070                         writelen = burnlen - (j * HFA384x_USB_RWMEM_MAXLEN);
2071                         writelen = writelen > HFA384x_USB_RWMEM_MAXLEN ?
2072                             HFA384x_USB_RWMEM_MAXLEN : writelen;
2073
2074                         result = hfa384x_dowmem_wait(hw,
2075                                                      writepage,
2076                                                      writeoffset,
2077                                                      writebuf, writelen);
2078                 }
2079
2080                 /* set the download 'write flash' mode */
2081                 result = hfa384x_cmd_download(hw,
2082                                               HFA384x_PROGMODE_NVWRITE,
2083                                               0, 0, 0);
2084                 if (result) {
2085                         netdev_err(hw->wlandev->netdev,
2086                                    "download(NVWRITE,lo=%x,hi=%x,len=%x) cmd failed, result=%d. Aborting d/l\n",
2087                                    burnlo, burnhi, burnlen, result);
2088                         goto exit_proc;
2089                 }
2090
2091                 /* TODO: We really should do a readback and compare. */
2092         }
2093
2094 exit_proc:
2095
2096         /* Leave the firmware in the 'post-prog' mode.  flashdl_disable will */
2097         /*  actually disable programming mode.  Remember, that will cause the */
2098         /*  the firmware to effectively reset itself. */
2099
2100         return result;
2101 }
2102
2103 /*----------------------------------------------------------------
2104 * hfa384x_drvr_getconfig
2105 *
2106 * Performs the sequence necessary to read a config/info item.
2107 *
2108 * Arguments:
2109 *       hw              device structure
2110 *       rid             config/info record id (host order)
2111 *       buf             host side record buffer.  Upon return it will
2112 *                       contain the body portion of the record (minus the
2113 *                       RID and len).
2114 *       len             buffer length (in bytes, should match record length)
2115 *
2116 * Returns:
2117 *       0               success
2118 *       >0              f/w reported error - f/w status code
2119 *       <0              driver reported error
2120 *       -ENODATA        length mismatch between argument and retrieved
2121 *                       record.
2122 *
2123 * Side effects:
2124 *
2125 * Call context:
2126 *       process
2127 ----------------------------------------------------------------*/
2128 int hfa384x_drvr_getconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2129 {
2130         return hfa384x_dorrid_wait(hw, rid, buf, len);
2131 }
2132
2133 /*----------------------------------------------------------------
2134  * hfa384x_drvr_getconfig_async
2135  *
2136  * Performs the sequence necessary to perform an async read of
2137  * of a config/info item.
2138  *
2139  * Arguments:
2140  *       hw              device structure
2141  *       rid             config/info record id (host order)
2142  *       buf             host side record buffer.  Upon return it will
2143  *                       contain the body portion of the record (minus the
2144  *                       RID and len).
2145  *       len             buffer length (in bytes, should match record length)
2146  *       cbfn            caller supplied callback, called when the command
2147  *                       is done (successful or not).
2148  *       cbfndata        pointer to some caller supplied data that will be
2149  *                       passed in as an argument to the cbfn.
2150  *
2151  * Returns:
2152  *       nothing         the cbfn gets a status argument identifying if
2153  *                       any errors occur.
2154  * Side effects:
2155  *       Queues an hfa384x_usbcmd_t for subsequent execution.
2156  *
2157  * Call context:
2158  *       Any
2159  ----------------------------------------------------------------*/
2160 int
2161 hfa384x_drvr_getconfig_async(hfa384x_t *hw,
2162                              u16 rid, ctlx_usercb_t usercb, void *usercb_data)
2163 {
2164         return hfa384x_dorrid_async(hw, rid, NULL, 0,
2165                                     hfa384x_cb_rrid, usercb, usercb_data);
2166 }
2167
2168 /*----------------------------------------------------------------
2169  * hfa384x_drvr_setconfig_async
2170  *
2171  * Performs the sequence necessary to write a config/info item.
2172  *
2173  * Arguments:
2174  *       hw              device structure
2175  *       rid             config/info record id (in host order)
2176  *       buf             host side record buffer
2177  *       len             buffer length (in bytes)
2178  *       usercb          completion callback
2179  *       usercb_data     completion callback argument
2180  *
2181  * Returns:
2182  *       0               success
2183  *       >0              f/w reported error - f/w status code
2184  *       <0              driver reported error
2185  *
2186  * Side effects:
2187  *
2188  * Call context:
2189  *       process
2190  ----------------------------------------------------------------*/
2191 int
2192 hfa384x_drvr_setconfig_async(hfa384x_t *hw,
2193                              u16 rid,
2194                              void *buf,
2195                              u16 len, ctlx_usercb_t usercb, void *usercb_data)
2196 {
2197         return hfa384x_dowrid_async(hw, rid, buf, len,
2198                                     hfa384x_cb_status, usercb, usercb_data);
2199 }
2200
2201 /*----------------------------------------------------------------
2202 * hfa384x_drvr_ramdl_disable
2203 *
2204 * Ends the ram download state.
2205 *
2206 * Arguments:
2207 *       hw              device structure
2208 *
2209 * Returns:
2210 *       0               success
2211 *       >0              f/w reported error - f/w status code
2212 *       <0              driver reported error
2213 *
2214 * Side effects:
2215 *
2216 * Call context:
2217 *       process
2218 ----------------------------------------------------------------*/
2219 int hfa384x_drvr_ramdl_disable(hfa384x_t *hw)
2220 {
2221         /* Check that we're already in the download state */
2222         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2223                 return -EINVAL;
2224
2225         pr_debug("ramdl_disable()\n");
2226
2227         /* There isn't much we can do at this point, so I don't */
2228         /*  bother  w/ the return value */
2229         hfa384x_cmd_download(hw, HFA384x_PROGMODE_DISABLE, 0, 0, 0);
2230         hw->dlstate = HFA384x_DLSTATE_DISABLED;
2231
2232         return 0;
2233 }
2234
2235 /*----------------------------------------------------------------
2236 * hfa384x_drvr_ramdl_enable
2237 *
2238 * Begins the ram download state.  Checks to see that we're not
2239 * already in a download state and that a port isn't enabled.
2240 * Sets the download state and calls cmd_download with the
2241 * ENABLE_VOLATILE subcommand and the exeaddr argument.
2242 *
2243 * Arguments:
2244 *       hw              device structure
2245 *       exeaddr         the card execution address that will be
2246 *                       jumped to when ramdl_disable() is called
2247 *                       (host order).
2248 *
2249 * Returns:
2250 *       0               success
2251 *       >0              f/w reported error - f/w status code
2252 *       <0              driver reported error
2253 *
2254 * Side effects:
2255 *
2256 * Call context:
2257 *       process
2258 ----------------------------------------------------------------*/
2259 int hfa384x_drvr_ramdl_enable(hfa384x_t *hw, u32 exeaddr)
2260 {
2261         int result = 0;
2262         u16 lowaddr;
2263         u16 hiaddr;
2264         int i;
2265
2266         /* Check that a port isn't active */
2267         for (i = 0; i < HFA384x_PORTID_MAX; i++) {
2268                 if (hw->port_enabled[i]) {
2269                         netdev_err(hw->wlandev->netdev,
2270                                    "Can't download with a macport enabled.\n");
2271                         return -EINVAL;
2272                 }
2273         }
2274
2275         /* Check that we're not already in a download state */
2276         if (hw->dlstate != HFA384x_DLSTATE_DISABLED) {
2277                 netdev_err(hw->wlandev->netdev, "Download state not disabled.\n");
2278                 return -EINVAL;
2279         }
2280
2281         pr_debug("ramdl_enable, exeaddr=0x%08x\n", exeaddr);
2282
2283         /* Call the download(1,addr) function */
2284         lowaddr = HFA384x_ADDR_CMD_MKOFF(exeaddr);
2285         hiaddr = HFA384x_ADDR_CMD_MKPAGE(exeaddr);
2286
2287         result = hfa384x_cmd_download(hw, HFA384x_PROGMODE_RAM,
2288                                       lowaddr, hiaddr, 0);
2289
2290         if (result == 0) {
2291                 /* Set the download state */
2292                 hw->dlstate = HFA384x_DLSTATE_RAMENABLED;
2293         } else {
2294                 pr_debug("cmd_download(0x%04x, 0x%04x) failed, result=%d.\n",
2295                          lowaddr, hiaddr, result);
2296         }
2297
2298         return result;
2299 }
2300
2301 /*----------------------------------------------------------------
2302 * hfa384x_drvr_ramdl_write
2303 *
2304 * Performs a RAM download of a chunk of data. First checks to see
2305 * that we're in the RAM download state, then uses the [read|write]mem USB
2306 * commands to 1) copy the data, 2) readback and compare.  The download
2307 * state is unaffected.  When all data has been written using
2308 * this function, call drvr_ramdl_disable() to end the download state
2309 * and restart the MAC.
2310 *
2311 * Arguments:
2312 *       hw              device structure
2313 *       daddr           Card address to write to. (host order)
2314 *       buf             Ptr to data to write.
2315 *       len             Length of data (host order).
2316 *
2317 * Returns:
2318 *       0               success
2319 *       >0              f/w reported error - f/w status code
2320 *       <0              driver reported error
2321 *
2322 * Side effects:
2323 *
2324 * Call context:
2325 *       process
2326 ----------------------------------------------------------------*/
2327 int hfa384x_drvr_ramdl_write(hfa384x_t *hw, u32 daddr, void *buf, u32 len)
2328 {
2329         int result = 0;
2330         int nwrites;
2331         u8 *data = buf;
2332         int i;
2333         u32 curraddr;
2334         u16 currpage;
2335         u16 curroffset;
2336         u16 currlen;
2337
2338         /* Check that we're in the ram download state */
2339         if (hw->dlstate != HFA384x_DLSTATE_RAMENABLED)
2340                 return -EINVAL;
2341
2342         netdev_info(hw->wlandev->netdev, "Writing %d bytes to ram @0x%06x\n",
2343                     len, daddr);
2344
2345         /* How many dowmem calls?  */
2346         nwrites = len / HFA384x_USB_RWMEM_MAXLEN;
2347         nwrites += len % HFA384x_USB_RWMEM_MAXLEN ? 1 : 0;
2348
2349         /* Do blocking wmem's */
2350         for (i = 0; i < nwrites; i++) {
2351                 /* make address args */
2352                 curraddr = daddr + (i * HFA384x_USB_RWMEM_MAXLEN);
2353                 currpage = HFA384x_ADDR_CMD_MKPAGE(curraddr);
2354                 curroffset = HFA384x_ADDR_CMD_MKOFF(curraddr);
2355                 currlen = len - (i * HFA384x_USB_RWMEM_MAXLEN);
2356                 if (currlen > HFA384x_USB_RWMEM_MAXLEN)
2357                         currlen = HFA384x_USB_RWMEM_MAXLEN;
2358
2359                 /* Do blocking ctlx */
2360                 result = hfa384x_dowmem_wait(hw,
2361                                              currpage,
2362                                              curroffset,
2363                                              data +
2364                                              (i * HFA384x_USB_RWMEM_MAXLEN),
2365                                              currlen);
2366
2367                 if (result)
2368                         break;
2369
2370                 /* TODO: We really should have a readback. */
2371         }
2372
2373         return result;
2374 }
2375
2376 /*----------------------------------------------------------------
2377 * hfa384x_drvr_readpda
2378 *
2379 * Performs the sequence to read the PDA space.  Note there is no
2380 * drvr_writepda() function.  Writing a PDA is
2381 * generally implemented by a calling component via calls to
2382 * cmd_download and writing to the flash download buffer via the
2383 * aux regs.
2384 *
2385 * Arguments:
2386 *       hw              device structure
2387 *       buf             buffer to store PDA in
2388 *       len             buffer length
2389 *
2390 * Returns:
2391 *       0               success
2392 *       >0              f/w reported error - f/w status code
2393 *       <0              driver reported error
2394 *       -ETIMEDOUT      timout waiting for the cmd regs to become
2395 *                       available, or waiting for the control reg
2396 *                       to indicate the Aux port is enabled.
2397 *       -ENODATA        the buffer does NOT contain a valid PDA.
2398 *                       Either the card PDA is bad, or the auxdata
2399 *                       reads are giving us garbage.
2400
2401 *
2402 * Side effects:
2403 *
2404 * Call context:
2405 *       process or non-card interrupt.
2406 ----------------------------------------------------------------*/
2407 int hfa384x_drvr_readpda(hfa384x_t *hw, void *buf, unsigned int len)
2408 {
2409         int result = 0;
2410         u16 *pda = buf;
2411         int pdaok = 0;
2412         int morepdrs = 1;
2413         int currpdr = 0;        /* word offset of the current pdr */
2414         size_t i;
2415         u16 pdrlen;             /* pdr length in bytes, host order */
2416         u16 pdrcode;            /* pdr code, host order */
2417         u16 currpage;
2418         u16 curroffset;
2419         struct pdaloc {
2420                 u32 cardaddr;
2421                 u16 auxctl;
2422         } pdaloc[] = {
2423                 {
2424                 HFA3842_PDA_BASE, 0}, {
2425                 HFA3841_PDA_BASE, 0}, {
2426                 HFA3841_PDA_BOGUS_BASE, 0}
2427         };
2428
2429         /* Read the pda from each known address.  */
2430         for (i = 0; i < ARRAY_SIZE(pdaloc); i++) {
2431                 /* Make address */
2432                 currpage = HFA384x_ADDR_CMD_MKPAGE(pdaloc[i].cardaddr);
2433                 curroffset = HFA384x_ADDR_CMD_MKOFF(pdaloc[i].cardaddr);
2434
2435                 /* units of bytes */
2436                 result = hfa384x_dormem_wait(hw, currpage, curroffset, buf,
2437                                                 len);
2438
2439                 if (result) {
2440                         netdev_warn(hw->wlandev->netdev,
2441                                     "Read from index %zd failed, continuing\n",
2442                                     i);
2443                         continue;
2444                 }
2445
2446                 /* Test for garbage */
2447                 pdaok = 1;      /* initially assume good */
2448                 morepdrs = 1;
2449                 while (pdaok && morepdrs) {
2450                         pdrlen = le16_to_cpu(pda[currpdr]) * 2;
2451                         pdrcode = le16_to_cpu(pda[currpdr + 1]);
2452                         /* Test the record length */
2453                         if (pdrlen > HFA384x_PDR_LEN_MAX || pdrlen == 0) {
2454                                 netdev_err(hw->wlandev->netdev,
2455                                            "pdrlen invalid=%d\n", pdrlen);
2456                                 pdaok = 0;
2457                                 break;
2458                         }
2459                         /* Test the code */
2460                         if (!hfa384x_isgood_pdrcode(pdrcode)) {
2461                                 netdev_err(hw->wlandev->netdev, "pdrcode invalid=%d\n",
2462                                            pdrcode);
2463                                 pdaok = 0;
2464                                 break;
2465                         }
2466                         /* Test for completion */
2467                         if (pdrcode == HFA384x_PDR_END_OF_PDA)
2468                                 morepdrs = 0;
2469
2470                         /* Move to the next pdr (if necessary) */
2471                         if (morepdrs) {
2472                                 /* note the access to pda[], need words here */
2473                                 currpdr += le16_to_cpu(pda[currpdr]) + 1;
2474                         }
2475                 }
2476                 if (pdaok) {
2477                         netdev_info(hw->wlandev->netdev,
2478                                     "PDA Read from 0x%08x in %s space.\n",
2479                                     pdaloc[i].cardaddr,
2480                                     pdaloc[i].auxctl == 0 ? "EXTDS" :
2481                                     pdaloc[i].auxctl == 1 ? "NV" :
2482                                     pdaloc[i].auxctl == 2 ? "PHY" :
2483                                     pdaloc[i].auxctl == 3 ? "ICSRAM" :
2484                                     "<bogus auxctl>");
2485                         break;
2486                 }
2487         }
2488         result = pdaok ? 0 : -ENODATA;
2489
2490         if (result)
2491                 pr_debug("Failure: pda is not okay\n");
2492
2493         return result;
2494 }
2495
2496 /*----------------------------------------------------------------
2497 * hfa384x_drvr_setconfig
2498 *
2499 * Performs the sequence necessary to write a config/info item.
2500 *
2501 * Arguments:
2502 *       hw              device structure
2503 *       rid             config/info record id (in host order)
2504 *       buf             host side record buffer
2505 *       len             buffer length (in bytes)
2506 *
2507 * Returns:
2508 *       0               success
2509 *       >0              f/w reported error - f/w status code
2510 *       <0              driver reported error
2511 *
2512 * Side effects:
2513 *
2514 * Call context:
2515 *       process
2516 ----------------------------------------------------------------*/
2517 int hfa384x_drvr_setconfig(hfa384x_t *hw, u16 rid, void *buf, u16 len)
2518 {
2519         return hfa384x_dowrid_wait(hw, rid, buf, len);
2520 }
2521
2522 /*----------------------------------------------------------------
2523 * hfa384x_drvr_start
2524 *
2525 * Issues the MAC initialize command, sets up some data structures,
2526 * and enables the interrupts.  After this function completes, the
2527 * low-level stuff should be ready for any/all commands.
2528 *
2529 * Arguments:
2530 *       hw              device structure
2531 * Returns:
2532 *       0               success
2533 *       >0              f/w reported error - f/w status code
2534 *       <0              driver reported error
2535 *
2536 * Side effects:
2537 *
2538 * Call context:
2539 *       process
2540 ----------------------------------------------------------------*/
2541
2542 int hfa384x_drvr_start(hfa384x_t *hw)
2543 {
2544         int result, result1, result2;
2545         u16 status;
2546
2547         might_sleep();
2548
2549         /* Clear endpoint stalls - but only do this if the endpoint
2550          * is showing a stall status. Some prism2 cards seem to behave
2551          * badly if a clear_halt is called when the endpoint is already
2552          * ok
2553          */
2554         result =
2555             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_in, &status);
2556         if (result < 0) {
2557                 netdev_err(hw->wlandev->netdev, "Cannot get bulk in endpoint status.\n");
2558                 goto done;
2559         }
2560         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_in))
2561                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk in endpoint.\n");
2562
2563         result =
2564             usb_get_status(hw->usb, USB_RECIP_ENDPOINT, hw->endp_out, &status);
2565         if (result < 0) {
2566                 netdev_err(hw->wlandev->netdev, "Cannot get bulk out endpoint status.\n");
2567                 goto done;
2568         }
2569         if ((status == 1) && usb_clear_halt(hw->usb, hw->endp_out))
2570                 netdev_err(hw->wlandev->netdev, "Failed to reset bulk out endpoint.\n");
2571
2572         /* Synchronous unlink, in case we're trying to restart the driver */
2573         usb_kill_urb(&hw->rx_urb);
2574
2575         /* Post the IN urb */
2576         result = submit_rx_urb(hw, GFP_KERNEL);
2577         if (result != 0) {
2578                 netdev_err(hw->wlandev->netdev,
2579                            "Fatal, failed to submit RX URB, result=%d\n",
2580                            result);
2581                 goto done;
2582         }
2583
2584         /* Call initialize twice, with a 1 second sleep in between.
2585          * This is a nasty work-around since many prism2 cards seem to
2586          * need time to settle after an init from cold. The second
2587          * call to initialize in theory is not necessary - but we call
2588          * it anyway as a double insurance policy:
2589          * 1) If the first init should fail, the second may well succeed
2590          *    and the card can still be used
2591          * 2) It helps ensures all is well with the card after the first
2592          *    init and settle time.
2593          */
2594         result1 = hfa384x_cmd_initialize(hw);
2595         msleep(1000);
2596         result = hfa384x_cmd_initialize(hw);
2597         result2 = result;
2598         if (result1 != 0) {
2599                 if (result2 != 0) {
2600                         netdev_err(hw->wlandev->netdev,
2601                                    "cmd_initialize() failed on two attempts, results %d and %d\n",
2602                                    result1, result2);
2603                         usb_kill_urb(&hw->rx_urb);
2604                         goto done;
2605                 } else {
2606                         pr_debug("First cmd_initialize() failed (result %d),\n",
2607                                  result1);
2608                         pr_debug("but second attempt succeeded. All should be ok\n");
2609                 }
2610         } else if (result2 != 0) {
2611                 netdev_warn(hw->wlandev->netdev, "First cmd_initialize() succeeded, but second attempt failed (result=%d)\n",
2612                             result2);
2613                 netdev_warn(hw->wlandev->netdev,
2614                             "Most likely the card will be functional\n");
2615                 goto done;
2616         }
2617
2618         hw->state = HFA384x_STATE_RUNNING;
2619
2620 done:
2621         return result;
2622 }
2623
2624 /*----------------------------------------------------------------
2625 * hfa384x_drvr_stop
2626 *
2627 * Shuts down the MAC to the point where it is safe to unload the
2628 * driver.  Any subsystem that may be holding a data or function
2629 * ptr into the driver must be cleared/deinitialized.
2630 *
2631 * Arguments:
2632 *       hw              device structure
2633 * Returns:
2634 *       0               success
2635 *       >0              f/w reported error - f/w status code
2636 *       <0              driver reported error
2637 *
2638 * Side effects:
2639 *
2640 * Call context:
2641 *       process
2642 ----------------------------------------------------------------*/
2643 int hfa384x_drvr_stop(hfa384x_t *hw)
2644 {
2645         int i;
2646
2647         might_sleep();
2648
2649         /* There's no need for spinlocks here. The USB "disconnect"
2650          * function sets this "removed" flag and then calls us.
2651          */
2652         if (!hw->wlandev->hwremoved) {
2653                 /* Call initialize to leave the MAC in its 'reset' state */
2654                 hfa384x_cmd_initialize(hw);
2655
2656                 /* Cancel the rxurb */
2657                 usb_kill_urb(&hw->rx_urb);
2658         }
2659
2660         hw->link_status = HFA384x_LINK_NOTCONNECTED;
2661         hw->state = HFA384x_STATE_INIT;
2662
2663         del_timer_sync(&hw->commsqual_timer);
2664
2665         /* Clear all the port status */
2666         for (i = 0; i < HFA384x_NUMPORTS_MAX; i++)
2667                 hw->port_enabled[i] = 0;
2668
2669         return 0;
2670 }
2671
2672 /*----------------------------------------------------------------
2673 * hfa384x_drvr_txframe
2674 *
2675 * Takes a frame from prism2sta and queues it for transmission.
2676 *
2677 * Arguments:
2678 *       hw              device structure
2679 *       skb             packet buffer struct.  Contains an 802.11
2680 *                       data frame.
2681 *       p80211_hdr      points to the 802.11 header for the packet.
2682 * Returns:
2683 *       0               Success and more buffs available
2684 *       1               Success but no more buffs
2685 *       2               Allocation failure
2686 *       4               Buffer full or queue busy
2687 *
2688 * Side effects:
2689 *
2690 * Call context:
2691 *       interrupt
2692 ----------------------------------------------------------------*/
2693 int hfa384x_drvr_txframe(hfa384x_t *hw, struct sk_buff *skb,
2694                          union p80211_hdr *p80211_hdr,
2695                          struct p80211_metawep *p80211_wep)
2696 {
2697         int usbpktlen = sizeof(hfa384x_tx_frame_t);
2698         int result;
2699         int ret;
2700         char *ptr;
2701
2702         if (hw->tx_urb.status == -EINPROGRESS) {
2703                 netdev_warn(hw->wlandev->netdev, "TX URB already in use\n");
2704                 result = 3;
2705                 goto exit;
2706         }
2707
2708         /* Build Tx frame structure */
2709         /* Set up the control field */
2710         memset(&hw->txbuff.txfrm.desc, 0, sizeof(hw->txbuff.txfrm.desc));
2711
2712         /* Setup the usb type field */
2713         hw->txbuff.type = cpu_to_le16(HFA384x_USB_TXFRM);
2714
2715         /* Set up the sw_support field to identify this frame */
2716         hw->txbuff.txfrm.desc.sw_support = 0x0123;
2717
2718 /* Tx complete and Tx exception disable per dleach.  Might be causing
2719  * buf depletion
2720  */
2721 /* #define DOEXC  SLP -- doboth breaks horribly under load, doexc less so. */
2722 #if defined(DOBOTH)
2723         hw->txbuff.txfrm.desc.tx_control =
2724             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2725             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(1);
2726 #elif defined(DOEXC)
2727         hw->txbuff.txfrm.desc.tx_control =
2728             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2729             HFA384x_TX_TXEX_SET(1) | HFA384x_TX_TXOK_SET(0);
2730 #else
2731         hw->txbuff.txfrm.desc.tx_control =
2732             HFA384x_TX_MACPORT_SET(0) | HFA384x_TX_STRUCTYPE_SET(1) |
2733             HFA384x_TX_TXEX_SET(0) | HFA384x_TX_TXOK_SET(0);
2734 #endif
2735         hw->txbuff.txfrm.desc.tx_control =
2736             cpu_to_le16(hw->txbuff.txfrm.desc.tx_control);
2737
2738         /* copy the header over to the txdesc */
2739         memcpy(&(hw->txbuff.txfrm.desc.frame_control), p80211_hdr,
2740                sizeof(union p80211_hdr));
2741
2742         /* if we're using host WEP, increase size by IV+ICV */
2743         if (p80211_wep->data) {
2744                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len + 8);
2745                 usbpktlen += 8;
2746         } else {
2747                 hw->txbuff.txfrm.desc.data_len = cpu_to_le16(skb->len);
2748         }
2749
2750         usbpktlen += skb->len;
2751
2752         /* copy over the WEP IV if we are using host WEP */
2753         ptr = hw->txbuff.txfrm.data;
2754         if (p80211_wep->data) {
2755                 memcpy(ptr, p80211_wep->iv, sizeof(p80211_wep->iv));
2756                 ptr += sizeof(p80211_wep->iv);
2757                 memcpy(ptr, p80211_wep->data, skb->len);
2758         } else {
2759                 memcpy(ptr, skb->data, skb->len);
2760         }
2761         /* copy over the packet data */
2762         ptr += skb->len;
2763
2764         /* copy over the WEP ICV if we are using host WEP */
2765         if (p80211_wep->data)
2766                 memcpy(ptr, p80211_wep->icv, sizeof(p80211_wep->icv));
2767
2768         /* Send the USB packet */
2769         usb_fill_bulk_urb(&(hw->tx_urb), hw->usb,
2770                           hw->endp_out,
2771                           &(hw->txbuff), ROUNDUP64(usbpktlen),
2772                           hfa384x_usbout_callback, hw->wlandev);
2773         hw->tx_urb.transfer_flags |= USB_QUEUE_BULK;
2774
2775         result = 1;
2776         ret = submit_tx_urb(hw, &hw->tx_urb, GFP_ATOMIC);
2777         if (ret != 0) {
2778                 netdev_err(hw->wlandev->netdev,
2779                            "submit_tx_urb() failed, error=%d\n", ret);
2780                 result = 3;
2781         }
2782
2783 exit:
2784         return result;
2785 }
2786
2787 void hfa384x_tx_timeout(wlandevice_t *wlandev)
2788 {
2789         hfa384x_t *hw = wlandev->priv;
2790         unsigned long flags;
2791
2792         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2793
2794         if (!hw->wlandev->hwremoved) {
2795                 int sched;
2796
2797                 sched = !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags);
2798                 sched |= !test_and_set_bit(WORK_RX_HALT, &hw->usb_flags);
2799                 if (sched)
2800                         schedule_work(&hw->usb_work);
2801         }
2802
2803         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2804 }
2805
2806 /*----------------------------------------------------------------
2807 * hfa384x_usbctlx_reaper_task
2808 *
2809 * Tasklet to delete dead CTLX objects
2810 *
2811 * Arguments:
2812 *       data    ptr to a hfa384x_t
2813 *
2814 * Returns:
2815 *
2816 * Call context:
2817 *       Interrupt
2818 ----------------------------------------------------------------*/
2819 static void hfa384x_usbctlx_reaper_task(unsigned long data)
2820 {
2821         hfa384x_t *hw = (hfa384x_t *)data;
2822         struct list_head *entry;
2823         struct list_head *temp;
2824         unsigned long flags;
2825
2826         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2827
2828         /* This list is guaranteed to be empty if someone
2829          * has unplugged the adapter.
2830          */
2831         list_for_each_safe(entry, temp, &hw->ctlxq.reapable) {
2832                 hfa384x_usbctlx_t *ctlx;
2833
2834                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2835                 list_del(&ctlx->list);
2836                 kfree(ctlx);
2837         }
2838
2839         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2840 }
2841
2842 /*----------------------------------------------------------------
2843 * hfa384x_usbctlx_completion_task
2844 *
2845 * Tasklet to call completion handlers for returned CTLXs
2846 *
2847 * Arguments:
2848 *       data    ptr to hfa384x_t
2849 *
2850 * Returns:
2851 *       Nothing
2852 *
2853 * Call context:
2854 *       Interrupt
2855 ----------------------------------------------------------------*/
2856 static void hfa384x_usbctlx_completion_task(unsigned long data)
2857 {
2858         hfa384x_t *hw = (hfa384x_t *)data;
2859         struct list_head *entry;
2860         struct list_head *temp;
2861         unsigned long flags;
2862
2863         int reap = 0;
2864
2865         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2866
2867         /* This list is guaranteed to be empty if someone
2868          * has unplugged the adapter ...
2869          */
2870         list_for_each_safe(entry, temp, &hw->ctlxq.completing) {
2871                 hfa384x_usbctlx_t *ctlx;
2872
2873                 ctlx = list_entry(entry, hfa384x_usbctlx_t, list);
2874
2875                 /* Call the completion function that this
2876                  * command was assigned, assuming it has one.
2877                  */
2878                 if (ctlx->cmdcb != NULL) {
2879                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2880                         ctlx->cmdcb(hw, ctlx);
2881                         spin_lock_irqsave(&hw->ctlxq.lock, flags);
2882
2883                         /* Make sure we don't try and complete
2884                          * this CTLX more than once!
2885                          */
2886                         ctlx->cmdcb = NULL;
2887
2888                         /* Did someone yank the adapter out
2889                          * while our list was (briefly) unlocked?
2890                          */
2891                         if (hw->wlandev->hwremoved) {
2892                                 reap = 0;
2893                                 break;
2894                         }
2895                 }
2896
2897                 /*
2898                  * "Reapable" CTLXs are ones which don't have any
2899                  * threads waiting for them to die. Hence they must
2900                  * be delivered to The Reaper!
2901                  */
2902                 if (ctlx->reapable) {
2903                         /* Move the CTLX off the "completing" list (hopefully)
2904                          * on to the "reapable" list where the reaper task
2905                          * can find it. And "reapable" means that this CTLX
2906                          * isn't sitting on a wait-queue somewhere.
2907                          */
2908                         list_move_tail(&ctlx->list, &hw->ctlxq.reapable);
2909                         reap = 1;
2910                 }
2911
2912                 complete(&ctlx->done);
2913         }
2914         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
2915
2916         if (reap)
2917                 tasklet_schedule(&hw->reaper_bh);
2918 }
2919
2920 /*----------------------------------------------------------------
2921 * unlocked_usbctlx_cancel_async
2922 *
2923 * Mark the CTLX dead asynchronously, and ensure that the
2924 * next command on the queue is run afterwards.
2925 *
2926 * Arguments:
2927 *       hw      ptr to the hfa384x_t structure
2928 *       ctlx    ptr to a CTLX structure
2929 *
2930 * Returns:
2931 *       0       the CTLX's URB is inactive
2932 * -EINPROGRESS  the URB is currently being unlinked
2933 *
2934 * Call context:
2935 *       Either process or interrupt, but presumably interrupt
2936 ----------------------------------------------------------------*/
2937 static int unlocked_usbctlx_cancel_async(hfa384x_t *hw,
2938                                          hfa384x_usbctlx_t *ctlx)
2939 {
2940         int ret;
2941
2942         /*
2943          * Try to delete the URB containing our request packet.
2944          * If we succeed, then its completion handler will be
2945          * called with a status of -ECONNRESET.
2946          */
2947         hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
2948         ret = usb_unlink_urb(&hw->ctlx_urb);
2949
2950         if (ret != -EINPROGRESS) {
2951                 /*
2952                  * The OUT URB had either already completed
2953                  * or was still in the pending queue, so the
2954                  * URB's completion function will not be called.
2955                  * We will have to complete the CTLX ourselves.
2956                  */
2957                 ctlx->state = CTLX_REQ_FAILED;
2958                 unlocked_usbctlx_complete(hw, ctlx);
2959                 ret = 0;
2960         }
2961
2962         return ret;
2963 }
2964
2965 /*----------------------------------------------------------------
2966 * unlocked_usbctlx_complete
2967 *
2968 * A CTLX has completed.  It may have been successful, it may not
2969 * have been. At this point, the CTLX should be quiescent.  The URBs
2970 * aren't active and the timers should have been stopped.
2971 *
2972 * The CTLX is migrated to the "completing" queue, and the completing
2973 * tasklet is scheduled.
2974 *
2975 * Arguments:
2976 *       hw              ptr to a hfa384x_t structure
2977 *       ctlx            ptr to a ctlx structure
2978 *
2979 * Returns:
2980 *       nothing
2981 *
2982 * Side effects:
2983 *
2984 * Call context:
2985 *       Either, assume interrupt
2986 ----------------------------------------------------------------*/
2987 static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
2988 {
2989         /* Timers have been stopped, and ctlx should be in
2990          * a terminal state. Retire it from the "active"
2991          * queue.
2992          */
2993         list_move_tail(&ctlx->list, &hw->ctlxq.completing);
2994         tasklet_schedule(&hw->completion_bh);
2995
2996         switch (ctlx->state) {
2997         case CTLX_COMPLETE:
2998         case CTLX_REQ_FAILED:
2999                 /* This are the correct terminating states. */
3000                 break;
3001
3002         default:
3003                 netdev_err(hw->wlandev->netdev, "CTLX[%d] not in a terminating state(%s)\n",
3004                            le16_to_cpu(ctlx->outbuf.type),
3005                            ctlxstr(ctlx->state));
3006                 break;
3007         }                       /* switch */
3008 }
3009
3010 /*----------------------------------------------------------------
3011 * hfa384x_usbctlxq_run
3012 *
3013 * Checks to see if the head item is running.  If not, starts it.
3014 *
3015 * Arguments:
3016 *       hw      ptr to hfa384x_t
3017 *
3018 * Returns:
3019 *       nothing
3020 *
3021 * Side effects:
3022 *
3023 * Call context:
3024 *       any
3025 ----------------------------------------------------------------*/
3026 static void hfa384x_usbctlxq_run(hfa384x_t *hw)
3027 {
3028         unsigned long flags;
3029
3030         /* acquire lock */
3031         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3032
3033         /* Only one active CTLX at any one time, because there's no
3034          * other (reliable) way to match the response URB to the
3035          * correct CTLX.
3036          *
3037          * Don't touch any of these CTLXs if the hardware
3038          * has been removed or the USB subsystem is stalled.
3039          */
3040         if (!list_empty(&hw->ctlxq.active) ||
3041             test_bit(WORK_TX_HALT, &hw->usb_flags) || hw->wlandev->hwremoved)
3042                 goto unlock;
3043
3044         while (!list_empty(&hw->ctlxq.pending)) {
3045                 hfa384x_usbctlx_t *head;
3046                 int result;
3047
3048                 /* This is the first pending command */
3049                 head = list_entry(hw->ctlxq.pending.next,
3050                                   hfa384x_usbctlx_t, list);
3051
3052                 /* We need to split this off to avoid a race condition */
3053                 list_move_tail(&head->list, &hw->ctlxq.active);
3054
3055                 /* Fill the out packet */
3056                 usb_fill_bulk_urb(&(hw->ctlx_urb), hw->usb,
3057                                   hw->endp_out,
3058                                   &(head->outbuf), ROUNDUP64(head->outbufsize),
3059                                   hfa384x_ctlxout_callback, hw);
3060                 hw->ctlx_urb.transfer_flags |= USB_QUEUE_BULK;
3061
3062                 /* Now submit the URB and update the CTLX's state */
3063                 result = SUBMIT_URB(&hw->ctlx_urb, GFP_ATOMIC);
3064                 if (result == 0) {
3065                         /* This CTLX is now running on the active queue */
3066                         head->state = CTLX_REQ_SUBMITTED;
3067
3068                         /* Start the OUT wait timer */
3069                         hw->req_timer_done = 0;
3070                         hw->reqtimer.expires = jiffies + HZ;
3071                         add_timer(&hw->reqtimer);
3072
3073                         /* Start the IN wait timer */
3074                         hw->resp_timer_done = 0;
3075                         hw->resptimer.expires = jiffies + 2 * HZ;
3076                         add_timer(&hw->resptimer);
3077
3078                         break;
3079                 }
3080
3081                 if (result == -EPIPE) {
3082                         /* The OUT pipe needs resetting, so put
3083                          * this CTLX back in the "pending" queue
3084                          * and schedule a reset ...
3085                          */
3086                         netdev_warn(hw->wlandev->netdev,
3087                                     "%s tx pipe stalled: requesting reset\n",
3088                                     hw->wlandev->netdev->name);
3089                         list_move(&head->list, &hw->ctlxq.pending);
3090                         set_bit(WORK_TX_HALT, &hw->usb_flags);
3091                         schedule_work(&hw->usb_work);
3092                         break;
3093                 }
3094
3095                 if (result == -ESHUTDOWN) {
3096                         netdev_warn(hw->wlandev->netdev, "%s urb shutdown!\n",
3097                                     hw->wlandev->netdev->name);
3098                         break;
3099                 }
3100
3101                 netdev_err(hw->wlandev->netdev, "Failed to submit CTLX[%d]: error=%d\n",
3102                            le16_to_cpu(head->outbuf.type), result);
3103                 unlocked_usbctlx_complete(hw, head);
3104         }                       /* while */
3105
3106 unlock:
3107         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3108 }
3109
3110 /*----------------------------------------------------------------
3111 * hfa384x_usbin_callback
3112 *
3113 * Callback for URBs on the BULKIN endpoint.
3114 *
3115 * Arguments:
3116 *       urb             ptr to the completed urb
3117 *
3118 * Returns:
3119 *       nothing
3120 *
3121 * Side effects:
3122 *
3123 * Call context:
3124 *       interrupt
3125 ----------------------------------------------------------------*/
3126 static void hfa384x_usbin_callback(struct urb *urb)
3127 {
3128         wlandevice_t *wlandev = urb->context;
3129         hfa384x_t *hw;
3130         hfa384x_usbin_t *usbin = (hfa384x_usbin_t *)urb->transfer_buffer;
3131         struct sk_buff *skb = NULL;
3132         int result;
3133         int urb_status;
3134         u16 type;
3135
3136         enum USBIN_ACTION {
3137                 HANDLE,
3138                 RESUBMIT,
3139                 ABORT
3140         } action;
3141
3142         if (!wlandev || !wlandev->netdev || wlandev->hwremoved)
3143                 goto exit;
3144
3145         hw = wlandev->priv;
3146         if (!hw)
3147                 goto exit;
3148
3149         skb = hw->rx_urb_skb;
3150         BUG_ON(!skb || (skb->data != urb->transfer_buffer));
3151
3152         hw->rx_urb_skb = NULL;
3153
3154         /* Check for error conditions within the URB */
3155         switch (urb->status) {
3156         case 0:
3157                 action = HANDLE;
3158
3159                 /* Check for short packet */
3160                 if (urb->actual_length == 0) {
3161                         ++(wlandev->linux_stats.rx_errors);
3162                         ++(wlandev->linux_stats.rx_length_errors);
3163                         action = RESUBMIT;
3164                 }
3165                 break;
3166
3167         case -EPIPE:
3168                 netdev_warn(hw->wlandev->netdev, "%s rx pipe stalled: requesting reset\n",
3169                             wlandev->netdev->name);
3170                 if (!test_and_set_bit(WORK_RX_HALT, &hw->usb_flags))
3171                         schedule_work(&hw->usb_work);
3172                 ++(wlandev->linux_stats.rx_errors);
3173                 action = ABORT;
3174                 break;
3175
3176         case -EILSEQ:
3177         case -ETIMEDOUT:
3178         case -EPROTO:
3179                 if (!test_and_set_bit(THROTTLE_RX, &hw->usb_flags) &&
3180                     !timer_pending(&hw->throttle)) {
3181                         mod_timer(&hw->throttle, jiffies + THROTTLE_JIFFIES);
3182                 }
3183                 ++(wlandev->linux_stats.rx_errors);
3184                 action = ABORT;
3185                 break;
3186
3187         case -EOVERFLOW:
3188                 ++(wlandev->linux_stats.rx_over_errors);
3189                 action = RESUBMIT;
3190                 break;
3191
3192         case -ENODEV:
3193         case -ESHUTDOWN:
3194                 pr_debug("status=%d, device removed.\n", urb->status);
3195                 action = ABORT;
3196                 break;
3197
3198         case -ENOENT:
3199         case -ECONNRESET:
3200                 pr_debug("status=%d, urb explicitly unlinked.\n", urb->status);
3201                 action = ABORT;
3202                 break;
3203
3204         default:
3205                 pr_debug("urb status=%d, transfer flags=0x%x\n",
3206                          urb->status, urb->transfer_flags);
3207                 ++(wlandev->linux_stats.rx_errors);
3208                 action = RESUBMIT;
3209                 break;
3210         }
3211
3212         urb_status = urb->status;
3213
3214         if (action != ABORT) {
3215                 /* Repost the RX URB */
3216                 result = submit_rx_urb(hw, GFP_ATOMIC);
3217
3218                 if (result != 0) {
3219                         netdev_err(hw->wlandev->netdev,
3220                                    "Fatal, failed to resubmit rx_urb. error=%d\n",
3221                                    result);
3222                 }
3223         }
3224
3225         /* Handle any USB-IN packet */
3226         /* Note: the check of the sw_support field, the type field doesn't
3227          *       have bit 12 set like the docs suggest.
3228          */
3229         type = le16_to_cpu(usbin->type);
3230         if (HFA384x_USB_ISRXFRM(type)) {
3231                 if (action == HANDLE) {
3232                         if (usbin->txfrm.desc.sw_support == 0x0123) {
3233                                 hfa384x_usbin_txcompl(wlandev, usbin);
3234                         } else {
3235                                 skb_put(skb, sizeof(*usbin));
3236                                 hfa384x_usbin_rx(wlandev, skb);
3237                                 skb = NULL;
3238                         }
3239                 }
3240                 goto exit;
3241         }
3242         if (HFA384x_USB_ISTXFRM(type)) {
3243                 if (action == HANDLE)
3244                         hfa384x_usbin_txcompl(wlandev, usbin);
3245                 goto exit;
3246         }
3247         switch (type) {
3248         case HFA384x_USB_INFOFRM:
3249                 if (action == ABORT)
3250                         goto exit;
3251                 if (action == HANDLE)
3252                         hfa384x_usbin_info(wlandev, usbin);
3253                 break;
3254
3255         case HFA384x_USB_CMDRESP:
3256         case HFA384x_USB_WRIDRESP:
3257         case HFA384x_USB_RRIDRESP:
3258         case HFA384x_USB_WMEMRESP:
3259         case HFA384x_USB_RMEMRESP:
3260                 /* ALWAYS, ALWAYS, ALWAYS handle this CTLX!!!! */
3261                 hfa384x_usbin_ctlx(hw, usbin, urb_status);
3262                 break;
3263
3264         case HFA384x_USB_BUFAVAIL:
3265                 pr_debug("Received BUFAVAIL packet, frmlen=%d\n",
3266                          usbin->bufavail.frmlen);
3267                 break;
3268
3269         case HFA384x_USB_ERROR:
3270                 pr_debug("Received USB_ERROR packet, errortype=%d\n",
3271                          usbin->usberror.errortype);
3272                 break;
3273
3274         default:
3275                 pr_debug("Unrecognized USBIN packet, type=%x, status=%d\n",
3276                          usbin->type, urb_status);
3277                 break;
3278         }                       /* switch */
3279
3280 exit:
3281
3282         if (skb)
3283                 dev_kfree_skb(skb);
3284 }
3285
3286 /*----------------------------------------------------------------
3287 * hfa384x_usbin_ctlx
3288 *
3289 * We've received a URB containing a Prism2 "response" message.
3290 * This message needs to be matched up with a CTLX on the active
3291 * queue and our state updated accordingly.
3292 *
3293 * Arguments:
3294 *       hw              ptr to hfa384x_t
3295 *       usbin           ptr to USB IN packet
3296 *       urb_status      status of this Bulk-In URB
3297 *
3298 * Returns:
3299 *       nothing
3300 *
3301 * Side effects:
3302 *
3303 * Call context:
3304 *       interrupt
3305 ----------------------------------------------------------------*/
3306 static void hfa384x_usbin_ctlx(hfa384x_t *hw, hfa384x_usbin_t *usbin,
3307                                int urb_status)
3308 {
3309         hfa384x_usbctlx_t *ctlx;
3310         int run_queue = 0;
3311         unsigned long flags;
3312
3313 retry:
3314         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3315
3316         /* There can be only one CTLX on the active queue
3317          * at any one time, and this is the CTLX that the
3318          * timers are waiting for.
3319          */
3320         if (list_empty(&hw->ctlxq.active))
3321                 goto unlock;
3322
3323         /* Remove the "response timeout". It's possible that
3324          * we are already too late, and that the timeout is
3325          * already running. And that's just too bad for us,
3326          * because we could lose our CTLX from the active
3327          * queue here ...
3328          */
3329         if (del_timer(&hw->resptimer) == 0) {
3330                 if (hw->resp_timer_done == 0) {
3331                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3332                         goto retry;
3333                 }
3334         } else {
3335                 hw->resp_timer_done = 1;
3336         }
3337
3338         ctlx = get_active_ctlx(hw);
3339
3340         if (urb_status != 0) {
3341                 /*
3342                  * Bad CTLX, so get rid of it. But we only
3343                  * remove it from the active queue if we're no
3344                  * longer expecting the OUT URB to complete.
3345                  */
3346                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3347                         run_queue = 1;
3348         } else {
3349                 const u16 intype = (usbin->type & ~cpu_to_le16(0x8000));
3350
3351                 /*
3352                  * Check that our message is what we're expecting ...
3353                  */
3354                 if (ctlx->outbuf.type != intype) {
3355                         netdev_warn(hw->wlandev->netdev,
3356                                     "Expected IN[%d], received IN[%d] - ignored.\n",
3357                                     le16_to_cpu(ctlx->outbuf.type),
3358                                     le16_to_cpu(intype));
3359                         goto unlock;
3360                 }
3361
3362                 /* This URB has succeeded, so grab the data ... */
3363                 memcpy(&ctlx->inbuf, usbin, sizeof(ctlx->inbuf));
3364
3365                 switch (ctlx->state) {
3366                 case CTLX_REQ_SUBMITTED:
3367                         /*
3368                          * We have received our response URB before
3369                          * our request has been acknowledged. Odd,
3370                          * but our OUT URB is still alive...
3371                          */
3372                         pr_debug("Causality violation: please reboot Universe\n");
3373                         ctlx->state = CTLX_RESP_COMPLETE;
3374                         break;
3375
3376                 case CTLX_REQ_COMPLETE:
3377                         /*
3378                          * This is the usual path: our request
3379                          * has already been acknowledged, and
3380                          * now we have received the reply too.
3381                          */
3382                         ctlx->state = CTLX_COMPLETE;
3383                         unlocked_usbctlx_complete(hw, ctlx);
3384                         run_queue = 1;
3385                         break;
3386
3387                 default:
3388                         /*
3389                          * Throw this CTLX away ...
3390                          */
3391                         netdev_err(hw->wlandev->netdev,
3392                                    "Matched IN URB, CTLX[%d] in invalid state(%s). Discarded.\n",
3393                                    le16_to_cpu(ctlx->outbuf.type),
3394                                    ctlxstr(ctlx->state));
3395                         if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0)
3396                                 run_queue = 1;
3397                         break;
3398                 }               /* switch */
3399         }
3400
3401 unlock:
3402         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3403
3404         if (run_queue)
3405                 hfa384x_usbctlxq_run(hw);
3406 }
3407
3408 /*----------------------------------------------------------------
3409 * hfa384x_usbin_txcompl
3410 *
3411 * At this point we have the results of a previous transmit.
3412 *
3413 * Arguments:
3414 *       wlandev         wlan device
3415 *       usbin           ptr to the usb transfer buffer
3416 *
3417 * Returns:
3418 *       nothing
3419 *
3420 * Side effects:
3421 *
3422 * Call context:
3423 *       interrupt
3424 ----------------------------------------------------------------*/
3425 static void hfa384x_usbin_txcompl(wlandevice_t *wlandev,
3426                                   hfa384x_usbin_t *usbin)
3427 {
3428         u16 status;
3429
3430         status = le16_to_cpu(usbin->type); /* yeah I know it says type... */
3431
3432         /* Was there an error? */
3433         if (HFA384x_TXSTATUS_ISERROR(status))
3434                 prism2sta_ev_txexc(wlandev, status);
3435         else
3436                 prism2sta_ev_tx(wlandev, status);
3437 }
3438
3439 /*----------------------------------------------------------------
3440 * hfa384x_usbin_rx
3441 *
3442 * At this point we have a successful received a rx frame packet.
3443 *
3444 * Arguments:
3445 *       wlandev         wlan device
3446 *       usbin           ptr to the usb transfer buffer
3447 *
3448 * Returns:
3449 *       nothing
3450 *
3451 * Side effects:
3452 *
3453 * Call context:
3454 *       interrupt
3455 ----------------------------------------------------------------*/
3456 static void hfa384x_usbin_rx(wlandevice_t *wlandev, struct sk_buff *skb)
3457 {
3458         hfa384x_usbin_t *usbin = (hfa384x_usbin_t *)skb->data;
3459         hfa384x_t *hw = wlandev->priv;
3460         int hdrlen;
3461         struct p80211_rxmeta *rxmeta;
3462         u16 data_len;
3463         u16 fc;
3464
3465         /* Byte order convert once up front. */
3466         usbin->rxfrm.desc.status = le16_to_cpu(usbin->rxfrm.desc.status);
3467         usbin->rxfrm.desc.time = le32_to_cpu(usbin->rxfrm.desc.time);
3468
3469         /* Now handle frame based on port# */
3470         switch (HFA384x_RXSTATUS_MACPORT_GET(usbin->rxfrm.desc.status)) {
3471         case 0:
3472                 fc = le16_to_cpu(usbin->rxfrm.desc.frame_control);
3473
3474                 /* If exclude and we receive an unencrypted, drop it */
3475                 if ((wlandev->hostwep & HOSTWEP_EXCLUDEUNENCRYPTED) &&
3476                     !WLAN_GET_FC_ISWEP(fc)) {
3477                         goto done;
3478                 }
3479
3480                 data_len = le16_to_cpu(usbin->rxfrm.desc.data_len);
3481
3482                 /* How much header data do we have? */
3483                 hdrlen = p80211_headerlen(fc);
3484
3485                 /* Pull off the descriptor */
3486                 skb_pull(skb, sizeof(hfa384x_rx_frame_t));
3487
3488                 /* Now shunt the header block up against the data block
3489                  * with an "overlapping" copy
3490                  */
3491                 memmove(skb_push(skb, hdrlen),
3492                         &usbin->rxfrm.desc.frame_control, hdrlen);
3493
3494                 skb->dev = wlandev->netdev;
3495                 skb->dev->last_rx = jiffies;
3496
3497                 /* And set the frame length properly */
3498                 skb_trim(skb, data_len + hdrlen);
3499
3500                 /* The prism2 series does not return the CRC */
3501                 memset(skb_put(skb, WLAN_CRC_LEN), 0xff, WLAN_CRC_LEN);
3502
3503                 skb_reset_mac_header(skb);
3504
3505                 /* Attach the rxmeta, set some stuff */
3506                 p80211skb_rxmeta_attach(wlandev, skb);
3507                 rxmeta = P80211SKB_RXMETA(skb);
3508                 rxmeta->mactime = usbin->rxfrm.desc.time;
3509                 rxmeta->rxrate = usbin->rxfrm.desc.rate;
3510                 rxmeta->signal = usbin->rxfrm.desc.signal - hw->dbmadjust;
3511                 rxmeta->noise = usbin->rxfrm.desc.silence - hw->dbmadjust;
3512
3513                 prism2sta_ev_rx(wlandev, skb);
3514
3515                 break;
3516
3517         case 7:
3518                 if (!HFA384x_RXSTATUS_ISFCSERR(usbin->rxfrm.desc.status)) {
3519                         /* Copy to wlansnif skb */
3520                         hfa384x_int_rxmonitor(wlandev, &usbin->rxfrm);
3521                         dev_kfree_skb(skb);
3522                 } else {
3523                         pr_debug("Received monitor frame: FCSerr set\n");
3524                 }
3525                 break;
3526
3527         default:
3528                 netdev_warn(hw->wlandev->netdev, "Received frame on unsupported port=%d\n",
3529                             HFA384x_RXSTATUS_MACPORT_GET(
3530                                     usbin->rxfrm.desc.status));
3531                 goto done;
3532                 break;
3533         }
3534
3535 done:
3536         return;
3537 }
3538
3539 /*----------------------------------------------------------------
3540 * hfa384x_int_rxmonitor
3541 *
3542 * Helper function for int_rx.  Handles monitor frames.
3543 * Note that this function allocates space for the FCS and sets it
3544 * to 0xffffffff.  The hfa384x doesn't give us the FCS value but the
3545 * higher layers expect it.  0xffffffff is used as a flag to indicate
3546 * the FCS is bogus.
3547 *
3548 * Arguments:
3549 *       wlandev         wlan device structure
3550 *       rxfrm           rx descriptor read from card in int_rx
3551 *
3552 * Returns:
3553 *       nothing
3554 *
3555 * Side effects:
3556 *       Allocates an skb and passes it up via the PF_PACKET interface.
3557 * Call context:
3558 *       interrupt
3559 ----------------------------------------------------------------*/
3560 static void hfa384x_int_rxmonitor(wlandevice_t *wlandev,
3561                                   hfa384x_usb_rxfrm_t *rxfrm)
3562 {
3563         hfa384x_rx_frame_t *rxdesc = &(rxfrm->desc);
3564         unsigned int hdrlen = 0;
3565         unsigned int datalen = 0;
3566         unsigned int skblen = 0;
3567         u8 *datap;
3568         u16 fc;
3569         struct sk_buff *skb;
3570         hfa384x_t *hw = wlandev->priv;
3571
3572         /* Remember the status, time, and data_len fields are in host order */
3573         /* Figure out how big the frame is */
3574         fc = le16_to_cpu(rxdesc->frame_control);
3575         hdrlen = p80211_headerlen(fc);
3576         datalen = le16_to_cpu(rxdesc->data_len);
3577
3578         /* Allocate an ind message+framesize skb */
3579         skblen = sizeof(struct p80211_caphdr) + hdrlen + datalen + WLAN_CRC_LEN;
3580
3581         /* sanity check the length */
3582         if (skblen >
3583             (sizeof(struct p80211_caphdr) +
3584              WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
3585                 pr_debug("overlen frm: len=%zd\n",
3586                          skblen - sizeof(struct p80211_caphdr));
3587         }
3588
3589         skb = dev_alloc_skb(skblen);
3590         if (skb == NULL) {
3591                 netdev_err(hw->wlandev->netdev,
3592                            "alloc_skb failed trying to allocate %d bytes\n",
3593                            skblen);
3594                 return;
3595         }
3596
3597         /* only prepend the prism header if in the right mode */
3598         if ((wlandev->netdev->type == ARPHRD_IEEE80211_PRISM) &&
3599             (hw->sniffhdr != 0)) {
3600                 struct p80211_caphdr *caphdr;
3601                 /* The NEW header format! */
3602                 datap = skb_put(skb, sizeof(struct p80211_caphdr));
3603                 caphdr = (struct p80211_caphdr *)datap;
3604
3605                 caphdr->version = htonl(P80211CAPTURE_VERSION);
3606                 caphdr->length = htonl(sizeof(struct p80211_caphdr));
3607                 caphdr->mactime = __cpu_to_be64(rxdesc->time) * 1000;
3608                 caphdr->hosttime = __cpu_to_be64(jiffies);
3609                 caphdr->phytype = htonl(4);     /* dss_dot11_b */
3610                 caphdr->channel = htonl(hw->sniff_channel);
3611                 caphdr->datarate = htonl(rxdesc->rate);
3612                 caphdr->antenna = htonl(0);     /* unknown */
3613                 caphdr->priority = htonl(0);    /* unknown */
3614                 caphdr->ssi_type = htonl(3);    /* rssi_raw */
3615                 caphdr->ssi_signal = htonl(rxdesc->signal);
3616                 caphdr->ssi_noise = htonl(rxdesc->silence);
3617                 caphdr->preamble = htonl(0);    /* unknown */
3618                 caphdr->encoding = htonl(1);    /* cck */
3619         }
3620
3621         /* Copy the 802.11 header to the skb
3622            (ctl frames may be less than a full header) */
3623         datap = skb_put(skb, hdrlen);
3624         memcpy(datap, &(rxdesc->frame_control), hdrlen);
3625
3626         /* If any, copy the data from the card to the skb */
3627         if (datalen > 0) {
3628                 datap = skb_put(skb, datalen);
3629                 memcpy(datap, rxfrm->data, datalen);
3630
3631                 /* check for unencrypted stuff if WEP bit set. */
3632                 if (*(datap - hdrlen + 1) & 0x40)       /* wep set */
3633                         if ((*(datap) == 0xaa) && (*(datap + 1) == 0xaa))
3634                                 /* clear wep; it's the 802.2 header! */
3635                                 *(datap - hdrlen + 1) &= 0xbf;
3636         }
3637
3638         if (hw->sniff_fcs) {
3639                 /* Set the FCS */
3640                 datap = skb_put(skb, WLAN_CRC_LEN);
3641                 memset(datap, 0xff, WLAN_CRC_LEN);
3642         }
3643
3644         /* pass it back up */
3645         prism2sta_ev_rx(wlandev, skb);
3646
3647         return;
3648 }
3649
3650 /*----------------------------------------------------------------
3651 * hfa384x_usbin_info
3652 *
3653 * At this point we have a successful received a Prism2 info frame.
3654 *
3655 * Arguments:
3656 *       wlandev         wlan device
3657 *       usbin           ptr to the usb transfer buffer
3658 *
3659 * Returns:
3660 *       nothing
3661 *
3662 * Side effects:
3663 *
3664 * Call context:
3665 *       interrupt
3666 ----------------------------------------------------------------*/
3667 static void hfa384x_usbin_info(wlandevice_t *wlandev, hfa384x_usbin_t *usbin)
3668 {
3669         usbin->infofrm.info.framelen =
3670             le16_to_cpu(usbin->infofrm.info.framelen);
3671         prism2sta_ev_info(wlandev, &usbin->infofrm.info);
3672 }
3673
3674 /*----------------------------------------------------------------
3675 * hfa384x_usbout_callback
3676 *
3677 * Callback for URBs on the BULKOUT endpoint.
3678 *
3679 * Arguments:
3680 *       urb             ptr to the completed urb
3681 *
3682 * Returns:
3683 *       nothing
3684 *
3685 * Side effects:
3686 *
3687 * Call context:
3688 *       interrupt
3689 ----------------------------------------------------------------*/
3690 static void hfa384x_usbout_callback(struct urb *urb)
3691 {
3692         wlandevice_t *wlandev = urb->context;
3693         hfa384x_usbout_t *usbout = urb->transfer_buffer;
3694
3695 #ifdef DEBUG_USB
3696         dbprint_urb(urb);
3697 #endif
3698
3699         if (wlandev && wlandev->netdev) {
3700                 switch (urb->status) {
3701                 case 0:
3702                         hfa384x_usbout_tx(wlandev, usbout);
3703                         break;
3704
3705                 case -EPIPE:
3706                         {
3707                                 hfa384x_t *hw = wlandev->priv;
3708                                 netdev_warn(hw->wlandev->netdev,
3709                                             "%s tx pipe stalled: requesting reset\n",
3710                                             wlandev->netdev->name);
3711                                 if (!test_and_set_bit
3712                                     (WORK_TX_HALT, &hw->usb_flags))
3713                                         schedule_work(&hw->usb_work);
3714                                 ++(wlandev->linux_stats.tx_errors);
3715                                 break;
3716                         }
3717
3718                 case -EPROTO:
3719                 case -ETIMEDOUT:
3720                 case -EILSEQ:
3721                         {
3722                                 hfa384x_t *hw = wlandev->priv;
3723
3724                                 if (!test_and_set_bit
3725                                     (THROTTLE_TX, &hw->usb_flags) &&
3726                                     !timer_pending(&hw->throttle)) {
3727                                         mod_timer(&hw->throttle,
3728                                                   jiffies + THROTTLE_JIFFIES);
3729                                 }
3730                                 ++(wlandev->linux_stats.tx_errors);
3731                                 netif_stop_queue(wlandev->netdev);
3732                                 break;
3733                         }
3734
3735                 case -ENOENT:
3736                 case -ESHUTDOWN:
3737                         /* Ignorable errors */
3738                         break;
3739
3740                 default:
3741                         netdev_info(wlandev->netdev, "unknown urb->status=%d\n",
3742                                     urb->status);
3743                         ++(wlandev->linux_stats.tx_errors);
3744                         break;
3745                 }               /* switch */
3746         }
3747 }
3748
3749 /*----------------------------------------------------------------
3750 * hfa384x_ctlxout_callback
3751 *
3752 * Callback for control data on the BULKOUT endpoint.
3753 *
3754 * Arguments:
3755 *       urb             ptr to the completed urb
3756 *
3757 * Returns:
3758 * nothing
3759 *
3760 * Side effects:
3761 *
3762 * Call context:
3763 * interrupt
3764 ----------------------------------------------------------------*/
3765 static void hfa384x_ctlxout_callback(struct urb *urb)
3766 {
3767         hfa384x_t *hw = urb->context;
3768         int delete_resptimer = 0;
3769         int timer_ok = 1;
3770         int run_queue = 0;
3771         hfa384x_usbctlx_t *ctlx;
3772         unsigned long flags;
3773
3774         pr_debug("urb->status=%d\n", urb->status);
3775 #ifdef DEBUG_USB
3776         dbprint_urb(urb);
3777 #endif
3778         if ((urb->status == -ESHUTDOWN) ||
3779             (urb->status == -ENODEV) || (hw == NULL))
3780                 return;
3781
3782 retry:
3783         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3784
3785         /*
3786          * Only one CTLX at a time on the "active" list, and
3787          * none at all if we are unplugged. However, we can
3788          * rely on the disconnect function to clean everything
3789          * up if someone unplugged the adapter.
3790          */
3791         if (list_empty(&hw->ctlxq.active)) {
3792                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3793                 return;
3794         }
3795
3796         /*
3797          * Having something on the "active" queue means
3798          * that we have timers to worry about ...
3799          */
3800         if (del_timer(&hw->reqtimer) == 0) {
3801                 if (hw->req_timer_done == 0) {
3802                         /*
3803                          * This timer was actually running while we
3804                          * were trying to delete it. Let it terminate
3805                          * gracefully instead.
3806                          */
3807                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3808                         goto retry;
3809                 }
3810         } else {
3811                 hw->req_timer_done = 1;
3812         }
3813
3814         ctlx = get_active_ctlx(hw);
3815
3816         if (urb->status == 0) {
3817                 /* Request portion of a CTLX is successful */
3818                 switch (ctlx->state) {
3819                 case CTLX_REQ_SUBMITTED:
3820                         /* This OUT-ACK received before IN */
3821                         ctlx->state = CTLX_REQ_COMPLETE;
3822                         break;
3823
3824                 case CTLX_RESP_COMPLETE:
3825                         /* IN already received before this OUT-ACK,
3826                          * so this command must now be complete.
3827                          */
3828                         ctlx->state = CTLX_COMPLETE;
3829                         unlocked_usbctlx_complete(hw, ctlx);
3830                         run_queue = 1;
3831                         break;
3832
3833                 default:
3834                         /* This is NOT a valid CTLX "success" state! */
3835                         netdev_err(hw->wlandev->netdev,
3836                                    "Illegal CTLX[%d] success state(%s, %d) in OUT URB\n",
3837                                    le16_to_cpu(ctlx->outbuf.type),
3838                                    ctlxstr(ctlx->state), urb->status);
3839                         break;
3840                 }               /* switch */
3841         } else {
3842                 /* If the pipe has stalled then we need to reset it */
3843                 if ((urb->status == -EPIPE) &&
3844                     !test_and_set_bit(WORK_TX_HALT, &hw->usb_flags)) {
3845                         netdev_warn(hw->wlandev->netdev,
3846                                     "%s tx pipe stalled: requesting reset\n",
3847                                     hw->wlandev->netdev->name);
3848                         schedule_work(&hw->usb_work);
3849                 }
3850
3851                 /* If someone cancels the OUT URB then its status
3852                  * should be either -ECONNRESET or -ENOENT.
3853                  */
3854                 ctlx->state = CTLX_REQ_FAILED;
3855                 unlocked_usbctlx_complete(hw, ctlx);
3856                 delete_resptimer = 1;
3857                 run_queue = 1;
3858         }
3859
3860 delresp:
3861         if (delete_resptimer) {
3862                 timer_ok = del_timer(&hw->resptimer);
3863                 if (timer_ok != 0)
3864                         hw->resp_timer_done = 1;
3865         }
3866
3867         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3868
3869         if (!timer_ok && (hw->resp_timer_done == 0)) {
3870                 spin_lock_irqsave(&hw->ctlxq.lock, flags);
3871                 goto delresp;
3872         }
3873
3874         if (run_queue)
3875                 hfa384x_usbctlxq_run(hw);
3876 }
3877
3878 /*----------------------------------------------------------------
3879 * hfa384x_usbctlx_reqtimerfn
3880 *
3881 * Timer response function for CTLX request timeouts.  If this
3882 * function is called, it means that the callback for the OUT
3883 * URB containing a Prism2.x XXX_Request was never called.
3884 *
3885 * Arguments:
3886 *       data            a ptr to the hfa384x_t
3887 *
3888 * Returns:
3889 *       nothing
3890 *
3891 * Side effects:
3892 *
3893 * Call context:
3894 *       interrupt
3895 ----------------------------------------------------------------*/
3896 static void hfa384x_usbctlx_reqtimerfn(unsigned long data)
3897 {
3898         hfa384x_t *hw = (hfa384x_t *)data;
3899         unsigned long flags;
3900
3901         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3902
3903         hw->req_timer_done = 1;
3904
3905         /* Removing the hardware automatically empties
3906          * the active list ...
3907          */
3908         if (!list_empty(&hw->ctlxq.active)) {
3909                 /*
3910                  * We must ensure that our URB is removed from
3911                  * the system, if it hasn't already expired.
3912                  */
3913                 hw->ctlx_urb.transfer_flags |= URB_ASYNC_UNLINK;
3914                 if (usb_unlink_urb(&hw->ctlx_urb) == -EINPROGRESS) {
3915                         hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3916
3917                         ctlx->state = CTLX_REQ_FAILED;
3918
3919                         /* This URB was active, but has now been
3920                          * cancelled. It will now have a status of
3921                          * -ECONNRESET in the callback function.
3922                          *
3923                          * We are cancelling this CTLX, so we're
3924                          * not going to need to wait for a response.
3925                          * The URB's callback function will check
3926                          * that this timer is truly dead.
3927                          */
3928                         if (del_timer(&hw->resptimer) != 0)
3929                                 hw->resp_timer_done = 1;
3930                 }
3931         }
3932
3933         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3934 }
3935
3936 /*----------------------------------------------------------------
3937 * hfa384x_usbctlx_resptimerfn
3938 *
3939 * Timer response function for CTLX response timeouts.  If this
3940 * function is called, it means that the callback for the IN
3941 * URB containing a Prism2.x XXX_Response was never called.
3942 *
3943 * Arguments:
3944 *       data            a ptr to the hfa384x_t
3945 *
3946 * Returns:
3947 *       nothing
3948 *
3949 * Side effects:
3950 *
3951 * Call context:
3952 *       interrupt
3953 ----------------------------------------------------------------*/
3954 static void hfa384x_usbctlx_resptimerfn(unsigned long data)
3955 {
3956         hfa384x_t *hw = (hfa384x_t *)data;
3957         unsigned long flags;
3958
3959         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3960
3961         hw->resp_timer_done = 1;
3962
3963         /* The active list will be empty if the
3964          * adapter has been unplugged ...
3965          */
3966         if (!list_empty(&hw->ctlxq.active)) {
3967                 hfa384x_usbctlx_t *ctlx = get_active_ctlx(hw);
3968
3969                 if (unlocked_usbctlx_cancel_async(hw, ctlx) == 0) {
3970                         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3971                         hfa384x_usbctlxq_run(hw);
3972                         return;
3973                 }
3974         }
3975         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
3976 }
3977
3978 /*----------------------------------------------------------------
3979 * hfa384x_usb_throttlefn
3980 *
3981 *
3982 * Arguments:
3983 *       data    ptr to hw
3984 *
3985 * Returns:
3986 *       Nothing
3987 *
3988 * Side effects:
3989 *
3990 * Call context:
3991 *       Interrupt
3992 ----------------------------------------------------------------*/
3993 static void hfa384x_usb_throttlefn(unsigned long data)
3994 {
3995         hfa384x_t *hw = (hfa384x_t *)data;
3996         unsigned long flags;
3997
3998         spin_lock_irqsave(&hw->ctlxq.lock, flags);
3999
4000         /*
4001          * We need to check BOTH the RX and the TX throttle controls,
4002          * so we use the bitwise OR instead of the logical OR.
4003          */
4004         pr_debug("flags=0x%lx\n", hw->usb_flags);
4005         if (!hw->wlandev->hwremoved &&
4006             ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) &&
4007               !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags))
4008              |
4009              (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) &&
4010               !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags))
4011             )) {
4012                 schedule_work(&hw->usb_work);
4013         }
4014
4015         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4016 }
4017
4018 /*----------------------------------------------------------------
4019 * hfa384x_usbctlx_submit
4020 *
4021 * Called from the doxxx functions to submit a CTLX to the queue
4022 *
4023 * Arguments:
4024 *       hw              ptr to the hw struct
4025 *       ctlx            ctlx structure to enqueue
4026 *
4027 * Returns:
4028 *       -ENODEV if the adapter is unplugged
4029 *       0
4030 *
4031 * Side effects:
4032 *
4033 * Call context:
4034 *       process or interrupt
4035 ----------------------------------------------------------------*/
4036 static int hfa384x_usbctlx_submit(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx)
4037 {
4038         unsigned long flags;
4039
4040         spin_lock_irqsave(&hw->ctlxq.lock, flags);
4041
4042         if (hw->wlandev->hwremoved) {
4043                 spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4044                 return -ENODEV;
4045         }
4046
4047         ctlx->state = CTLX_PENDING;
4048         list_add_tail(&ctlx->list, &hw->ctlxq.pending);
4049         spin_unlock_irqrestore(&hw->ctlxq.lock, flags);
4050         hfa384x_usbctlxq_run(hw);
4051
4052         return 0;
4053 }
4054
4055 /*----------------------------------------------------------------
4056 * hfa384x_usbout_tx
4057 *
4058 * At this point we have finished a send of a frame.  Mark the URB
4059 * as available and call ev_alloc to notify higher layers we're
4060 * ready for more.
4061 *
4062 * Arguments:
4063 *       wlandev         wlan device
4064 *       usbout          ptr to the usb transfer buffer
4065 *
4066 * Returns:
4067 *       nothing
4068 *
4069 * Side effects:
4070 *
4071 * Call context:
4072 *       interrupt
4073 ----------------------------------------------------------------*/
4074 static void hfa384x_usbout_tx(wlandevice_t *wlandev, hfa384x_usbout_t *usbout)
4075 {
4076         prism2sta_ev_alloc(wlandev);
4077 }
4078
4079 /*----------------------------------------------------------------
4080 * hfa384x_isgood_pdrcore
4081 *
4082 * Quick check of PDR codes.
4083 *
4084 * Arguments:
4085 *       pdrcode         PDR code number (host order)
4086 *
4087 * Returns:
4088 *       zero            not good.
4089 *       one             is good.
4090 *
4091 * Side effects:
4092 *
4093 * Call context:
4094 ----------------------------------------------------------------*/
4095 static int hfa384x_isgood_pdrcode(u16 pdrcode)
4096 {
4097         switch (pdrcode) {
4098         case HFA384x_PDR_END_OF_PDA:
4099         case HFA384x_PDR_PCB_PARTNUM:
4100         case HFA384x_PDR_PDAVER:
4101         case HFA384x_PDR_NIC_SERIAL:
4102         case HFA384x_PDR_MKK_MEASUREMENTS:
4103         case HFA384x_PDR_NIC_RAMSIZE:
4104         case HFA384x_PDR_MFISUPRANGE:
4105         case HFA384x_PDR_CFISUPRANGE:
4106         case HFA384x_PDR_NICID:
4107         case HFA384x_PDR_MAC_ADDRESS:
4108         case HFA384x_PDR_REGDOMAIN:
4109         case HFA384x_PDR_ALLOWED_CHANNEL:
4110         case HFA384x_PDR_DEFAULT_CHANNEL:
4111         case HFA384x_PDR_TEMPTYPE:
4112         case HFA384x_PDR_IFR_SETTING:
4113         case HFA384x_PDR_RFR_SETTING:
4114         case HFA384x_PDR_HFA3861_BASELINE:
4115         case HFA384x_PDR_HFA3861_SHADOW:
4116         case HFA384x_PDR_HFA3861_IFRF:
4117         case HFA384x_PDR_HFA3861_CHCALSP:
4118         case HFA384x_PDR_HFA3861_CHCALI:
4119         case HFA384x_PDR_3842_NIC_CONFIG:
4120         case HFA384x_PDR_USB_ID:
4121         case HFA384x_PDR_PCI_ID:
4122         case HFA384x_PDR_PCI_IFCONF:
4123         case HFA384x_PDR_PCI_PMCONF:
4124         case HFA384x_PDR_RFENRGY:
4125         case HFA384x_PDR_HFA3861_MANF_TESTSP:
4126         case HFA384x_PDR_HFA3861_MANF_TESTI:
4127                 /* code is OK */
4128                 return 1;
4129                 break;
4130         default:
4131                 if (pdrcode < 0x1000) {
4132                         /* code is OK, but we don't know exactly what it is */
4133                         pr_debug("Encountered unknown PDR#=0x%04x, assuming it's ok.\n",
4134                                  pdrcode);
4135                         return 1;
4136                 } else {
4137                         /* bad code */
4138                         pr_debug("Encountered unknown PDR#=0x%04x, (>=0x1000), assuming it's bad.\n",
4139                                  pdrcode);
4140                         return 0;
4141                 }
4142                 break;
4143         }
4144         return 0;               /* avoid compiler warnings */
4145 }